joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009320
Capabilities:
Create device object
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rdi, rcx
call fcn.1400071ec
test al, al
jne 0x140009061
mov ebx, 0xc0000424
jmp 0x14000910c
and qword [rbp + 0x77], 0
lea rax, [0x14000fa40]
mov qword [rbp - 0x51], rax
lea r8, [rbp - 0x59]
lea rax, [0x14000fa60]
mov dword [rbp - 0x59], 0x20001e
mov qword [rbp - 0x41], rax
mov r15d, 0x100
lea rax, [0x14000faa0]
mov dword [rbp - 0x49], 0x180016
mov qword [rbp - 0x31], rax
mov r9d, 0x22
lea rax, [rbp + 0x77]
mov dword [rbp - 0x39], 0x160014
mov qword [rsp + 0x30], rax
xor edx, edx
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
jns 0x1400090e0
mov edx, eax
lea rcx, [0x14000fac0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000910c
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x140009116
mov edx, eax
lea rcx, [0x14000faf0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
call fcn.140007118
jmp 0x14000924f
cmp byte [section..data], 0
jne 0x140009202
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140012208]
and qword [rbp + 0x1f], 0
mov ecx, 3
and qword [rbp + 0x3f], 0
and qword [rbp - 0x11], 0
mov qword [rbp + 7], rax
lea rax, [0x14000a940]
mov qword [rbp + 0x17], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rbp + 0x27], rax
lea rax, [0x14000a9b0]
mov qword [rbp + 0x37], rax
lea rax, [0x14000fa80]
mov qword [rbp - 0x19], rax
lea rax, [rbp + 7]
mov dword [rbp + 0xf], ecx
mov dword [rbp + 0x2f], ecx
lea rcx, [rbp - 0x29]
mov qword [rbp - 9], rax
mov dword [rbp - 0x29], 0x20100
mov dword [rbp - 0x21], 0x160014
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
test eax, eax
jns 0x1400091b5
mov edx, eax
lea rcx, [0x14000fb30]
call sub.ntoskrnl.exe_DbgPrint
and word [0x140012006], 0
mov rax, qword [0x140012210]
lea rdx, [rbp - 0x39]
and qword [rsp + 0x28], 0
lea rcx, [0x14000bfe0]
add rax, 0x3098
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
mov ebx, eax
test eax, eax
jns 0x140009213
mov edx, eax
lea rcx, [0x14000fb70]
call sub.ntoskrnl.exe_DbgPrint
xor ebx, ebx
mov byte [0x140012005], bl
jmp 0x140009213
mov rax, qword [rbp + 0x77]
or dword [rax + 0x30], 4
mov rax, qword [rbp + 0x77]
btr dword [rax + 0x30], 7
lea rax, [0x140009270]
mov qword [rdi + 0x68], rax
lea rax, [0x140007540]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x70], rax
lea rax, [0x140007560]
mov qword [rdi + 0xe0], rax
call fcn.140001190
lea rcx, [0x14000fbb0]
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
jmp 0x14000902c
Function at 0x14000a278
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, edx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ecx, dword [0x1400121d0]
sub ecx, 0x2800
je 0x14000a2e8
sub ecx, 0x15a
je 0x14000a2e8
sub ecx, 0xedf
je 0x14000a2e8
sub ecx, 0x29e
je 0x14000a2e8
sub ecx, 0x4d4
je 0x14000a2e8
sub ecx, 0x343
je 0x14000a2e8
sub ecx, 0x275
je 0x14000a2e8
sub ecx, 0x257
je 0x14000a2e1
cmp ecx, 1
je 0x14000a2e1
mov ebx, 0x4b8
jmp 0x14000a2ed
mov ebx, 0x360
jmp 0x14000a2ed
mov ebx, 0x358
test eax, eax
js 0x14000a331
lea rdx, [rsp + 0x48]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a324
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbx + rax]
mov rax, qword [rsp + 0x40]
mov qword [rbx + rax], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000a33c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r8
mov dword [rax + 0x18], r15d
mov rbp, rdx
mov ebx, r15d
test r8, r8
je 0x14000a45b
test rdx, rdx
je 0x14000a45b
xor edx, edx
lea r9, [rax + 0x18]
xor r8d, r8d
lea edi, [rdx + 5]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov r12d, 0x6864694e
jmp 0x14000a3f7
test rbx, rbx
je 0x14000a3a1
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x1400121d8]
mov edx, dword [rsp + 0x60]
test rax, rax
je 0x14000a3cd
cmp dword [0x1400121d0], 0x4a61
jb 0x14000a3cd
mov r8d, r12d
mov ecx, 0x100
call qword [0x1400102b0]
jmp 0x14000a3db
mov r8d, r12d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a400
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, eax
cmp eax, 0xc0000004
je 0x14000a390
test esi, esi
js 0x14000a44f
test rbx, rbx
je 0x14000a454
mov rdi, rbx
cmp dword [rbx], r15d
je 0x14000a437
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x14000a42d
cmp word [rdi + 0x38], r15w
jbe 0x14000a42d
mov rdx, rbp
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14000a447
mov eax, dword [rdi]
add rdi, rax
cmp dword [rdi], r15d
jne 0x14000a411
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x14000a460
mov eax, dword [rdi + 0x50]
mov dword [r14], eax
jmp 0x14000a437
test rbx, rbx
jne 0x14000a437
mov esi, 0xc000009a
jmp 0x14000a443
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000a698
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [0x1400121d0]
mov r14, rcx
mov ebp, edx
mov r8d, eax
mov edx, 0x257
mov ecx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [rdx + 0x47]
lea r11d, [rdx + 0x1e]
sub r8d, 0x2800
je 0x14000a71a
sub r8d, ecx
je 0x14000a71a
sub r8d, r9d
je 0x14000a71a
sub r8d, r10d
je 0x14000a713
sub r8d, edi
je 0x14000a713
sub r8d, esi
je 0x14000a713
sub r8d, r11d
je 0x14000a713
sub r8d, edx
je 0x14000a71a
cmp r8d, 1
je 0x14000a71a
mov ebx, 0x448
jmp 0x14000a71f
mov ebx, 0x2e8
jmp 0x14000a71f
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000a758
sub eax, ecx
je 0x14000a758
sub eax, r9d
je 0x14000a758
sub eax, r10d
je 0x14000a758
sub eax, edi
je 0x14000a758
sub eax, esi
je 0x14000a758
sub eax, r11d
je 0x14000a758
sub eax, edx
je 0x14000a751
cmp eax, 1
je 0x14000a751
mov esi, 0x438
jmp 0x14000a75d
mov esi, 0x2e0
jmp 0x14000a75d
mov esi, 0x2d8
mov rcx, rbp
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x14000a7cc
add rsi, qword [rsp + 0x50]
xor edx, edx
add rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov r8d, ebp
mov rdx, rbx
mov rcx, r14
call fcn.140009eb8
test al, al
jne 0x14000a79f
mov edi, 0xc0000001
jmp 0x14000a7b4
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rdx], rax
mov qword [rax + 8], rdx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14000ac2c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [rdx]
mov rdi, rdx
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000ac8e
call fcn.14000b124
mov edx, eax
mov al, byte [rdi + 4]
add rdx, qword [rsp + 0x38]
shl al, 4
or al, byte [rdi + 5]
mov byte [rdx], al
mov al, byte [rdx + 2]
mov cl, al
xor cl, byte [rdi + 4]
and cl, 7
xor cl, al
mov byte [rdx + 2], cl
and cl, 0xf
mov al, byte [rdi + 5]
shl al, 4
or al, cl
mov byte [rdx + 2], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ac9c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
call fcn.14000a534
mov r14, rax
test rax, rax
jne 0x14000acc8
mov eax, 0xc0000001
jmp 0x14000adc6
mov eax, dword [0x1400121d0]
mov r8d, 0x257
mov ecx, eax
mov edx, 0x15a
mov edi, 0x4d4
mov esi, 0x343
mov r9d, 0xedf
lea r10d, [r8 + 0x47]
lea r11d, [r8 + 0x1e]
sub ecx, 0x2800
je 0x14000ad2e
sub ecx, edx
je 0x14000ad2e
sub ecx, r9d
je 0x14000ad2e
sub ecx, r10d
je 0x14000ad27
sub ecx, edi
je 0x14000ad27
sub ecx, esi
je 0x14000ad27
sub ecx, r11d
je 0x14000ad27
sub ecx, r8d
je 0x14000ad2e
cmp ecx, 1
je 0x14000ad2e
mov ebx, 0x448
jmp 0x14000ad33
mov ebx, 0x2e8
jmp 0x14000ad33
mov ebx, 0x2f0
sub eax, 0x2800
je 0x14000ad6d
sub eax, edx
je 0x14000ad6d
sub eax, r9d
je 0x14000ad6d
sub eax, r10d
je 0x14000ad6d
sub eax, edi
je 0x14000ad6d
sub eax, esi
je 0x14000ad6d
sub eax, r11d
je 0x14000ad6d
sub eax, r8d
je 0x14000ad66
cmp eax, 1
je 0x14000ad66
mov edi, 0x438
jmp 0x14000ad72
mov edi, 0x2e0
jmp 0x14000ad72
mov edi, 0x2d8
lea rdx, [rsp + 0x40]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x14000adc6
add rdi, qword [rsp + 0x40]
xor edx, edx
add rbx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rax, qword [rbx]
xor edx, edx
mov qword [r14 + 8], rbx
mov rcx, rdi
mov qword [r14], rax
mov qword [rax + 8], r14
mov qword [rbx], r14
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000addc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
and qword [rsp + 0x58], 0
mov eax, dword [0x1400121d0]
mov r8d, eax
mov ecx, 0x2800
sub r8d, ecx
je 0x14000ae61
sub r8d, 0x15a
je 0x14000ae61
sub r8d, 0xedf
je 0x14000ae61
sub r8d, 0x29e
je 0x14000ae61
sub r8d, 0x4d4
je 0x14000ae61
sub r8d, 0x343
je 0x14000ae61
sub r8d, 0x275
je 0x14000ae61
sub r8d, 0x257
je 0x14000ae5a
cmp r8d, 1
je 0x14000ae5a
mov edi, 0x438
jmp 0x14000ae66
mov edi, 0x2e0
jmp 0x14000ae66
mov edi, 0x2d8
sub eax, ecx
je 0x14000aeae
sub eax, 0x15a
je 0x14000aea7
sub eax, 0xedf
je 0x14000aea7
sub eax, 0x29e
je 0x14000aea7
sub eax, 0x4d4
je 0x14000aea7
sub eax, 0x343
je 0x14000aea7
sub eax, 0x275
je 0x14000aea7
sub eax, 0x257
je 0x14000aea7
cmp eax, 1
je 0x14000aea7
mov esi, 0x5e0
jmp 0x14000aeb3
mov esi, 0x488
jmp 0x14000aeb3
mov esi, 0x480
mov ecx, dword [rdx]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000af03
cmp eax, 0xc0000225
jne 0x14000af67
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x14000fc60]
mov rcx, r15
call fcn.14000a33c
test eax, eax
js 0x14000af67
mov ecx, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000af67
add rdi, qword [rsp + 0x58]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
lea rcx, [rsi + rcx]
mov rax, qword [r14 + 8]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000af35
mov ecx, 3
int 0x29
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000af4f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000af7c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
and qword [rsp + 0x68], 0
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.14000a5dc
cmp dword [rsp + 0x24], 0
jne 0x14000afb0
mov eax, 0xc0000225
jmp 0x14000b115
mov eax, dword [0x1400121d0]
mov ecx, eax
mov edx, 0x2800
sub ecx, edx
je 0x14000b00c
sub ecx, 0x15a
je 0x14000b00c
sub ecx, 0xedf
je 0x14000b00c
sub ecx, 0x29e
je 0x14000b00c
sub ecx, 0x4d4
je 0x14000b00c
sub ecx, 0x343
je 0x14000b00c
sub ecx, 0x275
je 0x14000b00c
sub ecx, 0x257
je 0x14000b005
cmp ecx, 1
je 0x14000b005
mov edi, 0x438
jmp 0x14000b011
mov edi, 0x2e0
jmp 0x14000b011
mov edi, 0x2d8
sub eax, edx
je 0x14000b059
sub eax, 0x15a
je 0x14000b052
sub eax, 0xedf
je 0x14000b052
sub eax, 0x29e
je 0x14000b052
sub eax, 0x4d4
je 0x14000b052
sub eax, 0x343
je 0x14000b052
sub eax, 0x275
je 0x14000b052
sub eax, 0x257
je 0x14000b052
cmp eax, 1
je 0x14000b052
mov esi, 0x5e0
jmp 0x14000b05e
mov esi, 0x488
jmp 0x14000b05e
mov esi, 0x480
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000b0b0
cmp eax, 0xc0000225
jne 0x14000b115
and dword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
lea rdx, [0x14000fc60]
mov rcx, r14
call fcn.14000a33c
test eax, eax
js 0x14000b115
mov ecx, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000b115
add rdi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
lea rcx, [rsi + rcx]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x14000b0de
mov ecx, 3
int 0x29
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
jmp 0x14000b0fd
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400013d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140045028]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r13, rcx
mov r15, qword [rbp + 0x60]
test r8b, 0xf
jne 0x14000153b
mov ecx, esi
call fcn.14000cf54
mov r12, rax
mov ecx, dword [r13 + 4]
inc ecx
shl ecx, 4
call fcn.14000cf54
mov r14, rax
mov r8, rax
mov rdx, rdi
mov rcx, r13
call fcn.140002110
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x20], xmm0
xor r15d, r15d
test esi, esi
je 0x140001509
nop
movzx eax, byte [r15 + rbx]
xor byte [rbp - 0x20], al
movzx eax, byte [r15 + rbx + 1]
xor byte [rbp - 0x1f], al
movzx eax, byte [r15 + rbx + 2]
xor byte [rbp - 0x1e], al
movzx eax, byte [r15 + rbx + 3]
xor byte [rbp - 0x1d], al
movzx eax, byte [r15 + rbx + 4]
xor byte [rbp - 0x1c], al
movzx eax, byte [r15 + rbx + 5]
xor byte [rbp - 0x1b], al
movzx eax, byte [r15 + rbx + 6]
xor byte [rbp - 0x1a], al
movzx eax, byte [r15 + rbx + 7]
xor byte [rbp - 0x19], al
movzx eax, byte [r15 + rbx + 8]
xor byte [rbp - 0x18], al
movzx eax, byte [r15 + rbx + 9]
xor byte [rbp - 0x17], al
movzx eax, byte [r15 + rbx + 0xa]
xor byte [rbp - 0x16], al
movzx eax, byte [r15 + rbx + 0xb]
xor byte [rbp - 0x15], al
movzx eax, byte [r15 + rbx + 0xc]
xor byte [rbp - 0x14], al
movzx eax, byte [r15 + rbx + 0xd]
xor byte [rbp - 0x13], al
movzx eax, byte [r15 + rbx + 0xe]
xor byte [rbp - 0x12], al
movzx eax, byte [r15 + rbx + 0xf]
xor byte [rbp - 0x11], al
lea rdi, [r15 + r12]
mov r9, r14
mov r8, rdi
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.1400017d0
movups xmm1, xmmword [rdi]
movups xmmword [rbp - 0x20], xmm1
add r15d, 0x10
cmp r15d, esi
jb 0x140001450
mov rcx, r14
call fcn.14000cf10
mov rax, r12
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000cef0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x60]
call fcn.140001320
nop
mov r8, rax
lea rcx, [rbp - 0x40]
call fcn.140002510
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400012b0
lea rdx, [0x1400443b0]
lea rcx, [rbp - 0x20]
call fcn.140013584
int3
Function at 0x140001570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140045028]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
mov r14d, r8d
mov rbp, rdx
mov qword [rsp + 0x20], rdx
mov r13, rcx
test r8b, 0xf
jne 0x140001709
mov ecx, r14d
call fcn.14000cf54
mov rbx, rax
mov ecx, dword [r13 + 4]
inc ecx
shl ecx, 4
call fcn.14000cf54
mov r15, rax
mov r8, rax
mov rdx, rdi
mov rcx, r13
call fcn.140002110
mov rcx, qword [rsp + 0xf0]
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x68], xmm0
xor r12d, r12d
test r14d, r14d
je 0x1400016d3
nop word [rax + rax]
mov esi, r12d
lea rdi, [r12 + rbx]
add rbp, rsi
mov r9, r15
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call fcn.140001ca0
movzx eax, byte [rsp + 0x68]
xor byte [rdi], al
movzx eax, byte [rsp + 0x69]
xor byte [r12 + rbx + 1], al
movzx eax, byte [rsp + 0x6a]
xor byte [r12 + rbx + 2], al
movzx eax, byte [rsp + 0x6b]
xor byte [r12 + rbx + 3], al
movzx eax, byte [rsp + 0x6c]
xor byte [r12 + rbx + 4], al
movzx eax, byte [rsp + 0x6d]
xor byte [r12 + rbx + 5], al
movzx eax, byte [rsp + 0x6e]
xor byte [r12 + rbx + 6], al
movzx eax, byte [rsp + 0x6f]
xor byte [r12 + rbx + 7], al
movzx eax, byte [rsp + 0x70]
xor byte [r12 + rbx + 8], al
movzx eax, byte [rsp + 0x71]
xor byte [r12 + rbx + 9], al
movzx eax, byte [rsp + 0x72]
xor byte [r12 + rbx + 0xa], al
movzx eax, byte [rsp + 0x73]
xor byte [r12 + rbx + 0xb], al
movzx eax, byte [rsp + 0x74]
xor byte [r12 + rbx + 0xc], al
movzx eax, byte [rsp + 0x75]
xor byte [r12 + rbx + 0xd], al
movzx eax, byte [rsp + 0x76]
xor byte [r12 + rbx + 0xe], al
movzx eax, byte [rsp + 0x77]
xor byte [r12 + rbx + 0xf], al
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x68], xmm0
add r12d, 0x10
cmp r12d, r14d
mov rbp, qword [rsp + 0x20]
jb 0x140001600
mov rcx, r15
call fcn.14000cf10
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000cef0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x28]
call fcn.140001320
nop
mov r8, rax
lea rcx, [rsp + 0x48]
call fcn.140002510
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400012b0
lea rdx, [0x1400443b0]
lea rcx, [rsp + 0x68]
call fcn.140013584
int3
Function at 0x140002110
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx]
mov r10, r8
xor r8d, r8d
mov rbx, rcx
lea eax, [r9*4]
test eax, eax
je 0x14000214c
nop
movzx eax, byte [r8 + rdx]
mov byte [r8 + r10], al
inc r8d
mov r9d, dword [rcx]
lea eax, [r9*4]
cmp r8d, eax
jb 0x140002130
mov eax, dword [rcx + 4]
lea r9d, [r9*4]
inc eax
shl eax, 4
cmp r9d, eax
jae 0x140002349
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r12
lea r12, str.cw
mov qword [rsp + 8], r14
mov qword [rsp], r15
lea r15d, [r9 + 2]
nop dword [rax]
mov edi, dword [rbx]
lea eax, [r9 - 4]
movzx r8d, byte [rax + r10]
xor edx, edx
lea eax, [r9 - 3]
movzx r11d, r8b
movzx esi, byte [rax + r10]
lea eax, [r9 - 2]
movzx ebp, byte [rax + r10]
lea eax, [r9 - 1]
movzx r14d, byte [rax + r10]
mov eax, r9d
shr eax, 2
div edi
test edx, edx
jne 0x14000225b
mov eax, esi
mov ecx, esi
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
xor edx, edx
mov eax, ebp
and eax, 0xf
movzx r11d, byte [rcx + r12]
mov ecx, ebp
and rcx, 0xfffffffffffffff0
add rcx, rax
mov eax, r14d
and eax, 0xf
movzx esi, byte [rcx + r12]
mov ecx, r14d
and rcx, 0xfffffffffffffff0
add rcx, rax
mov eax, r8d
and eax, 0xf
movzx ebp, byte [rcx + r12]
mov ecx, r8d
and rcx, 0xfffffffffffffff0
lea r8d, [rdi*4]
add rcx, rax
mov eax, r9d
div r8d
movzx r14d, byte [rcx + r12]
mov cl, 1
sub eax, 1
je 0x140002256
mov r8d, eax
nop word [rax + rax]
movzx eax, cl
add cl, cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
xor cl, dl
sub r8, 1
jne 0x140002240
xor r11b, cl
jmp 0x1400022b9
cmp edi, 6
jbe 0x1400022b9
cmp edx, 4
jne 0x1400022b9
mov rax, r8
mov rcx, r8
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
mov rax, rsi
and eax, 0xf
movzx r11d, byte [rcx + r12]
mov rcx, rsi
and rcx, 0xfffffffffffffff0
add rcx, rax
mov rax, rbp
and eax, 0xf
movzx esi, byte [rcx + r12]
mov rcx, rbp
and rcx, 0xfffffffffffffff0
add rcx, rax
mov rax, r14
and eax, 0xf
movzx ebp, byte [rcx + r12]
mov rcx, r14
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx r14d, byte [rcx + r12]
mov ecx, r9d
lea eax, [rdi*4]
sub ecx, eax
xor r11b, byte [rcx + r10]
mov ecx, r9d
mov byte [r9 + r10], r11b
mov eax, dword [rbx]
shl eax, 2
sub ecx, eax
lea eax, [r15 - 1]
inc ecx
xor sil, byte [rcx + r10]
mov ecx, r9d
mov byte [rax + r10], sil
mov eax, dword [rbx]
shl eax, 2
sub ecx, eax
add ecx, 2
xor bpl, byte [rcx + r10]
mov ecx, r9d
mov byte [r15 + r10], bpl
add r9d, 4
mov eax, dword [rbx]
shl eax, 2
sub ecx, eax
lea eax, [r15 + 1]
add ecx, 3
add r15d, 4
xor r14b, byte [rcx + r10]
mov byte [rax + r10], r14b
mov eax, dword [rbx + 4]
inc eax
shl eax, 4
cmp r9d, eax
jb 0x140002190
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret