joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ed50
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x230
mov rsi, rdx
mov rdi, rcx
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebx, 1
lock xadd dword [0x140036004], ebx
lea rcx, [rsp + 0x1b0]
lea r14, [rsp + 0x50]
mov qword [r14], rcx
mov qword [r14 + 8], 0x80
and qword [r14 + 0x10], 0
mov ebp, eax
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x68]
mov qword [rcx], r14
lea rdx, str..pipeprocess_d_d
mov r8d, 0x11
call fcn.140010542
test ax, ax
jne 0x14000ee1c
lea rdx, [rsp + 0x48]
mov ecx, ebp
call fcn.14000a2a5
test ax, ax
jne 0x14000ee1c
lea rcx, [rsp + 0x70]
mov qword [rcx], r14
lea rdx, [0x1400301f4]
mov r8d, 1
call fcn.140010542
test ax, ax
jne 0x14000ee1c
lea rdx, [rsp + 0x48]
mov ecx, ebx
call fcn.14000a2a5
test ax, ax
jne 0x14000ee1c
lea rcx, [rsp + 0x78]
mov qword [rcx], r14
lea rdx, [0x1400301f8]
mov r8d, 1
call fcn.140010542
test ax, ax
je 0x14000ef25
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0xb0]
mov rcx, rbx
mov rdx, r14
call fcn.140008f10
mov rax, qword [rbx]
and word [rsp + rax*2 + 0xb0], 0
lea rax, [0x140030120]
mov qword [rsp + 0x38], rax
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
and dword [rsp + 0x30], 0
mov rcx, r14
mov edx, 0x40000001
xor r8d, r8d
mov r9d, 1
call sub.KERNEL32.dll_CreateNamedPipeW
cmp rax, 0xffffffffffffffff
je 0x14000eef3
mov rbx, rax
mov rax, qword [0x140030130]
lea r9, [rsp + 0x90]
mov qword [r9 + 0x10], rax
movups xmm0, xmmword [0x140030120]
movaps xmmword [r9], xmm0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xb0]
mov edx, 0x40000000
xor r8d, r8d
call sub.KERNEL32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x14000eefa
mov r14, rax
mov rcx, rbx
call fcn.14000ecbb
test ax, ax
je 0x14000ef1b
mov ebp, eax
mov rcx, r14
call sub.ntdll.dll_NtClose
mov rcx, rbx
call sub.ntdll.dll_NtClose
jmp 0x14000ef0b
call sub.KERNEL32.dll_GetLastError
jmp 0x14000ef07
call sub.KERNEL32.dll_GetLastError
mov rcx, rbx
call sub.ntdll.dll_NtClose
mov bp, 0xe
mov eax, ebp
add rsp, 0x230
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov qword [rdi], rbx
mov qword [rsi], r14
xor ebp, ebp
jmp 0x14000ef0b
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x60]
dec r9
jmp 0x14000ee1c
Function at 0x14001020c
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0x50
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x8000400
mov dword [rsp + 0x20], 1
xor esi, esi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
jne 0x140010260
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [rax - 0xbc]
cmp ecx, 0xf
jae 0x140010268
mov si, 0x6d
mov eax, esi
add rsp, 0x50
pop rsi
ret
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x140010293
cmp eax, 5
je 0x140010299
cmp eax, 0xb
je 0x14001025c
cmp eax, 0x7b
je 0x14001029f
cmp eax, 0xce
je 0x1400102a5
cmp eax, 0xd8
je 0x14001025c
mov si, 0xe
jmp 0x140010260
mov si, 8
jmp 0x140010260
mov si, 9
jmp 0x140010260
mov si, 0x70
jmp 0x140010260
mov si, 0xb
jmp 0x140010260

Function at 0x1400107a1
Capabilities:
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rcx
bt r9d, 9
mov eax, 0x200040
mov ebx, 0x200001
cmovae ebx, eax
lea eax, [r8 + r8]
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], ax
mov qword [rsp + 0x78], rdx
cmp word [rdx], 0x2e
jne 0x1400107f9
movzx eax, word [rdx + 2]
cmp eax, 0x2e
je 0x1400107ee
test eax, eax
jne 0x1400107f9
and word [rsp + 0x70], 0
jmp 0x1400107f9
cmp word [rdx + 4], 0
je 0x14001093c
lea rdi, [rsp + 0x90]
mov dword [rdi], 0x30
mov rcx, rdx
mov rdx, r8
call fcn.14000a923
xor ecx, ecx
test al, 1
cmovne rsi, rcx
mov qword [rdi + 8], rsi
and dword [rdi + 0x18], 0
lea rax, [rsp + 0x70]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x20], xmm0
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x40], ebx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x80]
mov edx, 0x110000
mov r8, rdi
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x140010958
mov ecx, eax
mov ax, 8
cmp ecx, 0xc0000034
je 0x14001097c
cmp ecx, 0xc000003a
je 0x14001097c
cmp ecx, 0xc0000043
je 0x14001093c
cmp ecx, 0xc0000056
je 0x140010932
cmp ecx, 0xc00000ba
je 0x140010948
cmp ecx, 0xc00000be
je 0x140010936
cmp ecx, 0xc00000cc
je 0x140010936
cmp ecx, 0xc0000103
je 0x140010942
test ecx, ecx
jne 0x140010978
lea r8, [rsp + 0x68]
mov byte [r8], 1
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0xd
lea rdx, [rsp + 0x80]
mov r9d, 1
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x14001094e
cmp eax, 0xc00000a2
je 0x14001094e
cmp eax, 0xc0000101
je 0x14001095e
cmp eax, 0xc0000121
je 0x14001094e
test eax, eax
jne 0x14001096e
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x14001097c
mov ax, 0xf
jmp 0x14001097c
mov ax, 0x1c
jmp 0x14001097c
mov ax, 0x19
jmp 0x14001097c
mov ax, 0x17
jmp 0x14001097c
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 9
jmp 0x14001097c
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 0x6c
jmp 0x14001097c
mov rcx, qword [rsp + 0x60]
call sub.ntdll.dll_NtClose
mov ax, 0xe
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140010987
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov r15d, 0xffffffff
mov r12, rdx
cmp r14, rsi
jae 0x1400109d0
cmp r12, r15
mov ebx, 0xffffffff
cmovb rbx, r12
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test eax, eax
je 0x1400109d4
add r14, rbx
add rdi, rbx
sub r12, rbx
jmp 0x1400109a6
xor eax, eax
jmp 0x1400109dd
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400109eb
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm8
movdqa xmmword [rsp + 0x70], xmm7
movdqa xmmword [rsp + 0x60], xmm6
xor eax, eax
cmp rax, 8
je 0x140010a2e
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x10], xmm1
movaps xmmword [rsp], xmm0
mov r8d, dword [rsp + rax*4]
mov dword [rsp + rax*4 + 0x40], r8d
inc rax
jmp 0x140010a0a
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
xor eax, eax
movdqa xmm2, xmmword [0x14002eb50]
xor edx, edx
cmp rax, 0x1c0
ja 0x140010bd3
add rax, 0x40
movd xmm3, edx
movdqa xmm5, xmm3
movdqa xmm6, xmm1
movdqa xmm4, xmm0
movdqa xmm7, xmm2
xor r8d, r8d
cmp r8, 7
ja 0x140010b86
paddd xmm7, xmm4
pxor xmm5, xmm7
movdqa xmm8, xmm5
psrld xmm8, 0x10
pslld xmm5, 0x10
por xmm5, xmm8
paddd xmm6, xmm5
pxor xmm4, xmm6
movdqa xmm8, xmm4
psrld xmm8, 0x14
pslld xmm4, 0xc
por xmm4, xmm8
paddd xmm7, xmm4
pxor xmm5, xmm7
pshufd xmm7, xmm7, 0x93
movdqa xmm8, xmm5
psrld xmm8, 0x18
pslld xmm5, 8
por xmm5, xmm8
paddd xmm6, xmm5
pshufd xmm5, xmm5, 0x4e
pxor xmm4, xmm6
pshufd xmm6, xmm6, 0x39
movdqa xmm8, xmm4
psrld xmm8, 0x19
pslld xmm4, 7
por xmm4, xmm8
paddd xmm7, xmm4
pxor xmm5, xmm7
movdqa xmm8, xmm5
psrld xmm8, 0x10
pslld xmm5, 0x10
por xmm5, xmm8
paddd xmm6, xmm5
pxor xmm4, xmm6
movdqa xmm8, xmm4
psrld xmm8, 0x14
pslld xmm4, 0xc
por xmm4, xmm8
paddd xmm7, xmm4
pxor xmm5, xmm7
pshufd xmm7, xmm7, 0x39
movdqa xmm8, xmm5
psrld xmm8, 0x18
pslld xmm5, 8
por xmm5, xmm8
paddd xmm6, xmm5
pshufd xmm5, xmm5, 0x4e
pxor xmm4, xmm6
pshufd xmm6, xmm6, 0x93
movdqa xmm8, xmm4
psrld xmm8, 0x19
pslld xmm4, 7
por xmm4, xmm8
add r8, 2
jmp 0x140010a6d
paddd xmm7, xmm2
paddd xmm4, xmm0
paddd xmm6, xmm1
paddd xmm5, xmm3
movdqa xmmword [rsp], xmm7
movdqa xmmword [rsp + 0x10], xmm4
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm5
xor r8d, r8d
cmp r8, 0x40
je 0x140010bc8
movdqa xmm3, xmmword [rsp + r8]
movdqu xmmword [rcx + r8], xmm3
add r8, 0x10
jmp 0x140010bb0
inc edx
add rcx, 0x40
jmp 0x140010a46
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x140011b45
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rsi
push rdi
mov r9d, dword [rcx]
add r9d, 0x3f
xor eax, eax
cmp r9d, 0x40
jb 0x140011b99
shr r9d, 5
neg r8d
mov r10d, 1
xor r11d, r11d
mov esi, dword [rcx + r10*4]
add r11d, esi
mov eax, r11d
sub eax, dword [rdx + r10*4]
mov r11d, eax
sar r11d, 0x1f
mov edi, eax
and edi, 0x7fffffff
xor edi, esi
and edi, r8d
xor edi, esi
mov dword [rcx + r10*4], edi
inc r10
cmp r9, r10
jne 0x140011b66
shr eax, 0x1f
pop rdi
pop rsi
ret

Function at 0x140011b9c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
test r8, r8
je 0x140011c44
mov r9d, 1
xor ecx, ecx
xor r10d, r10d
mov esi, r10d
movzx r11d, byte [rdx + r8 - 1]
mov r10d, r11d
shl r10d, cl
dec r8
or r10d, esi
cmp ecx, 0x17
jl 0x140011bed
and r10d, 0x7fffffff
lea esi, [rcx - 0x17]
not cl
shr r11d, cl
mov dword [rax + r9*4], r10d
inc r9
mov r10d, r11d
mov ecx, esi
jmp 0x140011bf0
add ecx, 8
test r8, r8
jne 0x140011bb6
test ecx, ecx
je 0x140011c00
mov dword [rax + r9*4], r10d
inc r9
cmp r9, 1
je 0x140011c44
xor r10d, r10d
xor ecx, ecx
mov edx, ecx
mov ecx, r10d
cmp r10d, 1
mov r8d, 0
sbb r8d, r8d
mov r10d, dword [rax + r9*4 - 4]
xor r10d, ecx
and r10d, r8d
xor r10d, ecx
lea ecx, [r9 - 2]
xor ecx, edx
and ecx, r8d
xor ecx, edx
dec r9
cmp r9, 1
jne 0x140011c0b
shl ecx, 5
jmp 0x140011c49
xor ecx, ecx
xor r10d, r10d
xor edx, edx
test r10d, r10d
setne dl
mov r9d, 0xffff
sub r9d, r10d
lea r8d, [r10 - 0x10000]
and r8d, r10d
xor r8d, r9d
mov r11d, r10d
shr r11d, 0x10
test r8d, r8d
cmovns r11d, r10d
shr r8d, 0x1b
and r8d, 0xfffffff0
mov r10d, 0xff
sub r10d, r11d
lea r9d, [r11 - 0x100]
and r9d, r11d
xor r9d, r10d
mov esi, r11d
shr esi, 8
test r9d, r9d
cmovns esi, r11d
shr r9d, 0x1c
and r9d, 0xfffffff8
mov r11d, 0xf
sub r11d, esi
lea r10d, [rsi - 0x10]
and r10d, esi
xor r10d, r11d
mov edi, esi
shr edi, 4
test r10d, r10d
cmovns edi, esi
shr r10d, 0x1d
and r10d, 0xfffffffc
mov esi, 3
sub esi, edi
lea r11d, [rdi - 4]
and r11d, edi
xor r11d, esi
mov esi, edi
shr esi, 2
test r11d, r11d
cmovns esi, edi
shr r11d, 0x1e
and r11d, 0xfffffffe
mov edi, 1
sub edi, esi
lea ebx, [rsi - 2]
and ebx, esi
xor ebx, edi
shr ebx, 0x1f
or edx, ecx
or edx, r8d
or edx, r9d
or edx, r10d
or edx, r11d
add edx, ebx
mov dword [rax], edx
pop rbx
pop rdi
pop rsi
ret
Function at 0x140011d19
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10d, ecx
xor eax, eax
cmp ecx, r8d
cmove r10d, eax
mov r11d, 0x20
mov esi, 1
mov ebx, r10d
mov ecx, esi
shl r10d, cl
mov edi, edx
dec r11d
mov ebp, edx
mov ecx, r11d
shr ebp, cl
or ebp, r10d
mov r10d, ebp
sub r10d, r8d
xor ebp, r8d
mov r14d, r10d
xor r14d, r8d
and r14d, ebp
xor r14d, r10d
mov ebp, ebx
shr ebp, cl
not r14d
shr r14d, 0x1f
or ebp, r14d
mov ecx, esi
shr r10d, cl
mov r14d, r8d
mov ecx, r11d
shl r14d, cl
sub edx, r14d
mov ecx, ebp
neg ecx
xor r10d, ebx
and r10d, ecx
xor r10d, ebx
xor edx, edi
and edx, ecx
mov ecx, r11d
shl ebp, cl
xor edx, edi
or eax, ebp
inc esi
cmp r11d, 1
ja 0x140011d36
mov ecx, edx
sub ecx, r8d
mov r11d, edx
xor r11d, r8d
xor r8d, ecx
and r8d, r11d
xor r8d, ecx
not r8d
shr r8d, 0x1f
or r10d, r8d
or eax, r10d
neg r10d
xor ecx, edx
and ecx, r10d
xor ecx, edx
mov dword [r9], ecx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140011f2e
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r9d, dword [rcx]
add r9d, 0x3f
xor eax, eax
cmp r9d, 0x40
jb 0x140011f7e
shr r9d, 5
neg r8d
mov r10d, 1
xor r11d, r11d
mov esi, dword [rcx + r10*4]
add r11d, esi
add r11d, dword [rdx + r10*4]
mov eax, r11d
shr eax, 0x1f
and r11d, 0x7fffffff
xor r11d, esi
and r11d, r8d
xor r11d, esi
mov dword [rcx + r10*4], r11d
inc r10
mov r11d, eax
cmp r9, r10
jne 0x140011f4e
pop rsi
ret
Function at 0x14001209f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
mov qword [rsp + 0x40], rdx
mov rdi, rcx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x2c], eax
mov r13d, dword [r9]
add rcx, 4
mov dword [rdi], r13d
add r13d, 0x1f
mov r8d, r13d
shr r8d, 3
and r8d, 0xfffffffc
xor ebp, ebp
mov qword [rsp + 0x38], rcx
xor edx, edx
call fcn.140002794
cmp r13d, 0x20
jb 0x14001228e
shr r13d, 5
mov eax, r13d
and eax, 0xfffffffc
cmp r13, 2
mov ecx, 1
cmovae rcx, r13
mov qword [rsp + 0x30], rcx
xor edx, edx
mov r8d, 0x7fffffff
xor ebp, ebp
mov rcx, qword [rsp + 0x40]
mov r9d, dword [rcx + rdx*4 + 4]
mov r10d, dword [rbx + 4]
imul r10d, r9d
mov rcx, qword [rsp + 0x38]
add r10d, dword [rcx]
imul r10d, dword [rsp + 0x2c]
and r10d, 0x7fffffff
mov r10d, r10d
test rax, rax
je 0x140012225
xor r11d, r11d
xor r14d, r14d
mov r12d, dword [rdi + r11*4 + 4]
mov r15d, dword [rdi + r11*4 + 8]
add r12, r14
mov r14d, dword [rbx + r11*4 + 4]
imul r14, r9
add r14, r12
mov r12d, dword [rsi + r11*4 + 4]
imul r12, r10
add r12, r14
mov r14, r12
shr r14, 0x1f
and r12d, r8d
mov dword [rdi + r11*4], r12d
mov r12d, dword [rbx + r11*4 + 8]
imul r12, r9
add r12, r15
mov r15d, dword [rsi + r11*4 + 8]
imul r15, r10
add r15, r12
add r15, r14
mov r14, r15
shr r14, 0x1f
and r15d, r8d
mov dword [rdi + r11*4 + 4], r15d
mov r15d, dword [rdi + r11*4 + 0xc]
mov r12d, dword [rbx + r11*4 + 0xc]
imul r12, r9
add r12, r15
mov r15d, dword [rsi + r11*4 + 0xc]
imul r15, r10
add r15, r12
add r15, r14
mov r14, r15
shr r14, 0x1f
and r15d, r8d
mov dword [rdi + r11*4 + 8], r15d
lea r12, [r11 + 4]
mov r15d, dword [rdi + r11*4 + 0x10]
mov ecx, dword [rbx + r11*4 + 0x10]
imul rcx, r9
add rcx, r15
mov r15d, dword [rsi + r11*4 + 0x10]
imul r15, r10
add r15, rcx
add r15, r14
mov r14, r15
shr r14, 0x1f
and r15d, r8d
mov dword [rdi + r11*4 + 0xc], r15d
mov r11, r12
cmp r12, rax
jb 0x140012158
jmp 0x14001222b
xor r14d, r14d
xor r12d, r12d
inc rdx
cmp r12, r13
jae 0x140012271
mov ecx, dword [rdi + r12*4 + 4]
add rcx, r14
mov r11d, dword [rbx + r12*4 + 4]
imul r11, r9
add r11, rcx
mov ecx, dword [rsi + r12*4 + 4]
imul rcx, r10
add rcx, r11
mov r14, rcx
and ecx, 0x7fffffff
mov dword [rdi + r12*4], ecx
lea rcx, [r12 + 1]
shr r14, 0x1f
mov r12, rcx
cmp r13, rcx
jne 0x140012233
add ebp, r14d
mov ecx, ebp
and ecx, 0x7fffffff
mov dword [rdi + r13*4], ecx
shr ebp, 0x1f
cmp rdx, qword [rsp + 0x30]
jne 0x14001211f
mov eax, dword [rsi]
mov dword [rdi], eax
add eax, 0x3f
mov r8d, 1
cmp eax, 0x40
jb 0x1400122c9
shr eax, 5
mov ecx, 1
xor edx, edx
add edx, dword [rdi + rcx*4]
mov r8d, edx
sub r8d, dword [rsi + rcx*4]
mov edx, r8d
sar edx, 0x1f
inc rcx
cmp rax, rcx
jne 0x1400122aa
not r8d
shr r8d, 0x1f
or r8d, ebp
mov rcx, rdi
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140011b45
Function at 0x14001239d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x120
mov rbx, r9
mov rsi, rdx
mov rdi, rcx
mov bpl, byte [rsp + 0x180]
mov r12, qword [rcx]
mov r14d, dword [r12 + 8]
lea rcx, [rsp + 0x20]
mov rdx, r8
mov r8, r9
call fcn.1400027aa
test rbx, rbx
je 0x1400123eb
xor eax, eax
xor byte [rsp + rax + 0x20], bpl
inc rax
cmp rbx, rax
jne 0x1400123de
shr r14, 0x17
and r14b, 0xf
mov r15d, 1
mov ecx, r14d
shl r15, cl
lea rcx, [rsp + rbx]
add rcx, 0x20
mov r8, r15
sub r8, rbx
mov edx, ebp
call fcn.140002794
mov rcx, rdi
call qword [r12 + 0x10]
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8, r15
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x28]
nop
add rsp, 0x120
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140016b61
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4c8
mov rdi, r9
mov r14, r8
mov qword [rsp + 0x30], rdx
mov rsi, rcx
lea rbx, [rsp + 0x3e0]
mov r8d, 0xe4
mov rcx, rbx
mov rdx, rsi
call fcn.1400027aa
lea r9, [0x140030bd0]
mov rcx, rbx
mov rdx, rbx
mov r8, rdi
call fcn.140016db4
lea r15, [rsp + 0x2f8]
mov r8d, 0xe4
mov rcx, r15
mov qword [rsp + 0x28], rsi
mov rdx, rsi
call fcn.1400027aa
lea r9, str.U8_b6X9
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.140016db4
lea rbx, [rsp + 0x44]
mov r8d, 0xe0
mov rcx, rbx
xor edx, edx
call fcn.140002794
mov rax, qword [rdi]
mov eax, dword [rax]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x48], eax
mov dword [rbx - 4], eax
mov qword [rsp + 0x38], r14
test r14, r14
je 0x140016d89
mov esi, 1
lea r15, [0x140030bd0]
lea r12, [rsp + 0x40]
lea r13, [rsp + 0x128]
lea rbp, [rsp + 0x210]
mov ebx, 6
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov r9, r15
call fcn.140016db4
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov r9, r15
call fcn.140016db4
mov r8d, 0xe4
mov rcx, r13
mov rdx, qword [rsp + 0x28]
call fcn.1400027aa
mov r8d, 0xe4
mov rcx, rbp
mov rdx, r12
call fcn.1400027aa
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
mov ecx, ebx
shr eax, cl
and eax, 3
xor ecx, ecx
cmp eax, 2
lea rdx, [rsp + rcx + 0x128]
lea r8, [rsp + rcx + 0x3e0]
cmovne r8, rdx
mov r8b, byte [r8]
mov byte [rdx], r8b
inc rcx
cmp rcx, 0xe4
jne 0x140016c94
xor ecx, ecx
cmp eax, 3
lea rdx, [rsp + rcx + 0x128]
lea r8, [rsp + rcx + 0x2f8]
cmovne r8, rdx
mov r8b, byte [r8]
mov byte [rdx], r8b
inc rcx
cmp rcx, 0xe4
jne 0x140016cbf
xor r14d, r14d
test eax, eax
setne r14b
mov rcx, rbp
mov rdx, r13
mov r8, rdi
lea r9, str.U8_b6X9
call fcn.140016db4
mov eax, esi
and eax, r14d
neg al
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x40]
mov r8b, byte [rsp + rcx + 0x128]
xor r8b, dl
and r8b, al
xor r8b, dl
mov byte [rsp + rcx + 0x40], r8b
inc rcx
cmp rcx, 0xe4
jne 0x140016d0f
mov eax, esi
not eax
and eax, r14d
neg al
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x40]
mov r8b, byte [rsp + rcx + 0x210]
xor r8b, dl
and r8b, al
xor r8b, dl
mov byte [rsp + rcx + 0x40], r8b
inc rcx
cmp rcx, 0xe4
jne 0x140016d40
not r14d
and esi, r14d
lea eax, [rbx - 2]
test ebx, ebx
mov ebx, eax
jne 0x140016c3d
inc qword [rsp + 0x30]
dec qword [rsp + 0x38]
jne 0x140016c38
lea rdx, [rsp + 0x40]
mov r8d, 0xe4
mov rcx, qword [rsp + 0x28]
call fcn.1400027aa
nop
add rsp, 0x4c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001b6fb
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov ebx, r8d
mov rax, rcx
mov r10d, dword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rcx + 8]
lea r11, [rcx + 1]
mov qword [rax + 8], r11
mov r11, rcx
shr r11, 0x20
mov rsi, rcx
shr rsi, 0x38
mov byte [rsp + 0x53], sil
mov rsi, rcx
shr rsi, 0x30
mov byte [rsp + 0x54], sil
mov rsi, rcx
shr rsi, 0x28
mov byte [rsp + 0x55], sil
mov byte [rsp + 0x56], r11b
mov r11, rcx
shr r11, 0x18
mov byte [rsp + 0x57], r11b
mov r11, rcx
shr r11, 0x10
mov byte [rsp + 0x58], r11b
mov byte [rsp + 0x59], ch
mov byte [rsp + 0x5a], cl
mov byte [rsp + 0x5b], dl
mov byte [rsp + 0x5c], bh
mov byte [rsp + 0x5d], bl
mov rbx, rdi
mov byte [rsp + 0x5e], bh
mov byte [rsp + 0x5f], bl
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x60], rdx
mov edx, dword [rax + 0x38]
mov dword [rsp + 0x68], edx
mov edx, 0xb
xor byte [rsp + rdx + 0x60], cl
shr rcx, 8
dec rdx
cmp rdx, 3
jne 0x14001b7a8
lea rcx, [rax + 0x10]
mov rdx, qword [rax + 0x40]
mov dword [rsp + 0x40], r10d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r8
lea rdx, [rsp + 0x53]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0xd
lea rdx, [rsp + 0x60]
mov r8, r9
mov r9, rbx
call qword [rax + 0x48]
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001dce8
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov eax, dword [rdx]
bswap eax
lea rdi, [rsp + 0x34]
mov dword [rdi], eax
mov eax, dword [rdx + 4]
bswap eax
lea rbx, [rsp + 0x30]
mov dword [rbx], eax
mov rcx, rdi
mov rdx, rbx
call fcn.14001da92
mov eax, dword [rbx]
mov ecx, eax
movzx edx, al
shr eax, 4
mov r9d, 0xff00000
and r9d, eax
mov r8d, dword [rdi]
mov r10d, r8d
shr r10d, 0xc
mov r11d, 0xff000
and r10d, r11d
shr ecx, 0xc
mov edi, 0xff0
and ecx, edi
or ecx, r9d
or ecx, r10d
mov r9d, r8d
shr r9d, 0x14
and r9d, 0xf
or r9d, ecx
shl edx, 0x14
mov ecx, r8d
shl ecx, 4
and ecx, r11d
and eax, edi
or eax, edx
or eax, ecx
shr r8d, 0x10
and r8d, 0xf
or r8d, eax
xor r10d, r10d
mov r11d, 0x8103
mov edi, 0xffffffe
bt r11d, r10d
setae al
lea edx, [rax + 1]
mov ebx, r9d
mov ecx, edx
shl ebx, cl
xor al, 0x1b
mov ecx, eax
shr r9d, cl
mov ebp, r8d
mov ecx, edx
shl ebp, cl
mov ecx, eax
shr r8d, cl
and ebx, edi
or r9d, ebx
and ebp, edi
or r8d, ebp
mov dword [rsi + r10*8], r9d
mov dword [rsi + r10*8 + 4], r8d
inc r10
cmp r10, 0x10
jne 0x14001dd8c
xor eax, eax
lea rdx, [0x140031f40]
lea r8, [0x140031f50]
lea r9, [0x140031f60]
lea r10, [0x140031f70]
lea r11, [rax + rax]
mov edi, dword [rsi + rax*8]
lea rcx, [rax + rax]
inc rcx
mov qword [rsp + 0x28], rcx
mov ebp, dword [rsi + r11*4 + 4]
xor r14d, r14d
xor r15d, r15d
xor r12d, r12d
add r12d, r12d
add r15d, r15d
mov cl, byte [r14 + rdx]
mov r13d, edi
shr r13d, cl
and r13d, 1
shl r13d, 0x10
or r13d, r12d
movzx ecx, byte [r14 + r8]
xor r12d, r12d
bt ebp, ecx
setb r12b
mov cl, byte [r14 + r9]
mov ebx, edi
shr ebx, cl
or r12d, r13d
and ebx, 1
shl ebx, 0x10
or ebx, r15d
movzx ecx, byte [r14 + r10]
xor r15d, r15d
bt ebp, ecx
setb r15b
or r15d, ebx
inc r14
cmp r14, 0x10
jne 0x14001de0b
mov dword [rsi + r11*4], r12d
mov rcx, qword [rsp + 0x28]
mov dword [rsi + rcx*4], r15d
inc rax
cmp rax, 0x10
jne 0x14001ddea
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140020c00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
sub rsp, 0x110
mov rsi, rcx
lea rcx, [rsp + 0x20]
call fcn.14002037e
mov ecx, eax
mov eax, eax
mov rdx, rax
shl rdx, 4
movdqa xmm0, xmmword [rsp + rdx + 0x20]
movdqu xmmword [rsi], xmm0
cmp ecx, 2
jb 0x140020c5f
lea ecx, [rax - 1]
mov r8d, 0x10
mov r9d, r8d
and r9d, 0xfffffff0
mov r10d, ecx
shl r10, 4
aesimc xmm0, xmmword [rsp + r10 + 0x20]
movdqu xmmword [rsi + r9], xmm0
add r8, 0x10
dec ecx
cmp rdx, r8
jne 0x140020c38
mov ecx, eax
shl ecx, 4
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + rcx], xmm0
add rsp, 0x110
pop rsi
ret

Function at 0x140022a5f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
mov r12, qword [rcx + 0x48]
test r12, r12
je 0x140022b16
mov eax, 0x10
sub rax, r12
cmp rax, r14
cmovae rax, r14
test ebx, ebx
je 0x140022ac5
test rax, rax
je 0x140022aec
lea rcx, [r12 + rsi]
add rcx, 0x38
xor edx, edx
mov r8b, byte [rdi + rdx]
mov r9b, byte [rcx + rdx]
xor r9b, r8b
mov byte [rcx + rdx], r8b
mov byte [rdi + rdx], r9b
inc rdx
cmp rax, rdx
jne 0x140022aa8
jmp 0x140022aec
test rax, rax
je 0x140022aec
lea rcx, [r12 + rsi]
add rcx, 0x38
xor edx, edx
mov r8b, byte [rdi + rdx]
xor r8b, byte [rcx + rdx]
mov byte [rdi + rdx], r8b
mov byte [rcx + rdx], r8b
inc rdx
cmp rax, rdx
jne 0x140022ad4
add r12, rax
cmp r12, 0x10
jb 0x140022ba6
sub r14, rax
add rdi, rax
mov rcx, qword [rsi]
mov rax, qword [rcx]
lea rdx, [rsi + 0x18]
lea r8, [rsi + 0x38]
mov r9d, 0x10
call qword [rax + 0x30]
mov r13, r14
and r13, 0xfffffffffffffff0
xor eax, eax
test ebx, ebx
setne al
mov rcx, qword [rsi]
mov r10, qword [rcx]
lea r15, [rsi + 8]
lea r8, [rsi + 0x18]
mov qword [rsp + 0x20], r13
mov rdx, r15
mov r9, rdi
call qword [r10 + rax*8 + 0x18]
mov r12, r14
and r12, 0xf
je 0x140022ba3
add rdi, r13
lea r8, [rsi + 0x38]
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov r9d, 0x10
mov rdx, r15
call qword [rax + 0x28]
xor eax, eax
test ebx, ebx
je 0x140022b8b
mov cl, byte [rdi + rax]
mov dl, byte [rsi + rax + 0x38]
xor dl, cl
mov byte [rsi + rax + 0x38], cl
mov byte [rdi + rax], dl
inc rax
cmp r12, rax
jne 0x140022b71
jmp 0x140022ba6
mov cl, byte [rdi + rax]
xor cl, byte [rsi + rax + 0x38]
mov byte [rdi + rax], cl
mov byte [rsi + rax + 0x38], cl
inc rax
cmp r12, rax
jne 0x140022b8b
jmp 0x140022ba6
xor r12d, r12d
mov qword [rsi + 0x48], r12
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret