joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017c48
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rdx]
mov rdi, r9
xor eax, dword [r8]
lea r9, [rbp + 0x38]
mov dword [rbp + 0x20], eax
mov rbx, rcx
mov eax, dword [rdx + 4]
lea rcx, [rbp + 0x20]
xor eax, dword [r8 + 4]
mov dword [rbp + 0x28], eax
mov eax, dword [rdx + 8]
xor eax, dword [r8 + 8]
mov dword [rbp + 0x30], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rbp + 0x28]
xor eax, dword [r8 + 0xc]
lea r8, [rbp + 0x30]
mov dword [rbp + 0x38], eax
lea rax, [0x14016f440]
mov qword [r11 - 0x20], rax
lea rax, [0x14016f640]
mov qword [r11 - 0x28], rax
lea rax, [0x14016f540]
mov qword [r11 - 0x30], rax
lea rax, str.cw
mov qword [r11 - 0x38], rax
call fcn.140017b1c
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.1400179f4
mov eax, dword [rbp + 0x20]
xor eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rbp + 0x28]
xor eax, dword [rdi + 4]
mov dword [rbx + 4], eax
mov eax, dword [rbp + 0x30]
xor eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rbp + 0x38]
xor eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret

Function at 0x140017d04
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rdx]
mov rdi, r9
xor eax, dword [r8]
lea r9, [rbp + 0x38]
mov dword [rbp + 0x20], eax
mov rbx, rcx
mov eax, dword [rdx + 4]
lea rcx, [rbp + 0x20]
xor eax, dword [r8 + 4]
mov dword [rbp + 0x28], eax
mov eax, dword [rdx + 8]
xor eax, dword [r8 + 8]
mov dword [rbp + 0x30], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rbp + 0x28]
xor eax, dword [r8 + 0xc]
lea r8, [rbp + 0x30]
mov dword [rbp + 0x38], eax
lea rax, [0x14016f540]
mov qword [r11 - 0x20], rax
lea rax, str.cw
mov qword [r11 - 0x28], rax
lea rax, [0x14016f440]
mov qword [r11 - 0x30], rax
lea rax, [0x14016f640]
mov qword [r11 - 0x38], rax
call fcn.140017b1c
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.1400179f4
mov eax, dword [rbp + 0x20]
xor eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rbp + 0x28]
xor eax, dword [rdi + 4]
mov dword [rbx + 4], eax
mov eax, dword [rbp + 0x30]
xor eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rbp + 0x38]
xor eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x140017dc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx r10d, r9b
mov rdi, r8
mov r9b, r10b
mov rbx, rdx
and r9b, 0x1f
shr r10d, 5
mov r11, rcx
and r10d, 0x80000003
jge 0x140017dfe
dec r10d
or r10d, 0xfffffffc
inc r10d
movzx eax, r10b
mov ecx, 0x20
sub cl, r9b
movzx esi, r9b
neg r9b
mov r9d, 4
mov r8d, dword [r8 + rax*4]
sbb al, al
and al, cl
movzx ebp, al
sub rbx, r11
bswap r8d
inc r10b
mov ecx, esi
shl r8d, cl
and r10b, 3
movzx eax, r10b
mov ecx, ebp
mov edx, dword [rdi + rax*4]
bswap edx
mov eax, edx
shr eax, cl
or r8d, eax
bswap r8d
xor r8d, dword [r11 + rbx]
mov dword [r11], r8d
mov r8d, edx
lea r11, [r11 + 4]
sub r9, 1
jne 0x140017e28
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14001d084
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x90]
lea rax, [r11 - 0x38]
and qword [r11 - 0x38], 0
mov rbp, rdx
lea rdx, [rcx + 0x10]
mov qword [r11 - 0x48], rax
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea r9, [r11 - 0x30]
xorps xmm0, xmm0
add rcx, 0x20
mov r8d, 0x10
movups xmmword [rsp + 0x38], xmm0
call fcn.14001e5e4
mov edx, eax
test eax, eax
je 0x14001d0f5
or dword [rbx + 0xa4], 0x10
jmp 0x14001d11c
test rsi, rsi
je 0x14001d11a
sub rbp, rdi
lea rdx, [rsp + 0x38]
add rdx, rbp
sub r14, rdi
mov al, byte [rdx + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rsi, 1
jne 0x14001d108
xor edx, edx
xor eax, eax
lea rdi, [rsp + 0x38]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001d324
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov ecx, dword [rcx + 0xa4]
mov rsi, rdx
test cl, 0x10
jne 0x14001d467
test r8, r8
je 0x14001d45a
test cl, 8
jne 0x14001d467
mov rdx, qword [rbx + 0x88]
test cl, 4
jne 0x14001d38e
cmp r8, rdx
ja 0x14001d467
mov al, byte [rbx + 0x89]
xor byte [rbx], al
mov al, byte [rbx + 0x88]
xor byte [rbx + 1], al
or ecx, 4
mov dword [rbx + 0xa4], ecx
jmp 0x14001d3a1
mov rcx, qword [rbx + 0x98]
add rcx, r8
cmp rcx, rdx
ja 0x14001d467
mov r8, qword [rbx + 0x98]
mov eax, 0x10
add r8, 2
mov rcx, rdi
and r8d, 0xf
sub rax, r8
cmp rax, rdi
cmovbe rcx, rax
test rcx, rcx
je 0x14001d3e6
mov r9, rsi
lea rdx, [r8 + rbx]
sub r9, r8
mov r10, rcx
sub r9, rbx
mov al, byte [rdx + r9]
xor byte [rdx], al
inc rdx
sub r10, 1
jne 0x14001d3d7
mov rdx, qword [rbx + 0x98]
lea rax, [rcx + r8]
add rdx, rcx
sub rdi, rcx
add rsi, rcx
mov qword [rbx + 0x98], rdx
cmp rax, 0x10
je 0x14001d410
cmp rdx, qword [rbx + 0x88]
jne 0x14001d433
lea rax, [rsp + 0x40]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.14001e5e4
test eax, eax
jne 0x14001d45e
test rdi, rdi
jne 0x14001d3a1
mov rax, qword [rbx + 0x88]
cmp qword [rbx + 0x98], rax
jne 0x14001d45a
or dword [rbx + 0xa4], 8
and qword [rbx + 0x98], rdi
xor eax, eax
jmp 0x14001d46c
or dword [rbx + 0xa4], 0x10
jmp 0x14001d46c
mov eax, 0xfffffff3
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001d47c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x50], rax
test byte [rcx + 0xa4], 0x10
mov r14, r8
mov rdi, qword [rsp + 0xd8]
mov r13, rdx
mov qword [rsp + 0x30], r9
mov rbx, rcx
jne 0x14001d6df
cmp qword [rcx + 0x90], 0
lea r12, [rcx + 0x98]
je 0x14001d4e4
mov rcx, qword [r12]
add rcx, r8
cmp rcx, qword [rbx + 0x80]
ja 0x14001d6df
cmp qword [rsp + 0xd0], r8
jb 0x14001d6df
xor r15d, r15d
mov qword [rdi], r8
test r8, r8
je 0x14001d6ce
mov rcx, qword [r12]
mov eax, 0x10
mov rbp, rcx
mov rsi, r14
and ebp, 0xf
sub rax, rbp
cmp rax, r14
cmovbe rsi, rax
lea rax, [rsi + rcx]
mov qword [r12], rax
mov al, byte [rbx + 0xa1]
dec al
test al, 0xfd
jne 0x14001d5bf
test rsi, rsi
je 0x14001d558
mov rdx, r13
lea rcx, [rbx + rbp]
sub rdx, rbx
mov rdi, rsi
sub rdx, rbp
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub rdi, 1
jne 0x14001d54a
lea rax, [rsi + rbp]
cmp rax, 0x10
je 0x14001d56f
mov rax, qword [rbx + 0x80]
cmp qword [r12], rax
jne 0x14001d59e
lea rax, [rsp + 0x38]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.14001e5e4
mov r15d, eax
test eax, eax
jne 0x14001d6c7
mov r9, qword [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov r8, rsi
mov r9, r13
mov rdx, rbp
mov rcx, rbx
call fcn.14001d084
mov r15d, eax
test eax, eax
jne 0x14001d6ce
test byte [rbx + 0xa1], 0xfd
jne 0x14001d672
lea rax, [rsp + 0x40]
mov r9, r13
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbx
call fcn.14001d084
mov r15d, eax
test eax, eax
jne 0x14001d6ce
test rsi, rsi
je 0x14001d617
lea rdx, [rsp + 0x40]
mov rdi, rsi
sub rdx, rbx
lea rcx, [rbx + rbp]
sub rdx, rbp
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub rdi, 1
jne 0x14001d609
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8, rsi
call fcn.14013a522
xor eax, eax
lea rdi, [rsp + 0x40]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea rax, [rsi + rbp]
cmp rax, 0x10
je 0x14001d64c
mov rax, qword [rbx + 0x80]
cmp qword [r12], rax
jne 0x14001d67c
lea rax, [rsp + 0x38]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.14001e5e4
mov r15d, eax
test eax, eax
jne 0x14001d6c7
lea rax, [rsi + rbp]
cmp rax, 0x10
je 0x14001d689
mov rax, qword [rbx + 0x80]
cmp qword [r12], rax
jne 0x14001d6ac
xor dl, dl
cmp byte [rbx + 0xa0], dl
jbe 0x14001d6ac
movzx eax, dl
mov rcx, rbx
sub rcx, rax
add byte [rcx + 0x1f], 1
jne 0x14001d6ac
inc dl
cmp dl, byte [rbx + 0xa0]
jb 0x14001d693
mov r9, qword [rsp + 0x30]
add r13, rsi
add r9, rsi
mov qword [rsp + 0x30], r9
sub r14, rsi
jne 0x14001d501
jmp 0x14001d6ce
or dword [rbx + 0xa4], 0x10
xor eax, eax
lea rdi, [rsp + 0x40]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
mov eax, r15d
jmp 0x14001d6e4
mov eax, 0xfffffff3
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140138940
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001d880
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0xc8]
mov rbx, r8
mov rax, qword [rsp + 0xd8]
lea r8, [r11 - 0x38]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x48], rdi
mov qword [r11 - 0x50], r8
mov r8, rbx
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r11 - 0x68], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], rax
call fcn.14001d7d0
test eax, eax
jne 0x14001d947
xor edx, edx
xor r8b, r8b
test rdi, rdi
je 0x14001d945
mov r9, qword [rsp + 0xe8]
xor eax, eax
movzx ecx, byte [rax + r9]
inc r8b
movzx eax, byte [rsp + rax + 0x60]
xor ecx, eax
movzx eax, r8b
or edx, ecx
cmp rax, rdi
jb 0x14001d911
test edx, edx
je 0x14001d945
test rbx, rbx
je 0x14001d93e
mov rdi, rsi
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
mov eax, 0xfffffff1
jmp 0x14001d947
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140138940
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001dcf8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov r12, r9
mov r13, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14001dd58
mov rdx, r8
mov rcx, r9
sub rdx, r9
mov r8, qword [rbx + 0x80]
cmp r8, 0x40
jae 0x14001dd58
mov al, byte [rdx + rcx]
inc r14
xor al, byte [r8 + rbx + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rbx + 0x80]
sub rdi, 1
jne 0x14001dd2e
lea rsi, [rbx + 0x40]
cmp rdi, 0x40
jb 0x14001dde8
lea rax, [r14 + r13]
mov rbp, rdi
mov qword [rsp + 0x78], rax
mov r15, rbx
mov r12, qword [rsp + 0x78]
sub r15, r14
shr rbp, 6
sub r15, r13
mov rax, r9
add r15, 0x40
sub rax, r13
mov qword [rsp + 0x20], rax
imul rax, rbp, 0xffffffffffffffc0
add rdi, rax
mov rax, rbp
shl rax, 6
add r14, rax
mov rdx, rsi
mov rcx, rbx
call fcn.14001dc48
inc dword [rbx + 0x30]
mov rcx, r12
mov r8, qword [rsp + 0x20]
mov edx, 0x40
mov al, byte [r15 + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
inc rcx
sub rdx, 1
jne 0x14001ddbf
sub r15, 0x40
add r12, 0x40
sub rbp, 1
jne 0x14001dda4
mov r12, qword [rsp + 0x88]
test rdi, rdi
je 0x14001de24
mov rdx, rsi
mov rcx, rbx
call fcn.14001dc48
inc dword [rbx + 0x30]
mov rcx, rdi
sub r14, rbx
lea rdx, [r14 + r13]
lea r8, [r14 + r12]
mov al, byte [rsi + rdx - 0x40]
xor al, byte [rsi]
mov byte [r8 + rsi - 0x40], al
inc rsi
sub rcx, 1
jne 0x14001de09
mov qword [rbx + 0x80], rdi
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e240
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, qword [rsp + 0xa8]
lea rax, [r11 - 0x18]
mov qword [r11 - 0x28], rax
mov rbx, rdx
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r9
mov r9, r8
mov r8, rdx
mov edx, 1
call fcn.14001e1bc
test eax, eax
jne 0x14001e311
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x50]
xor edx, edx
xorps xmm3, xmm3
sub rcx, rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
add rax, rdx
add rdx, 4
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rdx, 0x10
jb 0x14001e2a8
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x14001e30f
test rbx, rbx
je 0x14001e308
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
mov eax, 0xffffffaa
jmp 0x14001e311
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14001fa2c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r11, r8
mov r9, rdx
mov r10, rcx
test r8, r8
je 0x14001fa57
sub r10, rdx
movzx edx, byte [r10 + r9]
movzx r8d, byte [r9]
inc r9
xor r8d, edx
or eax, r8d
sub r11, 1
jne 0x14001fa3f
ret

Function at 0x14001ff24
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
xor esi, esi
xor edi, edi
mov r11, r8
mov rbx, rcx
test r8, r8
je 0x14001ffb3
lea r14, [rdx - 8]
sub rbx, rdx
lea r14, [r14 + r8*8]
mov r9, qword [r14]
mov r10, qword [r14 + rbx]
mov r8, r9
xor r8, r10
lea r14, [r14 - 8]
mov rax, r10
mov rcx, r9
sub rcx, r10
shr rax, 0x3f
shr rcx, 0x3f
sub r10, r9
shr r10, 0x3f
mov rdx, r8
shr r8, 0x3f
not rdx
shr rdx, 0x3f
and eax, r8d
and ecx, edx
shr r9, 0x3f
or ecx, eax
and r10d, edx
or esi, ecx
and r9d, r8d
or r10d, r9d
mov ecx, 1
sub ecx, esi
or esi, r10d
and ecx, r10d
or edi, ecx
sub r11, 1
jne 0x14001ff51
mov rbx, qword [rsp + 8]
mov eax, edi
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov r14, qword [rsp + 0x20]
ret
Function at 0x14001ffcc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10, r9
lea rdi, [rdx - 0xb]
xor ebp, ebp
mov r15, r9
xor bl, bl
mov r11, rcx
cmp r9, rdi
mov r14, r8
movzx r9d, byte [rcx + 1]
mov rsi, rdx
cmova r10, rdi
lea ecx, [rbp + 2]
movzx eax, byte [r11]
xor r9d, ecx
or r9d, eax
cmp rcx, rdx
jae 0x14002004c
mov al, byte [r11 + rcx]
neg al
or al, byte [r11 + rcx]
inc rcx
not al
shr al, 7
or bl, al
mov al, bl
neg al
or al, bl
not al
movzx eax, al
shr rax, 7
add rbp, rax
cmp rcx, rsi
jb 0x140020021
movzx ecx, bl
lea rax, [rbp - 8]
neg ecx
shr rax, 0x3f
shr ecx, 0x1f
dec ecx
and ecx, 1
or ecx, eax
or r9d, ecx
mov ecx, esi
sub ecx, ebp
mov r8d, r9d
neg r8d
shr r8d, 0x1f
neg r8d
lea ebp, [rcx - 3]
mov edx, r8d
not edx
mov eax, r8d
and ebp, edx
and eax, r10d
or ebp, eax
and r8d, 0x4100
mov rcx, r10
sub rcx, rbp
shr rcx, 0x3f
mov ebx, ecx
or ecx, r9d
neg ecx
neg ebx
shr ebx, 0x1f
shr ecx, 0x1f
mov r13d, ebx
neg r13d
neg ecx
and r13d, edx
and r13d, 0x4400
or r13d, r8d
neg r13d
cmp rsi, 0xb
jbe 0x1400200d8
not cl
lea rax, [r11 + 0xb]
and byte [rax], cl
inc rax
sub rdi, 1
jne 0x1400200cd
neg ebx
mov eax, r10d
mov ecx, ebx
sub r11, r10
not ebx
and rcx, rax
and rbx, rbp
add r11, rsi
or rbx, rcx
test r10, r10
je 0x14002015d
xor r9d, r9d
test r10, r10
je 0x14002015d
lea r14, [r10 - 1]
mov r8, r9
sub r8, rbx
shr r8, 0x3f
neg r8d
shr r8d, 0x1f
test r14, r14
je 0x14002013f
mov edi, r8d
mov rsi, r11
neg edi
mov r12, r14
mov ebp, edi
not ebp
mov cl, byte [rsi]
mov al, byte [rsi + 1]
and cl, dil
and al, bpl
or cl, al
mov byte [rsi], cl
lea rsi, [rsi + 1]
sub r12, 1
jne 0x140020126
movzx eax, byte [r11 + r10 - 1]
neg r8b
and r8b, al
inc r9
mov byte [r11 + r10 - 1], r8b
cmp r9, r10
jb 0x140020101
mov r14, qword [rsp + 0x60]
test r15, r15
je 0x140020170
mov r8, r10
mov rdx, r11
mov rcx, r14
call fcn.14013a522
mov rcx, qword [rsp + 0x70]
mov eax, r13d
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400201fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, r8
mov rbx, rdx
mov r15, rcx
cmp r8, 0x180
jbe 0x140020248
mov eax, 0xffffffc8
jmp 0x140020427
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x1a0
call fcn.14013a51c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x120
call fcn.14013a51c
mov eax, edi
mov byte [rbp + 0xb7], 0x30
bswap eax
mov r8, rdi
mov dword [rbp + 0xb0], eax
mov rdx, rbx
lea rcx, [rbp + 0xb8]
call fcn.14013a522
xor eax, eax
mov byte [rbp + rdi + 0xb8], pe_nt_image_headers64
lea rcx, [rbp + 0x80]
lea r12, [rdi + 0x19]
movd xmm0, eax
add eax, 4
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x1402135a0]
andps xmm0, xmmword [0x140213650]
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [rcx], xmm0
lea rcx, [rcx + 4]
cmp eax, 0x20
jl 0x1400202a6
mov r8d, 0x100
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140015898
mov edx, eax
mov r13d, 0x10
test eax, eax
jne 0x1400203db
mov r14b, byte [rbp + 0xa3]
xor ebx, ebx
xorps xmm0, xmm0
mov rsi, r12
movups xmmword [rbp + 0x40], xmm0
test r12, r12
je 0x14002036f
lea rdi, [rbp + 0xa0]
lea rax, [rbp + 0x40]
sub rdi, rax
xor edx, edx
lea rcx, [rbp + 0x40]
add rcx, rdx
inc rdx
mov al, byte [rdi + rcx]
xor byte [rcx], al
cmp rdx, r13
jb 0x140020325
mov rax, rsi
lea r9, [rbp + 0x40]
add rdi, r13
lea r8, [rbp + 0x40]
cmp rsi, r13
lea rcx, [rsp + 0x20]
mov edx, 1
cmovae rax, r13
sub rsi, rax
call fcn.140016930
mov edx, eax
test eax, eax
jne 0x1400203db
test rsi, rsi
jne 0x140020323
movups xmm0, xmmword [rbp + 0x40]
inc r14b
movdqu xmmword [rbp + rbx + 0x50], xmm0
add rbx, r13
mov byte [rbp + 0xa3], r14b
cmp rbx, 0x30
jl 0x140020306
mov r8d, 0x100
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140015898
mov edx, eax
test eax, eax
jne 0x1400203db
mov rdi, r15
xor ebx, ebx
lea r9, [rbp + 0x70]
mov edx, 1
lea r8, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140016930
mov edx, eax
test eax, eax
jne 0x1400203db
movups xmm0, xmmword [rbp + 0x70]
add ebx, r13d
movdqu xmmword [rdi], xmm0
add rdi, r13
cmp ebx, 0x30
jl 0x1400203ab
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x120
rep stosb byte [rdi], al
lea rdi, [rbp + 0xa0]
mov ecx, 0x1a0
lea r8d, [rax + 0x30]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x50]
mov ecx, r8d
rep stosb byte [rdi], al
lea rdi, [rbp + 0x80]
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x40]
mov rcx, r13
rep stosb byte [rdi], al
test edx, edx
je 0x140020425
mov rdi, r15
mov ecx, r8d
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020454
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov rbp, rdx
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
movups xmmword [rsp + 0x40], xmm0
mov eax, 0x10
add byte [rdi + rax - 1], 1
jne 0x1400204a8
dec rax
test rax, rax
jg 0x140020499
mov r9, rsi
lea rcx, [rdi + 0x28]
mov r8, rdi
mov edx, 1
call fcn.140016930
mov edx, eax
test eax, eax
jne 0x14002051d
add rsi, 0x10
add ebx, 0x10
cmp ebx, 0x30
jl 0x140020494
xor edx, edx
lea rax, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rbp]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rdx, 0x30
jl 0x1400204d8
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x28]
call fcn.140015898
mov edx, eax
test eax, eax
jne 0x14002051d
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
xor eax, eax
lea rdi, [rsp + 0x20]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140138940
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140021918
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r10d, dword [rdx]
mov ebp, 0xf0f0f0f
mov r9d, dword [rdx + 4]
mov rdi, rcx
bswap r10d
mov eax, r10d
mov rbx, r8
shr eax, 4
mov esi, 8
bswap r9d
xor eax, r9d
and eax, ebp
lea rbp, sym.MZ__EK3tihnfyn:sdGOhulW__sGsI7___x_T_.HuMBYZm
xor r9d, eax
shl eax, 4
xor r10d, eax
mov eax, r10d
shr eax, 0x10
xor eax, r9d
movzx ecx, ax
xor r9d, ecx
shl ecx, 0x10
xor r10d, ecx
mov eax, r9d
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor r9d, eax
mov eax, r9d
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor r9d, eax
mov r11d, r9d
shr r11d, 0x1f
lea eax, [r9 + r9]
or r11d, eax
mov eax, r11d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r11d, eax
xor r10d, eax
ror r10d, 0x1f
mov r9d, r11d
mov eax, r11d
xor r9d, dword [rdi]
lea rdi, [rdi + 0x10]
ror eax, 4
xor eax, dword [rdi - 0xc]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x172e90]
xor edx, dword [rbp + rax*4 + 0x1735e0]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x172d70]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x172f90]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x1734e0]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x1731c0]
xor edx, dword [rbp + r8*4 + 0x1733e0]
xor edx, dword [rbp + r9*4 + 0x1732c0]
xor r10d, edx
mov r9d, r10d
mov eax, r10d
xor r9d, dword [rdi - 8]
ror eax, 4
xor eax, dword [rdi - 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x172e90]
xor edx, dword [rbp + rax*4 + 0x1735e0]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x172d70]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x172f90]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x1734e0]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x1731c0]
xor edx, dword [rbp + r8*4 + 0x1733e0]
xor edx, dword [rbp + r9*4 + 0x1732c0]
xor r11d, edx
sub rsi, 1
jne 0x1400219c9
mov rsi, qword [rsp + 0x18]
mov r8d, r11d
mov rdi, qword [rsp + 0x20]
mov ebp, 0xf0f0f0f
shl r8d, 0x1f
shr r11d, 1
or r8d, r11d
mov eax, r8d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r8d, eax
xor r10d, eax
mov edx, r10d
shr r10d, 1
shl edx, 0x1f
or edx, r10d
mov eax, edx
shr eax, 8
xor eax, r8d
and eax, 0xff00ff
xor r8d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r8d
and eax, 0x33333333
xor r8d, eax
shl eax, 2
xor edx, eax
mov eax, r8d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r8d, ecx
mov eax, r8d
shr eax, 4
xor eax, edx
and eax, ebp
mov rbp, qword [rsp + 0x10]
xor edx, eax
shl eax, 4
xor r8d, eax
xor eax, eax
bswap r8d
bswap edx
mov dword [rbx], r8d
mov dword [rbx + 4], edx
mov rbx, qword [rsp + 8]
ret