joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14037a440
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x14047fb40]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x1cc
call fcn.14026d510
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14025d230
mov al, byte [rsi + 0x17]
test al, al
jns 0x14037a4be
cmp qword [rsi + 8], 0x103
ja 0x14037a4dc
test al, al
jns 0x14037a4c5
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14025d470
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14037ace0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x14047fb40]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x88
call fcn.14026d510
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14025d230
mov rcx, rdi
call fcn.1402708c0
test al, al
jne 0x14037ad8c
mov rcx, rsi
call fcn.1402708c0
test al, al
jne 0x14037ad8a
cmp byte [rdi + 0x17], 0
jns 0x14037adce
cmp qword [rdi + 8], 0x103
jbe 0x14037adce
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.14025d470
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.140184b10
jmp 0x14037ad8c
cmp byte [rsi + 0x17], 0
jns 0x14037adde
cmp qword [rsi + 8], 0x103
ja 0x14037ad8a
lea r14, [rsp + 0x20]
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, reloc.OLEAUT32.dll_SysAllocStringByteLen
call fcn.14026d510
lea r8, [0x14053dac4]
mov rcx, r14
mov rdx, r15
call fcn.140184800
cmp byte [rsi + 0x17], 0
jns 0x14037ae23
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x14037ae30
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14037adc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bpl
je 0x14037adc2
mov ecx, eax
and ecx, 1
je 0x14037adc2
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bpl, 1
jmp 0x14037adc2
Function at 0x14037ae80
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x14047fb40]
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x4c6
call fcn.14026d510
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14025d230
mov al, byte [rdi + 0x17]
test al, al
jns 0x14037af08
cmp qword [rdi + 8], 0x103
ja 0x14037af1b
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x14037af47
cmp qword [rsi + 8], 0x103
jbe 0x14037af47
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.14025d470
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, rsi
test cl, cl
jns 0x14037af51
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x14037af5b
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x14037af1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1401498e0
test al, al
jne 0x14037af8b
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14037af19
mov rcx, rdi
mov rdx, rsi
call fcn.14037afa0
test al, al
jne 0x14037af1b
jmp 0x14037af81

Function at 0x14037b350
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1402708c0
test al, al
jne 0x14037b371
mov rcx, rsi
call fcn.1402708c0
test al, al
je 0x14037b37a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14037ae80
Function at 0x14037e7a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14053dce0], 0
je 0x14037e7e6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x14053dcb8]
test rdi, rdi
je 0x14037e887
test byte [reloc.WS2_32.dll_accept], 1
je 0x14037e7c9
cmp byte [rdi + 0x17], 0
jns 0x14037e808
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14053dce0], rax
inc rax
cmp rax, 1
ja 0x14037e7c9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1402e0d10
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x14037e94c
xor esi, esi
jmp 0x14037e7c9
mov ecx, SafeArrayCopy
call fcn.1402dd130
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1402e0d10
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14047fb40]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14031d9e0
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14037e8ed
and eax, 0x7f
mov rcx, rdi
jmp 0x14037e8f4
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
je 0x14037e92b
add rax, rax
test rax, rax
je 0x14037e92b
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x14037e8fc
cmp rdx, 0xfffffffffffffffe
je 0x14037e92b
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.14024d8b0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.14013baa0
mov qword [0x14053dcb8], rdi
jmp 0x14037e7f6
mov rdi, qword [0x14053dcb8]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140303804
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14013b940
mov rcx, qword [0x14053dcb8]
call fcn.140372850
cmp word [rax], 0x5c
je 0x14037e999
mov rcx, qword [0x14053dcb8]
lea rdx, [0x140495954]
mov r8d, 1
call fcn.14013baa0
mov rcx, qword [0x14053dcb8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.14013baa0
mov rcx, qword [0x14053dcb8]
cmp byte [rcx + 0x17], 0
jns 0x14037e9c2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14053dce0], rax
inc rax
cmp rax, 1
ja 0x14037e7c9
mov qword [0x14053dce0], 0
jmp 0x14037e880
Function at 0x140392e20
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x14053f0f0]
test rax, rax
jne 0x140392e64
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14053f0f0]
test rax, rax
je 0x140392e51
cmp eax, 2
jne 0x140392ebc
mov ecx, 2
call fcn.14026cdd0
test al, al
je 0x140392f19
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8f
mov r9d, 2
call fcn.14015a460
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.14031d7c0
mov rcx, rsi
call fcn.14015aab0
jmp 0x140392f19
mov eax, 1
lock xadd qword [0x14053f128], rax
inc rax
cmp rax, 2
jl 0x140392ee0
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14053f0ac], eax
mov qword [0x14053f0a4], rsi
mov rcx, qword [0x14052df30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x140392f49
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1402ddd70
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbb
mov r9d, 2
call fcn.14015a460
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
jmp 0x140392ead

Function at 0x1403933c0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp qword [0x14052df30], 0xffffffffffffffff
jne 0x140393461
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x140393420
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7003
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x160
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x367
mov r9d, 2
call fcn.14015a460
lea rcx, [rsp + 0x30]
lea rdx, str.not_connected
mov r8d, reloc.WS2_32.dll_listen
call fcn.14031d7c0
mov rcx, rsi
call fcn.14015aab0
jmp 0x1403933f2
mov rsi, rcx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1402ddd70
mov rcx, rsi
add rsp, 0x160
pop rsi
jmp fcn.140392e20
Function at 0x140396320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movapd xmmword [rsp + 0x30], xmm7
movapd xmmword [rsp + 0x20], xmm6
test rcx, rcx
je 0x140396347
mov rsi, rcx
movabs rdi, 0x100002600
jmp 0x140396350
xorpd xmm0, xmm0
jmp 0x14039637e
inc rsi
movzx ebx, byte [rsi]
cmp rbx, 0x20
ja 0x14039635f
bt rdi, rbx
jb 0x14039634d
xor ecx, ecx
cmp bl, 0x2d
sete cl
mov al, byte [rsi + rcx]
cmp al, 0x2e
je 0x1403963d7
lea edx, [rax - 0x3a]
cmp dl, 0xf6
jae 0x1403963d7
movsd xmm0, qword [0x14053f158]
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov al, byte [rsi]
inc rsi
cmp al, 0x20
ja 0x140396376
movzx eax, al
bt rdi, rax
jb 0x140396390
test rax, rax
jne 0x140396376
cmp bl, 0x2d
jne 0x1403963b4
xorpd xmm6, xmmword [0x1404761a0]
mov eax, edx
neg eax
test ecx, ecx
cmove eax, edx
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
movsd xmm0, qword [0x14048ca40]
call fcn.14031a060
mulsd xmm0, xmm6
jmp 0x14039637e
lea edx, [rax - 0x30]
cmp dl, 9
jbe 0x1403963e8
add rsi, rcx
xorpd xmm6, xmm6
jmp 0x140396421
xorpd xmm6, xmm6
movsd xmm0, qword [0x14048ca40]
movzx eax, al
movapd xmm1, xmm6
mulsd xmm1, xmm0
add eax, 0xffffffd0
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
addsd xmm6, xmm1
mov al, byte [rsi + rcx + 1]
lea r8d, [rax - 0x30]
inc rcx
cmp r8b, 0xa
jb 0x1403963f4
add rsi, rcx
cmp al, 0x2e
jne 0x1403964e1
mov cl, byte [rsi + 1]
inc rsi
cmp cl, 0x30
jb 0x140396463
cmp dl, 0xa
jb 0x140396442
cmp cl, 0x3a
jae 0x140396376
xor eax, eax
cmp cl, 0x30
jne 0x14039646e
xor eax, eax
inc eax
mov cl, byte [rsi + 1]
inc rsi
cmp cl, 0x30
je 0x14039644b
jmp 0x14039646e
xor edx, edx
xor ecx, ecx
jmp 0x140396392
xor eax, eax
cmp dl, 0xa
jae 0x140396376
lea edx, [rcx - 0x30]
xorpd xmm7, xmm7
cmp dl, 9
ja 0x1403964b4
lea edx, [rax + 0x14]
movsd xmm0, qword [0x14048ca40]
movzx ecx, cl
add ecx, 0xffffffd0
movapd xmm1, xmm7
mulsd xmm1, xmm0
xorps xmm7, xmm7
cvtsi2sd xmm7, ecx
addsd xmm7, xmm1
inc eax
mov cl, byte [rsi + 1]
inc rsi
lea r8d, [rcx - 0x30]
cmp r8b, 9
ja 0x1403964b4
cmp eax, edx
jb 0x140396485
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
movsd xmm0, qword [0x14048ca40]
call fcn.14031a060
divsd xmm7, xmm0
dec rsi
mov al, byte [rsi + 1]
inc rsi
lea ecx, [rax - 0x30]
cmp cl, 0xa
jb 0x1403964cf
addsd xmm6, xmm7
movzx ecx, al
or ecx, 0x20
cmp ecx, 0x65
jne 0x14039645a
movzx eax, byte [rsi + 1]
xor ecx, ecx
cmp eax, 0x2b
je 0x140396505
cmp eax, 0x2d
je 0x14039650b
inc rsi
jmp 0x140396514
add rsi, 2
jmp 0x140396514
add rsi, 2
mov ecx, 1
mov al, byte [rsi]
lea r8d, [rax - 0x30]
xor edx, edx
cmp r8b, 9
ja 0x140396392
xor edx, edx
mov r8d, edx
movzx eax, al
cmp edx, 0xf4240
lea edx, [r8 + r8*4]
lea edx, [rax + rdx*2 - 0x30]
cmovge edx, r8d
mov al, byte [rsi + 1]
inc rsi
lea r8d, [rax - 0x30]
cmp r8b, 0xa
jb 0x140396528
jmp 0x140396392
Function at 0x1403b4860
Capabilities:
Encrypt data using dpapi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b8
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x198]
mov qword [rsi], rax
movzx r8d, byte [rcx + 0x17]
mov r9d, r8d
and r9d, 0x7f
test r8b, r8b
mov r8, qword [rcx]
cmovns r8, rcx
mov qword [rsi + 8], r8
cmovs r9d, dword [rcx + 8]
mov rdi, rdx
mov dword [rsi], r9d
movaps xmm0, xmmword [0x14047fb40]
lea r14, [rsp + 0x180]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x178]
mov qword [rbx], rax
mov rcx, rbx
call fcn.14025bf70
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
mov esi, eax
lea r14, [rsp + 0x1a8]
mov rcx, r14
call fcn.14025bf70
mov rax, qword [r14]
mov rcx, qword [rbx]
xor edx, edx
cmp rax, rcx
setns dl
movabs r8, 0x7fffffffffffffff
add r8, rdx
sub rax, rcx
cmovo rax, r8
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14053f2b8]
test rcx, rcx
jne 0x1403b4978
mov dword [rsp + 0x20], 1
lea rcx, str.OSCrypt.Win.Decrypt.Time
mov edx, 0x3e8
mov r8d, 0x989680
mov r9d, 0x32
call fcn.140269640
mov rcx, rax
mov qword [0x14053f2b8], rax
lea rdx, [rsp + 0x38]
call fcn.140267330
test esi, esi
setne dl
lea rcx, str.OSCrypt.Win.Decrypt.Result
call fcn.140267230
test esi, esi
je 0x1403b49e1
mov r8d, dword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
mov rcx, rdi
call fcn.14022a560
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
setne bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 2
call fcn.14026cdd0
test al, al
je 0x1403b49bd
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....componentsos_crypt_syncos_crypt_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x60
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x48]
lea rdx, str.Failed_to_decrypt
mov r8d, reloc.WS2_32.dll_recvfrom
call fcn.14031d7c0
mov rcx, rdi
call fcn.14037edb0
jmp 0x1403b49bd

Function at 0x1403b9560
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp edx, 0x80
je 0x1403b9587
cmp edi, 0x100
je 0x1403b9587
cmp edi, 0xc0
jne 0x1403b95bd
mov ecx, 1
call fcn.140280fd0
mov rcx, rbx
mov edx, edi
mov r8, rsi
bt eax, 0x19
jae 0x1403b95ab
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140003260
bt eax, 9
jae 0x1403b95ca
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140004350
mov eax, 0xfffffffe
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1403b95e0
Function at 0x1403bb0c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x1403bb163
mov rdi, r9
mov r15, r8
mov r12, rdx
mov r14, rcx
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
cmp r8, 0x10
jae 0x1403bb174
mov rax, rsi
mov r13, r15
mov rcx, r13
neg rcx
mov rdx, 0xffffffffffffffff
mov r8b, byte [rax + rdx + 1]
xor r8b, byte [r14 + rdx + 1]
mov byte [r12 + rdx + 1], r8b
lea r8, [rcx + rdx]
inc r8
inc rdx
cmp r8, 0xffffffffffffffff
jne 0x1403bb10e
cmp rdx, 0xe
ja 0x1403bb149
dec r13
mov cl, byte [rax + r13 + 1]
mov byte [r12 + r13 + 1], cl
inc r13
cmp r13, 0xf
jb 0x1403bb136
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov rax, rbx
call qword [case.0x14012d181.0]
movups xmm0, xmmword [r12]
movups xmmword [rsi], xmm0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
mov rax, rsi
mov rsi, r12
mov r13, r15
lea rcx, [r12 + rbp]
mov rdx, qword [rax]
xor rdx, qword [r14 + rbp]
mov qword [r12 + rbp], rdx
mov rax, qword [rax + 8]
xor rax, qword [r14 + rbp + 8]
mov qword [r12 + rbp + 8], rax
mov rdx, rcx
mov r8, rdi
mov rax, rbx
call qword [case.0x14012d181.0]
add r13, 0xfffffffffffffff0
mov rax, rsi
add rsi, 0x10
add rbp, 0x10
cmp r13, 0xf
ja 0x1403bb17f
lea rax, [r12 + rbp]
add rax, 0xfffffffffffffff0
cmp r15, rbp
jne 0x1403bb1da
mov r12, rax
mov rsi, qword [rsp + 0x90]
jmp 0x1403bb15b
add r14, rbp
add r12, rbp
mov rsi, qword [rsp + 0x90]
jmp 0x1403bb101
Function at 0x1403bb1f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
test r8, r8
je 0x1403bb373
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
cmp rcx, 0x20
setae al
add rcx, 0xffffffffffffffe0
cmp rcx, rdx
setae cl
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rsp + 0x20], xmm0
cmp rdi, rdx
jb 0x1403bb2b7
and al, cl
jne 0x1403bb2b7
cmp rsi, 0x10
jb 0x1403bb30f
lea r12, [rsp + 0x20]
mov rcx, rdi
mov rdx, r12
mov r8, r14
mov rax, r15
call qword [case.0x14012d181.0]
mov rax, qword [rdi]
mov rcx, qword [r13]
xor rcx, qword [rsp + 0x20]
mov qword [rbx], rcx
mov qword [r13], rax
mov rax, qword [rdi + 8]
mov rcx, qword [r13 + 8]
xor rcx, qword [rsp + 0x28]
mov qword [rbx + 8], rcx
mov qword [r13 + 8], rax
add rsi, 0xfffffffffffffff0
add rdi, 0x10
add rbx, 0x10
cmp rsi, 0xf
ja 0x1403bb269
jmp 0x1403bb30a
cmp rsi, 0x10
jae 0x1403bb2c2
mov rax, r13
jmp 0x1403bb302
mov rbp, r13
mov r12, rdi
mov rcx, rdi
mov rdx, rbx
mov r8, r14
mov rax, r15
call qword [case.0x14012d181.0]
mov rax, qword [rbp]
xor qword [rbx], rax
mov rax, qword [rbp + 8]
xor qword [rbx + 8], rax
add rsi, 0xfffffffffffffff0
add rdi, 0x10
add rbx, 0x10
mov rbp, r12
cmp rsi, 0xf
ja 0x1403bb2c5
lea rax, [rdi - 0x10]
movups xmm0, xmmword [rax]
movups xmmword [r13], xmm0
test rsi, rsi
je 0x1403bb373
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r8, r14
mov rax, r15
call qword [case.0x14012d181.0]
mov rax, rsi
neg rax
mov rcx, 0xffffffffffffffff
mov dl, byte [rdi + rcx + 1]
mov r8b, byte [r13 + rcx + 1]
xor r8b, byte [rsp + rcx + 0x21]
mov byte [rbx + rcx + 1], r8b
mov byte [r13 + rcx + 1], dl
lea rdx, [rax + rcx]
inc rdx
inc rcx
cmp rdx, 0xffffffffffffffff
jne 0x1403bb330
cmp rcx, 0xe
ja 0x1403bb373
dec rsi
mov al, byte [rdi + rsi + 1]
mov byte [r13 + rsi + 1], al
inc rsi
cmp rsi, 0xf
jb 0x1403bb361
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403c64a0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x1403cabf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x1403cac4f
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x1403cac6b
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x1403cac95
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x1403cacb6
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x1403cacd8
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x1403cacfe
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x1403cacfc
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1402e0d10
mov r8, r12
xor r8, r15
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.1403c7a80
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x1403cad3a
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x14047fb40]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov eax, dword [rdi + 0x148]
test eax, eax
jle 0x1403cae0b
xor ecx, ecx
xor edx, edx
or rdx, qword [rsi + rcx*8]
inc rcx
cmp rax, rcx
jne 0x1403cada6
test rdx, rdx
sete dl
test rax, rax
je 0x1403cae5c
movsxd rcx, eax
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x1403cade0
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x1403cade0
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
mov ecx, eax
test rax, rax
jle 0x1403cae2a
xor r8d, r8d
jmp 0x1403cae1f
mov dl, 1
jmp 0x1403cadb8
xor r9d, r9d
mov qword [rsp + r8*8 + 0x30], r9
inc r8
cmp rcx, r8
je 0x1403cae2a
test dl, dl
jne 0x1403cae0f
mov r9, qword [rsp + r8*8 + 0x30]
jmp 0x1403cae12
test rcx, rcx
je 0x1403cae5c
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x1403cae3e
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret