joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084de7
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140186870
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x828
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x848]
mov rax, qword [0x1401f07c0]
xor rax, rbp
mov qword [rbp + 0x7e0], rax
mov dword [rbp + 0x7c4], 0
lea rcx, [0x140208803]
call fcn.140085710
cmp dword [rbp + 0x820], 0
jbe 0x140186938
cmp dword [rbp + 0x820], 7
jae 0x140186938
cmp dword [rbp + 0x820], 3
je 0x140186938
mov rax, qword [rbp + 0x810]
mov qword [rbp + 0x7d8], rax
mov eax, dword [rbp + 0x820]
dec eax
mov eax, eax
mov edx, eax
mov rcx, qword [rbp + 0x7d8]
call fcn.140085085
mov rdx, rax
mov rcx, qword [rbp + 0x818]
call fcn.140083528
mov eax, dword [rbp + 0x7c4]
or eax, 1
mov dword [rbp + 0x7c4], eax
mov rax, qword [rbp + 0x818]
jmp 0x140186a24
cmp dword [rbp + 0x820], 0xf
jbe 0x1401869a1
cmp dword [rbp + 0x820], 0x13
jae 0x1401869a1
mov rax, qword [rbp + 0x810]
add rax, 0xf0
mov qword [rbp + 0x7d8], rax
mov eax, dword [rbp + 0x820]
sub eax, 0x10
mov eax, eax
mov edx, eax
mov rcx, qword [rbp + 0x7d8]
call fcn.140084513
mov rdx, rax
mov rcx, qword [rbp + 0x818]
call fcn.140083528
mov eax, dword [rbp + 0x7c4]
or eax, 1
mov dword [rbp + 0x7c4], eax
mov rax, qword [rbp + 0x818]
jmp 0x140186a24
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x200
lea r9, [rbp + 0x130]
lea r8, [rbp + 0x10]
xor edx, edx
mov ecx, dword [rbp + 0x820]
call qword [sym.imp.USER32.dll_ToUnicode]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x788]
call fcn.140083ca8
nop
lea r8, [rbp + 0x788]
mov rdx, qword [rbp + 0x818]
mov rcx, qword [rbp + 0x810]
call fcn.140083a0a
mov eax, dword [rbp + 0x7c4]
or eax, 1
mov dword [rbp + 0x7c4], eax
lea rcx, [rbp + 0x788]
call fcn.1400851c5
mov rax, qword [rbp + 0x818]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.XINPUT1_4.dll_Ordinal_2
call fcn.1400850f8
mov rax, rdi
mov rcx, qword [rbp + 0x7e0]
xor rcx, rbp
call fcn.140084284
lea rsp, [rbp + 0x7f8]
pop rdi
pop rbp
ret
Function at 0x1400850b2
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1401850b0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x138]
mov rax, qword [0x1401f07c0]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14020868d]
call fcn.140085710
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140185196
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x118]
mov r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, 1
jmp 0x140185198
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1401d8150]
call fcn.1400850f8
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.140084284
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140085459
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400c69a0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140207c08]
call fcn.140085710
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x14019bec0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400c6a1f
mov dword [rbp + 0x120], 1
jmp 0x1400c6a29
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400c6a72
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400c69ea
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1400857bf
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140184bb0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x1401f07c0]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14020868d]
call fcn.140085710
xor edx, edx
mov ecx, 2
call fcn.140084216
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140184c19
xor eax, eax
jmp 0x140184c83
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x130
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400850ad
test eax, eax
jne 0x140184c4f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140184c83
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x258]
call fcn.14008462b
test eax, eax
jne 0x140184c65
jmp 0x140184c76
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140085756
test eax, eax
jne 0x140184c4f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401d81d0]
call fcn.1400850f8
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140084284
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x1400857ce
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14009a2d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [0x1401f07c0]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x14020759d]
call fcn.140085710
mov ecx, dword [0x1401f0760]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14009a4fb
movzx eax, byte [0x1401f78e8]
test eax, eax
je 0x14009a4fb
movzx eax, byte [0x1401f0774]
test eax, eax
jne 0x14009a4fb
mov rcx, qword [0x1401f78c8]
call fcn.140084365
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14009a368
jmp 0x14009a4fb
cmp dword [0x1401f78ec], 0
jne 0x14009a387
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x230]
call fcn.140083d9d
mov qword [rbp + 0x28], rax
jmp 0x14009a39b
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x230]
call fcn.140083753
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14009a3a7
jmp 0x14009a4fb
mov r8, qword [rbp + 8]
lea rdx, [rbp + 0x48]
mov rcx, qword [0x1401f78c8]
call fcn.140083537
mov r8, qword [rbp + 0x28]
lea rdx, [rbp + 0x78]
mov rcx, qword [0x1401f78c8]
call fcn.140083537
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x78]
call fcn.140085233
lea rcx, [rbp + 0xa8]
call fcn.140084563
movss xmm1, dword [rbp + 0xac]
movss xmm0, dword [rbp + 0xa8]
call fcn.140084e19
xorps xmm0, xmmword [0x140198db0]
divss xmm0, dword [0x140198da4]
mulss xmm0, dword [0x140198da8]
addss xmm0, dword [0x140198da8]
movss dword [rbp + 0xd4], xmm0
movss xmm0, dword [rbp + 0xa8]
mulss xmm0, dword [rbp + 0xa8]
movss xmm1, dword [rbp + 0xac]
mulss xmm1, dword [rbp + 0xac]
addss xmm0, xmm1
call fcn.140083e4c
movaps xmm1, xmm0
movss xmm0, dword [rbp + 0xb0]
call fcn.140084e19
divss xmm0, dword [0x140198da4]
mulss xmm0, dword [0x140198da8]
movss dword [rbp + 0xf4], xmm0
mov rax, qword [0x1401f78d8]
movsxd rax, dword [rax + 0xc]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
lea r8, [rbp + 0xd4]
mov rdx, rax
mov rcx, qword [0x1401f7980]
call fcn.140083b9f
mov rax, qword [0x1401f78d8]
movsxd rax, dword [rax + 0xc]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax + 4]
lea r8, [rbp + 0xf4]
mov rdx, rax
mov rcx, qword [0x1401f7980]
call fcn.140083b9f
mov dword [rbp + 0x1f4], 5
lea rdx, [rbp + 0x1f4]
lea rcx, [rbp + 0x1d8]
call fcn.1400838a2
mov rcx, rax
call fcn.140083483
jmp 0x14009a319
lea rcx, [rbp - 0x20]
lea rdx, [0x140198970]
call fcn.1400850f8
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.140084284
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret
Function at 0x140051df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x208
movsxd r14, dword [rdx + 0x3c]
mov rbx, rdx
mov eax, dword [r14 + rdx + 0x88]
test eax, eax
je 0x140051ec7
lea rdi, [rdx + rax]
mov esi, dword [rdi + 0x18]
test esi, esi
je 0x140051ec7
mov r8d, dword [rdi + 0xc]
xor ecx, ecx
mov eax, dword [rdi + 0x20]
add r8, rdx
mov r12d, dword [rdi + 0x1c]
add rax, rdx
mov r13d, dword [rdi + 0x24]
add r12, rdx
mov qword [rbp + 0x158], rax
add r13, rdx
mov al, byte [r8]
test al, al
je 0x140051e7e
xor edx, edx
inc ecx
or al, 0x20
mov byte [rbp + rdx - 0x10], al
mov edx, ecx
mov al, byte [rcx + r8]
test al, al
jne 0x140051e6c
mov byte [rbp + rcx - 0x10], 0
mov rdx, r9
lea rcx, [rbp - 0x10]
call fcn.140054358
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x158]
lea ecx, [rsi - 1]
mov rdx, qword [rbp + 0x168]
mov esi, ecx
mov r15d, ecx
mov ecx, dword [rax + rcx*4]
add rcx, rbx
call fcn.140054358
xor rax, qword [rsp + 0x20]
cmp rax, qword [rbp + 0x160]
je 0x140051edd
test esi, esi
jne 0x140051e94
xor eax, eax
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, word [r13 + r15*2]
mov r8d, dword [r12 + rax*4]
add r8, rbx
cmp r8, rdi
jb 0x140051f9d
mov eax, dword [r14 + rbx + 0x8c]
add rax, rdi
cmp r8, rax
jae 0x140051f9d
xor r10d, r10d
mov r9d, r10d
cmp byte [r8], r10b
je 0x140051f31
cmp r9d, 0x3c
jae 0x140051f31
mov eax, r9d
mov cl, byte [rax + r8]
mov byte [rsp + rax + 0x30], cl
cmp cl, 0x2e
je 0x140051f31
inc r9d
cmp byte [r9 + r8], r10b
jne 0x140051f12
lea eax, [r9 + 1]
mov edx, eax
mov byte [rsp + rax + 0x30], 0x64
lea eax, [r9 + 2]
mov byte [rsp + rax + 0x30], 0x6c
lea eax, [r9 + 3]
mov byte [rsp + rax + 0x30], 0x6c
lea eax, [r9 + 4]
lea r9, [rdx + r8]
mov byte [rsp + rax + 0x30], r10b
mov edx, r10d
cmp byte [r9], r10b
je 0x140051f7a
cmp edx, 0x7f
jae 0x140051f7a
mov ecx, edx
inc edx
mov al, byte [rcx + r9]
mov byte [rsp + rcx + 0x70], al
cmp byte [rdx + r9], r10b
jne 0x140051f63
mov rcx, qword [rbp + 0x150]
lea r9, [rsp + 0x70]
mov eax, edx
lea r8, [rsp + 0x30]
mov rdx, rbx
mov byte [rsp + rax + 0x70], r10b
call fcn.140051fa8
mov r8, rax
mov rax, r8
jmp 0x140051ec9
Function at 0x140051fa8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov r10, qword [rax + 0x60]
mov rax, qword [r10 + 0x18]
mov rbx, qword [rax + 0x10]
cmp qword [rbx + 0x30], r11
je 0x140052019
test r11, r11
jne 0x14005203a
mov rdx, qword [rbx + 0x30]
cmp rdx, rbp
je 0x14005200a
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call fcn.14005413c
mov r11, rax
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x140051feb
test r11, r11
jne 0x14005203a
mov rdx, r14
mov rcx, rdi
call fcn.140054054
test rax, rax
je 0x140052037
mov rdx, rsi
mov rcx, rax
call qword [rdi + 0x38]
mov r11, rax
jmp 0x14005203a
xor r11d, r11d
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140053df8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword gs:[0x30]
mov rsi, rcx
add rcx, 0x348
mov rbp, rdx
mov r15, qword [rax + 0x60]
call qword [rsi + 0x40]
xor ecx, ecx
movsxd r9, dword [rax + 0x3c]
add r9, rax
movzx r10d, word [r9 + 0x14]
movzx r8d, word [r9 + 6]
add r10, r9
test r8d, r8d
je 0x140053e68
mov r9d, dword [rsi + 0x340]
lea rdx, [rcx + rcx*4]
cmp dword [r10 + rdx*8 + 0x18], r9d
je 0x140053e9d
inc ecx
cmp ecx, r8d
jb 0x140053e56
mov ebx, dword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe0]
call qword [rsi + 0xc0]
xor edx, edx
test ebx, ebx
je 0x140053ebd
mov r8, rdi
lea rcx, [r8 + 8]
mov r14, r8
mov r8, rcx
cmp qword [rcx], rax
je 0x140053eaf
inc edx
cmp edx, ebx
jb 0x140053e86
jmp 0x140053ec5
mov edi, dword [r10 + rdx*8 + 0x24]
mov ebx, dword [r10 + rdx*8 + 0x20]
add rdi, rax
shr ebx, 3
jmp 0x140053e77
mov rdx, rbp
mov rcx, r14
call qword [rsi + 0x1f0]
jmp 0x140053ec5
mov r14, qword [rsp + 0xe0]
call qword [rsi + 0xb8]
xor ebp, ebp
lea r9d, [rbp + 1]
test ebx, ebx
je 0x140053f16
lea rcx, [rdi + 8]
cmp qword [rcx], rax
je 0x140053eeb
add ebp, r9d
add rcx, 8
cmp ebp, ebx
jb 0x140053ed9
jmp 0x140053f16
mov r8b, r9b
lea rcx, [rsp + 0x20]
mov rdx, r14
call qword [rsi + 0x1d0]
lea rcx, [rdi + rbp*8]
mov r8d, 0x10
lea rdx, [rsp + 0x20]
call fcn.140054864
mov r9d, 1
mov rax, qword [r15 + 0x18]
mov rdi, qword [rax + 0x10]
jmp 0x140054025
lea r12, [rsi + 0x370]

Function at 0x140054054
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
or r10d, 0xffffffff
xor r8d, r8d
mov rsi, rcx
cmp byte [rdx], r8b
je 0x14005408b
cmp r8d, 0x40
jae 0x14005408b
mov al, byte [r8 + rdx]
mov byte [rsp + r8 + 0x20], al
inc r8d
cmp byte [r8 + rdx], 0
jne 0x140054072
lea eax, [r8 - 4]
mov byte [rsp + r8 + 0x20], 0
cmp byte [rsp + rax + 0x20], 0x2e
je 0x1400540c6
mov byte [rsp + r8 + 0x20], 0x2e
inc r8d
mov byte [rsp + r8 + 0x20], 0x64
inc r8d
mov byte [rsp + r8 + 0x20], 0x6c
inc r8d
lea eax, [r8 + 1]
mov byte [rsp + r8 + 0x20], 0x6c
mov byte [rsp + rax + 0x20], 0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x14005411d
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
xor eax, eax
test ecx, ecx
je 0x140054110
mov edx, dword [rcx + rbx + 0xc]
lea rcx, [rsp + 0x20]
add rdx, rbx
call fcn.1400548c0
mov r10d, eax
xor eax, eax
test r10d, r10d
je 0x140054135
mov rdi, qword [rdi]
test r10d, r10d
jne 0x1400540db
test rax, rax
jne 0x140054125
lea rcx, [rsp + 0x20]
call qword [rsi + 0x30]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, rbx
jmp 0x140054125
Function at 0x14005413c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r11d, r11d
mov rdi, rdx
mov r10, rcx
mov ebx, r11d
test rdx, rdx
je 0x1400542c4
movsxd r15, dword [rdx + 0x3c]
mov eax, dword [r15 + rdx + 0x88]
test eax, eax
je 0x1400542c4
lea rsi, [rdx + rax]
mov r14d, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x20]
add r14, rdx
mov r12d, dword [rsi + 0x24]
add r13, rdx
add r12, rdx
test r8, r8
je 0x1400542b4
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x1400542c4
lea eax, [rbp - 1]
mov rdx, r8
mov ecx, dword [r13 + rax*4]
mov ebp, eax
add rcx, rdi
mov qword [rsp + 0xe8], rax
call fcn.1400548a0
xor r11d, r11d
test eax, eax
jne 0x1400541eb
mov rax, qword [rsp + 0xe8]
movzx eax, word [r12 + rax*2]
mov ebx, dword [r14 + rax*4]
add rbx, rdi
test ebp, ebp
je 0x1400541fc
mov r8, qword [rsp + 0xf0]
test rbx, rbx
je 0x1400541b3
mov r10, qword [rsp + 0xe0]
cmp rbx, rsi
jb 0x1400542af
mov eax, dword [r15 + rdi + 0x8c]
add rax, rsi
cmp rbx, rax
jae 0x1400542af
mov r8d, r11d
cmp byte [rbx], r11b
je 0x140054247
cmp r8d, 0x3c
jae 0x140054247
mov eax, r8d
mov cl, byte [rax + rbx]
mov byte [rsp + rax + 0x20], cl
cmp cl, 0x2e
je 0x140054247
inc r8d
cmp byte [r8 + rbx], r11b
jne 0x140054229
lea eax, [r8 + 1]
mov edx, eax
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
lea r8, [rdx + rbx]
mov byte [rsp + rax + 0x20], r11b
mov edx, r11d
cmp byte [r8], r11b
je 0x140054290
cmp edx, 0x3f
jae 0x140054290
mov ecx, edx
inc edx
mov al, byte [rcx + r8]
mov byte [rsp + rcx + 0x60], al
cmp byte [rdx + r8], r11b
jne 0x140054279
mov eax, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, r10
mov byte [rsp + rax + 0x60], r11b
call fcn.140051fa8
mov rbx, rax
mov rax, rbx
jmp 0x1400542c6
sub r9d, dword [rsi + 0x10]
mov ebx, dword [r14 + r9*4]
add rbx, rdi
jmp 0x140054204
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400542e4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor r10d, r10d
mov r9, qword [rax + 0x60]
mov rax, qword [r9 + 0x18]
mov rbx, qword [rax + 0x10]
jmp 0x140054337
test r10, r10
jne 0x140054340
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call fcn.140051df0
mov rbx, qword [rbx]
mov r10, rax
mov rax, qword [rbx + 0x30]
test rax, rax
jne 0x14005431b
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140054424
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movups xmm0, xmmword [rcx]
mov qword [rsp + 0x28], rdx
mov ecx, edx
mov r8d, dword [rsp + 0x2c]
xor r10d, r10d
movups xmmword [rsp], xmm0
mov edx, dword [rsp + 0xc]
mov r11d, dword [rsp + 8]
mov ebx, dword [rsp + 4]
mov r9d, dword [rsp]
mov eax, edx
ror ecx, 8
add ecx, r8d
mov edx, ebx
xor ecx, r9d
ror edx, 8
add edx, r9d
rol r8d, 3
xor edx, r10d
rol r9d, 3
xor r9d, edx
xor r8d, ecx
inc r10d
mov ebx, r11d
mov r11d, eax
cmp r10d, 0x1b
jb 0x140054451
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], r8d
mov rax, qword [rsp + 0x28]
add rsp, 0x10
pop rbx
ret

Function at 0x140054498
Capabilities:
Encrypt data using chaskey

Disassembly:
test r9d, r9d
je 0x1400545e6
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x10
mov r11, rcx
lea rax, [rbp - 0x10]
sub r11, rax
lea r14, [rdx + 0xf]
mov rdi, r8
mov r12d, 0x10
lea rax, [rbp - 0x10]
cmp rax, r14
ja 0x1400544ef
lea rax, [rbp - 1]
cmp rax, rdx
jb 0x1400544ef
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
jmp 0x1400544f7
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov r8d, 4
mov eax, dword [r11 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x140054501
mov r8d, dword [rbp - 4]
mov rbx, r12
mov eax, dword [rbp - 8]
mov r10d, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x10]
add ecx, r10d
add eax, r8d
rol r10d, 5
xor r10d, ecx
rol r8d, 8
xor r8d, eax
rol ecx, 0x10
add eax, r10d
add ecx, r8d
rol r10d, 7
rol r8d, 0xd
xor r10d, eax
xor r8d, ecx
rol eax, 0x10
sub rbx, 1
jne 0x140054522
mov dword [rbp - 4], r8d
lea r8d, [rbx + 4]
mov dword [rbp - 0x10], ecx
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], r10d
mov dword [rbp - 8], eax
mov eax, dword [rcx + r11]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14005456c
cmp r9d, r12d
mov ecx, r9d
cmova ecx, r12d
mov r10d, ecx
test ecx, ecx
je 0x1400545aa
lea rbx, [rbp - 0x10]
mov r8, rdi
sub rbx, rdi
mov esi, r10d
mov al, byte [rbx + r8]
xor byte [r8], al
inc r8
sub rsi, 1
jne 0x14005459a
sub r9d, ecx
mov r8d, r12d
add rdi, r10
lea eax, [r8 - 1]
add byte [rax + rdx], 1
jne 0x1400545c5
dec r8d
test r8d, r8d
jg 0x1400545b3
test r9d, r9d
jne 0x1400544d3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x10
pop r14
pop r12
pop rbp
ret
Function at 0x140054590
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
test r9d, r9d
je 0x1400545e6
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x10
mov r11, rcx
lea rax, [rbp - 0x10]
sub r11, rax
lea r14, [rdx + 0xf]
mov rdi, r8
mov r12d, 0x10
lea rax, [rbp - 0x10]
cmp rax, r14
ja 0x1400544ef
lea rax, [rbp - 1]
cmp rax, rdx
jb 0x1400544ef
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
jmp 0x1400544f7
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov r8d, 4
mov eax, dword [r11 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x140054501
mov r8d, dword [rbp - 4]
mov rbx, r12
mov eax, dword [rbp - 8]
mov r10d, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x10]
add ecx, r10d
add eax, r8d
rol r10d, 5
xor r10d, ecx
rol r8d, 8
xor r8d, eax
rol ecx, 0x10
add eax, r10d
add ecx, r8d
rol r10d, 7
rol r8d, 0xd
xor r10d, eax
xor r8d, ecx
rol eax, 0x10
sub rbx, 1
jne 0x140054522
mov dword [rbp - 4], r8d
lea r8d, [rbx + 4]
mov dword [rbp - 0x10], ecx
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], r10d
mov dword [rbp - 8], eax
mov eax, dword [rcx + r11]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14005456c
cmp r9d, r12d
mov ecx, r9d
cmova ecx, r12d
mov r10d, ecx
test ecx, ecx
je 0x1400545aa
lea rbx, [rbp - 0x10]
mov r8, rdi
sub rbx, rdi
mov esi, r10d
mov al, byte [rbx + r8]
xor byte [r8], al
inc r8
sub rsi, 1
jne 0x14005459a
sub r9d, ecx
mov r8d, r12d
add rdi, r10
lea eax, [r8 - 1]
add byte [rax + rdx], 1
jne 0x1400545c5
dec r8d
test r8d, r8d
jg 0x1400545b3
test r9d, r9d
jne 0x1400544d3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x10
pop r14
pop r12
pop rbp
ret