joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079a60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov rax, qword [0x141287898]
mov r14, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140079c55
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x140079c55
test rdi, rdi
je 0x140079c55
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140079c55
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140079c55
movzx ecx, word [rdi + 0x14]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x80], rbp
mov eax, dword [rcx + rdi + 0x24]
sub ebx, eax
mov dword [rsp + 0x88], eax
mov rcx, r14
mov eax, ebx
mov r8d, ebx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x40], r15
call fcn.14007b3e0
mov r13, rax
mov r12, rax
test rax, rax
je 0x140079c35
mov r8d, dword [rdi + 0x54]
mov rcx, rsi
mov rdx, qword [0x141287898]
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x2c
mov ebp, eax
cmp ax, word [rdi + 6]
jae 0x140079b76
add rbx, rdi
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, qword [0x141287898]
add rcx, rsi
mov r8d, dword [rbx - 4]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
lea rbx, [rbx + 0x28]
inc ebp
cmp ebp, eax
jl 0x140079b50
mov r15d, dword [rsp + 0x88]
lea rcx, [rsp + 0x20]
mov rbp, r12
mov rdx, rsi
sub r12, r15
mov rbx, r12
sub rbx, qword [rdi + 0x30]
call fcn.14007d350
mov rdx, rbx
mov rcx, rax
call fcn.140079d30
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14007d4b0
mov rdx, rax
mov rcx, r14
call fcn.140079e30
test al, al
je 0x140079c35
mov r9, qword [rsp + 0x90]
lea r8, [r15 + rsi]
mov rdx, rbp
mov rcx, r14
call fcn.14007b1a0
test al, al
je 0x140079c35
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0x88]
add r8, r12
mov dword [rsp + 0x88], 0
mov rcx, r14
call fcn.14007a1a0
test al, al
je 0x140079c35
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r13
mov rcx, r14
call fcn.14007b630
xor eax, eax
jmp 0x140079c14
xor eax, eax
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007a5d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor r14d, r14d
mov ecx, ntohs
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov edi, r14d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007a65d
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14007a612
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
test eax, eax
js 0x14007a700
mov ebx, r14d
cmp dword [rdi], ebx
jbe 0x14007a700
nop dword [rax]
mov eax, ebx
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rdi + 0x2e]
lea rbp, [rcx + rdi]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14007a6b5
lea rcx, [rsp + 0x28]
call fcn.1400643b0
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14007a6d5
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14007a736
lea rcx, [rsp + 0x28]
call fcn.1400641b0
inc ebx
cmp ebx, dword [rdi]
jb 0x14007a680
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rsp + 0x28]
call fcn.1400641b0
mov rax, rbx
jmp 0x14007a713
Function at 0x14007c920
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
push r15
mov eax, 0x1070
call fcn.14017ef60
sub rsp, rax
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x14007c96c
mov rdx, rbp
jmp 0x14007ca7d
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.14007b1a0
test al, al
je 0x14007c964
mov qword [rsp + 0x1068], rsi
lea rdx, [0x140d5ed60]
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r12
mov qword [rsp + 0x1050], r14
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x14007c9b0
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r12, rax
cmp bp, r14w
jae 0x14007ca52
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007ca1e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x14007ca10
cmp rdi, rax
je 0x14007ca2e
inc esi
cmp esi, r14d
jae 0x14007ca52
lea rdx, [0x140d5ed60]
jmp 0x14007c9f0
mov eax, dword [rbx + 0xc]
lea rcx, [rsp + 0x40]
mov edx, dword [rbx + 8]
add rcx, rax
je 0x14007ca52
test edx, edx
je 0x14007ca52
lea rax, [rsp + 0x40]
mov ebp, edx
sub rcx, rax
lea rdx, [rcx + r15]
jmp 0x14007ca55
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1058]
mov r14, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.14007c810
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x1070
pop r15
pop r13
pop rbp
ret
Function at 0x14007d350
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14007d47a
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14007d47a
test rax, rax
je 0x14007d47a
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x14007d3d3
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14007d485
lea rbx, [rdx + rcx]
mov ebp, dword [rax + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14007d468
nop dword [rax + rax]
mov edx, eax
cmp rdx, rbp
jae 0x14007d468
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x14007d468
lea rax, [rdx + rsi]
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r9 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14007d440
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14007d45c
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14007d990
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x14007d3f0
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14007d485
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14017e360
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140085d00
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rbp], rax
mov r14d, r9d
mov esi, r8d
mov edi, edx
mov ebx, ecx
mov dword [0x141255abc], ecx
mov dword [0x141255ab8], edx
mov dword [0x141255ac4], r8d
mov dword [0x141255ac0], r9d
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [0x140d5f4b8]
lea rcx, [rbp - 0x50]
call fcn.1400643b0
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
add r8, rdx
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14007d050
mov qword [rsp + 0x60], 0x50
xor r15d, r15d
lea rax, [0x140085f20]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x80], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea rax, [0x140d5f4a8]
mov qword [rbp - 0x60], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x58], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140085e1d
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9d, 0x96080000
lea r8, [0x140d5f4f8]
lea rdx, [0x140d5f4f8]
mov ecx, 8
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x141255ab0], rax
test rax, rax
jne 0x140085e84
lea rcx, [rbp - 0x20]
call fcn.14006c930
nop
lea rcx, [rbp - 0x50]
call fcn.1400641b0
xor eax, eax
jmp 0x140085efa
mov edx, 0xffffffec
mov r8d, 0xa8
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movdqa xmm0, xmmword [0x140d64ef0]
movdqu xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov rcx, qword [0x141255ab0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x141255ab0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x141255ab0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x141255ab0]
call qword [sym.imp.USER32.dll_BringWindowToTop]
lea rcx, [rbp - 0x20]
call fcn.14006c930
nop
lea rcx, [rbp - 0x50]
call fcn.1400641b0
mov eax, 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14017e360
add rsp, 0x118
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140086080
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140d81080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
mov ecx, 2
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14008618c
lea rdx, [0x140d5f530]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140086104
mov dword [0x141255ac8], 1
lea rdx, [0x140d5f578]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140086124
mov dword [0x141255ac8], 3
lea rdx, [0x140d5f560]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140086148
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x140086148
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [0x140d5f5a8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140086176
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x140086176
mov edi, dword [rsp + 0x28]
mov ebx, eax
mov dword [0x141255ac8], 2
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400860e4
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14017e360
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14008afb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm3, xmmword [0x140d64eb0]
mov rbx, rcx
movdqa xmm2, xmmword [0x140d625b0]
movdqa xmm0, xmmword [0x140d629b0]
movq xmm1, qword [0x140d623f0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 1
paddd xmm1, xmm3
movd eax, xmm0
movzx eax, ax
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140d62400]
paddd xmm1, xmm3
mov word [rbp - 0x20], ax
movzx eax, word [rbp - 0x1e]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140d62410]
paddd xmm1, xmm3
mov word [rbp - 0x1e], ax
movzx eax, word [rbp - 0x1c]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140d62420]
paddd xmm1, xmm3
mov word [rbp - 0x1c], ax
movzx eax, word [rbp - 0x1a]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rbp - 0x1a], ax
mov eax, 8
nop word [rax + rax]
lea ecx, [rax - 0x6e]
xor byte [rbp + rax - 0x20], cl
inc rax
cmp rax, 0xf
jb 0x14008b0d0
xor r8d, r8d
mov byte [rbp - 0x10], 0
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14006bf90
cmp rax, 0xffffffffffffffff
jne 0x14008b209
movdqa xmm0, xmmword [0x140d63700]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xe7fcd5
mov byte [rbp - 0xc], 1
call fcn.140062cb0
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14006bf90
cmp rax, 0xffffffffffffffff
jne 0x14008b209
movdqa xmm0, xmmword [0x140d64420]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xe7ddd1cd
mov dword [rbp - 0xc], 0xeaf7dfc9
mov word [rbp - 8], 0x100
call fcn.140063190
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14006bf90
cmp rax, 0xffffffffffffffff
jne 0x14008b209
movdqa xmm0, xmmword [0x140d64240]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xcae6d3cd
mov dword [rbp - 0xc], 0xebf8de
mov byte [rbp - 8], 1
call fcn.1400625b0
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14006bf90
cmp rax, 0xffffffffffffffff
jne 0x14008b209
movdqa xmm0, xmmword [0x140d63fb0]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xc6e5d1c7
mov dword [rbp - 0xc], 0xdac8d2
mov byte [rbp - 8], 1
call fcn.1400625b0
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14006bf90
cmp rax, 0xffffffffffffffff
jne 0x14008b209
mov rcx, rbx
call fcn.1400641b0
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
mov rcx, rbx
call fcn.1400641b0
mov rbx, qword [rsp + 0x58]
mov al, 1
add rsp, 0x40
pop rbp
ret
Function at 0x140099e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
mov rdx, rcx
je 0x14009a023
movdqa xmm2, xmmword [0x140d62440]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140d64ed0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140d625b0]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x18
jb 0x140099ed0
cmp rax, 0x1f
jae 0x14009a01f
lea ecx, [rax - 0x58]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x1f
jb 0x14009a010
mov byte [rdx + 0x20], 0
ret
Function at 0x14009a030
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
mov rdx, rcx
je 0x14009a1c3
movdqa xmm2, xmmword [0x140d62440]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140d64ed0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140d625b0]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x18
jb 0x14009a070
cmp rax, 0x1d
jae 0x14009a1bf
lea ecx, [rax - 0x58]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x1d
jb 0x14009a1b0
mov byte [rdx + 0x1e], 0
ret
Function at 0x14009a220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
mov rdx, rcx
je 0x14009a3b3
movdqa xmm2, xmmword [0x140d62440]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140d64ed0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140d625b0]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x20
jb 0x14009a260
cmp rax, 0x27
jae 0x14009a3af
lea ecx, [rax - 0x58]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x27
jb 0x14009a3a0
mov byte [rdx + 0x28], 0
ret
Function at 0x14009a3c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
mov rdx, rcx
je 0x14009a553
movdqa xmm2, xmmword [0x140d62440]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140d64ed0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140d625b0]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x28
jb 0x14009a400
cmp rax, 0x2e
jae 0x14009a54f
lea ecx, [rax - 0x58]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x2e
jb 0x14009a540
mov byte [rdx + 0x2f], 0
ret