joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400108b0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175d0
add rsp, 0x48
ret

Function at 0x140010900
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140010918
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010924
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140010920
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140010a20
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x140010a64
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175d0
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
lea r8, [0x14000e910]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140010aa5
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175d0
add rsp, 0x40
pop rbx
ret

Function at 0x140011260
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp byte [0x14003dd89], 0
mov esi, edx
mov rbx, rcx
je 0x140011286
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400112cc
cmp eax, 0x80010106
jne 0x14001132c
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400112d0
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov rdx, rax
call fcn.14000ec20
cmp al, 1
jne 0x14001131c
mov edx, esi
mov rcx, rbx
call fcn.14000f180
mov edi, eax
test eax, eax
jne 0x14001130e
mov rcx, rbx
call fcn.140010840
mov rcx, rbx
call fcn.14000eff0
mov edi, eax
jmp 0x140011320
js 0x140011320
mov rcx, rbx
call fcn.14000eff0
mov edi, eax
jmp 0x140011320
mov edi, dword [rsp + 0x40]
cmp byte [rbx + 0x62], 0
je 0x14001132c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140011480
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rbp + 0x160], rax
movups xmm0, xmmword [str.IGFXTRAYMUTEX]
mov eax, dword [0x1400291d8]
movsd xmm1, qword [0x1400291d0]
lea rcx, [rsp + 0x6c]
xor edx, edx
mov r8d, 0x1ec
mov r15d, r9d
mov ebx, 1
xor edi, edi
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov dword [rsp + 0x68], eax
call fcn.140017600
lea r8, [rsp + 0x50]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, ebx
cmp eax, 0xb7
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
cmove r14d, edi
mov r9d, 0xf003f
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400115c1
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400115c1
mov ebx, dword [rsp + 0x40]
jmp 0x140011602
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400115fe
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400115fe
mov ebx, dword [rsp + 0x40]
jmp 0x140011602
mov dword [rsp + 0x40], ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
je 0x14001163d
xor ecx, ecx
call fcn.14000e5b0
test al, al
je 0x14001163d
test ebx, ebx
je 0x14001163d
lea rcx, [0x14003dea0]
mov edx, r15d
call fcn.140011260
mov edi, eax
test rsi, rsi
je 0x14001164b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400175d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001030
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x60
xor edi, edi
mov rsi, r9
mov dword [rax + 0x10], edi
mov r14, r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov ecx, edi
mov eax, dword [rsp + 0x88]
mov qword [rsp + 0x80], rcx
cmp eax, 3
jl 0x1400010a1
mov rcx, qword [rbx + 8]
lea rdx, str._runtime
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
cmp eax, 5
jl 0x1400010bf
mov rcx, qword [rbx + 0x18]
lea rdx, str._runtime
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jne 0x140001158
movups xmm0, xmmword [str.Versions1.0Adobe_AIR.dll]
lea edx, [rcx + 0x1c]
movups xmm1, xmmword [0x140012480]
lea rcx, [rsp + 0x80]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140012490]
movups xmmword [rsp + 0x30], xmm1
movsd xmm1, qword [0x1400124a0]
movups xmmword [rsp + 0x40], xmm0
movsd qword [rsp + 0x50], xmm1
call fcn.140001e20
test eax, eax
je 0x140001124
mov eax, 4
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jne 0x140001158
lea eax, [rcx + 3]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi], rax
test rax, rax
je 0x14000110e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x80]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi]
lea rdx, str.ExtendedAppEntryWinMain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x90]
mov ecx, 4
test rax, rax
mov qword [r14], rax
cmove edi, ecx
mov eax, edi
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret

Function at 0x1400011b0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r8d, ax
lea r10, [0x140016910]
xor eax, eax
mov r9d, r8d
mov edx, eax
nop dword [rax]
mov ecx, edx
shl rcx, 5
cmp r9d, dword [rcx + r10 + 8]
je 0x1400011e4
inc edx
cmp edx, 0x11
jb 0x1400011d0
cmp edx, 0x11
jne 0x140001221
mov edx, 0x3ff
and r8w, dx
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shl rcx, 5
movzx ecx, word [rcx + r10 + 8]
and cx, dx
cmp r8w, cx
je 0x140001223
inc eax
cmp eax, 0x10
jb 0x140001200
add rsp, 0x28
ret
mov eax, edx
add rsp, 0x28
ret
Function at 0x140015b30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov r11, r11
mov eax, 0x2d2b80e9
add eax, 0x2a822514
sub eax, 0x3da2479b
add eax, 0x13f0dd3a
sub eax, 0x2dfc3b71
mov dword [rsp], 0x69eaa995
sub dword [rsp], 0x2f013605
add dword [rsp], 0x3c71d791
sub dword [rsp], 0x76f94aca
mov word [rsp + 0xc], ax
xor r9d, r9d
mov dword [rsp + 4], 0x3d0db700
xor dword [rsp + 4], 0x10553f70
xor dword [rsp + 4], 0x2684187e
add dword [rsp + 4], 0x175deaf0
sub dword [rsp + 4], 0x231c7acd
xchg rdi, rcx
mov r8, rdi
xchg rdi, rcx
mov dword [rsp + 8], 0x7e51cb68
xor dword [rsp + 8], 0x6c1b9048
sub dword [rsp + 8], 0xf4cd171
xor dword [rsp + 8], 0x28689b4
xchg r13, r9
mov qword [rsp + 0x20], r13
xchg r13, r9
xchg r9, rax
mov r9, qword [rsp + 0x20]
xchg r9, rax
xchg rsi, rcx
mov rsi, qword [rsp + 0x20]
xchg rsi, rcx
xchg r13, rax
mov r13, qword [rsp + 0x20]
xchg r13, rax
and cl, 3
mov rsp, rsp
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2]
mov eax, 0x31b78c52
add eax, 0x31c31d54
sub eax, 0x26e3017f
sub eax, 0x26be4cea
add eax, 0x1a68ba35
shr eax, cl
xchg rdi, rdi
movzx ecx, al
xchg r9, rax
mov r9, qword [rsp + 0x20]
xchg r9, rax
xor cx, dx
mov word [r8 + rax*2], cx
mov rax, qword [rsp + 0x20]
xchg r15, r15
inc rax
xchg r11, rax
mov qword [rsp + 0x20], r11
xchg r11, rax
mov rax, qword [rsp + 0x20]
cmp rax, 7
mov dword [rsp - 0x38], 0x38f9151c
jb 0x140015bd9
mov word [r8 + 0xe], r9w
mov rax, r8
xchg r8, r8
nop
sub rsp, 0x5b3bebd6
add rsp, 0x5b3bebee
ret
Function at 0x140016708
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
xchg r14, r14
xchg rbp, rsi
mov qword [rax + 0x10], rsi
xchg rsi, rbp
xchg rsi, rsp
mov qword [rax + 0x18], rsp
xchg rsi, rsp
nop
push r15
mov qword [rsp], rdi
neg rsp
sub rsp, 0xfffffffffffffd20
neg rsp
xor ebx, ebx
lea r9, [rax - 0x228]
xchg r9, rsi
mov r9, rdx
xchg r9, rsi
mov qword [rsp + 0x28], rbx
or rbp, 0xffffffffffffffff
xchg rdi, rdi
mov qword [rsp + 0x20], 0x3c14d45d
sub qword [rsp + 0x20], 0x196318f9
add qword [rsp + 0x20], 0x24b0f4ed
sub qword [rsp + 0x20], 0x4762ae39
lea rdx, [0x140000000]
mov rcx, rbp
xchg r11, r11
lea r8d, [rbx + 2]
call fcn.14005bb20
test eax, eax
xchg r8, r8
js 0x140016904
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0xd0]
mov rcx, rcx
call fcn.140093120
xchg r13, rax
mov rdi, r13
xchg r13, rax
test rax, rax
je 0x140016904
lea edx, [rbx + 0x2e]
mov dword [rsp - 0x28], 0x3b393e00
lea rcx, [rsp + 0xd0]
call fcn.140093120
test rax, rax
mov r8, r8
je 0x1400167e7
mov word [rax], bx
lea rcx, [rsp + 0x30]
call fcn.140015b30
mov dword [rsp - 0x3c], 0x752c90d6
lea r8, [rdi + 2]
xchg rdx, r13
mov r13, rax
xchg rdx, r13
lea rcx, [rsp + 0x40]
mov rcx, rcx
call fcn.140015dd8
xor eax, eax
lea rdi, [rsp + 0x30]
xchg r11, r11
xorps xmm0, xmm0
lea ecx, [rax + 7]
rep stosb byte [rdi], al
lea rax, [rsi + 8]
mov r12, r12
xchg rbx, rax
mov qword [rsi], rbx
xchg rbx, rax
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rax
xchg r10, rax
movups xmmword [r10 + 0x20], xmm0
xchg r10, rax
lea rax, [rsp + 0x40]
xchg r15, r15
inc rbp
cmp word [rax + rbp*2], bx
jne 0x140016855
xchg rbp, rcx
mov rdx, rcx
xchg rbp, rcx
xchg rsp, rbp
mov qword [rsi + 0x38], rsp
xchg rsp, rbp
mov rcx, rsi
call fcn.14001664c
mov edx, 0x7996ee6a
sub edx, 0x9bd0705
xor edx, 0x5bf276bb
sub edx, 0x3e97c6c
cmp qword [rsi + 0x38], rbx
jbe 0x140016928
mov dword [rsp - 0x2c], 0x4b8a3cd0
lea rdi, [rsp + 0x40]
sub rdi, rax
movzx ecx, dx
mov r8d, 0x4b3b878e
sub r8d, 0x3637d2f3
add r8d, 0x2f8011a
add r8d, 0x3a73864f
sub r8d, 0x526f3b05
and cx, r8w
ror edx, 7
ror edx, 1
xor cx, word [rdi + rax]
inc rbx
xchg r9, r9
mov word [rax], cx
lea rax, [rax + 2]
cmp rbx, qword [rsi + 0x38]
mov dword [rsp - 0x28], 0x1bdd29a
jb 0x1400168ae
jmp 0x140016928
lea rax, [rsi + 8]
xchg rbx, rbx
xorps xmm0, xmm0
mov qword [rsi], rax
movups xmmword [rax], xmm0
mov dword [rsp - 0x24], 0x7c540753
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rsi + 0x38], rbx
lea r11, [rsp + 0x2e0]
mov r15, r15
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg r10, rbx
mov r10, qword [r11 + 0x10]
xchg rbx, r10
xchg rbp, rcx
mov rcx, qword [r11 + 0x18]
xchg rcx, rbp
mov rsi, qword [r11 + 0x20]
xchg rbx, rbx
xchg r11, r14
mov rsp, r14
xchg r11, r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140027920
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg r11, rbp
mov qword [rsp + 0x10], r11
xchg r11, rbp
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg r9, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
mov rsi, rcx
mov dword [rsp - 0x18], esp
xchg rdi, r11
mov r11, rdx
xchg r11, rdi
nop
add rcx, 0x7e681df6
sub rcx, 0x7e681dee
xor edx, edx
xchg rcx, rcx
mov r8d, 0x135bdca0
xor r8d, 0x706794c4
sub r8d, 0x5223a114
add r8d, 0x6e20b3c2
sub r8d, 0x7f395a92
xchg rsp, rcx
mov qword [rsi], rsp
xchg rcx, rsp
call fcn.140092630
mov rbx, qword [rdi + 0x38]
lea rax, [rsp + 0x28]
mov r9, r9
mov rbp, qword [rdi]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm0
xchg r11, rax
mov qword [rsp + 0x20], r11
xchg r11, rax
xchg rsi, rsp
movups xmmword [rsi + 0x28], xmm0
xchg rsi, rsp
lea rdx, [rbx + 1]
mov r9, r9
xchg rsp, r9
movups xmmword [r9 + 0x38], xmm0
xchg rsp, r9
movups xmmword [rsp + 0x48], xmm0
call fcn.14001664c
xor r10d, r10d
mov dword [rsp - 0x38], 0x343bcc71
mov edi, 0x5b97df96
xor edi, 0xe9bbf3a
add edi, 0x1084fa52
sub edi, 0x354f458c
test rbx, rbx
je 0x140027a6f
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
sub rbp, rax
mov r14, r14
mov r8, rbx
movzx ecx, di
mov r9d, 0x4fbb9d20
sub r9d, 0x35c6247c
add r9d, 0x1436c2c7
xor r9d, 0x567fb9ac
xor r9d, 0x78538238
and cx, r9w
ror edi, 4
ror edi, 1
ror edi, 1
ror edi, 1
ror edi, 1
xor cx, word [rdx + rbp]
mov word [rdx], cx
lea rdx, [rdx + 2]
xchg r12, r12
sub r8, 1
jne 0x140027a23
mov word [rax + rbx*2], r10w
xchg rcx, r8
mov rcx, rbx
xchg rcx, r8
mov rdx, qword [rsp + 0x20]
mov dword [rsp - 0x30], edi
xchg rdx, rsi
mov rcx, rdx
xchg rdx, rsi
call fcn.14007d750
mov dword [rsp - 0x18], esi
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
lea rax, [rsp + 0x28]
mov rcx, rcx
cmp rcx, rax
jne 0x140027acb
xor eax, eax
mov r10, r10
lea rdi, [rsp + 0x28]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
mov rsp, rsp
jmp 0x140027ad0
call fcn.1400920d0
lea r11, [rsp + 0x60]
mov dword [rsp - 0x34], ebp
xchg r9, rax
mov r9, rsi
xchg r9, rax
xchg r12, rbx
mov r12, qword [r11 + 0x10]
xchg rbx, r12
xchg rbp, rsp
mov rsp, qword [r11 + 0x18]
xchg rsp, rbp
xchg r9, rsi
mov r9, qword [r11 + 0x20]
xchg rsi, r9
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14003d2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov dword [rcx + 8], 0x3e809075
add dword [rcx + 8], 0x32105f51
xor dword [rcx + 8], 0x7090efc7
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x1400028e8]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.14001664c
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x14003d35c
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x14003d342
mov ecx, dword [rsi + 0x40]
mov edx, 0x6d3f448f
xor edx, 0x261c6828
add edx, 0x10fea3dc
sub edx, 0x1dd9bfbc
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x49afe6b2
xor r15d, 0x39b4e433
xor r15d, 0x1547954b
xor r15d, 0x3299a0a2
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x21a2f266
add edx, 0x10d679e3
add edx, 0x1ec7df9c
sub edx, 0x51414bd5
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
add r14, 0xffff
mov rcx, r14
shl rcx, 4
call fcn.140092000
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x1400f0460]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x14003d444
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x1400f0460]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x14003d466
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.140020210
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop
add rsp, 0x23b6dc59
sub rsp, 0x23b6dc29
pop r15
pop r14
pop rdi
ret
Function at 0x14003eee4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x2e671f19
xor r10d, 0x546d0249
sub r10d, 0x3bc20c89
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x57c53768
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x14003ef7a
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400f0460]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x14003ef3e
mov eax, r9d
ret

Function at 0x14003f078
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x55c992d8
xor r10d, 0x49bc45e2
xor r10d, 0x184dcaa1
xor r10d, 0x3a700d5c
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x57c53768
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x14003f11d
mov r10, qword [rcx + 0x300]
movzx eax, ax
sub rdx, 0xfffffffffffffffe
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400f0460]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x14003f0de
mov eax, r9d
ret

Function at 0x14003f124
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
add rsp, 0xffffffffffffff60
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x14003f1b7
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x6aa20f94
sub ecx, 0x40de69a5
add ecx, 0x14846ad8
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140091f90
test rsi, rsi
jle 0x14003f1d4
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x3db36469
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x14003f193
jmp 0x14003f1d4
lea rdx, [rsp + 0xb0]
call fcn.14003f330
test al, al
je 0x14003f21f
mov rax, qword [rsp + 0xb0]
lea rcx, [0x1400029e8]
mov qword [rsp + 0x98], 0x3290225
xor qword [rsp + 0x98], 0x637e0431
xor qword [rsp + 0x98], 0x6057060c
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.14003e310
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140048c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x3ac1503d
add rsp, 0x3ac14fdd
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14001664c
mov edi, 0x2b239167
add edi, 0x289ae8e5
xor edi, 0x63fc6f3e
mov r9, rax
mov ecx, edi
mov r15d, 0x207a00aa
add r15d, 0x1c2d840a
xor r15d, 0x318a3686
sub r15d, 0xd2db133
test rbp, rbp
je 0x140048ce1
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x140048cc0
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x140048d2c
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x140048d2c
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x140048d0c
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff6ae43c28
xor rdx, 0x1fccc1c
add rdx, 0x7fffffff
add rdx, 0x14e70fcc
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x140048d69
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14001664c
cmp qword [r14 + 0x38], rbx
jbe 0x140048db5
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x140048d91
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140048ded
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x591c8a81
xor ecx, 0x5aa5b6b5
xor ecx, 0x2df7a8cc
sub ecx, 0x2e4e94c8
rep stosb byte [rdi], al
jmp 0x140048df2
call fcn.1400920d0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret