joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f4fc
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rdx
mov rdi, rcx
mov rdx, rcx
xorps xmm0, xmm0
lea rcx, [rbp - 0x39]
movdqu xmmword [rbp - 0x29], xmm0
call fcn.14000c768
lea rcx, [rbp - 0x39]
call fcn.14001ddc0
xor r15d, r15d
test al, al
jne 0x14001f58d
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14001f561
mov rcx, qword [rdi]
inc rdx
call fcn.140003894
mov esi, 0xf
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001f586
mov rcx, qword [rbx]
inc rdx
call fcn.140003894
xor al, al
jmp 0x14001f6a7
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.140028e24
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140028e24
cmp qword [rbp - 1], 8
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
mov r8d, 1
cmovae rdx, qword [rbp - 0x19]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rbp - 1]
test eax, eax
setne r14b
cmp rdx, 8
jb 0x14001f5ee
mov rcx, qword [rbp - 0x19]
lea rdx, [rdx*2 + 2]
call fcn.140003894
mov rdx, qword [rbp + 0x1f]
mov esi, 7
mov qword [rbp - 9], r15
mov qword [rbp - 1], rsi
mov word [rbp - 0x19], r15w
cmp rdx, 8
jb 0x14001f61b
mov rcx, qword [rbp + 7]
lea rdx, [rdx*2 + 2]
call fcn.140003894
mov rdx, qword [rdi + 0x18]
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], rsi
mov word [rbp + 7], r15w
cmp rdx, 0x10
jb 0x14001f65e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14001f659
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001f6d5
mov rcx, r8
call fcn.140030aa4
mov esi, 0xf
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001f6a4
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001f69f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001f6d5
mov rcx, r8
call fcn.140030aa4
mov al, r14b
mov byte [rbx], r15b
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], r15
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140036e5c
int3

Function at 0x14001f6dc
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
cmp qword [0x140071038], 0x10
lea r8, [0x140071020]
mov edx, 1
cmovae r8, qword [0x140071020]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001f716
add rsp, 0x28
ret
xor ecx, ecx
call fcn.140037db0
int3
Function at 0x1400214b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x20]
call fcn.14000aaac
mov rdx, rax
cmp byte [rax + 0x1a], 0
je 0x1400214fa
mov ecx, 0x1b
xor byte [rax], 0x4d
inc rax
sub rcx, 1
jne 0x1400214ee
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
call fcn.14000e010
and qword [rbx + 0x10], 0
lea rdx, [0x140058a0f]
mov rcx, rbx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
call fcn.14000e010
test edi, edi
jle 0x14002159e
mov edx, dword [rsp + 0x38]
xor ecx, ecx
dec edx
call fcn.1400215f8
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cdqe
cmovae rcx, qword [rsp + 0x28]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140021589
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14002157e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140021598
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140004670
sub rdi, 1
jne 0x14002153b
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400215d7
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400215d2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400215f2
call fcn.140030aa4
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.140036e5c
int3

Function at 0x1400215f8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x13e0
call fcn.1400312a0
sub rsp, rax
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov ebx, edx
mov edi, ecx
call fcn.140030128
or ecx, 0xffffffff
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x13c4], ecx
mov r8d, 1
mov r9d, 0x270
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x44], eax
inc r8
cmp r8, r9
jb 0x140021640
sub ebx, edi
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x28], 0x20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ecx
cmp ebx, ecx
jne 0x14002168b
lea rcx, [rsp + 0x40]
call fcn.14000b974
jmp 0x140021698
lea edx, [rbx + 1]
lea rcx, [rsp + 0x20]
call fcn.14000b8d8
add eax, edi
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0x13f0]
add rsp, 0x13e0
pop rdi
ret
Function at 0x1400231a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rcx, [rbp - 0x19]
call fcn.14000ab7c
cmp byte [rax + 9], 0
je 0x1400231ef
mov rcx, rax
mov edx, 0xa
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x1400231e3
and qword [rbp - 1], 0
lea rcx, [rbp - 0x11]
mov r14d, 0xf
mov byte [rbp - 0x11], 0
mov rdx, rax
mov qword [rbp + 7], r14
call fcn.14000e010
mov r8, rbx
lea rdx, [0x140058d08]
lea rcx, [rbp + 0x2f]
call fcn.1400036c4
mov rdx, rax
lea r8, [0x140058d08]
lea rcx, [rbp + 0xf]
call fcn.140003498
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140023241
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x11]
call fcn.14000df10
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140023264
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.140003894
and qword [rbp + 0x1f], 0
mov rdx, qword [rbp + 0x47]
mov qword [rbp + 0x27], r14
mov byte [rbp + 0xf], 0
cmp rdx, 0x10
jb 0x140023287
mov rcx, qword [rbp + 0x2f]
inc rdx
call fcn.140003894
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp + 0xf]
mov byte [rbp + 0xf], 0
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x2f]
movdqu xmmword [rbp + 0x3f], xmm0
call fcn.14000c768
lea r9, [rbp + 0xf]
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0x2f]
call fcn.14000c024
mov rdx, qword [rbp + 7]
mov edi, eax
cmp rdx, 0x10
jb 0x140023308
mov rcx, qword [rbp - 0x11]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023303
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002335d
call fcn.140030aa4
and qword [rbp - 1], 0
mov rdx, qword [rbx + 0x18]
mov qword [rbp + 7], r14
mov byte [rbp - 0x11], 0
cmp rdx, 0x10
jb 0x14002332a
mov rcx, qword [rbx]
inc rdx
call fcn.140003894
and qword [rbx + 0x10], 0
mov eax, edi
mov qword [rbx + 0x18], r14
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x1400235fc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, edx
lea r8, [0x140058cf8]
mov rbx, rcx
lea rdx, [0x140071000]
lea rcx, [rsp + 0x30]
call fcn.1400035d0
mov rdx, rax
lea rcx, [rbp - 0x29]
mov r8, rbx
call fcn.140003430
mov rdx, rax
lea r8, [0x140058d08]
lea rcx, [rbp - 0x69]
call fcn.140003498
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140023679
mov rcx, qword [rbp - 0x29]
inc rdx
call fcn.140003894
mov rdx, qword [rbp - 0x71]
xor esi, esi
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x29], sil
lea r14d, [rsi + 0xf]
mov qword [rbp - 0x11], r14
cmp rdx, 0x10
jb 0x1400236a2
mov rcx, qword [rsp + 0x30]
inc rdx
call fcn.140003894
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140028e24
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
mov rdx, rbx
movdqu xmmword [rbp - 0x79], xmm0
call fcn.14000c768
lea rcx, [rsp + 0x30]
call fcn.14001ddc0
lea rcx, [rsp + 0x30]
test al, al
jne 0x14002378d
xorps xmm0, xmm0
mov rdx, rbx
movdqu xmmword [rbp - 0x79], xmm0
call fcn.14000c768
lea r8, [rsp + 0x30]
mov edx, 0x2718
mov ecx, edi
call fcn.14001f328
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x140023717
mov rcx, qword [rbp - 0x49]
lea rdx, [rdx*2 + 2]
call fcn.140003894
mov rdx, qword [rbp - 0x51]
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], si
cmp rdx, 0x10
jb 0x14002373d
mov rcx, qword [rbp - 0x69]
inc rdx
call fcn.140003894
mov rdx, qword [rbx + 0x18]
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], r14
mov byte [rbp - 0x69], sil
cmp rdx, 0x10
jb 0x14002375e
mov rcx, qword [rbx]
inc rdx
call fcn.140003894
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r14
mov byte [rbx], sil
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140031310
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rdx, [0x140058a0f]
call fcn.140005704
mov r8, rax
mov edx, 0x2717
mov ecx, edi
call fcn.14001f328
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400056e0
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14001a31c
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.140028e24
lea rcx, [rbp + 0x17]
call fcn.14000ef28
lea rcx, [rbp - 0x49]
mov rbx, rax
call fcn.14000ef28
mov r9, rax
mov dword [rsp + 0x28], esi
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call fcn.140037db0
int3
Function at 0x140024ae8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 0x59]
call fcn.140006a30
cmp byte [rax + 0x13], 0
je 0x140024b34
mov rcx, rax
mov edx, 0x14
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x140024b28
and qword [rbp + 0x1f], 0
lea rcx, [rbp + 0xf]
mov esi, 0xf
mov byte [rbp + 0xf], 0
mov rdx, rax
mov qword [rbp + 0x27], rsi
call fcn.14000e010
lea r8, [0x14006f138]
lea rdx, [0x140070db0]
lea rcx, [rbp - 0x11]
call fcn.14000356c
lea r8, [0x140058d3c]
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.1400035d0
mov rdx, rax
lea r8, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.140003430
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140024ba3
mov rcx, qword [rbp + 0x2f]
inc rdx
call fcn.140003894
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp + 0x2f]
mov byte [rbp + 0x2f], 0
movdqu xmmword [rbp + 0x3f], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x51]
movdqu xmmword [rbp - 0x41], xmm0
call fcn.14000c768
lea r9, [rbp + 0x2f]
mov r8b, 1
xor edx, edx
lea rcx, [rbp - 0x51]
call fcn.14000c024
mov rdx, qword [rbp - 0x19]
xor ebx, ebx
test eax, eax
mov r14d, 0x1000
setne bl
cmp rdx, 0x10
jb 0x140024c2f
mov rcx, qword [rbp - 0x31]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x140024c2a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024cd6
call fcn.140030aa4
and qword [rbp - 0x21], 0
mov rdx, qword [rbp + 7]
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], 0
cmp rdx, 0x10
jb 0x140024c6f
mov rcx, qword [rbp - 0x11]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x140024c6a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024cd6
call fcn.140030aa4
and qword [rbp - 1], 0
mov rdx, qword [rbp + 0x27]
mov qword [rbp + 7], rsi
mov byte [rbp - 0x11], 0
cmp rdx, 0x10
jb 0x140024caf
mov rcx, qword [rbp + 0xf]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x140024caa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024cd6
call fcn.140030aa4
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x1400254dc
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
lea r8, str._del__
lea rcx, [rbp + 0x27]
lea rdx, [0x140070bf8]
call fcn.1400035d0
mov rdx, rax
lea rcx, [rbp + 7]
mov r8, rbx
call fcn.140003430
mov rdx, rax
lea r8, [0x140058d08]
lea rcx, [rbp - 0x19]
call fcn.140003498
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140025557
mov rcx, qword [rbp + 7]
inc rdx
call fcn.140003894
mov rdx, qword [rbp + 0x3f]
xor edi, edi
mov qword [rbp + 0x17], rdi
mov byte [rbp + 7], dil
lea esi, [rdi + 0xf]
mov qword [rbp + 0x1f], rsi
cmp rdx, 0x10
jb 0x14002557e
mov rcx, qword [rbp + 0x27]
inc rdx
call fcn.140003894
xorps xmm0, xmm0
lea rcx, [rbp + 0x27]
mov rdx, rbx
movdqu xmmword [rbp + 0x37], xmm0
call fcn.14000c768
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x39]
call fcn.14001a31c
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call fcn.140028e24
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x79]
call fcn.140028e24
cmp qword [rbp - 0x41], 8
lea rax, [rbp - 0x59]
lea r9, [rbp - 0x79]
mov dword [rsp + 0x28], edi
cmovae rax, qword [rbp - 0x59]
lea r8, str.cmd.exe
cmp qword [rbp - 0x61], 8
lea rdx, str.open
mov qword [rsp + 0x20], rax
cmovae r9, qword [rbp - 0x79]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x61]
cmp rdx, 8
jb 0x14002560f
mov rcx, qword [rbp - 0x79]
lea rdx, [rdx*2 + 2]
call fcn.140003894
mov rdx, qword [rbp - 0x41]
mov qword [rbp - 0x69], rdi
mov qword [rbp - 0x61], 7
mov word [rbp - 0x79], di
cmp rdx, 8
jb 0x14002563a
mov rcx, qword [rbp - 0x59]
lea rdx, [rdx*2 + 2]
call fcn.140003894
mov rdx, qword [rbp - 0x21]
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], 7
mov word [rbp - 0x59], di
cmp rdx, 0x10
jb 0x140025660
mov rcx, qword [rbp - 0x39]
inc rdx
call fcn.140003894
mov rdx, qword [rbp - 1]
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rsi
mov byte [rbp - 0x39], dil
cmp rdx, 0x10
jb 0x140025682
mov rcx, qword [rbp - 0x19]
inc rdx
call fcn.140003894
mov rdx, qword [rbx + 0x18]
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rsi
mov byte [rbp - 0x19], dil
cmp rdx, 0x10
jb 0x1400256a3
mov rcx, qword [rbx]
inc rdx
call fcn.140003894
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rsi
mov byte [rbx], dil
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140031310
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140026d34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 0x19]
call fcn.14000a2fc
xor ebx, ebx
cmp byte [rax + 0x41], bl
je 0x140026d76
mov rcx, rax
lea edx, [rbx + 0x42]
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x140026d6a
mov rdx, rax
mov qword [rbp + 0x3f], rbx
lea rcx, [rbp + 0x2f]
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], bl
call fcn.14000e010
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov byte [rbp - 0x11], bl
movdqu xmmword [rbp - 1], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.14000c768
lea r9, [rbp - 0x11]
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0xf]
call fcn.14000c024
mov rdx, qword [rbp + 0x47]
mov ebx, eax
cmp rdx, 0x10
jb 0x140026e11
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026e0c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026e30
call fcn.140030aa4
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x140026e38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
call fcn.140026d34
cmp eax, 1
jne 0x140026e9d
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov byte [rbp - 0x11], 0
movdqu xmmword [rbp - 1], xmm0
call fcn.14000e010
lea r8, [rbp - 0x11]
mov edx, 0x274f
mov ecx, 0x66
call fcn.14001f018
xor eax, eax
jmp 0x140026fa4
lea rcx, [rbp - 0x19]
call fcn.14000b240
cmp byte [rax + 0x45], 0
je 0x140026ec0
mov rcx, rax
mov edx, 0x46
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x140026eb4
and qword [rbp + 0x3f], 0
lea rcx, [rbp + 0x2f]
mov rdx, rax
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], 0
call fcn.14000e010
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov byte [rbp - 0x11], 0
movdqu xmmword [rbp - 1], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.14000c768
lea r9, [rbp - 0x11]
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0xf]
call fcn.14000c024
movdqa xmm0, xmmword [0x140059280]
mov edi, eax
mov byte [rbp - 0x11], 0
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp - 1], xmm0
test eax, eax
jne 0x140026f53
call fcn.14000e010
mov edx, 0x2750
jmp 0x140026f5d
call fcn.14000e010
mov edx, 0x2751
lea r8, [rbp - 0x11]
mov ecx, 0x66
call fcn.14001f018
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140026fa2
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026f9d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026fc1
call fcn.140030aa4
mov eax, edi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
mov rdi, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x140027358
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 0x39]
call fcn.14000a404
cmp byte [rax + 0x4d], 0
je 0x14002739b
mov rcx, rax
mov edx, 0x4e
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x14002738f
and qword [rbp + 0x3f], 0
lea rcx, [rbp + 0x2f]
mov rdx, rax
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], 0
call fcn.14000e010
lea r8, [0x14006f158]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.14000356c
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x31]
mov byte [rbp - 0x31], 0
movdqu xmmword [rbp - 0x21], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp - 1], xmm0
call fcn.14000c768
lea r9, [rbp - 0x31]
mov r8b, 1
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.14000c024
mov rdx, qword [rbp + 0x27]
mov ebx, eax
cmp rdx, 0x10
jb 0x14002742c
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.140003894
and qword [rbp + 0x1f], 0
mov rdx, qword [rbp + 0x47]
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
cmp rdx, 0x10
jb 0x140027474
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002746f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027493
call fcn.140030aa4
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x14002749c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
call fcn.140027358
cmp eax, 1
jne 0x140027501
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov byte [rbp - 0x11], 0
movdqu xmmword [rbp - 1], xmm0
call fcn.14000e010
lea r8, [rbp - 0x11]
mov edx, 0x273b
mov ecx, 0x66
call fcn.14001f018
xor eax, eax
jmp 0x14002766c
lea rcx, [rbp - 0x39]
call fcn.140007b5c
cmp byte [rax + 0x4e], 0
je 0x140027524
mov rcx, rax
mov edx, 0x4f
xor byte [rcx], 0x4d
inc rcx
sub rdx, 1
jne 0x140027518
and qword [rbp + 0x3f], 0
lea rcx, [rbp + 0x2f]
mov rdx, rax
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], 0
call fcn.14000e010
lea r8, [0x14006f158]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
call fcn.14000356c
mov rdx, rax
lea r8, [0x140058d68]
lea rcx, [rbp + 0xf]
call fcn.140003498
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14002757e
mov rcx, qword [rbp - 0x11]
inc rdx
call fcn.140003894
movdqa xmm0, xmmword [0x140059280]
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov byte [rbp - 0x11], 0
movdqu xmmword [rbp - 1], xmm0
call fcn.14000e010
xorps xmm0, xmm0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x31]
movdqu xmmword [rbp - 0x21], xmm0
call fcn.14000c768
lea r9, [rbp - 0x11]
mov r8b, 1
xor edx, edx
lea rcx, [rbp - 0x31]
call fcn.14000c024
movdqa xmm0, xmmword [0x140059280]
mov edi, eax
mov byte [rbp - 0x11], 0
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp - 1], xmm0
test eax, eax
jne 0x1400275f4
call fcn.14000e010
mov edx, 0x273c
jmp 0x1400275fe
call fcn.14000e010
mov edx, 0x273d
lea r8, [rbp - 0x11]
mov ecx, 0x66
call fcn.14001f018
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140027622
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.140003894
and qword [rbp + 0x1f], 0
mov rdx, qword [rbp + 0x47]
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], 0
cmp rdx, 0x10
jb 0x14002766a
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027665
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027689
call fcn.140030aa4
mov eax, edi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
mov rdi, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
call fcn.140036e5c
int3
Function at 0x140029158
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ebx, ecx
lea rcx, [rbp - 0x19]
call fcn.1400096d8
cmp byte [rax + 0xd], 0
je 0x14002919e
mov rdx, rax
mov r8d, 0xe
xor byte [rdx], 0x4d
inc rdx
sub r8, 1
jne 0x140029192
and qword [rbp + 0x3f], 0
lea rcx, [rbp + 0x2f]
mov rdx, rax
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], 0
call fcn.14000e010
test ebx, ebx
jle 0x14002920f
and qword [rbp - 1], 0
lea rdx, [0x140058a0f]
lea rcx, [rbp - 0x11]
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
call fcn.14000e010
and qword [rbp + 0x1f], 0
lea rdx, [rbp + 0x2f]
and qword [rbp + 0x27], 0
lea rcx, [rbp + 0xf]
call fcn.14000c768
lea r9, [rbp - 0x11]
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0xf]
call fcn.14000c024
sub rbx, 1
jne 0x1400291bf
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140029246
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029241
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029263
call fcn.140030aa4
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.140036e5c
int3