joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007acc0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
jne 0x14007adba
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14007ad40
test bl, bl
je 0x14007ad13
cmp byte [rdi + 8], 0
jne 0x14007ade4
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
jne 0x14007adc8
mov rcx, qword [rdi]
call fcn.1400ccdf0
mov rcx, qword [0x14016a208]
mov dil, 1
test rcx, rcx
je 0x14007ada3
mov edx, eax
mov r8d, esi
call fcn.1400cb940
jmp 0x14007ada3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
jne 0x14007add6
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14007ad66
xor edi, edi
jmp 0x14007ada3
cmp byte [rdi + 8], 0
jne 0x14007adf2
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14007ad86
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
jne 0x14007ae00
mov rcx, qword [rdi]
call fcn.1400ccdf0
mov rcx, qword [0x14016a208]
test rcx, rcx
jne 0x14007ae0b
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f0560
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007aceb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ad20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ad53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ad08
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ad73
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14007ad8f
mov edx, eax
mov r8d, esi
call fcn.1400cb940
jmp 0x14007ada0
Function at 0x14007af30
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x14007b06f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x14007afdc
call fcn.140063690
mov r15, rax
mov r14, qword [rsp + 0x58]
mov r12, qword [rsi]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14007b03f
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, r12
mov r8, rsi
mov r9, r14
call qword [rax + 0x10]
mov r14, qword [rsi]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14007b050
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14007b016
mov qword [rsi], rdi
call fcn.140063690
mov r15, rax
mov r14, qword [rsp + 0x58]
mov rcx, qword [0x14016a370]
test rcx, rcx
je 0x14007b061
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8, rsi
mov r9, r14
call qword [rax + 8]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x14007b073
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14007afa6
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14007afcd
call fcn.1400dae20
mov rcx, qword [0x14016a370]
jmp 0x14007b002
mov byte [rsi + 8], 1
int3

Function at 0x14007b8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x30], r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, 4
lea r15, [rsp + 0x44]
mov dword [r15], eax
lea rbp, [rsp + 0x40]
mov dword [rbp], eax
lea r14, [rsp + 0x3c]
mov dword [r14], 0
mov rbx, qword [rcx]
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov r9d, 0x199
call fcn.140063670
lea r13, [rsp + 0x68]
mov rcx, r13
mov rdx, rdi
mov r8, rbx
mov r9d, 1
call fcn.140032e00
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
mov rdx, r12
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, r13
call fcn.140032c30
test edi, edi
jne 0x14007b9a7
mov eax, dword [rsp + 0x44]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14007b9a7
cmp dword [rsp + 0x40], 4
jne 0x14007b9a7
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
xor edi, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f0560
mov eax, edi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007b9d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1048
call fcn.1400f04f0
sub rsp, rax
mov r14, r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r15, [rsp + 0x3c]
mov dword [r15], 1
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x800
mov rbx, qword [rcx]
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rdi, [rsp + 0x840]
mov rcx, rdi
mov r9d, 0x199
call fcn.140063670
lea r13, [rsp + 0x40]
mov rcx, r13
mov rdx, rdi
mov r8, rbx
mov r9d, 1
call fcn.140032e00
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
mov rdx, r12
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, r13
call fcn.140032c30
test edi, edi
jne 0x14007baa1
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14007bac7
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.14005b33c
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400f0560
mov eax, edi
add rsp, 0x1048
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 2
jne 0x14007bb00
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x14007baf9
lea rdx, [rsp + 0x40]
jmp 0x14007ba97
mov edi, 0xea
jmp 0x14007baa1
mov edi, 0x3f4
jmp 0x14007baa1
Function at 0x14007c380
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140169da0]
mov ecx, dword [0x1401653f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007c40f
movzx eax, word [0x140169d70]
cmp ax, 9
jne 0x14007c3dc
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f0560
mov eax, esi
add rsp, 0x60
pop rsi
ret
cmp ax, 5
jg 0x14007c3fc
test ax, ax
je 0x14007c471
cmp ax, 5
jne 0x14007c482
mov esi, 3
jmp 0x14007c3c7
cmp ax, 6
je 0x14007c478
cmp ax, 0xc
jne 0x14007c482
mov esi, 4
jmp 0x14007c3c7
lea rcx, [0x140169da0]
call fcn.1400ef8f0
cmp dword [0x140169da0], 0xffffffff
jne 0x14007c3b5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140169d90], xmm2
movups xmmword [0x140169d80], xmm1
movups xmmword [0x140169d70], xmm0
lea rcx, [0x140169da0]
call fcn.1400ef988
jmp 0x14007c3b5
xor esi, esi
jmp 0x14007c3c7
mov esi, 2
jmp 0x14007c3c7
mov esi, 5
jmp 0x14007c3c7
Function at 0x14007d3b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14007d3ec
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14007d3f6
add rdi, rbx
sub rsi, rbx
jne 0x14007d3ca
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x14007d9e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140169dc8]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14007da37
jnp 0x14007da9c
ucomisd xmm0, xmm6
jne 0x14007da3f
jnp 0x14007da98
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x140135630]
subpd xmm1, xmmword [0x140135640]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x140137090]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f0560
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor eax, eax
jmp 0x14007da71
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140169dd8]
mov ecx, dword [0x1401653f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007dbd6
mov eax, dword [0x140169de8]
mov ecx, dword [0x1401653f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007dc10
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x140169de0]
movq xmm0, rbp
punpckldq xmm0, xmmword [0x140135630]
subpd xmm0, xmmword [0x140135640]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x140137088]
ucomisd xmm2, xmm1
ja 0x14007da37
shl r15, 0x20
or r14, r15
sub r14, qword [0x140169dd0]
movq xmm2, r14
punpckldq xmm2, xmmword [0x140135630]
subpd xmm2, xmmword [0x140135640]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x140169dc8], xmm0
jmp 0x14007da37
lea rcx, [0x140169dd8]
call fcn.1400ef8f0
cmp dword [0x140169dd8], 0xffffffff
jne 0x14007dae6
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140169dd0], rdx
lea rcx, [0x140169dd8]
call fcn.1400ef988
jmp 0x14007dae6
lea rcx, [0x140169de8]
call fcn.1400ef8f0
cmp dword [0x140169de8], 0xffffffff
jne 0x14007db0b
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140169de0], rax
lea rcx, [0x140169de8]
call fcn.1400ef988
jmp 0x14007db0b
Function at 0x14007f44e
Capabilities:
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov eax, dword [0x140169e0c]
mov ecx, dword [0x1401653f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f4b6
mov bl, byte [0x140169e08]
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400f0560
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140169e0c]
call fcn.1400ef8f0
cmp dword [0x140169e0c], 0xffffffff
jne 0x14007f48f
movabs rbx, 0x7fffffffffffffef
lea rsi, [rsp + 0x40]
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov rcx, rsi
call fcn.14010e320
cmp rax, rbx
ja 0x14007f5c8
mov rsi, rax
cmp rax, 0xb
jb 0x14007f5b5
lea rdi, [rsi + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1400ef770
mov r15, rax
lea r14, [rsp + 0x20]
mov qword [r14], rax
add rbx, 0x11
or rbx, rdi
mov qword [r14 + 0x10], rbx
mov qword [r14 + 8], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1400f23d0
mov word [r15 + rsi*2], 0
lea rdx, str.usp10.dll
lea rcx, [rsp + 0x20]
call fcn.14005b0d0
xor edi, edi
cmp byte [rax + 0x17], dil
jns 0x14007f57d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [r14 + 0x17], dil
js 0x14007f5a9
cmp esi, 0xffffffff
setne byte [0x140169e08]
lea rcx, [0x140169e0c]
call fcn.1400ef988
jmp 0x14007f48f
mov rcx, qword [rsp + 0x20]
call fcn.1400ef7cc
jmp 0x14007f58e
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], sil
mov r15, r14
test rsi, rsi
jne 0x14007f547
jmp 0x14007f55a
lea rcx, [rsp + 0x20]
call fcn.14005994c
int3
Function at 0x14008cd00
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea rdi, [rsp + 0xc0]
mov edx, 0x20
mov rcx, r8
mov r8, rdi
call fcn.1400ac5b0
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rdi
call fcn.14008aa90
mov rcx, r14
mov rdx, r15
call fcn.14008cf10
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1400f0560
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14008cdb0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rbx, r9
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea r14, [rsp + 0x220]
mov edx, 0x20
mov rcx, r9
mov r8, r14
call fcn.1400ac5b0
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea rdi, [rsp + 0x148]
mov rcx, rdi
call fcn.1400bdab0
lea rdx, [rsp + 0x240]
mov r8d, 0x20
mov rcx, rdi
call fcn.1400bdb00
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400bdb00
lea r13, [rsp + 0x100]
mov rcx, r13
mov rdx, rdi
call fcn.1400bdc10
mov rcx, r13
call fcn.14008bf70
lea rbp, [rsp + 0x60]
mov rcx, rbp
mov rdx, r13
call fcn.14008aa90
mov rcx, rsi
mov rdx, rbp
call fcn.14008cf10
mov rcx, rdi
call fcn.1400bdab0
mov r8d, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.1400bdb00
lea rdx, [rbx + 0x20]
mov r8d, 0x20
mov rcx, rdi
call fcn.1400bdb00
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.1400bdb00
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rdi
call fcn.1400bdc10
mov rcx, rbx
call fcn.14008bf70
add rsi, 0x20
mov rcx, rsi
mov rdx, rbx
mov r8, r14
mov r9, r13
call fcn.14008cfd0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400f0560
mov eax, 1
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140090800
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov r14, rcx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0x160], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rsp + 0x140]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
and byte [rdx], 0xf8
mov al, byte [rdx + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdx + 0x1f], al
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.14008aa90
mov rax, qword [rbx + 0x50]
mov r13, qword [rbx + 0x28]
mov r8, qword [rbx + 0x30]
lea r9, [rax + r13]
mov rbp, qword [rbx + 0x58]
lea r10, [r8 + rbp]
mov rsi, qword [rbx + 0x60]
mov r11, qword [rbx + 0x38]
lea r12, [r11 + rsi]
mov rdi, qword [rbx + 0x68]
lea r15, [rsp + 0x78]
mov qword [r15], r9
mov r9, qword [rbx + 0x40]
mov qword [r15 + 8], r10
lea rdx, [r9 + rdi]
mov qword [r15 + 0x10], r12
mov rcx, qword [rbx + 0x70]
mov rbx, qword [rbx + 0x48]
mov qword [r15 + 0x18], rdx
lea rdx, [rbx + rcx]
mov qword [r15 + 0x20], rdx
movabs rdx, 0xffffffffffffe
add rax, rdx
sub rax, r13
add rbp, rdx
sub rbp, r8
add rsi, rdx
sub rsi, r11
add rdi, rdx
sub rdi, r9
add rcx, rdx
add rax, 0xffffffffffffffdc
sub rcx, rbx
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], rbp
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rdi
mov qword [rdx + 0x20], rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.140090980
mov rcx, rbx
mov rdx, r15
mov r8, rbx
call fcn.140098310
mov rcx, r14
mov rdx, rbx
call fcn.140098730
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400f0560
nop
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009f180
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs r10, 0x8000000000000000
cmp rdx, r9
mov r11, r9
cmovb r11, rdx
xor eax, eax
test r11, r11
je 0x14009f1fe
xor esi, esi
mov r14, qword [r8 + rsi*8]
mov r15, qword [rcx + rsi*8]
mov r12, r15
xor r12, r14
mov r13d, eax
lea rax, [r12 - 1]
mov rdi, r15
sub rdi, r14
xor rdi, r15
or rdi, r12
xor r12, r10
and rax, r12
sar rax, 0x3f
xor rdi, r15
sar rdi, 0x3f
mov rbx, rdi
not rdi
and edi, 1
or rdi, rbx
mov rbx, rax
and r13d, ebx
not rax
and rax, rdi
or rax, r13
inc rsi
cmp r11, rsi
jne 0x14009f1a8
mov r11, rdx
sub r11, r9
jb 0x14009f214
ja 0x14009f258
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r8 + rdx*8]
lea rbx, [rdx + 1]
cmp rbx, r9
je 0x14009f22f
or rcx, qword [r8 + rdx*8 + 8]
add rdx, 2
cmp rdx, r9
jne 0x14009f24a
xor r10, rcx
dec rcx
and rcx, r10
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x14009f208
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
je 0x14009f22f
jmp 0x14009f24a
mov rsi, r9
not rsi
add rsi, rdx
mov r8d, r11d
and r8d, 7
mov edx, 7
cmp rsi, rdx
jae 0x14009f276
xor edx, edx
jmp 0x14009f2b4
and r11, 0xfffffffffffffff8
neg r11
xor edx, edx
mov esi, 8
or rdx, qword [rcx + r9*8]
or rdx, qword [rcx + r9*8 + 8]
or rdx, qword [rcx + r9*8 + 0x10]
or rdx, qword [rcx + r9*8 + 0x18]
or rdx, qword [rcx + r9*8 + 0x20]
or rdx, qword [rcx + r9*8 + 0x28]
or rdx, qword [rcx + r9*8 + 0x30]
or rdx, qword [rcx + r9*8 + 0x38]
add r9, 8
add r11, rsi
jne 0x14009f284
test r8, r8
je 0x14009f2cb
lea rcx, [rcx + r9*8]
xor ebx, ebx
or rdx, qword [rcx + rbx*8]
inc rbx
cmp r8, rbx
jne 0x14009f2bf
xor r10, rdx
dec rdx
and rdx, r10
sar rdx, 0x3f
mov rcx, rdx
and ecx, eax
not rdx
and edx, 1
or edx, ecx
mov eax, edx
jmp 0x14009f208
Function at 0x14009f4c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
movsxd r10, dword [rcx + 8]
movsxd r9, dword [rdx + 8]
cmp r10d, r9d
jge 0x14009f4fd
mov rax, qword [rdx]
mov r11d, r9d
sub r11d, r10d
mov rbx, r10
not rbx
add rbx, r9
and r11d, 7
cmp rbx, 7
jae 0x14009f60e
xor r8d, r8d
mov rsi, r10
jmp 0x14009f656
xor r8d, r8d
cmp r9d, r10d
jge 0x14009f562
mov r11, qword [rcx]
mov edi, r10d
sub edi, r9d
mov rsi, r9
not rsi
add rsi, r10
mov rax, r9
and rdi, 7
je 0x14009f52c
or r8, qword [r11 + rax*8]
inc rax
dec rdi
jne 0x14009f520
cmp rsi, 7
jb 0x14009f562
or r8, qword [r11 + rax*8]
or r8, qword [r11 + rax*8 + 8]
or r8, qword [r11 + rax*8 + 0x10]
or r8, qword [r11 + rax*8 + 0x18]
or r8, qword [r11 + rax*8 + 0x20]
or r8, qword [r11 + rax*8 + 0x28]
or r8, qword [r11 + rax*8 + 0x30]
or r8, qword [r11 + rax*8 + 0x38]
add rax, 8
cmp r10, rax
jne 0x14009f532
cmp r10d, r9d
cmovl r9d, r10d
test r9d, r9d
jle 0x14009f5f7
mov r10, qword [rcx]
mov r11, qword [rdx]
mov r14d, r9d
lea rax, [r14 - 1]
mov r9d, r14d
and r9d, 3
mov edi, 3
cmp rax, rdi
jae 0x14009f594
xor eax, eax
jmp 0x14009f5d5
and r14d, 0xfffffffc
xor eax, eax
mov rdi, qword [r11 + rax*8]
mov rbx, qword [r11 + rax*8 + 8]
xor rdi, qword [r10 + rax*8]
xor rbx, qword [r10 + rax*8 + 8]
or rdi, r8
mov rsi, qword [r11 + rax*8 + 0x10]
xor rsi, qword [r10 + rax*8 + 0x10]
or rsi, rbx
mov r8, qword [r11 + rax*8 + 0x18]
xor r8, qword [r10 + rax*8 + 0x18]
or rsi, rdi
or r8, rsi
add rax, 4
cmp r14, rax
jne 0x14009f59a
test r9, r9
je 0x14009f5f7
lea rbx, [r11 + rax*8]
lea rax, [r10 + rax*8]
xor edi, edi
mov rsi, qword [rbx + rdi*8]
xor rsi, qword [rax + rdi*8]
or r8, rsi
inc rdi
cmp r9, rdi
jne 0x14009f5e4
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, r9
sub rdi, r10
and rdi, 0xfffffffffffffff8
neg rdi
xor r8d, r8d
mov ebx, 8
mov rsi, r10
or r8, qword [rax + rsi*8]
or r8, qword [rax + rsi*8 + 8]
or r8, qword [rax + rsi*8 + 0x10]
or r8, qword [rax + rsi*8 + 0x18]
or r8, qword [rax + rsi*8 + 0x20]
or r8, qword [rax + rsi*8 + 0x28]
or r8, qword [rax + rsi*8 + 0x30]
or r8, qword [rax + rsi*8 + 0x38]
add rsi, 8
add rdi, rbx
jne 0x14009f626
test r11, r11
je 0x14009f500
lea rax, [rax + rsi*8]
xor esi, esi
or r8, qword [rax + rsi*8]
inc rsi
cmp r11, rsi
jne 0x14009f665
jmp 0x14009f500