joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0790
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x14062d6e8]
movdqa xmm4, xmmword [0x140364680]
add rcx, rax
movdqa xmm5, xmmword [0x140364530]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x140364580]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1403645a0]
cmp rax, rcx
jae 0x1400f0820
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x1400f07f0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x1400f0850
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x140396618]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rax, qword [rcx + 0xab0]
mov rbx, rdx
mov edx, dword [0x14062d6e8]
movdqa xmm2, xmmword [0x1403646b0]
add rdx, rax
movdqa xmm3, xmmword [0x140364660]
movdqa xmm4, xmmword [0x1403646d0]
movdqa xmm5, xmmword [0x1403645e0]
cmp rax, rdx
jae 0x1400f08d0
nop word [rax + rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
add rax, 0x40
cmp rax, rdx
jb 0x1400f08b0
movdqa xmm0, xmmword [0x140364500]
lea rdi, [rcx + 0x980]
movdqa xmm1, xmmword [0x1403646e0]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rcx + 0xa40], xmm2
aesdec xmm3, xmm1
movdqu xmmword [rcx + 0xa50], xmm3
aesenc xmm4, xmm1
movdqu xmmword [rcx + 0xa60], xmm4
aesdec xmm5, xmm1
movdqu xmmword [rcx + 0xa70], xmm5
test rdi, rdi
je 0x1400f0976
test rbx, rbx
je 0x1400f0976
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.1400ebb70
test eax, eax
js 0x1400f0976
mov r8d, 0x100
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400ec1b0
test eax, eax
js 0x1400f0976
mov r8d, 0x20
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400ec310
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140283d00
mov rbx, qword [rsp + 0x140]
add rsp, 0x120
pop rdi
ret
Function at 0x1400f0a50
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm4, xmmword [0x14062d770]
lea rax, [rcx + 0x40]
mov ecx, dword [0x14062d6ec]
movdqa xmm5, xmmword [0x14062d780]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
lea r8d, [rcx*8 + 0x80]
movdqu xmm3, xmmword [rdx + 0x30]
add r8, rax
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14062d790]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x14062d7a0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x14062d7b0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x14062d7c0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x14062d7d0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x14062d7e0]
cmp rax, r8
jae 0x1400f0b64
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm2, xmm10
aesenc xmm3, xmm10
aesdec xmm0, xmm7
aesenc xmm1, xmm7
aesdec xmm2, xmm11
aesenc xmm3, xmm11
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, r8
jb 0x1400f0af0
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x1400f4190
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs rdi, 0xfffffffffffffff
cmp rax, rdi
je 0x1400f4398
lea r13, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, rdi
sub rax, rdx
cmp rcx, rax
ja 0x1400f4201
lea rdi, [rdx + rcx]
cmp rdi, r13
cmovb rdi, r13
mov qword [rsp + 0x98], rdi
mov rdx, rdi
call fcn.14001c5c0
mov r15, rax
mov qword [rsp + 0x38], rax
and rsi, 0xfffffffffffffff0
lea r12, [rsi + rax]
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x28
call fcn.140283d20
mov r9, rax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax]
mov dword [r9], ecx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [rsp + 0xb8]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
mov qword [r9 + 0x10], rcx
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [r9 + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x20], rax
mov qword [rsp + 0x40], r9
lea rax, [r12 + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400f43c0]
xor edx, edx
xor ecx, ecx
call fcn.140291c8c
mov qword [r12], rax
test rax, rax
je 0x1400f4384
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1400f430b
cmp rax, rcx
je 0x1400f4360
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1400f42f0
jmp 0x1400f4360
cmp rax, rbx
je 0x1400f432d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1400f4310
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x1400f4360
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rsi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x1400f4340
nop word [rax + rax]
mov r9, rdi
mov r8, r13
mov rdx, r15
mov rcx, r14
call fcn.1400eb7d0
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12 + 8], 0
mov ecx, 6
call fcn.140282540
nop
call fcn.1400135d0
int3
Function at 0x1400f4620
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.140283188
nop
lea rcx, [rsi + 0x88]
lea edx, [rbp + 2]
call fcn.1402827e0
nop
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x100], rbp
mov qword [rsi + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.140283d20
mov rdi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.140015090
nop
mov qword [rsi + 0xd8], rbx
mov rbx, qword [rsi + 0xe0]
mov qword [rsi + 0xe0], rdi
test rbx, rbx
je 0x1400f4725
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400f4725
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400f4725
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_recv
call fcn.140283d20
mov qword [rax], rsi
lea rcx, [0x1400f4c80]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x14006a000]
xor edx, edx
xor ecx, ecx
call fcn.140291c8c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f4798
cmp dword [rsi + 0xf0], 0
jne 0x1400f4792
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.14028ed68
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.140282540
int3
Function at 0x1400f6d60
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140396618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [0x140356fe0]
mov rbx, r8
mov r8, rdx
movups xmm1, xmmword [0x140356ff0]
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r9, [rbp - 0x70]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], 0
call fcn.1400f6b50
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
shr rax, 3
lea rdx, [0x140356fa0]
and eax, 0x3f
add rcx, rax
cmp rax, 0x38
jae 0x1400f6def
mov r8d, 0x38
sub r8, rax
call fcn.140286390
jmp 0x1400f6e30
mov r8d, 0x40
sub r8, rax
call fcn.140286390
lea r9, [rbp + 0x90]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.1400f5c70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsp + 0x40]
lea r9, [rbp + 0x90]
movzx eax, byte [rsp + 0x40]
lea r8, [rbp - 0x70]
mov byte [rbp - 0x79], al
lea rcx, [rsp + 0x20]
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x7a], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x7b], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x7c], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x7d], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x7e], al
mov rax, rdx
shr rdx, 0x38
mov byte [rbp - 0x80], dl
lea rdx, [rsp + 0x48]
shr rax, 0x30
mov byte [rbp - 0x7f], al
call fcn.1400f5c70
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400f5920
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140283d00
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x1400f82c0
Capabilities:
Encode data using xor

Disassembly:
test r9d, r9d
je 0x1400f83ec
mov qword [rsp + 0x20], rbx
push rdi
xor eax, eax
mov r10d, r8d
mov r11d, r9d
mov rdi, rdx
mov rbx, rcx
cmp r9d, 0x40
jb 0x1400f83be
dec r9d
mov edx, r9d
add rdx, rdi
lea r8d, [r9 + r10]
add r8, rcx
add rcx, r10
cmp rcx, rdx
ja 0x1400f8308
cmp r8, rdi
jae 0x1400f83be
mov qword [rsp + 0x10], rsi
mov esi, r11d
mov qword [rsp + 0x18], r14
and esi, 0xffffffc0
mov qword [rsp + 0x20], r15
mov r14d, 0xfffffff0
lea r9d, [r10 + 0x20]
sub r14d, r10d
mov r15d, reloc.WS2_32.dll_recv
sub r15d, r10d
movdqu xmm1, xmmword [rax + rdi]
lea ecx, [r9 - 0x20]
add eax, 0x40
movdqu xmm0, xmmword [rcx + rbx]
lea r8d, [r9 - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx + rbx], xmm1
lea ecx, [r14 + r9]
movdqu xmm0, xmmword [r8 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
mov ecx, r9d
sub ecx, r10d
pxor xmm1, xmm0
movdqu xmmword [r8 + rbx], xmm1
lea r8d, [r9 + 0x10]
movdqu xmm0, xmmword [r9 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
lea ecx, [r15 + r9]
pxor xmm1, xmm0
movdqu xmmword [r9 + rbx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [r8 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
pxor xmm1, xmm0
movdqu xmmword [r8 + rbx], xmm1
cmp eax, esi
jb 0x1400f8333
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
cmp eax, r11d
jae 0x1400f83e6
mov r8d, eax
add r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8]
lea edx, [rax + r10]
xor byte [rdx + rbx], cl
lea r8, [r8 + 1]
inc eax
cmp eax, r11d
jb 0x1400f83d0
mov rbx, qword [rsp + 0x28]
pop rdi
ret
Function at 0x1400f83f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [0x1403571d0]
mov qword [rsp + 0x28], select
mov qword [rsp + 0x20], r13
mov rbx, rcx
mov rcx, rbx
call fcn.1400f8540
mov rcx, rbx
call fcn.1400f86f0
mov rcx, rbx
call fcn.1400f8850
xor r13d, r13d
nop
mov eax, 0xcccccccd
lea r10d, [r13*4]
mul r13d
mov r8d, r13d
add r10d, r13d
shr edx, 2
inc r13d
lea eax, [rdx + rdx*4]
sub r8d, eax
lea r9d, [r8 + r8*4]
lea eax, [r9 + 2]
mov r12, qword [rbx + rax*8]
lea ecx, [r9 + 1]
mov rsi, qword [rbx + rcx*8]
lea eax, [r8 + r8*4]
mov r15, qword [rbx + rax*8]
lea r14, [rbx + rax*8]
lea eax, [r9 + 3]
not rsi
mov rdi, qword [rbx + rax*8]
and rsi, r12
imul eax, edx, 0x19
xor rsi, r15
not r12
and r12, rdi
not rdi
sub r10d, eax
lea eax, [r10 + 1]
xor r12, qword [rbx + rax*8]
lea r11, [rbx + rax*8]
lea eax, [r9 + 4]
mov r9, qword [rbx + rax*8]
lea eax, [r10 + 2]
and rdi, r9
lea r8, [rbx + rax*8]
xor rdi, qword [r8]
lea eax, [r10 + 3]
lea rdx, [rbx + rax*8]
not r9
and r9, r15
lea eax, [r10 + 4]
xor r9, qword [rdx]
not r15
and r15, qword [rbx + rcx*8]
xor r15, qword [rbx + rax*8]
mov qword [r14], rsi
mov qword [r11], r12
mov qword [r8], rdi
mov qword [rdx], r9
mov qword [rbx + rax*8], r15
cmp r13d, 5
jb 0x1400f8440
mov r13, qword [rsp + 0x20]
mov rax, qword [r13]
add r13, 8
xor qword [rbx], rax
sub qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
jne 0x1400f8424
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400f8540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140396618]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rsi, [rsp]
mov r11d, edi
mov rbx, rcx
nop word [rax + rax]
mov ecx, 4
lea rsi, [rsi + 8]
mov r10d, r11d
mov eax, 0xcccccccd
mul r11d
mov r9d, edx
shr r9d, 2
sub ecx, r9d
lea eax, [r9 + r9*4]
lea r8d, [r11 + rcx*4]
sub r10d, eax
add r8d, ecx
mov ecx, 3
sub ecx, r9d
mov rdx, qword [rbx + r8*8]
lea eax, [r11 + rcx*4]
add ecx, eax
xor rdx, qword [rbx + rcx*8]
mov ecx, 2
sub ecx, r9d
lea eax, [r11 + rcx*4]
inc r11d
add ecx, eax
lea eax, [r10 + 5]
xor rdx, qword [rbx + rcx*8]
xor rdx, qword [rbx + rax*8]
xor rdx, qword [rbx + r10*8]
mov qword [rsi - 8], rdx
cmp r11d, 5
jb 0x1400f8570
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 8]
mov r10, qword [rsp + 0x10]
mov rcx, r11
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x18]
shr rcx, 0x3f
lea rax, [r11 + r11]
xor rcx, rax
lea rax, [r10 + r10]
xor rcx, r9
mov qword [rsp + 0x28], rcx
mov rcx, r10
shr rcx, 0x3f
xor rcx, rax
lea rax, [r8 + r8]
xor rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, r8
shr rcx, 0x3f
xor rcx, rax
lea rax, [r9 + r9]
xor rcx, r11
mov qword [rsp + 0x38], rcx
mov rcx, r9
shr rcx, 0x3f
lea r9, [rsp + 0x28]
xor rcx, rax
lea rax, [rdx + rdx]
xor rcx, r10
mov qword [rsp + 0x40], rcx
mov rcx, rdx
shr rcx, 0x3f
xor rcx, rax
xor rcx, r8
mov qword [rsp + 0x48], rcx
nop dword [rax + rax]
mov r8, qword [r9]
lea r9, [r9 + 8]
mov ecx, edi
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add eax, 5
xor qword [rbx + rcx*8], r8
mov ecx, 2
sub ecx, edx
xor qword [rbx + rax*8], r8
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 3
sub ecx, edx
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 4
sub ecx, edx
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor qword [rbx + rcx*8], r8
cmp edi, 5
jb 0x1400f8670
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140283d00
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400f8a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x28
mov ebp, dword [rcx + 0xc8]
mov r12, r8
shr ebp, 3
mov rsi, rdx
cmp dword [rcx + 0xd0], 0
mov rdi, rcx
je 0x1400f8a64
mov eax, 1
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x20], r15
mov r15d, r13d
test r12, r12
je 0x1400f8bfd
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r14
nop word [rax + rax]
mov r8d, dword [rdi + 0xcc]
test r8d, r8d
jne 0x1400f8ba3
lea rax, [r15 + rbp]
mov r14d, ebp
cmp r12, rax
jb 0x1400f8ba3
mov rbx, r12
sub rbx, r15
cmp rbx, r14
jb 0x1400f8b9b
nop
mov r8d, r13d
test ebp, ebp
je 0x1400f8b84
cmp ebp, 0x40
jb 0x1400f8b5f
lea eax, [rbp - 1]
lea rdx, [rax + rdi]
add rax, rsi
cmp rdi, rax
ja 0x1400f8ae8
cmp rdx, rsi
jae 0x1400f8b5f
mov edx, ebp
and edx, 0xffffffc0
mov r9d, 0x20
mov eax, r8d
add r8d, 0x40
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
lea eax, [r9 - 0x10]
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
mov eax, r9d
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
cmp r8d, edx
jb 0x1400f8af3
cmp r8d, ebp
jae 0x1400f8b84
mov eax, r8d
mov ecx, ebp
lea rdx, [rax + rsi]
add rax, rdi
sub ecx, r8d
mov r8d, ecx
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1400f8b71
mov rcx, rdi
call fcn.1400f83f0
add rsi, r14
sub rbx, r14
cmp rbx, r14
jae 0x1400f8ac0
mov r15, r12
sub r15, rbx
jmp 0x1400f8bea
mov edx, r12d
mov ecx, ebp
sub edx, r15d
sub ecx, r8d
lea eax, [rdx + r8]
cmp eax, ebp
cmovbe ecx, edx
mov rdx, rsi
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
add r15, rbx
call fcn.1400f82c0
add dword [rdi + 0xcc], ebx
add rsi, rbx
cmp dword [rdi + 0xcc], ebp
jne 0x1400f8bea
mov rcx, rdi
call fcn.1400f83f0
mov dword [rdi + 0xcc], r13d
cmp r15, r12
jb 0x1400f8a90
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
xor eax, eax
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140107460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov ebp, edx
mov r13, rcx
call fcn.140282878
mov rbx, rax
call fcn.14028285c
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rcx, rax
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
xor r12d, r12d
mov rax, qword [r13 + 0x30]
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
jne 0x140107532
mov rcx, qword [rax + 0x28]
cmp qword [rcx + 0x10], 0
je 0x1401074e1
mov r12d, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x14010750d
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x140107508
cmp rax, qword [rcx + 0x10]
jne 0x140107508
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x1401074f5
mov rax, rcx
jmp 0x14010752c
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
jne 0x14010752c
nop dword [rax]
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140107520
cmp byte [rax + 0x19], 0
je 0x1401074d2
mov edx, r12d
mov rcx, r13
call fcn.140106ee0
mov rdi, rax
mov qword [rsp + 0x70], rax
lea rdx, [r13 + 0x18]
mov r9d, esi
mov r8d, ebp
mov rcx, rax
call fcn.1400f3ce0
mov rdx, rbx
mov ecx, r12d
call fcn.140106e50
cmp qword [r13 + 0x38], 1
jbe 0x1401076ae
mov rbx, qword [r13 + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1401076a6
lea rdx, [0x140107d20]
nop word [rax + rax]
lea rsi, [rbx + 0x20]
cmp dword [rsi], r12d
je 0x14010764f
mov rcx, rdi
call fcn.1400f4100
mov rbp, rax
mov qword [rsp + 0x88], rax
mov r14, qword [r13 + 0x48]
cmp r14, qword [r13 + 0x50]
je 0x14010761e
mov ecx, 0x20
call fcn.140283d20
mov qword [rax], rbp
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
lea rcx, [0x140107d20]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x88], rax
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140108750]
xor edx, edx
xor ecx, ecx
call fcn.140291c8c
mov qword [r14], rax
test rax, rax
je 0x1401076c8
add qword [r13 + 0x48], 0x10
jmp 0x140107643
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsi + 8]
mov r8, rdx
mov rdx, r14
lea rcx, [r13 + 0x40]
call fcn.1401084a0
lea rdx, [0x140107d20]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14010767b
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140107676
cmp rbx, qword [rax + 0x10]
jne 0x140107676
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140107663
mov rbx, rax
jmp 0x14010769c
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14010769c
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140107690
cmp byte [rbx + 0x19], 0
je 0x140107590
mov rcx, r13
call fcn.140107dd0
mov byte [r13 + 1], 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r14 + 8], 0
mov ecx, 6
call fcn.140282540
int3
Function at 0x1401081a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs rdi, 0xfffffffffffffff
cmp rax, rdi
je 0x140108399
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, rdi
sub rax, rdx
cmp rcx, rax
ja 0x140108214
lea rdi, [rdx + rcx]
cmp rdi, r8
cmovb rdi, r8
mov qword [rsp + 0x98], rdi
mov rdx, rdi
call fcn.14001c5c0
mov r15, rax
mov qword [rsp + 0x40], rax
and rsi, 0xfffffffffffffff0
lea r12, [rsi + rax]
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x18
call fcn.140283d20
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [r13]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x140108710]
xor edx, edx
xor ecx, ecx
call fcn.140291c8c
mov qword [r12], rax
test rax, rax
je 0x140108386
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x14010830b
cmp rax, rcx
je 0x140108360
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401082f0
jmp 0x140108360
cmp rax, rbx
je 0x14010832d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140108310
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x140108360
sub rsi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rsi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140108340
nop word [rax + rax]
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.1400eb7d0
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.140282540
nop
call fcn.1400135d0
int3