joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090f60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], edx
lea rbx, [rax + 8]
cmp qword [rbx + 0x20], 0
je 0x140090fc1
mov rcx, qword [rbx + 0x18]
mov qword [rbp - 0x11], rcx
mov rax, qword [rbx + 0x28]
mov qword [rbp - 1], rax
mov rax, qword [rcx + 8]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call rax
mov rcx, qword [rbp - 1]
jmp 0x140090fcf
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
xor ecx, ecx
mov qword [rbp - 1], rcx
mov rax, qword [rbx + 0x30]
mov qword [rbp + 7], rax
movaps xmm6, xmmword [rbp - 0x39]
movdqa xmmword [rbp + 0x17], xmm6
cmp qword [rbp - 9], 0
je 0x1400910c5
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140091013
lea rcx, [0x140092f60]
mov qword [rbp - 0x39], rcx
lea rcx, [rbp + 0x17]
mov qword [rbp - 0x31], rcx
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call rax
jmp 0x14009108b
mov rbx, qword [rcx + 0x10]
lea rax, [rbp - 0x49]
mov qword [rbp + 0x27], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140091036
mov rdx, qword [rax + 8]
jmp 0x140091038
xor edx, edx
mov r8d, 0x20
call fcn.14006eb80
mov qword [rbp + 0x37], 0
movups xmmword [rax + 8], xmm6
lea rcx, [0x140093390]
mov qword [rax], rcx
mov qword [rbp - 0x39], rax
mov qword [rbp + 0x2f], 0
lea rcx, [rbp + 0x27]
call fcn.140092e00
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call rbx
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14009108b
mov rax, qword [rcx]
xor edx, edx
call rax
nop
cmp qword [rbp - 9], 0
je 0x1400910a0
mov rax, qword [rbp - 0x11]
mov rdx, qword [rax]
lea rcx, [rbp - 0x29]
call rdx
nop
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xd8]
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbp
ret
lea rcx, [rbp + 0x27]
call fcn.14005d650
nop
lea rcx, [rbp + 0x27]
call fcn.140062400
int3
Function at 0x140092a50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140092a77
add rcx, 8
call fcn.140091b50
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140092ac3
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092ab3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140092ab3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140092ace
inc ecx
inc rax
cmp rax, 6
jl 0x140092aa1
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x40]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140092af0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140092b17
add rcx, 8
call fcn.14006bb90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140092b63
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092b53
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140092b53
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140092b6e
inc ecx
inc rax
cmp rax, 6
jl 0x140092b41
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140092b90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140092bcf
lea rbx, [rax + 8]
lea rcx, [rbx + 0x18]
cmp qword [rcx + 0x20], 0
je 0x140092bbf
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax]
call rdx
nop
mov rcx, rbx
call fcn.14006bb90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140092c22
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092c12
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140092c12
mov ecx, 4
mov eax, ecx
nop dword [rax]
cmp qword [rdx + rax*8], 0
je 0x140092c2d
inc ecx
inc rax
cmp rax, 6
jl 0x140092c00
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x60]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140092ca0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8, qword [rcx]
xor esi, esi
mov qword [rcx], rsi
mov qword [rbp + 0x17], r8
movups xmm0, xmmword [rcx + 8]
movups xmmword [rbp + 0x1f], xmm0
lea rbx, [rcx + 0x18]
cmp qword [rbx + 0x20], rsi
je 0x140092de6
mov rdx, qword [rbx + 0x28]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x140092d1a
lea rcx, [0x140092c60]
mov qword [rbp + 7], rcx
lea rcx, [rbp + 0x17]
mov qword [rbp + 0xf], rcx
lea rdx, [rbp + 7]
mov rcx, rbx
call rax
jmp 0x140092db8
mov rdi, qword [rdx + 0x10]
mov qword [rbp + 0x17], rsi
mov qword [rbp - 0x19], r8
movups xmmword [rbp - 0x11], xmm0
lea rax, [rbp - 0x19]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x2f], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092d51
mov rdx, qword [rax + 8]
jmp 0x140092d54
mov rdx, rsi
mov r8d, 0x28
call fcn.14006eb80
mov qword [rbp + 0x3f], rsi
mov rcx, qword [rbp - 0x19]
mov qword [rbp - 0x19], rsi
mov qword [rax + 8], rcx
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rax + 0x10], xmm0
lea rcx, [0x140093060]
mov qword [rax], rcx
mov qword [rbp - 0x21], rax
mov qword [rbp + 0x37], rsi
lea rcx, [rbp + 0x2f]
call fcn.140092af0
nop
lea rcx, [rbp - 0x19]
call fcn.14006bb90
nop
lea rdx, [rbp - 0x21]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092db8
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea rcx, [rbp + 0x17]
call fcn.14006bb90
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140156510
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rbp + 0x2f]
call fcn.14005d650
nop
lea rcx, [rbp + 0x2f]
call fcn.140062400
int3
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x140092ca0

Function at 0x140092e00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x140092e1c
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x140092e68
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092e58
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140092e58
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140092e73
inc ecx
inc rax
cmp rax, 6
jl 0x140092e46
mov rcx, rdi
call fcn.140019930
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi + 0x20]
mov byte [rdi], al
movsxd rax, ecx
mov qword [rdx + rax*8], rdi
mov qword [rbx + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140092ea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rcx
test rbx, rbx
je 0x140092ed0
lea rcx, [rbx + 0x10]
call fcn.140155bd0
lea rcx, [rbx + 8]
call fcn.14006bb90
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140092f22
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092f12
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140092f12
mov ecx, 4
mov eax, ecx
nop word [rax + rax]
cmp qword [rdx + rax*8], 0
je 0x140092f2d
inc ecx
inc rax
cmp rax, 6
jl 0x140092f00
mov rcx, rbx
call fcn.140019930
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140093450
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8, qword [rcx]
xor esi, esi
mov qword [rcx], rsi
mov qword [rbp + 0x17], r8
movups xmm0, xmmword [rcx + 8]
movups xmmword [rbp + 0x1f], xmm0
lea rbx, [rcx + 0x18]
cmp qword [rbx + 0x20], rsi
je 0x140092de6
mov rdx, qword [rbx + 0x28]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x140092d1a
lea rcx, [0x140092c60]
mov qword [rbp + 7], rcx
lea rcx, [rbp + 0x17]
mov qword [rbp + 0xf], rcx
lea rdx, [rbp + 7]
mov rcx, rbx
call rax
jmp 0x140092db8
mov rdi, qword [rdx + 0x10]
mov qword [rbp + 0x17], rsi
mov qword [rbp - 0x19], r8
movups xmmword [rbp - 0x11], xmm0
lea rax, [rbp - 0x19]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x2f], rax
mov ecx, dword [0x140308cd0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140092d51
mov rdx, qword [rax + 8]
jmp 0x140092d54
mov rdx, rsi
mov r8d, 0x28
call fcn.14006eb80
mov qword [rbp + 0x3f], rsi
mov rcx, qword [rbp - 0x19]
mov qword [rbp - 0x19], rsi
mov qword [rax + 8], rcx
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rax + 0x10], xmm0
lea rcx, [0x140093060]
mov qword [rax], rcx
mov qword [rbp - 0x21], rax
mov qword [rbp + 0x37], rsi
lea rcx, [rbp + 0x2f]
call fcn.140092af0
nop
lea rcx, [rbp - 0x19]
call fcn.14006bb90
nop
lea rdx, [rbp - 0x21]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140092db8
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea rcx, [rbp + 0x17]
call fcn.14006bb90
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140156510
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rbp + 0x2f]
call fcn.14005d650
nop
lea rcx, [rbp + 0x2f]
call fcn.140062400
int3
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
add rsp, 0x28
jmp 0x140092ca0
Function at 0x140097140
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r14, qword [rsp + 0x1f0]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x60], rdx
movabs rax, 0xbd4c377c171862da
mov qword [rsp + 0x70], rax
mov rsi, rdx
movabs rax, 0x3555318664bd1d9a
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rcx, 0xffffffff80000001
movaps xmm0, xmmword [rsp + 0x70]
movabs rax, 0xf81e762b435e2d89
mov qword [rsp + 0x70], rax
mov rbp, r9
movabs rax, 0x3555318603d970c6
xor r15d, r15d
mov qword [rsp + 0x78], rax
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1400971fa
xorps xmm0, xmm0
lea rdx, [0x14026d781]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
xor r8d, r8d
mov qword [rsi + 0x18], r15
jmp 0x140097351
mov rax, qword [0x140308b68]
mov dword [rsp + 0x60], 0x104
test rax, rax
jne 0x1400972ec
mov rax, qword gs:[0x60]
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1a0], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x1400972b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400972b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400972b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140097290
cmp r8d, 0x57949ea7
je 0x1400972bc
test r9d, r9d
jne 0x140097270
mov rax, qword [rax]
jmp 0x140097240
mov ecx, dword [rbx + 0x24]
mov rdi, qword [rsp + 0x1a0]
add rcx, r11
movzx r10d, word [rcx + r9*2]
mov r9d, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x1d0]
add r9, r11
mov eax, dword [r9 + r10*4]
add rax, r11
mov qword [0x140308b68], rax
lea rdx, [rsp + 0x60]
mov r9d, 1
mov qword [rsp + 0x30], rdx
mov r8, r14
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rdx
mov rdx, rbp
mov qword [rsp + 0x20], r15
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x18], r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140097340
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14000bef0
mov rax, rsi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140156510
add rsp, 0x1a8
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x1400b6790
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400b6826
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400b6826
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400b684a
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x30]
call fcn.140009040
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400b6900
lea rdx, [0x1402a3ef0]
lea rcx, [rsp + 0x50]
call fcn.140158bbc
int3

Function at 0x1400b6d00
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402a7978]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1402d6f10]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1402d4ec8], ecx
jg 0x1400b6ddf
mov eax, ebx
cmp rbx, rax
jne 0x1400b6da1
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x1400b6da1
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x1402d4ec0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400b6e22
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140156510
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140009040
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b6900
lea rdx, [0x1402a3ef0]
lea rcx, [rsp + 0x40]
call fcn.140158bbc
nop
lea rcx, [0x1402d4ec8]
call fcn.1401568cc
cmp dword [0x1402d4ec8], 0xffffffff
jne 0x1400b6d4c
lea rcx, [0x1402d4ec0]
call fcn.1400b6790
lea rcx, [0x1401af3a0]
call fcn.140156e18
nop
lea rcx, [0x1402d4ec8]
call fcn.140156860
jmp 0x1400b6d4c
lea rdx, [0x1401b4940]
lea rcx, [rsp + 0x20]
call fcn.140009040
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b6900
lea rdx, [0x1402a3ef0]
lea rcx, [rsp + 0x40]
call fcn.140158bbc
int3
Function at 0x1400c89b0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x1400c89e7
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x1400c89d0
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x1400c8ae8
sub rcx, r10
cmp r9, 8
jb 0x1400c8ac0
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp r11, rax
jb 0x1400c8a40
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x1400c8ae8
add r10, r11
sub r9, r11
nop word [rax + rax]
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x1400c8ad0
test r8d, r8d
sete al
ret
Function at 0x1400c8af0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400c8c94
cmp r9, 4
jb 0x1400c8b3a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400c8b20
xor r11d, r11d
test r9, r9
je 0x1400c8c94
cmp r9, 8
jb 0x1400c8c6e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400c8b6c
cmp rdx, r8
jae 0x1400c8c6e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400c8b81
cmp rdx, r10
jae 0x1400c8c6e
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1400c8c2b
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x1400c8bc0
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1400c8c60
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x1400c8c40
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x1400c8c94
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400c8c80
add rsp, 8
ret
Function at 0x1400c8ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
test r8, r8
je 0x1400c8e02
cmp r8, 4
jb 0x1400c8ce2
mov r9, r8
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdx]
add rdx, 4
xor dword [rcx], eax
add rcx, 4
sub r9, 1
jne 0x1400c8cd0
xor r10d, r10d
test r8, r8
je 0x1400c8e02
cmp r8, 8
jb 0x1400c8de5
lea r9, [rcx - 1]
lea rax, [rdx - 1]
add r9, r8
add rax, r8
cmp rcx, rax
ja 0x1400c8d14
cmp r9, rdx
jae 0x1400c8de5
mov r9, rdx
cmp r8, 0x40
jb 0x1400c8dac
mov r11, r8
mov qword [rsp], rbx
and r11d, 0x3f
mov rbx, r8
sub rbx, r11
lea rax, [rcx + 0x10]
sub r9, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rbx
jb 0x1400c8d40
mov rbx, qword [rsp]
cmp r11, 8
jb 0x1400c8de0
jmp 0x1400c8daf
sub r9, rcx
mov r11, r8
and r11, 0xfffffffffffffff8
lea rax, [r10 + rcx]
nop word [rax + rax]
movq xmm0, qword [rax]
add r10, 8
movq xmm1, qword [r9 + rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r10, r11
jb 0x1400c8dc0
cmp r10, r8
jae 0x1400c8e02
sub rdx, rcx
lea r9, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [r9 + rdx]
xor byte [r9], al
lea r9, [r9 + 1]
sub r8, 1
jne 0x1400c8df0
add rsp, 8
ret
Function at 0x1400cfc98
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rsi, r8
mov r11, r9
movdqa xmm0, xmmword [rsi]
movdqu xmm4, xmmword [rcx]
pxor xmm0, xmm4
movd ebx, xmm0
mov eax, 0xf0f0f0f0
and eax, ebx
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
movdqa xmm5, xmmword [rsi + rdi + 0x420]
movzx edi, al
movdqa xmm4, xmmword [rsi + rdi + 0x420]
shr eax, 0x10
movzx edi, ah
movdqa xmm3, xmmword [rsi + rdi + 0x420]
movzx edi, al
movdqa xmm2, xmmword [rsi + rdi + 0x420]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x20]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x20]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x20]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x20]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x520]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x520]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x520]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x520]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x120]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x120]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x120]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x120]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x620]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x620]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x620]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x620]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x220]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x220]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x220]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x220]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x720]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x720]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x720]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x720]
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x320]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x320]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x320]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x320]
movdqa xmm0, xmm3
pslldq xmm3, 1
pxor xmm2, xmm3
movdqa xmm1, xmm2
pslldq xmm2, 1
pxor xmm5, xmm2
psrldq xmm0, 0xf
movq rdi, xmm0
movzx eax, word [r11 + rdi*2]
shl eax, 8
movdqa xmm0, xmm5
pslldq xmm5, 1
pxor xmm4, xmm5
psrldq xmm1, 0xf
movq rdi, xmm1
xor ax, word [r11 + rdi*2]
shl eax, 8
psrldq xmm0, 0xf
movq rdi, xmm0
xor ax, word [r11 + rdi*2]
movd xmm0, eax
pxor xmm0, xmm4
add rcx, 0x10
sub rdx, 1
jne 0x1400cfca6
movdqa xmmword [rsi], xmm0
pop rbx
pop rdi
pop rsi
ret