joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eabc0]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400eaaa0]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400eaa30]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x17737117
mov word [rbp + 0x23], 0x171
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x1400057f0
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140005821
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400ead00]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eae70]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eae20]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x2d494b2d
mov word [rbp - 0x15], 0x3b4b
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140005871
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400058a0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140003110
nop
cmp byte [0x1400ff58d], 0
je 0x1400058f5
lea r8, [0x1400ffcc0]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff58e], 0
mov byte [0x1400ff599], 0
mov byte [0x1400ff59f], 0
mov byte [0x1400ff570], 0
jmp 0x140005906
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffcc0]
call fcn.140004e40
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005945
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000593f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000593f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140005983
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000597e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000597e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400059b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ead90]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400eac70]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [str.6__6S6__6__6__]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x36525036
mov word [rbp + 0x23], 0x2050
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x140005a20
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140005a51
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eb290]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eb3e0]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eb390]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x66020066
mov word [rbp - 0x15], 0x7000
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140005aa1
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140005ad0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140003110
nop
cmp byte [0x1400ff599], 0
je 0x140005b25
lea r8, [0x1400ffcc0]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff58e], 0
mov byte [0x1400ff58d], 0
mov byte [0x1400ff59f], 0
mov byte [0x1400ff570], 0
jmp 0x140005b36
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffcc0]
call fcn.140004e40
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005b75
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140005bb3
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005bae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140005be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ead80]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400eac60]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400eac80]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x33575533
mov word [rbp + 0x23], 0x2555
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x140005c50
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140005c81
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eab40]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eaa20]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eaa80]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x12767412
mov word [rbp - 0x15], 0x474
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140005cd1
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140005d00
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140003110
nop
cmp byte [0x1400ff59f], 0
je 0x140005d55
lea r8, [0x1400ffcc0]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff58e], 0
mov byte [0x1400ff58d], 0
mov byte [0x1400ff599], 0
mov byte [0x1400ff570], 0
jmp 0x140005d66
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffcc0]
call fcn.140004e40
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005da5
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140005de3
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005dde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140005e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb250]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400eb3d0]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400eb360]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x65010365
mov word [rbp + 0x23], 0x7303
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x140005e80
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140005eb1
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eac50]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400ead50]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eadb0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x22464422
mov word [rbp - 0x15], 0x3444
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140005f01
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140005f30
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140003110
nop
cmp byte [0x1400ff570], 0
je 0x140005f85
lea r8, [0x1400ffcc0]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff58e], 0
mov byte [0x1400ff58d], 0
mov byte [0x1400ff599], 0
mov byte [0x1400ff59f], 0
jmp 0x140005f96
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffcc0]
call fcn.140004e40
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140005fd5
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140006013
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000600e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000600e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eac10]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eaaf0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eb430]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x1d0e041d
mov dword [rbp + 0x1b], 0xb1d0d7f
mov dword [rbp + 0x1f], 0xb091d7e
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x1400060b0
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400060e1
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eb3f0]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eb2d0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [str.iyiiy]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x796a6079
mov dword [rbp - 0x25], 0x6f79691b
mov dword [rbp - 0x21], 0x6f6d791a
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140006140
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006170
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140003110
nop
cmp byte [0x1400ff59e], 0
je 0x1400061b0
lea r8, [0x1400ffc78]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff571], 0
jmp 0x1400061c1
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc78]
call fcn.140004e40
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140006200
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14000623e
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006239
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006239
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb060]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eaef0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eada0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x50434950
mov dword [rbp + 0x1b], 0x46504032
mov dword [rbp + 0x1f], 0x46445033
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x1400062d0
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006301
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eb160]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eafc0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eaeb0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x594a4059
mov dword [rbp - 0x25], 0x4f59493b
mov dword [rbp - 0x21], 0x4f4d593a
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140006360
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006390
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140003110
nop
cmp byte [0x1400ff571], 0
je 0x1400063d0
lea r8, [0x1400ffc78]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.1400045c0
mov byte [0x1400ff59e], 0
jmp 0x1400063e1
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc78]
call fcn.140004e40
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140006420
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000641a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000641a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14000645e
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006459
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400067f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eaf50]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eb070]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eb050]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400eaf40]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400eb1b0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x55204523
xor eax, eax
mov byte [rbp - 5], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x53
jb 0x140006870
mov byte [rbp - 5], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400068a1
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 7]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eb040]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eb130]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eb150]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400eb030]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400eb0e0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x5c294c2a
xor eax, eax
mov byte [rbp - 5], al
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x53
jb 0x140006910
mov byte [rbp - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006940
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
cmp byte [0x1400ff59d], 0
je 0x140006979
lea r8, [0x1400ffc60]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.1400045c0
jmp 0x14000698a
lea rdx, [rbp + 7]
lea rcx, [0x1400ffc60]
call fcn.140004e40
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400069c9
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140006a07
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400070b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb2c0]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eb420]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eb410]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eb2b0]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x9687870
mov dword [rbp - 5], 0x790d6878
xor eax, eax
mov byte [rbp - 1], al
xor ebx, ebx
mov ecx, ebx
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x47
jb 0x140007120
mov byte [rbp - 1], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x48]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007151
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 7]
call fcn.140003110
nop
movdqa xmm0, xmmword [0x1400eaf10]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eb090]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eb080]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eaf00]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x20415159
mov dword [rbp - 5], 0x50244151
xor eax, eax
mov byte [rbp - 1], al
nop
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x47
jb 0x1400071b0
mov byte [rbp - 1], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400071e0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x27]
call fcn.140003110
nop
cmp byte [0x1400ff583], 0
je 0x140007219
lea r8, [0x1400ffc30]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.1400045c0
jmp 0x14000722a
lea rdx, [rbp + 7]
lea rcx, [0x1400ffc30]
call fcn.140004e40
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007269
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007263
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007263
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400072a7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c28
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c00
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret