joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2160
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
lea rbx, [0x14024c050]
movsxd r10, edx
mov r13, rcx
shl r10, 5
mov r15d, 1
mov qword [rsp + 0x38], r9
mov rdx, qword [rax + 0x20]
mov qword [rsp + 0x40], r8
mov rsi, qword [r10 + rdx]
nop dword [rax]
mov r9d, r15d
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x48]
mov ecx, 0x18
call fcn.140061db0
mov rbp, qword [r13]
xor r11d, r11d
xor edi, edi
mov r14d, dword [rbp + 0x28]
test r14d, r14d
jle 0x1400d2392
movzx r12d, byte [rsp + 0x48]
nop word [rax + rax]
mov r10d, edi
xor r10d, 1
cmp edi, 2
cmovae r10d, edi
test rsi, rsi
je 0x1400d226b
mov rax, qword [rbp + 0x20]
mov ecx, r10d
shl rcx, 5
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x1400d2357
movzx r8d, byte [rsi]
test r8b, r8b
je 0x1400d2254
mov r9, rsi
movzx ecx, r8b
sub r9, rdx
nop
movzx eax, byte [rdx]
movzx r8d, cl
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x1400d2254
movzx ecx, byte [r9 + rdx + 1]
inc rdx
movzx r8d, cl
test cl, cl
jne 0x1400d2230
movzx eax, byte [rdx]
movzx edx, byte [rax + rbx]
movzx eax, r8b
movzx ecx, byte [rax + rbx]
cmp ecx, edx
jne 0x1400d2357
mov rax, qword [rbp + 0x20]
mov ecx, r10d
shl rcx, 5
mov r9, qword [rcx + rax + 0x18]
mov r10, qword [r9 + 0x18]
test r10, r10
je 0x1400d22c8
xor eax, eax
lea r8, [rsp + 0x48]
movzx ecx, r12b
test r12b, r12b
je 0x1400d22b2
movzx ecx, cl
lea r8, [r8 + 1]
movzx edx, byte [rcx + rbx]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x1400d2294
xor edx, edx
div dword [r9 + 8]
mov ecx, edx
add rcx, rcx
mov r11, qword [r10 + rcx*8 + 8]
mov ebx, dword [r10 + rcx*8]
jmp 0x1400d22d0
mov r11, qword [r9 + 0x10]
mov ebx, dword [r9 + 0xc]
test ebx, ebx
je 0x1400d234d
mov r10, qword [r11 + 0x18]
dec ebx
test r10, r10
je 0x1400d2346
movzx r9d, byte [r10]
lea r8, [rsp + 0x48]
test r9b, r9b
je 0x1400d232b
lea rcx, [rsp + 0x48]
movzx eax, r9b
sub r10, rcx
lea r14, [0x14024c050]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r14]
cmp byte [rcx + r14], al
jne 0x1400d2327
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x1400d2300
mov r14d, dword [rbp + 0x28]
movzx eax, byte [r8]
lea rcx, [0x14024c050]
movzx edx, byte [rax + rcx]
movzx eax, r9b
movzx ecx, byte [rax + rcx]
cmp ecx, edx
je 0x1400d23c4
mov r11, qword [r11]
test ebx, ebx
jne 0x1400d22d4
xor r11d, r11d
lea rbx, [0x14024c050]
inc edi
cmp edi, r14d
jl 0x1400d21f0
test r11, r11
je 0x1400d2392
mov rax, qword [rsp + 0x38]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov rax, qword [rsp + 0x40]
mov r8, rsi
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.1400f1cc0
inc r15d
lea rbx, [0x14024c050]
cmp r15d, 4
jle 0x1400d21b0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r11, qword [r11 + 0x10]
test r11, r11
jne 0x1400d2367
jmp 0x1400d2350
Function at 0x1400d41a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r14, rdx
mov r15, rcx
xor r12b, r12b
call fcn.1400ec180
mov rdi, qword [r14 + 0x10]
mov rbx, rax
mov r13d, dword [rsp + 0xa0]
test rdi, rdi
je 0x1400d4290
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsi]
test eax, eax
je 0x1400d427d
cmp qword [rdi + 0x48], 0
mov r12b, 1
je 0x1400d4228
mov r9d, dword [rbx + 0x3c]
mov r8d, eax
add r9d, 2
mov dword [rsp + 0x20], 0
mov edx, 0x4c
mov rcx, rbx
call fcn.1401089e0
mov eax, dword [rsi]
mov r9d, eax
mov dword [rsp + 0x20], 0
mov r8d, ebp
mov edx, WSASetLastError
mov rcx, rbx
call fcn.1401089e0
mov eax, r13d
neg eax
mov eax, dword [rdi + 0x5c]
sbb cl, cl
and al, 3
and cl, 0x10
movzx edx, cl
cmp al, 2
jne 0x1400d4263
test byte [r14 + 0x46], 0x20
je 0x1400d4263
or dl, r12b
test dl, dl
je 0x1400d427d
mov r8, qword [rbx + 8]
test r8, r8
je 0x1400d427d
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax + rax*2]
mov byte [r8 + rcx*8 - 0x15], dl
mov rdi, qword [rdi + 0x28]
inc ebp
add rsi, 4
test rdi, rdi
jne 0x1400d41f2
test byte [r14 + 0x46], 0x20
jne 0x1400d43ef
movzx eax, byte [r15 + 0x1f]
mov ebp, dword [rsp + 0x80]
test al, al
jne 0x1400d42b5
inc dword [r15 + 0x54]
mov edi, dword [r15 + 0x54]
jmp 0x1400d42c3
dec al
movzx eax, al
mov byte [r15 + 0x1f], al
mov edi, dword [r15 + rax*4 + 0x24]
movsx r9d, word [r14 + 0x3e]
lea r8d, [rbp + 1]
mov edx, 0x31
mov dword [rsp + 0x20], edi
mov rcx, rbx
call fcn.1401089e0
test r12b, r12b
jne 0x1400d42f0
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.140103a30
movsx r8d, word [r14 + 0x3e]
lea edx, [rbp + 1]
mov rcx, r15
call fcn.1400da510
cmp byte [r15 + 0x1e], 0
je 0x1400d430b
xor dl, dl
jmp 0x1400d4320
cmp dword [rsp + 0x90], 0
mov edx, 3
mov eax, 5
cmovne edx, eax
mov r8d, dword [rsp + 0x70]
movzx eax, dl
or al, 8
mov dword [rsp + 0x20], ebp
cmp dword [rsp + 0x98], 0
mov r9d, edi
movzx ecx, al
movzx eax, dl
cmove ecx, eax
movzx edx, cl
mov rcx, rbx
movzx eax, dl
or al, 0x10
movzx r12d, al
test r13d, r13d
cmove r12d, edx
mov edx, 0x4b
call fcn.1401089e0
cmp byte [r15 + 0x1e], 0
jne 0x1400d43d9
mov r8, qword [rbx + 8]
mov rsi, qword [r14]
mov rcx, qword [rbx]
test r8, r8
je 0x1400d43d9
cmp byte [rcx + 0x51], 0
jne 0x1400d43d9
movsxd rax, dword [rbx + 0x3c]
lea rdx, [rax + rax*2]
lea rdi, [r8 + rdx*8]
movsx edx, byte [r8 + rdx*8 - 0x17]
mov r8, qword [rdi - 8]
call fcn.140087680
mov qword [rdi - 8], 0
test rsi, rsi
jne 0x1400d43ac
mov byte [rdi - 0x17], sil
jmp 0x1400d43d9
cmp byte [rsi], 0
mov rax, rsi
je 0x1400d43bc
inc rax
cmp byte [rax], 0
jne 0x1400d43b4
mov rcx, qword [rbx]
sub eax, esi
and eax, 0x3fffffff
mov rdx, rsi
mov r8d, eax
call fcn.1400d6690
mov qword [rdi - 8], rax
mov byte [rdi - 0x17], 0xff
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400d43ef
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r12b
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400dac90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
xor r10d, r10d
mov rbx, rcx
mov esi, r9d
add rcx, 0x88
mov ebp, r8d
nop dword [rax]
cmp dword [rcx + 0xc], 0
jle 0x1400dacd2
cmp dword [rcx], esi
jne 0x1400dacd2
movsx eax, word [rcx + 4]
cmp eax, ebp
je 0x1400dad28
inc r10d
add rcx, 0x14
cmp r10d, 0xa
jl 0x1400dacc0
mov qword [rsp + 0x40], rdi
mov r9d, ebp
mov edi, dword [rsp + 0x60]
mov r8d, esi
mov rcx, r14
mov dword [rsp + 0x20], edi
call fcn.1400dae00
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x1400dadcf
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x1400daddf
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x1400daddf
mov eax, dword [rbx + 0x74]
mov dword [rcx + 0x10], eax
inc dword [rbx + 0x74]
mov eax, dword [rcx + 0xc]
cmp dword [rbx + 0x94], eax
jne 0x1400dad43
mov byte [rbx + 0x8e], 0
cmp dword [rbx + 0xa8], eax
jne 0x1400dad52
mov byte [rbx + 0xa2], 0
cmp dword [rbx + 0xbc], eax
jne 0x1400dad61
mov byte [rbx + 0xb6], 0
cmp dword [rbx + 0xd0], eax
jne 0x1400dad70
mov byte [rbx + 0xca], 0
cmp dword [rbx + 0xe4], eax
jne 0x1400dad7f
mov byte [rbx + 0xde], 0
cmp dword [rbx + 0xf8], eax
jne 0x1400dad8e
mov byte [rbx + 0xf2], 0
cmp dword [rbx + 0x10c], eax
jne 0x1400dad9d
mov byte [rbx + 0x106], 0
cmp dword [rbx + 0x120], eax
jne 0x1400dadac
mov byte [rbx + 0x11a], 0
cmp dword [rbx + 0x134], eax
jne 0x1400dadbb
mov byte [rbx + 0x12e], 0
cmp dword [rbx + 0x148], eax
jne 0x1400dadca
mov byte [rbx + 0x142], 0
mov eax, dword [rcx + 0xc]
jmp 0x1400dade6
mov r9d, edi
mov r8d, ebp
mov edx, esi
mov rcx, rbx
call fcn.1400da740
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400dcac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400dcc55
test rdx, rdx
je 0x1400dcc55
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x1400dcb34
and r9d, r11d
bt r9d, 0xa
jae 0x1400dcc4b
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1400dcc4b
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x1400dcb7c
cmp r8b, 0x5f
jne 0x1400dcb54
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.1400dcac0
cmp eax, 2
jl 0x1400dcb75
cmp byte [rbx], 0x5f
jne 0x1400dcc4b
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.1400dcac0
cmp eax, 2
jge 0x1400dcc4b
mov eax, 1
jmp 0x1400dcb1f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x1400dcbbb
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400dcbbb
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1400dcba7
inc rax
test ecx, ecx
jne 0x1400dcb94
test edx, edx
je 0x1400dcbbb
xor eax, eax
cmp r8b, 0x5f
setne al
inc eax
jmp 0x1400dcb1f
xor r9d, r11d
test r9b, 0x10
jne 0x1400dcc4b
bt esi, 0xe
jb 0x1400dcb1d
bt esi, 0xb
jb 0x1400dcc4b
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, qword [rdi + 0x10]
call fcn.1400dcac0
test eax, eax
jne 0x1400dcc4b
mov rdx, qword [rbx + 0x18]
mov r8d, ebp
mov rcx, qword [rdi + 0x18]
call fcn.1400dcac0
test eax, eax
jne 0x1400dcc4b
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, qword [rdi + 0x20]
call fcn.1400dd9d0
test eax, eax
jne 0x1400dcc4b
bt esi, 0xd
jb 0x1400dcb1d
cmp byte [rdi], 0x61
je 0x1400dcb1d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1400dcc4b
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x1400dcb1d
cmp ecx, ebp
jne 0x1400dcc4b
test eax, eax
js 0x1400dcb1d
mov eax, 2
jmp 0x1400dcb1f
mov rbp, qword [rsp + 0x40]
xor eax, eax
cmp rbx, rdi
mov ecx, 2
mov rbx, qword [rsp + 0x38]
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1400df190
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
mov ebp, dword [rcx + 0x28]
xor r10d, r10d
xor esi, esi
mov r14, r8
mov rdi, rdx
test ebp, ebp
jle 0x1400df356
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r12
lea r12, [0x14024c050]
mov qword [rsp + 0x40], r15
mov r15, qword [rcx + 0x20]
nop word [rax + rax]
mov eax, esi
xor eax, 1
cmp esi, 2
cmovae eax, esi
shl rax, 5
mov rbx, qword [rax + r15 + 0x18]
test r14, r14
je 0x1400df24f
mov rdx, qword [rax + r15]
test rdx, rdx
je 0x1400df329
movzx r8d, byte [r14]
test r8b, r8b
je 0x1400df236
mov r9, r14
movzx ecx, r8b
sub r9, rdx
nop dword [rax]
movzx eax, byte [rdx]
movzx r8d, cl
movzx ecx, cl
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x1400df236
movzx ecx, byte [r9 + rdx + 1]
inc rdx
movzx r8d, cl
test cl, cl
jne 0x1400df210
movzx eax, byte [rdx]
movzx edx, byte [rax + r12]
movzx eax, r8b
movzx ecx, byte [rax + r12]
cmp ecx, edx
jne 0x1400df329
mov r9, qword [rbx + 0x30]
test r9, r9
je 0x1400df2a8
movzx eax, byte [rdi]
xor r8d, r8d
mov rdx, rdi
test al, al
je 0x1400df290
nop word [rax + rax]
movzx eax, al
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r12]
lea eax, [r8*8]
xor ecx, eax
movzx eax, byte [rdx]
xor r8d, ecx
test al, al
jne 0x1400df270
xor edx, edx
mov eax, r8d
div dword [rbx + 0x20]
mov ecx, edx
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
mov ebx, dword [r9 + rcx*8]
jmp 0x1400df2af
mov r11, qword [rbx + 0x28]
mov ebx, dword [rbx + 0x24]
test ebx, ebx
je 0x1400df326
mov r10, qword [r11 + 0x18]
dec ebx
test r10, r10
jne 0x1400df2c8
mov rax, rdi
neg rax
sbb edx, edx
jmp 0x1400df31b
test rdi, rdi
je 0x1400df31f
movzx r9d, byte [r10]
mov r8, rdi
test r9b, r9b
je 0x1400df307
movzx eax, r9b
sub r10, rdi
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x1400df307
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x1400df2e0
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx edx, byte [rax + r12]
sub edx, ecx
test edx, edx
je 0x1400df34b
mov r11, qword [r11]
test ebx, ebx
jne 0x1400df2b3
xor r10d, r10d
inc esi
cmp esi, ebp
jl 0x1400df1d0
mov r12, qword [rsp + 0x38]
mov rax, r10
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x40]
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r10, qword [r11 + 0x10]
test r10, r10
jne 0x1400df333
jmp 0x1400df329
mov rax, r10
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400df360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
push r15
mov r15d, dword [rcx + 0x28]
xor r11d, r11d
xor esi, esi
mov r14, r8
mov rdi, rdx
mov rbp, rcx
test r15d, r15d
jle 0x1400df54c
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r12
lea r12, [0x14024c050]
nop word [rax + rax]
mov r10d, esi
xor r10d, 1
cmp esi, 2
cmovae r10d, esi
test r14, r14
je 0x1400df41f
mov rax, qword [rbp + 0x20]
mov ecx, r10d
shl rcx, 5
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x1400df51d
movzx r8d, byte [r14]
test r8b, r8b
je 0x1400df406
mov r9, r14
movzx ecx, r8b
sub r9, rdx
nop
movzx eax, byte [rdx]
movzx r8d, cl
movzx ecx, cl
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x1400df406
movzx ecx, byte [r9 + rdx + 1]
inc rdx
movzx r8d, cl
test cl, cl
jne 0x1400df3e0
movzx eax, byte [rdx]
movzx edx, byte [rax + r12]
movzx eax, r8b
movzx ecx, byte [rax + r12]
cmp ecx, edx
jne 0x1400df51d
mov rax, qword [rbp + 0x20]
mov ecx, r10d
shl rcx, 5
mov r9, qword [rcx + rax + 0x18]
mov r10, qword [r9 + 0x18]
test r10, r10
je 0x1400df489
movzx eax, byte [rdi]
xor r8d, r8d
mov rdx, rdi
test al, al
je 0x1400df470
nop word [rax + rax]
movzx eax, al
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r12]
lea eax, [r8*8]
xor ecx, eax
movzx eax, byte [rdx]
xor r8d, ecx
test al, al
jne 0x1400df450
xor edx, edx
mov eax, r8d
div dword [r9 + 8]
mov ecx, edx
add rcx, rcx
mov r11, qword [r10 + rcx*8 + 8]
mov ebx, dword [r10 + rcx*8]
jmp 0x1400df491
mov r11, qword [r9 + 0x10]
mov ebx, dword [r9 + 0xc]
test ebx, ebx
je 0x1400df51a
nop dword [rax]
mov r10, qword [r11 + 0x18]
dec ebx
test r10, r10
jne 0x1400df4b5
mov rax, rdi
neg rax
sbb edx, edx
jmp 0x1400df50b
test rdi, rdi
je 0x1400df50f
movzx r9d, byte [r10]
mov r8, rdi
test r9b, r9b
je 0x1400df4f7
movzx eax, r9b
sub r10, rdi
nop dword [rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x1400df4f7
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x1400df4d0
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx edx, byte [rax + r12]
sub edx, ecx
test edx, edx
je 0x1400df541
mov r11, qword [r11]
test ebx, ebx
jne 0x1400df4a0
xor r11d, r11d
inc esi
cmp esi, r15d
jl 0x1400df3a0
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop rdi
pop rsi
ret
mov r11, qword [r11 + 0x10]
test r11, r11
jne 0x1400df528
jmp 0x1400df51d
mov rbp, qword [rsp + 0x40]
mov rax, r11
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e15b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rsi, rdx
mov r14, rcx
mov ebx, r15d
test dword [rax + 0x2c], 0x80000
je 0x1400e179c
mov r9, qword [rdx + 0x20]
mov qword [rsp + 0x58], rbp
test r9, r9
je 0x1400e1621
mov eax, dword [r9 + 0x28]
test eax, eax
jle 0x1400e1618
lea rdx, [r9 + 0x40]
mov r8d, eax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x1400e1605
mov eax, 0xffffffff
jmp 0x1400e160c
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 0x10
sub r8, 1
jne 0x1400e15f7
mov r9, qword [r9 + 8]
test r9, r9
jne 0x1400e15e8
mov r9, qword [rsi + 0x68]
lea rbp, [0x14024c050]
mov r10, qword [rsi]
mov qword [rsp + 0x60], rdi
mov r11, qword [r9 + 0x60]
test r11, r11
je 0x1400e1688
movzx eax, byte [r10]
mov rdx, r10
mov r8d, r15d
test al, al
je 0x1400e166f
nop dword [rax + rax]
movzx eax, al
lea rdx, [rdx + 1]
movzx ecx, byte [rax + rbp]
lea eax, [r8*8]
xor ecx, eax
movzx eax, byte [rdx]
xor r8d, ecx
test al, al
jne 0x1400e1650
xor edx, edx
mov eax, r8d
div dword [r9 + 0x50]
mov ecx, edx
add rcx, rcx
mov rdi, qword [r11 + rcx*8 + 8]
mov r11d, dword [r11 + rcx*8]
jmp 0x1400e1690
mov rdi, qword [r9 + 0x58]
mov r11d, dword [r9 + 0x54]
test r11d, r11d
je 0x1400e1781
nop dword [rax]
mov r9, qword [rdi + 0x18]
dec r11d
test r9, r9
jne 0x1400e16b6
mov rax, r10
neg rax
sbb ecx, ecx
jmp 0x1400e1705
test r10, r10
je 0x1400e1709
movzx r8d, byte [r9]
mov rdx, r10
test r8b, r8b
je 0x1400e16f4
movzx eax, r8b
sub r9, r10
nop
movzx ecx, al
movzx r8d, al
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp]
cmp byte [rcx + rbp], al
jne 0x1400e16f4
movzx eax, byte [r9 + rdx + 1]
inc rdx
movzx r8d, al
test al, al
jne 0x1400e16d0
movzx eax, r8b
movzx ecx, byte [rax + rbp]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp]
sub ecx, eax
test ecx, ecx
je 0x1400e1713
mov rdi, qword [rdi]
test r11d, r11d
jne 0x1400e16a0
jmp 0x1400e1781
mov rdi, qword [rdi + 0x10]
test rdi, rdi
je 0x1400e1781
nop dword [rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov r8, rdi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, r14
call fcn.1400e10b0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400e1778
movzx r8d, word [rdx + 0x56]
test r8, r8
je 0x1400e1778
mov rdx, qword [rdx + 8]
movzx ecx, word [rdx]
cmp cx, 0x1f
jle 0x1400e1765
mov eax, 0xffffffff
jmp 0x1400e176c
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 2
sub r8, 1
jne 0x1400e1755
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x1400e1720
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x1400ec320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 0x10]
lea rsi, [0x14024c050]
mov r11, rdx
mov r9, rcx
test r10, r10
je 0x1400ec384
mov r8, rdx
xor eax, eax
movzx edx, byte [rdx]
test dl, dl
je 0x1400ec36f
movzx ecx, dl
lea r8, [r8 + 1]
movzx edx, byte [rcx + rsi]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
movzx edx, byte [r8]
test dl, dl
jne 0x1400ec351
xor edx, edx
div dword [r9]
mov ecx, edx
add rcx, rcx
mov rbx, qword [r10 + rcx*8 + 8]
mov edi, dword [r10 + rcx*8]
jmp 0x1400ec38b
mov rbx, qword [rcx + 8]
mov edi, dword [rcx + 4]
test edi, edi
je 0x1400ec402
nop
mov r10, qword [rbx + 0x18]
dec edi
test r10, r10
jne 0x1400ec3a5
mov rax, r11
neg rax
sbb edx, edx
jmp 0x1400ec3f7
test r11, r11
je 0x1400ec3fb
movzx r9d, byte [r10]
mov r8, r11
test r9b, r9b
je 0x1400ec3e5
movzx eax, r9b
sub r10, r11
nop dword [rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + rsi]
cmp byte [rcx + rsi], al
jne 0x1400ec3e5
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x1400ec3c0
movzx eax, byte [r8]
movzx ecx, byte [rax + rsi]
movzx eax, r9b
movzx edx, byte [rax + rsi]
sub edx, ecx
test edx, edx
je 0x1400ec414
mov rbx, qword [rbx]
test edi, edi
jne 0x1400ec390
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rax, qword [rbx + 0x10]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400f1920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r15
sub rsp, 0x30
mov r12d, r8d
movsxd r15, edx
mov rbx, rcx
call fcn.1400ec180
mov rsi, rax
test rax, rax
je 0x1400f1ae7
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
test al, al
jne 0x1400f196e
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x1400f1993
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
test al, al
jne 0x1400f1987
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x1400f1993
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, 0x33
mov rcx, rsi
call fcn.1401089e0
mov eax, dword [rsi + 0x94]
bts eax, r15d
mov dword [rsi + 0x94], eax
cmp r15d, 1
je 0x1400f19ed
mov rax, qword [rsi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], 0
je 0x1400f19ed
mov eax, dword [rsi + 0x98]
bts eax, r15d
mov dword [rsi + 0x98], eax
xor edi, edi
mov r9d, ebp
mov r8d, r12d
mov dword [rsp + 0x20], edi
mov rcx, rsi
lea edx, [rdi + 0x19]
call fcn.1401089e0
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
lea edx, [rdi + 0x53]
mov rcx, rsi
call fcn.1401089e0
mov r12d, eax
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400f1a33
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov dword [rsp + 0x20], ebp
mov r8d, r15d
mov rcx, rsi
lea edx, [r9 + 0x32]
call fcn.1401089e0
mov edx, dword [rsi + 0x3c]
cmp edx, r12d
jbe 0x1400f1a63
mov rax, qword [rsi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
test r14d, r14d
je 0x1400f1aa3
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x1400f1aa3
mov ecx, edi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x1400f1a9f
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x1400f1a84
mov dword [rbx + rdx*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x1400f1aa3
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x60]
test ebp, ebp
je 0x1400f1add
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x1400f1add
lea rax, [rbx + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], ebp
je 0x1400f1ad9
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x1400f1ac0
mov dword [rbx + rcx*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x1400f1add
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rsi
ret