joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059eb0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
jne 0x140059f1a
mov rdx, qword [rdx + 0x18]
jmp 0x14005a03b
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005a02d
nop dword [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.14005e450
mov r8, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140059f72
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140059f80
mov r8, qword [rax]
cmp rdx, qword [rbx + 0x10]
jne 0x140059fa9
test rdx, rdx
je 0x140059fa4
sub r8, rcx
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140059fa9
add rcx, 2
sub rdx, 1
jne 0x140059f90
mov dil, 1
jmp 0x140059fac
xor dil, dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140059fee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059fe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a0ad
call fcn.140062270
test dil, dil
je 0x14005a017
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14005a00a
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rsi + 8], 4
jmp 0x14005a017
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.14005f4d0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140059f50
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14005a072
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14005a06d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005a0b4
mov rcx, r8
call fcn.140062270
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140061c60
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140060ed0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
mov rdx, rcx
je 0x140061018
movdqa xmm3, xmmword [0x14006c850]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14006c8b0]
xor eax, eax
mov r9d, 0xc464
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xc47c
jb 0x140060f00
cmp rax, 0x1e
jae 0x140061014
mov r8d, 0x3ba3
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x1e
jb 0x140061000
mov byte [rdx + 0x3e], 0
mov rax, rdx
ret

Function at 0x1400616ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140061726
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006172b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140061774
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140065970]
cmp byte [rcx + rax], 0
je 0x140061774
dec r8
sub rdx, 1
jne 0x14006175a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140062a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140062ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140062ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140062ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140062ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140062ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140062ad4
xor al, al
add rsp, 0x28
ret
Function at 0x14002f7e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x14002f983
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002f983
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14002f983
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x14002f983
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 4]
mov qword [rbx + 0x10], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rcx + 6]
jae 0x14002f971
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x14002f94d
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x14002f95e
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.14002f990
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x14002f920
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140030200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400cd080]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
lea rdx, [rsp + 0x60]
call fcn.14002f7e0
mov r15, qword [rbp]
test al, al
je 0x1400303b0
mov dword [rsp + 0x20], 0xd1cdd388
mov word [rsp + 0x24], 0xde
mov byte [rsp + 0x26], 1
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x140030270
mov byte [rsp + 0x26], 0
mov rbx, r15
mov rdi, qword [rbp + 8]
cmp r15, rdi
je 0x1400302b5
mov r12, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [0x14009ece0]
test eax, eax
je 0x1400302b8
add rbx, 8
cmp rbx, rdi
jne 0x140030291
xor r12d, r12d
mov dword [rsp + 0x28], 0xc8ccd588
mov dword [rsp + 0x2c], 0x100cade
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x28], al
inc rcx
cmp rcx, 6
jb 0x1400302d0
mov byte [rsp + 0x2f], 0
mov rbx, r15
cmp r15, rdi
je 0x140030314
nop dword [rax]
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [0x14009ece0]
test eax, eax
je 0x140030317
add rbx, 8
cmp rbx, rdi
jne 0x1400302f0
xor r14d, r14d
mov dword [rsp + 0x20], 0xddc9c388
mov word [rsp + 0x24], 0xcb
mov byte [rsp + 0x26], 1
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x140030330
mov byte [rsp + 0x26], 0
mov rbx, r15
cmp r15, rdi
je 0x140030374
nop dword [rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [0x14009ece0]
test eax, eax
je 0x140030376
add rbx, 8
cmp rbx, rdi
jne 0x140030350
xor esi, esi
test r12, r12
je 0x1400303b0
cmp r12, r14
jae 0x1400303b0
cmp r14, rsi
jae 0x1400303b0
lea rcx, [rsp + 0x30]
call qword [0x14009e380]
xor edx, edx
mov eax, dword [r14 + 0xc]
mov rcx, qword [rsp + 0x58]
div ecx
test edx, edx
jne 0x1400303b0
xor edx, edx
mov eax, dword [rsi + 0xc]
div ecx
test edx, edx
jne 0x1400303b0
mov bl, 1
jmp 0x1400303b2
xor bl, bl
test r15, r15
je 0x1400303f2
mov rdx, qword [rbp + 0x10]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x1400303ea
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400303ea
call qword [0x14009ebb0]
int3
mov rcx, r15
call fcn.140098fac
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140098c30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140030420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400cd080]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
lea rdx, [rsp + 0x30]
call fcn.14002f7e0
mov r15, qword [rbp - 0x30]
test al, al
je 0x1400305e7
mov dword [rsp + 0x20], 0xd1cdd388
mov word [rsp + 0x24], 0xde
mov byte [rsp + 0x26], 1
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x140030490
mov byte [rsp + 0x26], 0
mov rbx, r15
mov rdi, qword [rbp - 0x28]
cmp r15, rdi
je 0x1400304d5
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [0x14009ece0]
test eax, eax
je 0x1400304d8
add rbx, 8
cmp rbx, rdi
jne 0x1400304b1
xor r14d, r14d
mov dword [rsp + 0x28], 0xc8ccd588
mov dword [rsp + 0x2c], 0x100cade
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x28], al
inc rcx
cmp rcx, 6
jb 0x1400304f0
mov byte [rsp + 0x2f], 0
mov rbx, r15
cmp r15, rdi
je 0x140030534
nop dword [rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [0x14009ece0]
test eax, eax
je 0x140030536
add rbx, 8
cmp rbx, rdi
jne 0x140030510
xor esi, esi
test r14, r14
je 0x1400305e7
cmp r14, rsi
jae 0x1400305e7
mov dword [rbp - 0x10], 1
mov dword [rbp - 0xc], 2
mov dword [rbp - 8], 4
mov dword [rbp - 4], 8
mov dword [rbp], 0x10
mov dword [rbp + 4], 0x20
mov dword [rbp + 8], 0x40
mov dword [rbp + 0xc], 0x80
mov dword [rbp + 0x10], 0x100
mov dword [rbp + 0x14], 0x200
mov dword [rbp + 0x18], 0x400
mov dword [rbp + 0x1c], 0x80000000
lea rdi, [rbp - 0x10]
mov r13, qword [rsp + 0x48]
nop word [rax + rax]
mov r8d, dword [r14 + 8]
add r8d, 0x1000
mov r9d, dword [rdi]
mov rdx, qword [r13 + 0x18]
call fcn.140030650
mov r8d, dword [rsi + 8]
mov edx, dword [rsi + 0xc]
add rdx, qword [r13 + 0x18]
mov r9d, dword [rdi]
call fcn.140030650
add rdi, 4
lea rax, [rbp + 0x20]
cmp rdi, rax
jne 0x1400305b0
test r15, r15
je 0x140030627
mov rdx, qword [rbp - 0x20]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x14003061f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003061f
call qword [0x14009ebb0]
int3
mov rcx, r15
call fcn.140098fac
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140098c30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140030650
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400cd080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x50], ebx
mov edi, r9d
mov qword [rsp + 0x58], r8
call qword [0x14009e278]
mov rcx, qword gs:[0x58]
mov rsi, rax
mov eax, 4
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x1400ceac8], ecx
jle 0x14003071a
lea rcx, [0x1400ceac8]
call fcn.140099138
cmp dword [0x1400ceac8], 0xffffffff
jne 0x14003071a
movdqa xmm0, xmmword [0x1400bd590]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xd8dbd0f9
mov dword [rsp + 0x44], 0x100c0ca
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x5c]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 0x16
jb 0x1400306e0
mov rcx, qword [0x1400ceaa0]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x47], 0
call qword [0x14009e390]
lea rcx, [0x1400ceac8]
mov qword [0x1400ceab8], rax
call fcn.1400990d8
mov rax, qword [0x1400ceab8]
test rax, rax
je 0x140030744
lea rcx, [rsp + 0x50]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x58]
mov rcx, rsi
lea rdx, [rsp + 0x48]
call rax
jmp 0x14003074f
mov ecx, 0x7f
call qword [0x14009e290]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140098c30
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140031150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140031184
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140031170
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400311a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140041bc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140031223
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003121e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003121e
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140031230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140031264
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140031250
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140031289
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140041bc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140031303
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400312fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400312fe
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140031310
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140031344
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140031330
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140031369
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140041bc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400313e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400313de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400313de
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400313f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x140031424
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x140031410
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140031449
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140041bc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400314c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400314be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400314be
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400314d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x140031504
mov ecx, ebx
lea eax, [rcx - 0x6a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400314f0
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140023b70
nop
cmp byte [rdi + 0xb], 0
je 0x140031534
lea eax, [rbx - 0x6a]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0xa
jb 0x140031521
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140037b10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400315a4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003159e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003159e
call qword [0x14009ebb0]
int3
call fcn.140098fac
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400315e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400315df
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400315f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140031624
mov eax, esi
lea ecx, [rax - 0x6a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140031610
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140023b70
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140031649
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140041bc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400316c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400316be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400316be
call qword [0x14009ebb0]
int3
call fcn.140098fac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140038ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 8], al
je 0x140038ed3
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 7
jb 0x140038ec0
mov byte [rdx + 8], 0
lea r8, [rdx + 7]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140023b70
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140038ef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 9], al
je 0x140038f23
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 8
jb 0x140038f10
mov byte [rdx + 9], 0
lea r8, [rdx + 8]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140023b70
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140038f40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x10], al
je 0x140038f73
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x6a]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x140038f60
mov byte [rdx + 0x10], 0
lea r8, [rdx + 0xf]
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140023b70
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140039e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140039e23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140039e10
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140039e30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140039e53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x6a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 7
jb 0x140039e40
mov byte [rcx + 8], 0
mov rax, rcx
ret