joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001710
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [rcx + 0x5074], 1
mov rdi, rdx
mov rbx, rcx
je 0x14000173e
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002ad0
mov eax, 0xffffffff
add rsp, 0x38
pop rdi
pop rbx
ret
cmp byte [rdx + 0x11], 0x6e
jne 0x140001768
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x14000175f
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002ad0
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
add rcx, 0x3070
lea rbp, [rdx + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140007bd0
mov r12, rax
test rax, rax
jne 0x1400017b9
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140002830
mov rbp, qword [rsp + 0x50]
lea eax, [r12 - 1]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [0x14002b834]
call fcn.140003f60
mov r15, rax
test rax, rax
jne 0x1400017ee
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
lea ebx, [r15 - 1]
jmp 0x14000192f
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.140010824
test eax, eax
jns 0x140001823
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, [0x14002b8ac]
call fcn.140002830
mov ebx, 0xffffffff
jmp 0x140001927
cmp byte [rdi + 0x10], 1
jne 0x140001841
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.140001050
mov ebx, eax
jmp 0x140001927
mov qword [rsp + 0x30], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x28], r14
mov ecx, r13d
call fcn.140014fa0
mov r14, rax
test rax, rax
jne 0x140001882
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140002830
lea ebx, [r14 - 1]
jmp 0x14000191d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001915
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
cmp rdi, r13
mov rsi, rdi
mov r9, r15
mov r8d, 1
cmova rsi, r13
mov rcx, r14
mov rdx, rsi
call fcn.1400104ec
cmp rax, 1
jb 0x1400018f5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.140010c2c
cmp rax, 1
jb 0x1400018e5
sub rdi, rsi
jne 0x1400018a0
jmp 0x140001910
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001903
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140002830
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.140014f8c
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r15
call fcn.14001019c
mov rcx, r12
call fcn.14001019c
mov r15, qword [rsp + 0x20]
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x140001a40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rdx, [0x14002b834]
add rcx, 0x70
mov esi, 0xffffffff
call fcn.140003f60
mov rdi, rax
test rax, rax
je 0x140001c29
mov rax, qword [0x14002da90]
lea r8d, [rsi + 9]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
shr rax, 0x18
mov rcx, rdi
add al, 0xc
mov qword [rsp + 0x48], rbp
mov byte [rsp + 0x23], al
call fcn.140008270
mov rbp, rax
test rax, rax
je 0x140001c1c
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.140010824
test eax, eax
jns 0x140001ae4
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, [0x14002b8ac]
call fcn.140002830
jmp 0x140001c1c
mov edx, 0x58
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8d, [rdx - 0x57]
call fcn.1400104ec
cmp rax, 1
jae 0x140001b17
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.140002830
jmp 0x140001c1c
mov ecx, dword [rbx + 0x20]
xor r8d, r8d
mov eax, dword [rbx + 0x24]
bswap eax
mov dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x28]
bswap eax
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0x2c]
bswap ecx
mov ecx, ecx
sub rbp, rcx
mov dword [rbx + 0x20], ecx
bswap eax
mov dword [rbx + 0x2c], eax
add rbp, 0x58
mov qword [rbx], rbp
mov rcx, rdi
mov dword [rbx + 0x5078], 0
mov dword [0x14003ec94], eax
mov edx, dword [rbx + 0x24]
add rdx, qword [rbx]
call fcn.140010824
movsxd rcx, dword [rbx + 0x28]
call fcn.140014fa0
mov qword [rbx + 8], rax
test rax, rax
jne 0x140001b8e
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x140001c1c
movsxd rdx, dword [rbx + 0x28]
mov r9, rdi
mov r8d, 1
mov rcx, rax
call fcn.1400104ec
cmp rax, 1
jae 0x140001bbe
lea rdx, str.Could_not_read_full_TOC__n
lea rcx, str.fread
call fcn.140002830
jmp 0x140001c1c
movsxd rax, dword [rbx + 0x28]
mov rcx, rdi
add rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
call fcn.140010260
test eax, eax
je 0x140001be4
lea rcx, str.Error_on_file._n
call fcn.140002ad0
jmp 0x140001c1c
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jae 0x140001c1a
nop
mov ecx, dword [rax + 4]
mov edx, dword [rax]
bswap ecx
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
bswap ecx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0xc]
bswap ecx
mov dword [rax + 0xc], ecx
bswap edx
mov dword [rax], edx
movsxd rcx, edx
add rax, rcx
cmp rax, qword [rbx + 0x10]
jb 0x140001bf0
xor esi, esi
mov rcx, rdi
call fcn.14001019c
mov rbp, qword [rsp + 0x48]
mov eax, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000bcd0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400110e6
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001a9e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400310ec]
call fcn.14001184d
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001aa37
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001ab43
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001aadc
cmp qword [rbp + 0x28], 0
jle 0x14001aadc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001aa7c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400117d5
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001ab32
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001ab32
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400114c4
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d580
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115d2
Capabilities:
Log keystrokes via application hook

Disassembly:
jmp 0x14001abc0
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002a018]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1400310f4]
call fcn.14001184d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14001ac1a
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
mov r8, rax
lea rdx, [0x1400113bb]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14001ac72
cmp dword [rbp + 0x50], 0x12
jne 0x14001ac5c
jmp 0x14001ac72
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14001ac3e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400257d0]
call fcn.1400116f4
mov eax, edi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.14001141f
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x1400115f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e0b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e0d0
xor al, al
jmp 0x14001e151
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001e0e3
xor al, al
jmp 0x14001e151
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001e10d
xor al, al
jmp 0x14001e151
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001e121
xor al, al
jmp 0x14001e151
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001e133
xor al, al
jmp 0x14001e151
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001e14f
xor al, al
jmp 0x14001e151
mov al, 1
add rsp, 0x38
ret
Function at 0x140011834
Capabilities:
Write file on windows

Disassembly:
jmp 0x140017380
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14002a018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400310ec]
call fcn.14001184d
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x1400173e6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400173ed
mov al, 1
jmp 0x140017547
call fcn.140011253
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.140011253
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011712
movzx eax, al
test eax, eax
je 0x140017448
xor al, al
jmp 0x140017547
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1400174ad
cmp dword [rbp + 0x194], 1
je 0x1400174b8
cmp dword [rbp + 0x194], 3
je 0x140017536
jmp 0x140017545
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140017508
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140017508
xor al, al
jmp 0x140017547
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140017523
mov dword [rbp + 0x194], 1
jmp 0x14001752d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140017547
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140017547
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400256d0]
call fcn.1400116f4
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.14001141f
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140033af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
sub rsp, 0x9784468
add rsp, 0x9784438
mov dword [rcx + 8], 0x5cfc580d
sub dword [rcx + 8], 0x221ae064
sub dword [rcx + 8], 0x3ae177a8
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140002a08]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.140018ab0
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140033b97
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140033b7d
mov ecx, dword [rbx + 0x40]
mov esi, 0x2fbc9d4e
xor esi, 0x7ca55f54
sub esi, 0x5318c21b
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0xe603b87
add edx, 0x52ecd3d5
xor edx, 0x397c61db
sub edx, 0x58316e77
mov eax, dword [rbx + 0x54]
xor eax, 0x2ed57f6f
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x2ed57f6f
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x2ed57f6f
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x2ed57f6f
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x570b0af7
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x2ed57f6f
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x2f8611d8
xor eax, 0x560b0381
sub eax, 0x798d115a
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.1400bbff0
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404e1530]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140033c6d
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rax + rdx - 0x10]
xor ecx, 0x570b0af7
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rax + rdx - 0xc]
xor ecx, 0x570b0af7
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rax + rdx - 8]
xor ecx, 0x570b0af7
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rax + rdx - 4]
xor ecx, 0x570b0af7
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404e1530]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140033c91
lea rcx, [r14 + 0xa0]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.14002efe0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
neg rsp
add rsp, 0xffffffffffffffd0
neg rsp
pop r14
pop rdi
pop rsi
ret
Function at 0x14003423e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov qword [rsp + 0x78], rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140018ab0
mov edx, 0x3d0733e5
sub edx, 0x3b8c479b
add edx, 0x35d568df
add edx, 0x15c300c9
test rbp, rbp
je 0x14003430c
mov rdi, rax
sub rbx, rax
mov r9, rbp
mov r8d, 0x38012947
xor r8d, 0x774cef3c
add r8d, 0x8a89c2
sub r8d, 0x4fd84f3e
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x1400342eb
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
call fcn.1400a1490
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14003437b
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x546fda78
xor ecx, 0x1a4c20dc
sub ecx, 0x24151b91
sub ecx, 0x2a0edee3
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
nop
add rsp, 0x50240ef7
sub rsp, 0x50240e97
pop rdi
ret
call fcn.1400bc0d0
mov rax, rsi
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x140036030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140034230
mov ebx, 0x6ffd907d
sub ebx, 0x19074bcf
add ebx, 0x1fe2809e
add ebx, 0x89273ab3
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x1400360ca
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x36c99f4b
xor r8d, 0x7036e514
xor r8d, 0x60567b90
xor r8d, 0x26a901ce
inc rdi
call fcn.1400a07b0
cmp byte [rdi], 0
jne 0x14003608c
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400360fe
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x1931b4c6
sub ecx, 0x988cf7a
sub ecx, 0xfa8e4cc
rep stosb byte [rdi], al
jmp 0x140036103
call fcn.1400bc0d0
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x7f6f
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x140036170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x2ed57f6f
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x2ed57f6f
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x570b0af7
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.14006dc30
test ax, ax
je 0x140036234
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404e1530]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.14006dc30
test ax, ax
jne 0x1400361ea
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
neg rsp
add rsp, 0xffffffffffffffc0
neg rsp
pop r14
pop rdi
pop rsi
ret

Function at 0x140036260
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x2ed57f6f
xor r9d, 0x2ed57f6f
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x570b0af7
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x1400362ed
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404e1530]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x1400362b4
mov eax, r8d
ret
Function at 0x140036300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
sub rsp, 0x7ec4e14c
add rsp, 0x7ec4e10c
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x2ed57f6f
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x2ed57f6f
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x570b0af7
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.14006dc30
test ax, ax
je 0x1400363c9
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404e1530]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.14006dc30
test ax, ax
jne 0x14003637f
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
nop
add rsp, 0x47736311
sub rsp, 0x477362d1
pop r14
pop rdi
pop rsi
ret

Function at 0x140036400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x2ed57f6f
xor r9d, 0x2ed57f6f
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x570b0af7
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x14003649b
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404e1530]
movzx eax, ax
nop
sub rdx, 0x111eacbb
add rdx, 0x111eacbd
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x140036455
mov eax, r8d
ret