joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f517c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp byte [0x1401ad2e0], 0
mov rbp, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
je 0x1400f520b
cmp byte [rcx + 4], 0
je 0x1400f51c8
mov edx, ebp
lea r8, [rcx + 8]
imul edx, r14d
mov rcx, r15
call fcn.1400beb7c
jmp 0x1400f520b
mov rdi, r14
mov r12, r15
imul rdi, rbp
test rdi, rdi
je 0x1400f520b
mov ebx, dword [rsi + 0x1f0]
mov rcx, rsi
movsx edx, byte [r12]
and ebx, 0xfffd
or ebx, 2
call fcn.1400f5100
mov eax, ebx
xor eax, 1
imul eax, ebx
shr eax, 8
xor byte [r12], al
inc r12
sub rdi, 1
jne 0x1400f51d7
and dword [rsp + 0x20], 0
mov r9, rbp
mov r8, r14
mov rdx, r15
mov rcx, rsi
call fcn.1400f3ee4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x1400fd878
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fd8b0
test al, 0x10
jne 0x1400fd8ac
and eax, 0xffffffdf
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400fd8b0
mov al, 1
jmp 0x1400fd8c6
mov rdx, qword [rdi + 0x64bad8]
mov r8, rbx
mov ecx, 0x11
call fcn.14002f274
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140103320
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140103333
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1401039a4
lea rdx, [0x140182aa0]
lea rcx, [rsp + 0x20]
call fcn.140120c3c
int3

Function at 0x14010f92c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140237660]
xor edx, edx
jmp fcn.140103320

Function at 0x14011034c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140237660]
jmp fcn.140103320
Function at 0x14012c960
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14012c734
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14012c734
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14012c734
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14012c734
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14012c734
cmp dword [rcx + 0x84], 0xe
jbe 0x14012c734
cmp dword [rcx + 0xf8], esi
je 0x14012c734
mov ecx, r14d
call fcn.14012c87c
mov ecx, 2
call fcn.1401320f8
nop
cmp byte [0x140237950], 0
jne 0x14012c7fe
mov r15d, 1
mov eax, r15d
xchg dword [0x140237940], eax
test ebx, ebx
jne 0x14012c7a7
mov rdi, qword [0x140191630]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140237948]
cmp rcx, rax
je 0x14012c79e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140123b50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140237a88]
jmp 0x14012c7b3
cmp ebx, r15d
jne 0x14012c7b9
lea rcx, [0x140237aa0]
call fcn.14012d414
nop
test ebx, ebx
jne 0x14012c7d0
lea rdx, [0x140140130]
lea rcx, [0x140140108]
call fcn.14012d780
lea rdx, [0x140140140]
lea rcx, [0x140140138]
call fcn.14012d780
movzx eax, byte [0x140237950]
test esi, esi
cmove eax, r15d
mov byte [0x140237950], al
jmp 0x14012c7fe
mov ecx, 2
call fcn.140132158
test esi, esi
jne 0x14012c815
mov ecx, r14d
call fcn.14012c830
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14012c6c4
Function at 0x1401317c0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140131660
call fcn.14012aa8c
mov dword [rax], 0x16
call fcn.1401267ec
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140131648
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140131648
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140131692
lock or dword [rax + 0x14], 0x10
jmp 0x140131648
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401316af
mov rcx, qword [rbp + 0x10]
call fcn.1401363cc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14012b624
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14012973c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140131706
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140131648
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140131772
mov rcx, qword [rbp + 0x10]
call fcn.14012b624
cmp eax, 0xffffffff
je 0x140131759
mov rcx, qword [rbp + 0x10]
call fcn.14012b624
cmp eax, 0xfffffffe
je 0x140131759
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14012b624
movsxd rdi, eax
lea rsi, [0x140237b10]
mov rcx, rbx
sar rdi, 6
call fcn.14012b624
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140131760
lea rax, [0x140191b30]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140131772
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401317a8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401317a4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401317a4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14013164b
jmp 0x140131618
Function at 0x180adf0e2
Capabilities:
Encode data using xor

Disassembly:
test rsi, rsi
push 0x1986f8b7
lea rsp, [rsp + 0x18]
je 0x180adf141
lea rcx, [0x180b03908]
movzx ebx, byte [rax]
push 0x75b65088
sub dword [rsp + 1], 0x148fff88
xor ebx, edi
rol dword [rsp], 0x26
and ebx, 0xff
mov ebx, dword [rcx + rbx*4]
shr edi, 8
push 0x69c1017
xor edi, ebx
inc rax
xor edi, 0xf59e8e1d
dec rsi
push 0xffffffff8bb82f24
lea rsp, [rsp + 0x18]
jne 0x180adf0fc
push 0xffffffff9f9c5b0a
not edi
mov dword [r9], edi
lea rsp, [rsp + 8]
jmp fcn.180aff3b0
Function at 0x1400028d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rdi, r8
mov rsi, rcx
mov eax, ebx
test r8, r8
je 0x140002909
lea rcx, [rsp + 0x20]
call fcn.14005c890
mov rax, rdi
cmp rdi, 0x40
jae 0x14000291c
cmp rax, 0x40
jae 0x14000298b
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 0x40
jb 0x14000290f
mov rcx, rsi
call fcn.140010fc0
lea rax, [rsp + 0x20]
mov rdi, rsi
sub rdi, rax
mov r8, rbx
lea rdx, [rsp + 0x20]
add rdx, r8
inc r8
mov al, byte [rdx]
xor al, 0x36
mov byte [rdi + rdx + 0x70], al
cmp r8, 0x40
jb 0x140002932
lea rdx, [rsi + 0x70]
mov r8d, 0x40
mov rcx, rsi
call fcn.1400110b0
lea rcx, [rsp + 0x20]
add rcx, rbx
inc rbx
mov al, byte [rcx]
xor al, 0x5c
mov byte [rdi + rcx + 0x70], al
cmp rbx, 0x40
jb 0x14000295d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005a330
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
call fcn.14005a458
int3

Function at 0x140002994
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rdx
mov r13, rcx
mov edx, 0x10
mov rcx, r9
mov rdi, r9
mov r14, r8
call fcn.1400114a0
mov rbp, r14
lea r15, [rdi + 0x10]
shr rbp, 4
test rbp, rbp
je 0x140002a32
lea rsi, [rsp + 0x20]
mov r12, rbp
sub rsi, rbx
mov rcx, rbx
sub rdi, rbx
mov edx, 0x10
mov al, byte [rdi + rcx]
xor al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
sub rdx, 1
jne 0x1400029fc
mov r8, r15
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140026030
mov rdi, r15
add rbx, 0x10
add r15, 0x10
sub rsi, 0x10
sub r12, 1
jne 0x1400029f1
shl rbp, 4
sub r14d, ebp
je 0x140002a5d
mov rcx, rdi
mov r8d, r14d
sub rcx, rbx
lea rdx, [rsp + 0x20]
sub rdx, rbx
mov al, byte [rbx + rcx]
xor al, byte [rbx]
mov byte [rbx + rdx], al
inc rbx
sub r8, 1
jne 0x140002a4c
mov esi, 0x10
mov eax, r14d
lea rbx, [rsp + 0x20]
sub esi, r14d
add rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.1400138e0
cmp r14d, 0x10
jae 0x140002a96
lea rax, [rsp + 0x20]
sub rdi, rax
mov al, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rsi, 1
jne 0x140002a88
mov r8, r15
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140026030
lea rax, [rbp + 0x20]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14005a330
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400053dc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm0, xmmword [0x14008d970]
mov r15, rdx
movdqa xmm1, xmmword [0x14008d900]
mov r14, rcx
movdqa xmm2, xmmword [0x14008d9f0]
mov bl, 1
mov dword [rbp + 0x2f], 0xf4c36dc4
mov eax, dword [rbp + 0x2f]
mov dword [rbp - 0x11], eax
mov word [rbp + 0x33], 0x7b44
movzx eax, word [rbp + 0x33]
mov word [rbp - 0xd], ax
mov rax, qword [rdx]
mov dword [rbp + 0x27], 0xf8c761c0
mov dword [rbp + 0x2b], 0x76457740
movaps xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [rbp + 0x27]
mov word [rbp - 0xb], 0x101
movaps xmmword [rbp - 0x39], xmm1
movaps xmmword [rbp - 0x29], xmm2
movsd qword [rbp - 0x19], xmm0
test rax, rax
je 0x14000547b
mov rsi, qword [rax]
jmp 0x140005482
lea rsi, [0x14008d1d0]
and qword [rbp - 0x51], 0
xor edi, edi
mov rax, qword [r15]
movabs r9, 0x10101058d811587
test rax, rax
je 0x1400054a1
mov rcx, qword [rax + 8]
jmp 0x1400054a3
xor ecx, ecx
cmp rdi, rcx
jae 0x140005581
movsx edx, byte [rdi + rsi]
mov byte [rbp - 0x59], dl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x1400054d1
lea eax, [rdx - 0x41]
cmp al, 0x19
jbe 0x1400054d1
lea eax, [rdx - 0x61]
cmp al, 0x19
jbe 0x1400054d1
lea rdx, [rbp - 0x59]
jmp 0x140005570
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x140005506
test bl, bl
je 0x140005501
xor r8d, r8d
mov cl, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbp + r8 - 0x49], al
inc r8
cmp r8, 0x3f
jb 0x1400054df
xor bl, bl
mov byte [rbp - 0xa], bl
lea eax, [rdx - 0x37]
jmp 0x140005567
lea eax, [rdx - 0x61]
cmp al, 0x19
ja 0x14000553b
test bl, bl
je 0x140005536
xor r8d, r8d
mov cl, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbp + r8 - 0x49], al
inc r8
cmp r8, 0x3f
jb 0x140005514
xor bl, bl
mov byte [rbp - 0xa], bl
lea eax, [rdx - 0x3d]
jmp 0x140005567
test bl, bl
je 0x140005564
xor r8d, r8d
mov cl, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbp + r8 - 0x49], al
inc r8
cmp r8, 0x3f
jb 0x140005542
xor bl, bl
mov byte [rbp - 0xa], bl
lea eax, [rdx - 0x30]
cdqe
lea rdx, [rbp - 0x49]
add rdx, rax
lea rcx, [rbp - 0x51]
call fcn.14000697c
inc rdi
jmp 0x140005489
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x140005590
mov r9, qword [rbx + 0x30]
jmp 0x140005593
xor r9d, r9d
test rbx, rbx
je 0x14000559e
mov r8, qword [rbx + 0x28]
jmp 0x1400055a1
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call fcn.14001f6b0
test rbx, rbx
je 0x1400055b9
mov rcx, rbx
call fcn.140027dd0
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14005a330
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140006db4
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor esi, esi
mov dword [rbp + 0x170], 0x5f0084
mov dword [rbp + 0x174], 0xb00f6
mov ebx, eax
mov dword [rbp + 0x178], 0x480052
mov edx, esi
mov dword [rbp + 0x17c], 0x490055
movups xmm0, xmmword [rbp + 0x170]
mov dword [rbp + 0x180], 0x4a00e5
lea eax, [rsi + 5]
mov dword [rbp + 0x184], 0xeb
lea r15d, [rsi + 1]
movsd xmm1, qword [rbp + 0x180]
mov byte [rbp + 0x1aa], r15b
mov word [rbp + 0x1a8], ax
movups xmmword [rbp + 0x190], xmm0
movsd qword [rbp + 0x1a0], xmm1
mov cl, dl
movabs rax, 0x101010545b30fcb
and cl, 7
shl cl, 3
shr rax, cl
mov ecx, 0xff
and ax, cx
xor word [rbp + rdx*2 + 0x190], ax
add rdx, r15
cmp rdx, 0xd
jb 0x140006e80
or r8, 0xffffffffffffffff
mov byte [rbp + 0x1aa], sil
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x28]
call fcn.14001e5e0
jmp 0x140006f55
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.14001e5e0
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x170]
call fcn.14001bbe0
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x20]
call fcn.140020470
test rax, rax
jne 0x140006f3b
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140006f3b
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001bff0
test ebx, ebx
jne 0x140006ecf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x28]
call fcn.14001bff0
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14005a330
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140006f9c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dil, dl
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x140006fc5
call fcn.140060978
and qword [rbx + 0x80], 0
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x140006fde
call fcn.140060978
and qword [rbx + 0xa0], 0
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x140006ff7
call fcn.140060978
and qword [rbx + 0x88], 0
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x140007010
call fcn.140060978
and qword [rbx + 0x90], 0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x140007032
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
and qword [rbx + 0x98], 0
test dil, dil
je 0x140007043
mov rcx, qword [rbx + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x30]
xor dil, 1
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x140007834
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov dword [rbp - 9], 0xb6f63c1
mov ebx, 1
mov eax, dword [rbp - 9]
mov rsi, rdx
mov dword [rbp - 1], eax
xor edx, edx
mov word [rbp - 5], 0x16b
movzx eax, word [rbp - 5]
mov word [rbp + 3], ax
mov byte [rbp + 5], bl
mov cl, dl
movabs rax, 0x1010107670b17af
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbp + rdx - 1], al
add rdx, rbx
cmp rdx, 6
jb 0x140007885
lea rcx, [rbp - 1]
mov byte [rbp + 5], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
test rax, rax
jne 0x1400078c4
xor edi, edi
jmp 0x14000796c
movdqa xmm0, xmmword [0x14008d9a0]
xor edx, edx
movups xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x17], 0x11bf4dd2
mov dword [rbp + 0x1b], 0x72646266
movsd xmm0, qword [rbp + 0x17]
mov word [rbp + 0x1f], 0x23ce
movzx eax, word [rbp + 0x1f]
movsd qword [rbp + 0x37], xmm0
mov byte [rbp + 0x41], bl
mov word [rbp + 0x3f], ax
mov cl, dl
movabs rax, 0x101010963ef23bd
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbp + rdx + 0x27], al
add rdx, rbx
cmp rdx, 0x1a
jb 0x1400078fb
lea rdx, [rbp + 0x27]
mov byte [rbp + 0x41], 0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1400078bd
mov ecx, 0x30
call fcn.14006098c
and dword [rbp - 9], 0
mov rbx, rax
lea rax, [rbp - 9]
mov r8, rbx
mov r9d, 0x30
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call rdi
mov rdi, qword [rbx + 8]
mov rcx, rbx
call fcn.140060978
mov ecx, 0x248
call fcn.14006098c
and qword [rsp + 0x20], 0
mov r9d, 0x248
mov r8, rax
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
neg eax
sbb rax, rax
and rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14005a330
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000d8f0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x20], rcx
mov r8d, 0x20
lea rcx, [rbp + 0x40]
call fcn.14003f330
movzx eax, byte [rbp + 0x5f]
lea rdx, [rbp + 0x40]
and byte [rbp + 0x40], 0xf8
lea rcx, [rbp - 0x60]
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x5f], al
call fcn.14000e940
mov edx, dword [rbp - 0x18]
mov ecx, dword [rbp - 0x14]
mov r12d, dword [rbp + 4]
mov ebx, dword [rbp - 0x24]
mov r14d, dword [rbp + 8]
mov r10d, dword [rbp - 0x20]
mov edi, dword [rbp + 0xc]
mov r8d, dword [rbp - 0x1c]
mov r11d, dword [rbp + 0x10]
mov eax, dword [rbp - 0x38]
add eax, dword [rbp - 0x10]
mov r9d, dword [rbp + 0x14]
mov dword [rsp + 0x78], eax
mov eax, dword [rbp - 0x34]
add eax, dword [rbp - 0xc]
mov dword [rsp + 0x7c], eax
mov eax, dword [rbp - 8]
add eax, dword [rbp - 0x30]
mov dword [rbp - 0x80], eax
mov eax, dword [rbp - 4]
add eax, dword [rbp - 0x2c]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp]
add eax, dword [rbp - 0x28]
mov dword [rbp - 0x78], eax
lea eax, [r12 + rbx]
mov dword [rbp - 0x74], eax
sub r12d, ebx
lea eax, [r14 + r10]
mov dword [rsp + 0x64], r12d
mov dword [rbp - 0x70], eax
sub r14d, r10d
lea eax, [rdi + r8]
mov dword [rsp + 0x68], r14d
mov dword [rbp - 0x6c], eax
sub edi, r8d
lea eax, [r11 + rdx]
mov dword [rsp + 0x6c], edi
mov dword [rbp - 0x68], eax
sub r11d, edx
lea eax, [r9 + rcx]
mov dword [rsp + 0x70], r11d
mov dword [rbp - 0x64], eax
lea rdx, [rsp + 0x50]
mov eax, dword [rbp - 0x10]
sub r9d, ecx
sub eax, dword [rbp - 0x38]
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0xc]
sub eax, dword [rbp - 0x34]
mov dword [rsp + 0x54], eax
mov eax, dword [rbp - 8]
sub eax, dword [rbp - 0x30]
mov dword [rsp + 0x58], eax
mov eax, dword [rbp - 4]
sub eax, dword [rbp - 0x2c]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbp]
sub eax, dword [rbp - 0x28]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x74], r9d
call fcn.14000dab0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.14000e030
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14000fa90
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.14003f5e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14005a330
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbx
push rsi
push r14
sub rsp, 0x140
mov rax, qword [0x14009c218]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea eax, [r8 - 2]
mov esi, r8d
mov r10d, edx
mov r14, rcx
cmp eax, 0x3e
ja 0x140016145
cmp byte [rsp + 0x180], 0
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r15
je 0x140015fdd
lea r15, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz__
cmp r8d, 0x24
jbe 0x140015fe4
lea r15, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ__
mov r11d, 1
mov ebp, 0x100
cmp r9d, r11d
mov ecx, ebp
cmovae r11d, r9d
xor r13b, r13b
test r10d, r10d
jns 0x140016036
movzx eax, byte [rsp + 0x11f]
neg r10d
cmp byte [rsp + 0x1a0], 0
mov ecx, 0x29
mov r13b, 1
cmovne eax, ecx
movzx ecx, byte [rsp + 0x1a0]
xor ecx, 1
mov byte [rsp + 0x11f], al
add ecx, 0xff
movzx edi, byte [rsp + 0x188]
xor ebx, ebx
mov r9d, ebx
test r10d, r10d
jne 0x14001604d
test r11d, r11d
je 0x1400160a0
test dil, dil
je 0x140016074
test r9d, r9d
je 0x140016074
test ecx, ecx
je 0x1400160a0
mov eax, 0xaaaaaaab
mul r9d
shr edx, 1
lea edx, [rdx + rdx*2]
cmp r9d, edx
jne 0x140016078
dec ecx
mov byte [rsp + rcx + 0x20], dil
test ecx, ecx
je 0x1400160a0
xor edx, edx
mov eax, r10d
div esi
dec ecx
inc r9d
mov r10d, eax
test r11d, r11d
movzx eax, byte [rdx + r15]
mov byte [rsp + rcx + 0x20], al
lea eax, [r11 - 1]
cmove eax, r11d
mov r11d, eax
jmp 0x140016043
mov r15, qword [rsp + 0x130]
test r13b, r13b
mov r13, qword [rsp + 0x138]
je 0x1400160d6
test ecx, ecx
je 0x1400160fe
dec ecx
mov byte [rsp + rcx + 0x20], 0x2d
cmp byte [rsp + 0x1a0], bl
je 0x1400160fe
test ecx, ecx
je 0x1400160fe
dec ecx
mov byte [rsp + rcx + 0x20], 0x28
jmp 0x1400160fe
cmp byte [rsp + 0x190], bl
je 0x1400160ea
test ecx, ecx
je 0x1400160ea
dec ecx
mov byte [rsp + rcx + 0x20], 0x2b
cmp byte [rsp + 0x198], bl
je 0x1400160fe
test ecx, ecx
je 0x1400160fe
dec ecx
mov byte [rsp + rcx + 0x20], 0x20
sub ebp, ecx
mov eax, ecx
lea rsi, [rsp + 0x20]
mov edi, ebp
mov rbp, qword [rsp + 0x168]
add rsi, rax
je 0x140016138
mov ecx, edi
call fcn.1400139b0
mov rbx, rax
test rax, rax
je 0x140016138
test rdi, rdi
je 0x140016138
mov rcx, qword [rax]
mov r8d, edi
mov rdx, rsi
call fcn.14003f330
mov rdi, qword [rsp + 0x170]
mov qword [r14], rbx
jmp 0x14001614a
xor ebx, ebx
mov qword [rcx], rbx
mov rax, r14
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14005a330
add rsp, 0x140
pop r14
pop rsi
pop rbx
ret