joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002480
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000249f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400024a8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400024c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400097a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400024e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400024e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024e0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400024e0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002534
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002540
add rdx, 0x28
cmp r9, rdx
jne 0x140002520
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002550
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400097a0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002572
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002580
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002572
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002572
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002572
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400025d5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400025e8
add rdx, 0x28
cmp rdx, r10
jne 0x1400025c0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400025f7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002607
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400025de
test ecx, ecx
jg 0x1400025f0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140027330
Capabilities:
Get disk information

Disassembly:
push rbx
add dword [rax], eax
mov rcx, qword [rsp - 0x619ffdb0]
xchg dword [rbx], esi
int3
push rbx
sub rsp, 0x20
mov rbx, rcx
je 0x140027305
jne 0x140027370
mov ch, 0xc8
dec dword [rax - 0x7d]
invalid
push rsi
enter 0x20ec, 0xffffffffffffffc0
jns 0x1400273a1
add byte [rax - 0x75], cl
int1
ja 0x140027392
call 0x140fafe58
invalid
cmp dword [rbx], 0x38
add cl, byte [0xc94b189b]
pop rsp
and al, 0x38
mov qword [rsp - 0xc], rdi
and al, 0xf4
adc eax, 0x2cab8d48
mov dword [rcx + 0x27cb0238], 0x12e7
adc al, 0x81
fstp dword [rsi]
add ch, cl
mov rdi, qword [rcx + 0x5000240]
sbb qword [rsi - 0x2600b7fd], 0x66
cmp dword [rdi + rbx*2], 0
sub edi, ebp
test rbx, rbx
mov esi, 0xcf8b484d
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sbb bh, al
add dword [rsp + 0x48], ecx
clc
xchg esp, eax
je 0x140027441
test dword [r10], r10d
lea r8, [rsp - 0x75]
xor edx, dword [rdi]
mov rbp, rbp
call qword [fcn.14008e340]
mov al, al
je 0x140027402
cmp qword [rsp + 0x69], 0x19
jne 0x140027445
imul ebx, dword [rcx], 0x8d5d3f75
cmp al, 0x5f
pop rbp
lea edi, [rdi + rbx*2]
add rdi, 2
rol dword [rbx - 0xb78e35], 1
ret
invalid
lea rax, [rbx + 1]
mov ecx, 0x8004
lea rax, [rdi + rax*2]
invalid

Function at 0x140027370
Capabilities:
Get disk information

Disassembly:
push rbx
add dword [rax], eax
mov rcx, qword [rsp - 0x619ffdb0]
xchg dword [rbx], esi
int3
push rbx
sub rsp, 0x20
mov rbx, rcx
je 0x140027305
jne 0x140027370
mov ch, 0xc8
dec dword [rax - 0x7d]
invalid
push rsi
enter 0x20ec, 0xffffffffffffffc0
jns 0x1400273a1
add byte [rax - 0x75], cl
int1
ja 0x140027392
call 0x140fafe58
invalid
cmp dword [rbx], 0x38
add cl, byte [0xc94b189b]
pop rsp
and al, 0x38
mov qword [rsp - 0xc], rdi
and al, 0xf4
adc eax, 0x2cab8d48
mov dword [rcx + 0x27cb0238], 0x12e7
adc al, 0x81
fstp dword [rsi]
add ch, cl
mov rdi, qword [rcx + 0x5000240]
sbb qword [rsi - 0x2600b7fd], 0x66
cmp dword [rdi + rbx*2], 0
sub edi, ebp
test rbx, rbx
mov esi, 0xcf8b484d
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sbb bh, al
add dword [rsp + 0x48], ecx
clc
xchg esp, eax
je 0x140027441
test dword [r10], r10d
lea r8, [rsp - 0x75]
xor edx, dword [rdi]
mov rbp, rbp
call qword [fcn.14008e340]
mov al, al
je 0x140027402
cmp qword [rsp + 0x69], 0x19
jne 0x140027445
imul ebx, dword [rcx], 0x8d5d3f75
cmp al, 0x5f
pop rbp
lea edi, [rdi + rbx*2]
add rdi, 2
rol dword [rbx - 0xb78e35], 1
ret
invalid
lea rax, [rbx + 1]
mov ecx, 0x8004
lea rax, [rdi + rax*2]
invalid
Function at 0x140034b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [rax], al
mov dword [rsp + 0x38], 0x80c1
mov cl, 0x44
and al, 0x30
cmpsb byte [rsi], byte [rdi]
add byte [rax], ah
xor edi, eax
and al, 0x28
mov qword [rbp + rsi*8 + 8], rbx
jbe 0x140034b00
insb byte [rdi], dx
xchg ecx, eax
adc byte [rax - 0x77], cl
je 0x140034ba2
sbb byte [rbx + 0x6a415641], bl
sbb rsp, 0x30
mov rax, qword [rcx + 0x868]
xor r10d, r10d
movzx esi, r8w
mov rsp, qword [rdx]
xchg edi, eax
movsd dword [rdi], dword [rsi]
jmp 0xc523c42b
test byte [rax + 0x4c00fec9], bl
cmp esi, dword [rax + 0x28]
cmp al, 0xb6
cmp eax, 0x30ca76
nop dword [rsi + 0x1f0f6600]
test byte [rax], al
add byte [rbx - 0x72b10000], ah
or al, 0x52
lea r9, [r10 + r10*2]
rol r14, 4
mov r12b, 0xce
mov r11, qword [r9]
test r11, r11
je 0x140034c37
movzx eax, si
cmp dword [r9 + 0x20], eax
sbb ebp, dword [rcx + 0x66]
mov edx, dword [rdx - 0x3f7ab7f0]
jne 0x140034bee
lea rdx, [rax + 0x695d7c]
jmp 0x140034c0b
add bl, ch
sbb eax, 0x74003880
adc dword [rbp - 0x4a], esp
or byte [rdx], bh
or eax, 0x6ca6a
cmp byte [rax], 0
je 0x140034c04
mov dh, 8
cmp cl, byte [0x1400a1666]
jne 0x140034c0b
cmp byte [rcx + 0x482d7594], r11b
insd dword [rdi], dx
insd dword [rdi], dx
push rdx
lodsb al, byte [rsi]
popfq
push rcx
mov esi, dword [rbp + rax*4 + 0x482774c0]
test ebx, esp
xlatb
mov ah, 0x85
sal byte [rdi + riz + 0x48], 0x85
jrcxz 0x140034beb
and cl, byte [rbx + rcx*4 - 0x47]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
push rdx
sal dword [rbp + 7], 1
inc rax
jmp 0x140034bf1
inc r10d
cmp r10d, edi
jb 0x140034bc0
div byte [rdi + 0xdfb48d6]
invalid

Function at 0x1400644b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x77], rbx
xchg rsp, rax
insb byte [rdi], dx
cli
jb 0x140064520
lodsb al, byte [rsi]
je 0x1400644e2
and byte [rdi + 0x41], dl
push rsi
push r15
xor r11d, r11d
nop
lea edi, [0x1400bdf3a]
movabs qword [0x41f68b4cda8b48f1], rax
mov esp, dword [rsi + 0x3a0d8348]
jbe 0x14006455c
add byte [rax], al
int1
invalid
movzx ecx, sil
rol byte [rdx], 2
shr cl, 0xf2
add r10, 3
add sil, byte [rdi]
adc al, 0xe6
adc al, 0xe6
invalid
add al, ah
psubw mm3, qword [rdx + rax*2]
psrlq mm6, qword [rbx + 0x39]
jne 0x140064533
add byte [rdx], al
movzx ecx, sil
xchg ecx, eax
movzx ecx, byte [rcx + rdi]
mov byte [rcx + r15 + 3], cl
xor rax, rax
add al, 0xdd
invalid
Function at 0x14006a158
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [rbp - 0x79]
cmpsb byte [rsi], byte [rdi]
mov dh, 0xc1
cmp dword [rdi + rax*4 + 0xc00], r8d
sbb eax, 0x8b411442
scasw ax, word [rdi]
call 0x110bd4685
xchg r8d, eax
rol byte [rbp - 0x75], 0xc8
mov r8d, dword [rdi + rdx*4 + 0x4d1]
cmp al, 0xc1
call 0x1082ec792
push 0x79
ror dword [rax - 0x3f], 0x49
sbb byte [0x14096266f], bh
or byte [rax], al
add bh, dh
xor edi, dword [0xf615e327]
rol dword [rbx + rsi - 0x7c], 0xb9
add byte [rax + rax], cl
add byte [rbp + 0x33], al
sbb byte [rbp - 0x6b], al
enter 0x5d59, 0xffffffffffffffc0
shr rax, 0x10
shr eax, 0x10
movzx edx, al
sub r8d, eax
or ecx, dword [rax]
test dword [rax], ecx
movzx esi, byte [rbx + 0x44c18b41]
mov eax, dword [rdi + rdx*4 + 0x400]
shr rax, 0x18
xor r8b, byte [rdi + rcx*4 + 0x61000800]
xor r10d, eax
xchg dword [rcx + 0xf], eax
mov dh, 0xc1
xor r8d, dword [rdi + rax*8 + 0xc00]
cwde
xor eax, dword [rdi + 0x1c]
jnp 0x14006a1b4
and bl, al
rol byte cs:[rbx], 0xc1
call 0x11c6e020d
mov eax, r8d
shr rax, 8
movzx edx, al
mov ecx, dword [rdi + rcx*4 + 0x42000434]
rcr byte [rdx], 0xc1
call 0xd792d530
add byte [rax], cl
add byte [rax], al
and byte [rdi + rax*4], cl
pushfq
sbb cl, byte [rbx]
xor eax, eax
xchg dword [rax], eax
add byte [r8], al
xor al, byte [rbx - 0x7a37fe15]
in al, dx
std
invalid
Function at 0x140e82a58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e82a62
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e82a8b
pop rbp
sub rbp, 0x33
sub rbp, 0xe82a58
sub rsp, 0x20
jmp 0x140e82aaa
mov rax, 0xe82a58
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffe7fa9ed2
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e82ac9
jmp 0x140e82ae0
invalid

Function at 0x100001f08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001f55
cmp rcx, 0xffffffffffffffff
je 0x100001f55
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100001f4d
cmp dword [rcx + 0x3c], edx
jl 0x100001f4d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100001f4d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001f55
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001fa0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140001ff7
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140002000
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140001fe7
mov qword [rsi], rdi
call fcn.14002f5f0
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140049f00
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140007ca4
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
mov r9d, 0x40
lea r11, [rcx + r9]
cmp r8, r9
jb 0x140007df2
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
lea r10, [r9 + 0x80]
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140154180]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x140007d3d
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140154190]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x140007e82
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x140007e57
movdqa xmm1, xmmword [0x140154190]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
movss xmm0, xmm3
pclmulqdq xmm0, xmmword [0x1401541a0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000cde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14000cf06
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, edx
mov rsi, rcx
mov rax, qword [0x14019e638]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14000cf4d
mov edi, dword [rsi + 0x5c]
test r12b, r12b
je 0x14000d081
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
jmp 0x14000d081
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14013b680
cmp eax, 0xffffffff
je 0x14000d07c
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x14000cf6b
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x14000cfb2
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r12b, r12b
je 0x14000d043
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14000d081
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r15d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14000d069
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r15w
cmp rdi, 8
je 0x14000d07c
mov rcx, qword [rsi + 0x40]
call fcn.14013b680
cmp eax, 0xffffffff
je 0x14000d07c
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14000cfc7
mov edi, edi
test rdi, rdi
jle 0x14000d062
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + rdi + 0x57]
dec rdi
call fcn.140141d64
cmp eax, 0xffffffff
jne 0x14000d045
jmp 0x14000d07c
movzx edi, byte [rsp + 0x57]
jmp 0x14000d081
cmp eax, 2
je 0x14000d07c
cmp eax, 3
je 0x14000cf94
jmp 0x14000cf9c
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401207e0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000d130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14000d25a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, edx
mov rsi, rcx
mov rax, qword [0x14019e638]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14000d2a1
movzx edi, word [rsi + 0x5c]
test r12b, r12b
je 0x14000d3dc
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x14000d3dc
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14013b680
cmp eax, 0xffffffff
je 0x14000d3d8
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rbp, rdi
jb 0x14000d2bf
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x14000d30b
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r12b, r12b
je 0x14000d39c
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14000d3dc
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r15d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14000d3c5
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r15w
cmp rdi, 8
je 0x14000d3d8
mov rcx, qword [rsi + 0x40]
call fcn.14013b680
cmp eax, 0xffffffff
je 0x14000d3d8
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14000d320
mov edi, edi
test rdi, rdi
jle 0x14000d3be
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.140141d64
cmp eax, 0xffffffff
jne 0x14000d39e
jmp 0x14000d3d8
movzx edi, word [rsp + 0x56]
jmp 0x14000d3dc
cmp eax, 2
je 0x14000d3d8
cmp eax, 3
je 0x14000d2ea
jmp 0x14000d2f4
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401207e0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000d440
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14019e638]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14013b2a4
cmp rax, rbx
jne 0x14000d4dc
cmp edi, 1
je 0x14000d484
cmp edi, 2
je 0x14000d4dc
mov rcx, qword [rsi + 0x40]
call fcn.14013a858
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401207e0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000d500
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000d535
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14013b2a4
xor ebx, ebx
test rsi, rsi
jle 0x14000d55a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14000d55a
inc rbx
cmp rsi, rbx
jne 0x14000d53c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000d570
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x14019e638]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
mov byte [rsp + 0x57], 0xaa
cmp edx, 0xffffffff
je 0x14000d5e1
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14000d5f0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14013b2a4
mov esi, 0xffffffff
cmp rax, 1
jne 0x14000d6a5
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x14000d6a5
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14000d6a0
mov ebp, eax
cmp eax, 3
je 0x14000d67f
cmp ebp, 1
ja 0x14000d6a0
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14013b2a4
cmp rax, rsi
jne 0x14000d6a0
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000d608
jmp 0x14000d5e1
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14013b2a4
cmp rax, 1
je 0x14000d5e1
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401207e0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000d710
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000d745
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14013b2a4
xor ebx, ebx
test rsi, rsi
jle 0x14000d76b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14000d76b
inc rbx
cmp rsi, rbx
jne 0x14000d74c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000d780
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x14019e638]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
mov word [rsp + 0x56], 0xaaaa
cmp dx, 0xffff
je 0x14000d7f2
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14000d802
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14013b2a4
mov di, 0xffff
cmp rax, 1
jne 0x14000d8b6
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x14000d8b6
lea r15, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], r15
lea rbx, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x14000d8b2
mov ebp, eax
cmp eax, 3
je 0x14000d891
cmp ebp, 1
ja 0x14000d8b2
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14013b2a4
cmp rax, rbx
jne 0x14000d8b2
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000d81a
jmp 0x14000d7f2
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.14013b2a4
cmp rax, 1
je 0x14000d7f2
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401207e0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140011e20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140011e57
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140011e31
ret

Function at 0x140011f70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140011fa8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140011f81
ret