joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d1cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x1400d1cf5
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1400d1780
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x1400d1d5d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, setsockopt
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.1400c2a80
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1400c9790
int3

Function at 0x1400df6f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov eax, 0x35
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm8
mov rbx, rcx
movsd xmm8, qword [0x14011e788]
cvtsi2sd xmm6, rax
test rax, rax
jns 0x1400df729
addsd xmm6, xmm8
movaps xmm0, xmm8
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2]
divsd xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
movsd xmm6, qword [0x1400ee430]
mov ecx, 1
cvttsd2si eax, xmm0
xorps xmm7, xmm7
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1400df863
mov qword [rsp + 0x60], rbp
movabs rbp, 0x38eb3ffff6d3
mov qword [rsp + 0x68], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x70], rdi
mov edi, eax
mov eax, dword [rbx]
cmp eax, 0x138
jne 0x1400df7dc
lea r8, [rbx + 0x10]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400df7a0
jmp 0x1400df7eb
cmp eax, 0x270
jb 0x1400df7eb
mov rcx, rbx
call fcn.1400e0ee0
mov eax, dword [rbx]
xorps xmm1, xmm1
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rbp
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
cvtsi2sd xmm1, rax
jns 0x1400df83d
addsd xmm1, xmm8
mulsd xmm1, xmm6
mulsd xmm6, xmm8
addsd xmm7, xmm1
sub rdi, 1
jne 0x1400df785
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x1400e0ee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
lea r9, [rcx + 0x9c8]
movabs rbx, 0xb5026f5aa96619e9
mov r11d, 0x9c
nop
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1400e0f00
lea r9, [r10 + 0xea8]
mov r11d, 0x9b
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1400e0f50
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], r11d
ret
Function at 0x1400e1ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x140158638]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400e1b7f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x1400e1c47
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400e1c35
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x1400e1c35
shr ecx, 1
je 0x1400e1bf3
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x1400e1be9
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x1400e1be0
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1400e1960
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.1400e15c0
jmp 0x1400e1c4f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1400b4d10
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.1400e4f50
add rsp, 0xae0
pop rbx
ret
Function at 0x1400e1d00
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140158638]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x14011e9e0]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x14011e9e4]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x14011e9c8]
mov word [rsp + 0x6c], ax
mov eax, gethostbyname
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x14011e9d8]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400e1e04
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400e1db8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x1400e1e27
inc ax
mov word [rsp + 0x6a], ax
jmp 0x1400e1dd3
cmp eax, 0xe7
jne 0x1400e1e27
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1400e1e27
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400e1d98
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400e4f50
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x1400e1e09

Function at 0x1400e1e30
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400e1e50
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x1400e1e46
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400e1e46
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400e1edb
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x1400e1ef0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1400e1ec4
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.1400e1c70
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e1f00
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x1400e1f16
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x1400e1f23
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400e1f1b
test rdx, rdx
je 0x1400e1f1b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1400e1f5a
cmp dword [rsp + 0x50], edi
jne 0x1400e1f5a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400e44b4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400e4538
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14011f600]
cmp byte [rcx + rax], 0
je 0x1400e4538
dec r8
sub rdx, 1
jne 0x1400e451e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400e5f34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e5f7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e5f7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e5f7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e5f7e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e5f7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400e5f80
xor al, al
add rsp, 0x28
ret
Function at 0x140002e70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002eba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002eba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002eba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002eba
cmp dword [rcx + 0x84], 0xe
jbe 0x140002eba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002ebc
xor al, al
add rsp, 0x28
ret

Function at 0x1400015a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
or ebx, 0xffffffff
lock xadd dword [0x140005020], ebx
sub ebx, 1
jne 0x1400015f7
lea ecx, [rbx + 4]
call fcn.140001028
and qword [rsp + 0x28], 0
lea r8, [0x140001570]
and dword [rsp + 0x20], ebx
mov r9, rax
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x493e0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400015f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400015f7
call fcn.1400011a8
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14000269c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400026e8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400026e0
cmp dword [rcx + 0x3c], edx
jl 0x1400026e0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400026e0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400026e8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400056e1
Capabilities:
Execute syscall

Disassembly:
mov rax, rcx
mov r10, rax
mov eax, dword [section..data]
syscall
ret

Function at 0x14165e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14165e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14165e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14165e06f
add dl, dl
jne 0x14165e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14165e0f6
xor eax, eax
add dl, dl
jne 0x14165e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14165e1ad
add dl, dl
jne 0x14165e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14165e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14165e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14165e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14165e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14165e07e
mov eax, 1
add dl, dl
jne 0x14165e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14165e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14165e0fb
sub eax, ebx
mov ebx, 1
jne 0x14165e14c
mov ecx, 1
add dl, dl
jne 0x14165e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14165e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14165e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14165e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14165e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14165e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14165e15d
cmp eax, 0x7d00
jae 0x14165e19b
cmp eax, 0x500
jb 0x14165e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14165e07e
cmp eax, 0x7f
ja 0x14165e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14165e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14165e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14165e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140015c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov r10d, 0x7b959da7
sub r10d, 0x6e61afa6
add r10d, 0x5499367f
sub r10d, 0x61cd247d
mov dword [rsp], 0x157526ec
add dword [rsp], 0x535d2c50
sub dword [rsp], 0x42c57218
add dword [rsp], 0x51ebb82d
sub dword [rsp], 0x77a99863
xor r9d, r9d
mov dword [rsp + 4], 0x54ad0d5e
sub dword [rsp + 4], 0x4b9f1eb2
xor dword [rsp + 4], 0x6532602c
sub dword [rsp + 4], 0x6c3c8e19
mov dword [rsp + 8], 0xcea1d5f
add dword [rsp + 8], 0x3b6b6dd
add dword [rsp + 8], 0x43272ce6
xor dword [rsp + 8], 0x5a30ea02
xor dword [rsp + 8], 0x9aeeb82
xchg r14, r8
mov r14, rcx
xchg r14, r8
lea eax, [r10 + 0x7a]
xchg r8, r8
mov word [rsp + 0xc], ax
mov qword [rsp + 0x20], r9
xchg r15, rax
mov r15, qword [rsp + 0x20]
xchg r15, rax
xchg rcx, r11
mov r11, qword [rsp + 0x20]
xchg r11, rcx
mov rax, qword [rsp + 0x20]
mov dword [rsp - 0xc], 0x13034095
and cl, r10b
shl cl, 3
movzx edx, word [rsp + rax*2]
mov dword [rsp - 0x18], 0x2dc3e79e
mov eax, 0x51769b1b
sub eax, 0x133b8a4d
sub eax, 0xd0a50d1
xor eax, 0x39699211
add eax, 0x24bb0adf
shr eax, cl
mov dword [rsp - 0xc], edi
movzx ecx, al
xchg r12, rax
mov r12, qword [rsp + 0x20]
xchg r12, rax
xor cx, dx
xchg rsp, rsp
mov word [r8 + rax*2], cx
xchg r12, rax
mov r12, qword [rsp + 0x20]
xchg r12, rax
inc rax
mov r8, r8
mov qword [rsp + 0x20], rax
xchg rdx, rax
mov rdx, qword [rsp + 0x20]
xchg rdx, rax
cmp rax, 7
jb 0x140015cb0
mov word [r8 + 0xe], r9w
mov dword [rsp - 0x20], 0x77036810
mov rax, r8
neg rsp
add rsp, 0xffffffffffffffe8
neg rsp
ret
Function at 0x14001683c
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rax
mov r15, rsp
xchg r15, rax
xchg rdx, rbx
mov qword [rax + 8], rdx
xchg rdx, rbx
xchg rbp, rdi
mov qword [rax + 0x10], rdi
xchg rdi, rbp
xchg rbp, rsi
mov qword [rax + 0x18], rbp
xchg rbp, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xfffffffffffffd20
neg rsp
xor ebx, ebx
mov dword [rsp - 0x30], 0x7c0cb460
lea r9, [rax - 0x228]
xchg rsi, rsp
mov rsp, rdx
xchg rsi, rsp
xchg rbx, r10
mov qword [rsp + 0x28], r10
xchg r10, rbx
or rbp, 0xffffffffffffffff
mov dword [rsp - 0x3c], esp
mov qword [rsp + 0x20], 0x433627fc
add qword [rsp + 0x20], 0x7f65fea
add qword [rsp + 0x20], 0x109430e
sub qword [rsp + 0x20], 0x4c35c8dc
lea rdx, [0x140000000]
xchg rcx, r13
mov r13, rbp
xchg r13, rcx
lea r8d, [rbx + 2]
call fcn.14005d270
mov rbx, rbx
test eax, eax
js 0x140016a6d
lea edx, [rbx + 0x5c]
mov dword [rsp - 0x20], ebp
lea rcx, [rsp + 0xd0]
call fcn.140093c50
mov rdi, rax
mov rdi, rdi
test rax, rax
je 0x140016a6d
lea edx, [rbx + 0x2e]
lea rcx, [rsp + 0xd0]
mov rbp, rbp
call fcn.140093c50
test rax, rax
je 0x140016937
mov word [rax], bx
mov dword [rsp - 0x20], 0x3af047e0
lea rcx, [rsp + 0x30]
call fcn.140015c00
lea r8, [rdi + 2]
xchg rdx, rbp
mov rbp, rax
xchg rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140015ec0
mov dword [rsp - 0x20], 0x2e3feec2
xor eax, eax
lea rdi, [rsp + 0x30]
xorps xmm0, xmm0
xchg r13, r13
lea ecx, [rax + 7]
rep stosb byte [rdi], al
lea rax, [rsi + 8]
mov dword [rsp - 0x38], edi
xchg rdi, rax
mov qword [rsi], rdi
xchg rdi, rax
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
lea rax, [rsp + 0x40]
inc rbp
xchg r13, r13
cmp word [rax + rbp*2], bx
jne 0x1400169a0
xchg rdx, rbp
mov rbp, rdx
xchg rdx, rbp
mov qword [rsi + 0x38], rbp
mov dword [rsp - 0x14], ebx
xchg rsi, rbp
mov rcx, rbp
xchg rbp, rsi
call fcn.140016760
mov dword [rsp - 0x40], 0x4a163f5
mov edx, 0x39e3a360
xor edx, 0x302ed582
add edx, 0x1078c4c8
add edx, 0x5020231d
xor edx, 0x4772660c
cmp qword [rsi + 0x38], rbx
mov dword [rsp - 0x3c], ebx
jbe 0x140016a99
lea rdi, [rsp + 0x40]
sub rdi, rax
movzx ecx, dx
mov dword [rsp - 0x2c], edi
mov r8d, 0x2888623e
xor r8d, 0x1f136d59
xor r8d, 0x6306be60
sub r8d, 0x800d4b5
sub r8d, 0x4c9cdb53
and cx, r8w
mov dword [rsp - 0x3c], edi
ror edx, 2
ror edx, 4
ror edx, 1
ror edx, 1
xor cx, word [rdi + rax]
mov r15, r15
inc rbx
mov word [rax], cx
lea rax, [rax + 2]
cmp rbx, qword [rsi + 0x38]
mov dword [rsp - 0x3c], 0x4d5ad2d6
jb 0x140016a0a
jmp 0x140016a99
lea rax, [rsi + 8]
xorps xmm0, xmm0
xchg r8, r8
mov qword [rsi], rax
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg r9, rax
movups xmmword [r9 + 0x10], xmm0
xchg r9, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
mov qword [rsi + 0x38], rbx
lea r11, [rsp + 0x2e0]
xchg rdx, rdx
mov rax, rsi
xchg rbx, r13
mov r13, qword [r11 + 0x10]
xchg rbx, r13
xchg rbp, rsi
mov rsi, qword [r11 + 0x18]
xchg rbp, rsi
xchg rsi, r10
mov r10, qword [r11 + 0x20]
xchg rsi, r10
xchg rsp, r9
mov r9, r11
xchg rsp, r9
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140027fc4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x40], 0x6b4536db
push rdi
add rsp, 0xffffffffffffffa0
xchg rsi, r12
mov r12, rcx
xchg r12, rsi
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
nop
sub rcx, 0x3e69da2d
add rcx, 0x3e69da35
xor edx, edx
mov r8d, 0x79ee346e
sub r8d, 0x5d3e0429
add r8d, 0x18500a80
sub r8d, 0x35003a45
xchg r9, rcx
mov qword [rsi], r9
xchg rcx, r9
call fcn.1400931c0
mov dword [rsp - 0x10], esp
mov rbx, qword [rdi + 0x38]
lea rax, [rsp + 0x28]
mov rbp, qword [rdi]
lea rcx, [rsp + 0x20]
mov r15, r15
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbx + 1]
mov dword [rsp - 0x44], ebx
xchg rdi, rsp
movups xmmword [rdi + 0x38], xmm0
xchg rsp, rdi
xchg rsp, rbp
movups xmmword [rbp + 0x48], xmm0
xchg rbp, rsp
call fcn.140016760
mov r12, r12
xor r10d, r10d
mov edi, 0x28a04ee5
xor edi, 0x204d5efe
add edi, 0x44e7ce11
sub edi, 0x20c0a561
test rbx, rbx
mov dword [rsp - 0x1c], esi
je 0x140028102
xchg r9, rax
mov rdx, r9
xchg r9, rax
sub rbp, rax
mov dword [rsp - 0x24], edx
xchg rbp, r8
mov rbp, rbx
xchg rbp, r8
movzx ecx, di
mov r9d, 0x2be5025b
sub r9d, 0x1a47fc0b
add r9d, 0xe66d8c
xor r9d, 0x27156bba
xor r9d, 0x35961899
and cx, r9w
ror edi, 1
ror edi, 6
ror edi, 1
xor cx, word [rdx + rbp]
mov word [rdx], cx
lea rdx, [rdx + 2]
mov dword [rsp - 0xc], ebx
sub r8, 1
jne 0x1400280b9
mov word [rax + rbx*2], r10w
mov r9, r9
xchg rsi, r8
mov rsi, rbx
xchg r8, rsi
xchg rdx, r12
mov r12, qword [rsp + 0x20]
xchg rdx, r12
xchg r11, rsi
mov rcx, r11
xchg rsi, r11
call fcn.14007e670
mov dword [rsp - 0x2c], 0x7a44bca0
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x1c], 0x4e37c2ff
jne 0x140028163
xor eax, eax
lea rdi, [rsp + 0x28]
xchg rdx, rdx
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
jmp 0x140028168
call fcn.140092c10
lea r11, [rsp + 0x60]
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rbx, r9
mov r9, qword [r11 + 0x10]
xchg r9, rbx
xchg rbp, rdx
mov rdx, qword [r11 + 0x18]
xchg rbp, rdx
xchg r9, rsi
mov r9, qword [r11 + 0x20]
xchg r9, rsi
xchg r15, r11
mov rsp, r15
xchg r11, r15
pop rdi
mov dword [rsp - 0x1c], esi
ret