joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140280390
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
mov rsi, qword [rsp + 0x68]
movzx ebp, r9w
mov r14, qword [rsp + 0x60]
mov r15d, r8d
mov r12d, edx
and qword [rsi], 0
mov byte [r14], 0
call qword [sym.imp.ws2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x14028043e
cmp word [rax + 0x10], 2
jne 0x14028041e
cmp word [rax + 0x12], 4
jne 0x14028041e
mov rdi, qword [rax + 0x18]
jmp 0x140280416
mov r9d, dword [rax]
movzx r8d, bp
mov edx, r15d
mov ecx, r12d
call fcn.1402802e0
mov qword [rsi], rax
test rax, rax
je 0x140280437
lea rsi, [rax + 0x28]
add rdi, 8
mov rax, qword [rdi]
test rax, rax
jne 0x1402803f4
mov r8, qword [rbx]
mov r9d, 0x400
mov rcx, r14
lea edx, [r9 + 1]
call fcn.1403df890
xor eax, eax
jmp 0x140280465
mov eax, 8
jmp 0x140280465
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x140280463
sub eax, 1
je 0x14028045c
cmp eax, 1
jne 0x140280463
lea eax, [rcx + 2]
jmp 0x140280465
mov eax, 0x2afa
jmp 0x140280465
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140291500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x48
call fcn.1403cb200
sub rsp, rax
mov r12, qword [rsp + 0xc0]
mov rdi, r8
mov r15, qword [rsp + 0xb8]
mov r14, rdx
mov rbp, rcx
mov ebx, dword [r12]
test ebx, ebx
je 0x140291560
test rdi, rdi
je 0x140291560
mov eax, ebx
dec rdi
mov cl, byte [rax + r15]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14029153f
mov esi, 0x10
cmp rdi, rsi
jb 0x14029165d
mov rax, qword [rsp + 0xb0]
mov rcx, rdi
add rax, rsi
shr rcx, 4
mov qword [rsp + 0x30], rax
mov r12, r14
imul rax, rcx, 0xfffffffffffffff0
mov r13, rbp
xor ebx, ebx
add rdi, rax
mov dword [rsp + 0x20], ebx
mov rax, rcx
mov qword [rsp + 0xa0], rdi
mov rdi, qword [rsp + 0x30]
sub r12, r15
shl rax, 4
sub r13, r15
add r14, rax
mov rbx, rcx
add rbp, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0xb0]
mov qword [rsp + 0x90], rbp
mov rbp, qword [rsp + 0xa8]
mov r8, rbp
mov rdx, r15
mov rcx, r14
call qword [rsp + 0xc8]
mov r8d, esi
mov ecx, 1
mov rdx, rdi
dec rdx
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x1402915f6
mov rcx, r15
lea edx, [r8 + 2]
mov rax, qword [rcx + r13]
xor rax, qword [rcx]
mov qword [r12 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140291610
add r12, rsi
add r13, rsi
sub rbx, 1
jne 0x1402915db
mov ebx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0xc0]
mov r9, qword [rsp + 0xa8]
test rdi, rdi
je 0x1402916aa
mov r13, qword [rsp + 0xb0]
mov r8, r9
mov rcx, r13
mov rdx, r15
call qword [rsp + 0xc8]
mov ecx, 1
lea rdx, [r13 + 0x10]
dec rdx
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add esi, 0xffffffff
jne 0x140291683
mov ecx, ebx
inc ebx
mov al, byte [rcx + rbp]
xor al, byte [rcx + r15]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x140291695
mov dword [r12], ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402916c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.1403cb200
sub rsp, rax
mov rax, qword [rsp + 0xa0]
mov rbx, r8
mov r13, qword [rsp + 0x98]
mov r15, rdx
mov rbp, rcx
mov edi, dword [rax]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x140291730
test rbx, rbx
je 0x140291729
mov eax, edi
dec rbx
mov cl, byte [rax + r13]
xor cl, byte [rbp]
inc rbp
mov byte [r15], cl
inc r15
inc edi
and edi, 0xf
jne 0x140291708
mov dword [rsp + 0x80], edi
mov r14, qword [rsp + 0x90]
mov r12d, 0xc
add r14, 0xc
mov esi, dword [r14]
bswap esi
cmp rbx, 0x10
jb 0x1402917f9
mov rdi, qword [rsp + 0x90]
mov r13d, 0x10000000
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
cmp rdx, r13
cmova rdx, r13
add esi, edx
mov r12, rdx
mov eax, esi
mov ecx, esi
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor esi, esi
cmp rax, rdx
mov r8, r12
mov rdx, r15
cmovae esi, ecx
mov rcx, rbp
call qword [rsp + 0xa8]
mov eax, esi
bswap eax
mov dword [r14], eax
test esi, esi
jne 0x1402917c5
lea ecx, [rsi + 1]
mov rdx, r14
lea r8d, [rsi + 0xc]
dec rdx
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x1402917b2
mov r9, qword [rsp + 0x88]
shl r12, 4
sub rbx, r12
add r15, r12
add rbp, r12
cmp rbx, 0x10
jae 0x14029175f
mov edi, dword [rsp + 0x80]
mov r12d, 0xc
mov r13, qword [rsp + 0x98]
test rbx, rbx
je 0x14029186d
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x10]
call fcn.1403ccc50
mov rax, qword [rsp + 0x90]
mov r8d, 1
mov r9, qword [rsp + 0x88]
mov rdx, r13
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [rsp + 0xa8]
add esi, 1
bswap esi
mov dword [r14], esi
jne 0x140291858
mov ecx, 1
dec r14
movzx eax, byte [r14]
add ecx, eax
mov byte [r14], cl
shr ecx, 8
add r12d, 0xffffffff
jne 0x140291843
mov ecx, edi
inc edi
mov al, byte [rcx + rbp]
xor al, byte [rcx + r13]
mov byte [rcx + r15], al
sub rbx, 1
jne 0x140291858
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x70]
mov dword [rax], edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140291890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov ebx, dword [r15]
test ebx, ebx
jns 0x1402918d2
or ebx, 0xffffffff
jmp 0x1402919bf
mov rsi, qword [rsp + 0x80]
test ebx, ebx
je 0x1402918fe
test rdi, rdi
je 0x1402918fe
mov eax, ebx
dec rdi
mov cl, byte [rax + rsi]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x1402918de
cmp rdi, 0x10
jb 0x140291996
mov r15, r14
mov r13, rdi
shr r13, 4
mov r12, rbp
imul rax, r13, 0xfffffffffffffff0
sub r15, rsi
sub r12, rsi
add rdi, rax
mov rax, r13
shl rax, 4
add r14, rax
mov qword [rsp + 0x68], r14
add rbp, rax
mov r14, qword [rsp + 0x78]
mov r8, r14
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x90]
cmp ebx, 0x10
jae 0x140291974
mov edx, 0xf
mov ecx, ebx
sub edx, ebx
add rcx, rsi
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14029195f
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x140291939
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x88]
mov r9, qword [rsp + 0x78]
test rdi, rdi
je 0x1402919bf
mov r8, r9
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x90]
mov ecx, ebx
inc ebx
mov al, byte [rcx + rbp]
xor al, byte [rcx + rsi]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x1402919ab
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140291b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
mov rbp, qword [rsp + 0x88]
mov r13, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov ebx, dword [rbp]
test ebx, ebx
jns 0x140291bd5
or ebx, 0xffffffff
jmp 0x140291dc0
cmp dword [rsp + 0x90], 0
mov rsi, qword [rsp + 0x80]
je 0x140291ce3
test ebx, ebx
je 0x140291c12
test rdi, rdi
je 0x140291c12
mov al, byte [r15]
dec rdi
mov ecx, ebx
inc r15
xor byte [rcx + rsi], al
mov al, byte [rcx + rsi]
mov byte [r14], al
inc r14
inc ebx
and ebx, 0xf
jne 0x140291bef
cmp rdi, 0x10
jb 0x140291cad
mov r12, r14
mov r13, rdi
shr r13, 4
mov rbp, r15
imul rax, r13, 0xfffffffffffffff0
sub r12, rsi
sub rbp, rsi
add rdi, rax
mov rax, r13
shl rax, 4
add r14, rax
mov qword [rsp + 0x68], r14
add r15, rax
mov r14, qword [rsp + 0x78]
mov r8, r14
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x98]
cmp ebx, 0x10
jae 0x140291c8b
mov edx, 0xf
mov ecx, ebx
sub edx, ebx
add rcx, rsi
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r12 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140291c73
add r12, 0x10
add rbp, 0x10
xor ebx, ebx
sub r13, 1
jne 0x140291c4d
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
test rdi, rdi
je 0x140291dc0
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x98]
mov ecx, ebx
inc ebx
mov al, byte [rcx + r15]
xor byte [rcx + rsi], al
mov al, byte [rcx + rsi]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x140291cc6
jmp 0x140291dc0
test ebx, ebx
je 0x140291d0c
test rdi, rdi
je 0x140291d0c
mov dl, byte [r15]
dec rdi
mov ecx, ebx
inc r15
mov al, dl
xor al, byte [rcx + rsi]
mov byte [r14], al
inc r14
inc ebx
mov byte [rcx + rsi], dl
and ebx, 0xf
jne 0x140291ce7
cmp rdi, 0x10
jb 0x140291d91
mov rbp, rdi
mov r12, r14
shr rbp, 4
sub r12, rsi
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x98]
cmp ebx, 0x10
jae 0x140291d75
mov r10d, 0xf
mov r8d, ebx
sub r10d, ebx
mov r9, r15
shr r10d, 3
add r8, rsi
sub r9, r14
inc r10d
lea rcx, [r12 + r8]
mov rdx, qword [rcx + r9]
mov rax, rdx
xor rax, qword [r8]
mov qword [rcx], rax
mov qword [r8], rdx
lea r8, [r8 + 8]
sub r10, 1
jne 0x140291d57
add r14, 0x10
add r12, 0x10
add r15, 0x10
xor ebx, ebx
sub rbp, 1
jne 0x140291d26
mov rbp, qword [rsp + 0x88]
test rdi, rdi
je 0x140291dc0
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [rsp + 0x98]
mov edx, ebx
inc ebx
mov cl, byte [rdx + r15]
mov al, cl
xor al, byte [rdx + rsi]
mov byte [rdx + r14], al
mov byte [rdx + rsi], cl
sub rdi, 1
jne 0x140291da6
mov dword [rbp], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140291de0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x50
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb0]
lea eax, [r8 - 1]
mov r12, qword [rsp + 0xc0]
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov rbx, rcx
cmp eax, 0x7f
ja 0x140291f43
mov ebp, 0x10
lea rcx, [rsp + 0x20]
mov r8d, ebp
mov rdx, rdi
call fcn.1403cc5a0
mov r8, r15
mov rdx, rdi
mov rcx, rdi
call r12
lea eax, [r14 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r9, eax
test eax, eax
jle 0x140291ed0
cmp dword [rsp + 0xb8], 0
je 0x140291e96
mov rcx, rdi
lea rdx, [rsp + 0x30]
sub rcx, rbx
sub rdx, rbx
sub rsi, rbx
mov al, byte [rcx + rbx]
xor al, byte [rbx]
mov byte [rdx + rbx], al
mov byte [rsi + rbx], al
inc rbx
sub r9, 1
jne 0x140291e80
jmp 0x140291ed0
lea rax, [rsp + 0x30]
mov r10, rdi
sub rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rsi, rax
lea rdx, [rsp + 0x30]
add rdx, r8
inc r8
mov cl, byte [rbx + rdx]
mov byte [rdx], cl
xor cl, byte [r10 + rdx]
mov byte [rsi + rdx], cl
cmp r8, r9
jl 0x140291eb4
mov eax, r14d
cdq
and edx, 7
add eax, edx
mov r9d, eax
and eax, 7
sar r9d, 3
sub eax, edx
mov r10d, eax
movsxd rax, r9d
lea r9, [rsp + 0x20]
add r9, rax
test r10d, r10d
jne 0x140291f08
mov r8, rbp
mov rdx, r9
mov rcx, rdi
call fcn.1403cc5a0
jmp 0x140291f43
mov r8b, byte [r9]
sub rdi, rax
mov r11d, 8
lea rax, [rsp + 0x20]
sub r11d, r10d
sub rdi, rax
lea rdx, [r9 + 1]
mov cl, r11b
mov al, byte [rdx]
shr al, cl
mov ecx, r10d
shl r8b, cl
or al, r8b
mov r8b, byte [rdx]
mov byte [rdi + r9], al
lea r9, [rdx]
sub rbp, 1
jne 0x140291f1f
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140292da0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, qword [rcx + 0x30]
mov rbp, r8
mov r12, qword [rcx + 0x38]
mov r14, rdx
mov esi, dword [rcx + 0x170]
mov rdi, rcx
mov rax, qword [rcx + 0x160]
mov r13, qword [rcx + 0x168]
shl r15, 3
shl r12, 3
test esi, esi
je 0x140292e3d
add rcx, 0x188
lea ebx, [rsi + 0xf]
and ebx, 0xfffffff0
add rcx, rsi
mov r8d, ebx
xor edx, edx
sub r8d, esi
call fcn.1403ccc50
mov r9d, 0x30
mov esi, ebx
cmp ebx, r9d
jne 0x140292e50
lea r8, [rdi + 0x188]
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call r13
xor esi, esi
jmp 0x140292e50
cmp dword [rcx + 0x174], 0
je 0x140292e50
lea rdx, [rcx + 0x60]
add rcx, 0x40
call rax
mov eax, esi
lea rcx, [rdi + 0x188]
bswap r15
bswap r12
add rcx, rax
mov qword [rsp + 0x20], r15
mov r8d, 0x10
mov qword [rsp + 0x28], r12
lea rdx, [rsp + 0x20]
call fcn.1403cc5a0
lea rbx, [rdi + 0x40]
mov rcx, rbx
lea r9d, [rsi + 0x10]
lea r8, [rdi + 0x188]
lea rdx, [rdi + 0x60]
call r13
mov r9, rbx
mov r8d, 2
mov rax, qword [r9 - 0x20]
xor qword [r9], rax
lea r9, [r9 + 8]
sub r8, 1
jne 0x140292e9e
test r14, r14
je 0x140292eca
cmp rbp, 0x10
ja 0x140292eca
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.1400102b0
jmp 0x140292ecd
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1403cb150
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140293000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
mov r12, qword [rcx + 0x160]
mov rsi, r8
xor edi, edi
mov qword [rsp + 0x60], r12
lea r8d, [rax - 0x14]
xorps xmm0, xmm0
mov rbp, rdx
mov rbx, rcx
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x170], rdi
cmp rsi, r8
jne 0x14029305f
call fcn.1403cc5a0
mov dword [rbx + 0xc], 0x1000000
lea esi, [rdi + 1]
jmp 0x140293122
mov qword [rsp + 0x70], rsi
lea r14, [rcx + 0x40]
lea r13, [rcx + 0x60]
mov r15, rsi
movups xmmword [r14], xmm0
cmp rsi, 0x10
jb 0x1402930d5
mov rdi, qword [rsp + 0x60]
mov r12, rsi
shr r12, 4
mov r15, rbp
imul rax, r12, 0xfffffffffffffff0
sub r15, rbx
add rsi, rax
sub r15, 0x40
mov rax, r12
shl rax, 4
add rbp, rax
mov rcx, r14
mov edx, 0x10
mov al, byte [r15 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1402930a8
mov rdx, r13
mov rcx, r14
call rdi
add r15, 0x10
sub r12, 1
jne 0x1402930a0
mov r15, qword [rsp + 0x70]
xor edi, edi
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x1402930f8
mov rcx, r14
sub rbp, rbx
mov al, byte [rcx + rbp - 0x40]
xor byte [rcx], al
inc rcx
sub rsi, 1
jne 0x1402930e0
mov rdx, r13
mov rcx, r14
call r12
shl r15, 3
mov rdx, r13
bswap r15
xor qword [rbx + 0x48], r15
mov rcx, r14
call r12
mov esi, dword [rbx + 0x4c]
bswap esi
mov rax, qword [r14 + rdi*8]
mov qword [rbx + rdi*8], rax
inc rdi
cmp rdi, 2
jl 0x140293111
xorps xmm0, xmm0
lea rdx, [rbx + 0x20]
movups xmmword [rbx + 0x40], xmm0
mov r8, qword [rbx + 0x180]
mov rcx, rbx
call qword [rbx + 0x178]
inc esi
bswap esi
mov dword [rbx + 0xc], esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140293550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx r13d, byte [rcx]
mov rsi, r9
mov r15, qword [rcx + 0x28]
mov rbx, rcx
mov r12, qword [rcx + 0x30]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x20], r13b
test r13b, 0x40
jne 0x1402935ad
lea rdx, [rcx + 0x10]
mov r8, r12
call r15
xor edi, edi
mov r8d, r13d
and r8d, 7
mov ecx, edi
mov byte [rbx], r8b
lea r14d, [rdi + 0xf]
sub r14d, r8d
mov dword [rsp + 0x30], r14d
cmp r14d, 0xf
jae 0x1402935ec
mov edx, r14d
add rdx, rbx
mov r9d, r8d
movzx eax, byte [rdx]
or rcx, rax
mov byte [rdx], dil
shl rcx, 8
inc rdx
sub r9, 1
jne 0x1402935d6
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rsi
je 0x140293604
or eax, 0xffffffff
jmp 0x140293739
mov ebp, 0x10
cmp rsi, rbp
jb 0x1402936a0
mov r13, rsi
lea r14, [rbx + 0x10]
shr r13, 4
imul rax, r13, 0xfffffffffffffff0
add rsi, rax
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x38]
mov r8, r12
lea rdx, [rsp + 0x48]
mov rcx, rbx
call r15
mov edx, 8
dec edx
add byte [rdx + rbx + 8], 1
jne 0x14029364e
test edx, edx
jne 0x140293641
mov r8, qword [rsp + 0x28]
mov rdx, r14
mov rax, qword [rsp + 0x48]
mov rcx, r14
xor rax, qword [rsi]
mov qword [r8], rax
xor qword [r14], rax
mov rax, qword [rsp + 0x50]
xor rax, qword [rsi + 8]
mov qword [r8 + 8], rax
mov r8, r12
xor qword [rbx + 0x18], rax
call r15
add qword [rsp + 0x28], rbp
add rsi, rbp
sub r13, 1
jne 0x14029362e
mov r14d, dword [rsp + 0x30]
mov r13b, byte [rsp + 0x20]
mov qword [rsp + 0x38], rsi
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1402936ea
mov r8, r12
lea rdx, [rsp + 0x48]
mov rcx, rbx
call r15
test rsi, rsi
je 0x1402936dd
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
mov r8, qword [rsp + 0x28]
mov al, byte [rcx + rdx]
inc edi
xor al, byte [rsp + rcx + 0x48]
mov byte [rcx + r8], al
xor byte [rcx + rbx + 0x10], al
mov ecx, edi
cmp rcx, rsi
jb 0x1402936c5
lea rcx, [rbx + 0x10]
mov r8, r12
mov rdx, rcx
call r15
cmp r14d, ebp
jae 0x140293702
sub ebp, r14d
mov ecx, r14d
mov r8d, ebp
add rcx, rbx
xor edx, edx
call fcn.1403ccc50
mov r8, r12
lea rdx, [rsp + 0x48]
mov rcx, rbx
call r15
lea rdx, [rsp + 0x48]
mov r8d, 2
sub rdx, rbx
lea rcx, [rbx + 0x10]
mov rax, qword [rdx + rcx - 0x10]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x140293722
mov byte [rbx], r13b
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1403cb150
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140293760
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x88
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf0]
lea r15, [rcx + 0x10]
movzx edi, byte [rcx]
mov r10, r8
mov qword [rsp + 0x50], rax
mov r14, r9
mov rax, qword [rcx + 0x28]
mov r13, rdx
mov qword [rsp + 0x38], r8
mov rbx, rcx
mov r8, qword [rcx + 0x30]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x40], r8
test dil, 0x40
jne 0x1402937da
mov rdx, r15
call rax
mov r10, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
xor esi, esi
mov r9d, edi
and r9d, 7
mov rbp, r15
mov byte [rbx], r9b
mov ecx, esi
lea r12d, [rsi + 0xf]
sub r12d, r9d
cmp r12d, 0xf
jae 0x140293817
mov edx, r12d
add rdx, rbx
mov r11d, r9d
movzx eax, byte [rdx]
or rcx, rax
mov byte [rdx], sil
shl rcx, 8
inc rdx
sub r11, 1
jne 0x140293801
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, r14
je 0x14029382f
or eax, 0xffffffff
jmp 0x140293964
mov rdi, r14
shr rdi, 4
test rdi, rdi
je 0x1402938b0
mov r9, r8
mov qword [rsp + 0x28], rbp
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rdx, r10
mov rcx, r13
call qword [rsp + 0x50]
shl rdi, 4
add qword [rsp + 0x38], rdi
add r13, rdi
sub r14, rdi
je 0x140293908
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
dec r8
movzx ecx, dil
shr rdi, 8
movzx eax, byte [r8]
add rdx, rax
lea rax, [r9 + r8]
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1402938bd
test rdi, rdi
jne 0x14029387f
test rdx, rdx
jne 0x14029387f
jmp 0x1402938bd
mov rax, r14
mov qword [rsp + 0x38], r10
test rax, rax
je 0x140293908
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8, rdi
mov rcx, rbx
call qword [rsp + 0x48]
test r14, r14
je 0x1402938f6
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
mov al, byte [rdx + r13]
inc esi
xor al, byte [rsp + rdx + 0x60]
mov byte [rdx + rcx], al
xor byte [rdx + rbx + 0x10], al
mov edx, esi
cmp rdx, r14
jb 0x1402938de
mov rsi, qword [rsp + 0x48]
mov r8, rdi
mov rdx, r15
mov rcx, r15
call rsi
jmp 0x140293912
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov eax, 0x10
cmp r12d, eax
jae 0x14029392f
sub eax, r12d
mov ecx, r12d
mov r8d, eax
add rcx, rbx
xor edx, edx
call fcn.1403ccc50
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call rsi
lea rcx, [rsp + 0x60]
mov edx, 2
sub rcx, rbx
mov rax, qword [rcx + rbp - 0x10]
xor qword [rbp], rax
lea rbp, [rbp + 8]
sub rdx, 1
jne 0x140293949
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402948f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x40
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rcx + 0x60]
mov r15, r8
shr r15, 4
mov r12, r8
add r15, rax
mov r13, rdx
xor edi, edi
mov rbx, rcx
lea r14, [rax + 1]
lea esi, [rdi + 2]
jmp 0x1402949e8
mov rax, r14
mov ecx, edi
test r14b, 1
jne 0x140294957
shr rax, 1
inc ecx
test al, 1
je 0x14029494e
mov edx, ecx
mov rcx, rbx
call fcn.140295560
mov rdx, rax
test rax, rax
je 0x140294aa0
lea rcx, [rbx + 0x70]
sub rdx, rbx
mov r8, rsi
mov rax, qword [rdx + rcx - 0x70]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x140294977
mov r8d, 0x10
lea rcx, [rbp - 0x20]
mov rdx, r13
call fcn.1403cc5a0
add r13, 0x10
mov rcx, rdi
mov rax, qword [rbx + rcx*8 + 0x70]
xor qword [rbp + rcx*8 - 0x20], rax
inc rcx
cmp rcx, rsi
jl 0x1402949a2
mov r8, qword [rbx + 0x10]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x20]
call qword [rbx]
lea rdx, [rbp - 0x20]
mov r8, rsi
sub rdx, rbx
lea rcx, [rbx + 0x80]
mov rax, qword [rdx + rcx - 0x80]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1402949d3
inc r14
cmp r14, r15
jbe 0x140294943
and r12d, 0xf
jbe 0x140294a73
lea rcx, [rbx + 0x70]
mov r9, rsi
mov rax, qword [rcx - 0x38]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x1402949fe
xor edx, edx
lea r8d, [r9 + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1403ccc50
mov r8, r12
lea rcx, [rbp - 0x20]
mov rdx, r13
call fcn.1403cc5a0
mov byte [rbp + r12 - 0x20], 0x80
mov rax, qword [rbx + rdi*8 + 0x70]
xor qword [rbp + rdi*8 - 0x20], rax
inc rdi
cmp rdi, rsi
jl 0x140294a33
mov r8, qword [rbx + 0x10]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x20]
call qword [rbx]
lea r8, [rbp - 0x20]
sub r8, rbx
lea rdx, [rbx + 0x80]
mov rcx, qword [r8 + rdx - 0x80]
xor qword [rdx], rcx
lea rdx, [rdx + 8]
sub rsi, 1
jne 0x140294a61
mov qword [rbx + 0x60], r15
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1403cb150
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x140294a7c