joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002ac0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002b67
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002b67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd809cd93
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002b62
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002b40
cmp r8d, 0x36358a17
je 0x180002b6c
test r9d, r9d
jne 0x180002b20
mov rax, qword [rax]
jmp 0x180002af0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002e20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002ef7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002ef7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe19ef3a1
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002ef2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002ed0
cmp r8d, 0x15753ad3
je 0x180002efc
test r9d, r9d
jne 0x180002eb0
mov rax, qword [rax]
jmp 0x180002e80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180015910]
addsd xmm8, qword [0x180015910]
movups xmm9, xmmword [0x180015838]
movups xmm10, xmmword [0x18001c298]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002900
cmp word [rax], 0
je 0x180002f76
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002f60
xor edx, edx
add ecx, 1
je 0x180002f7a
mov rdx, rax
jmp 0x180002f7a
xor edx, edx
mov ecx, edx
mov rax, qword [0x180018780]
movaps xmm0, xmmword [0x180015b50]
mov rbx, qword [0x1800187f0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001c740]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180003028
mov rax, qword [0x180018910]
lea r8, str.Canvas.K2_DrawText
add rax, 0x10061f0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001c740], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
imul esi, edi, 0x55
out dx, al
invalid
Function at 0x14000124c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 5]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 5]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov byte [rax + 4], cl
add rax, 5
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 5
jb 0x1400012a0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400012f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.140009f18
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x7a]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.140009f18
mov qword [rdi], rax
lea r8d, [rsi + 0x7a]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x7a]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000c9d0
lea rax, [rbx + 0x7a]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0xa105a932f2ca891f
mul r8
inc esi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x7a
jb 0x140001357
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400013b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xb]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xb]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
mov byte [rax + 0xa], cl
add rax, 0xb
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xb
jb 0x140001409
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002ae4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xc]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xc]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
add rax, 0xc
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x1400425d0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xc
jb 0x140002b39
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400040c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x140042770]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 2
jb 0x14000411a
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 8
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, [0x140042910]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x14000635c
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400063ac
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 5
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, [0x140042910]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x1400063d8
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140006428
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 9
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, [0x140042910]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x140006454
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006530
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 3
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, [0x140042910]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x14000655c
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400065ac
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 2
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, [0x140042910]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x1400065d8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006f88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, [0x140042ab0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x140006fe0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007180
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.140009f18
mov edx, 0xc
mov rcx, rax
call fcn.140001f6c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0xa105a932f2ca891f
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 8
imul rcx, rdx, 0x197
sub r10, rcx
lea rcx, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x1400071ac
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400071fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x140007252
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400072a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x1400072fd
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x1400073ab
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x140007453
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400074a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.140009f18
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.140009f18
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0xa105a932f2ca891f
mul r8
inc edi
shr rdx, 8
imul rax, rdx, 0x197
sub r8, rax
lea rax, str.XtqALJHEoKPIkiZAo_smMvYdePaqDpClProtToJqWvxJxrPOKccKxGXJGkrMdipguejsloqidAfhNPxxAaQoyNpxSjvZFTUsAeiUYdYwFqjYsPeLcgJvKTWzQPYDZPkBGnGmRZwbUhkOZAOMetzYjnOwsStuCDNxbNrIurmIoOoAYwzFQlGpyrKLnpQIPSpDtGEFNhrKviOoFKBRIRAhXgrzLcxLCNHcRDeroCkucgKdLhpcKyYaksgZjzREehyrDRuaOdtYYPcHIVUMfZZwKyyFiyXDHPkCgyvvGjjlKrooqAH_YIATWctjukBhItcoCqkKREldkPVQYycwgezUwRnZESvvqeJHntVGAcAIHCvFgyMYWCDaqqIScvjWxRuzIoJMfepyfUuyEXEvtTL_Pu
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x140007504
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret