joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040fbc
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a16d8], al
je 0x140040fe9
lea rax, [0x14019b878]
jmp 0x14004106a
mov r10d, 0x14
mov dword [rbp - 0x40], 0x60036
mov dword [rbp - 0x3c], 0x110014
mov dword [rbp - 0x38], 0x140007
mov dword [rbp - 0x34], 0x150039
mov dword [rbp - 0x30], 0x1b0019
lea r9d, [r10 - 0x13]
mov dword [rbp - 0x2c], 0x1001a
mov dword [rbp - 0x28], 0xb0031
mov dword [rbp - 0x24], 0x140015
mov dword [rbp - 0x20], 0x6000e
mov dword [rbp - 0x1c], 0x48005b
mov word [rbp - 0x18], ax
lea rdx, [0x14019b878]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r9
cmp rax, r10
jl 0x140041044
mov byte [0x1401a16d8], r9b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x40
pop rbp
ret

Function at 0x14004107c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
cmp byte [0x1401a1705], bl
je 0x1400410ad
lea rax, [0x14019b908]
jmp 0x140041164
mov eax, dword [0x14019fd80]
mov dword [rbp - 0x40], 0x3b
mov dword [rbp - 0x3c], 0x1c0030
mov dword [rbp - 0x38], 0x1e001f
mov dword [rbp - 0x34], 0x110008
mov dword [rbp - 0x30], 0x110000
imul eax, eax
mov dword [rbp - 0x2c], 0xd0038
mov dword [rbp - 0x28], 0x170017
mov dword [rbp - 0x24], 0x100012
mov dword [rbp - 0x20], 0x2f0003
mov edx, 4
mov dword [rbp - 0x1c], 0x50004
mov dword [rbp - 0x18], 0x1d0008
mov dword [rbp - 0x14], 0x56000b
mov dword [rbp - 0x10], 0x4a
and eax, 0x8000000f
jge 0x140041124
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xf
jne 0x140041139
mov rcx, rdx
call fcn.1400b97c8
mov ecx, dword [0x14019fd80]
mov dword [rax], ecx
lea rax, [0x14019b908]
lea rcx, [0x14019ada0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0x19
jl 0x140041140
mov byte [0x1401a1705], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14004117c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5718]
mov eax, 0x5810
call fcn.1400be0c0
sub rsp, rax
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x5700], rax
mov eax, dword [0x14019fd80]
xor edi, edi
lea ecx, [rax + 1]
lea esi, [rdi + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xf
jne 0x140041252
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x57c6
mov word [rsp + 0x30], di
call fcn.1400be450
mov r10d, edi
or r9, 0xffffffffffffffff
mov r8, rdi
test r10, r10
je 0x14004122c
test r8, r8
je 0x14004122c
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x1a2]
add dx, word [rsp + rax*2 + 0x30]
lea rax, [r9 + r8]
add dx, si
mov word [rsp + rax*2 + 0x32], dx
add r8, rsi
cmp r8, 0x6a
jl 0x140041201
add r9, 0x6a
add r10, rsi
cmp r9, 0x2be3
jl 0x1400411fe
movsx eax, word [rbp + 0x56f6]
mov dword [0x14019fd80], eax
cmp byte [0x1401a1703], dil
je 0x140041264
lea rax, [0x14019b348]
jmp 0x1400412c4
mov dword [rsp + 0x20], 0x130058
mov dword [rsp + 0x24], 0x110003
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x2c], 0x22
mov rcx, rdi
lea rbx, [0x14019b348]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [rbx + rcx*2], ax
add rcx, rsi
cmp rcx, 7
jl 0x14004128e
call fcn.14003f690
test al, al
jne 0x1400412ba
add dword [0x14019fd80], esi
mov byte [0x1401a1703], sil
mov rax, rbx
mov rcx, qword [rbp + 0x5700]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x5810]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140041508
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
cmp byte [0x1401a1701], r9b
je 0x14004153b
lea rax, [0x14019bb00]
jmp 0x14004161b
mov dword [rbp - 0x28], 0x300053
mov dword [rbp - 0x24], 0x1c001d
mov dword [rbp - 0x20], 0x140025
mov dword [rbp - 0x1c], 0x30019
mov dword [rbp - 0x18], 0x1b001d
mov dword [rbp - 0x14], 0x590000
mov word [rbp - 0x10], r9w
mov rcx, r9
lea rbx, [0x14019bb00]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x28]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, 0xc
jl 0x140041574
mov ecx, dword [0x14019fd80]
mov byte [0x1401a1701], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 1
jne 0x140041618
mov eax, dword [str.swO4sR]
or r8, 0xffffffffffffffff
mov dword [rbp - 0x30], eax
movzx eax, word [0x1401337c4]
mov rcx, r8
mov word [rbp - 0x2c], ax
mov al, byte [0x1401337c6]
mov byte [rbp - 0x2a], al
lea rax, [rbp - 0x30]
inc rcx
cmp byte [rax + rcx], r9b
jne 0x1400415f3
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400b8688
mov rcx, rax
call fcn.1400ba0bc
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140041634
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
cmp byte [0x1401a16d0], r9b
je 0x140041667
lea rax, [0x14019b4f0]
jmp 0x14004172b
mov r10d, 2
mov dword [rbp - 0x30], 0x2001b
mov dword [rbp - 0x2c], 0x2f0001
lea edx, [r10 - 1]
mov dword [rbp - 0x28], 0x50000
mov dword [rbp - 0x24], 0x2f000f
lea r8d, [r10 + 0xf]
mov dword [rbp - 0x20], 0xc0011
mov dword [rbp - 0x1c], 0x1000d
mov dword [rbp - 0x10], edx
mov dword [rbp - 0x18], 0x170015
mov dword [rbp - 0x14], 0x1e000e
mov rcx, r9
lea rbx, [0x14019b4f0]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rbx + rcx*2], ax
add rcx, rdx
cmp rcx, r8
jl 0x1400416ba
mov ecx, dword [0x14019fd80]
mov byte [0x1401a16d0], dl
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, r10d
jne 0x140041728
mov qword [rsp + 0x28], r9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140041744
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x14019fd80]
mov eax, 0x6bca1af3
mov ebx, 4
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x1400417dc
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x2f4
movsxd rcx, r9d
mul rcx
lea rcx, [rbx - 5]
cmovo rax, rcx
mov rcx, rax
call fcn.1400b8688
mov rcx, rax
call fcn.1400ba0bc
mov r9d, dword [0x14019fd80]
xor r8d, r8d
cmp byte [0x1401a16e6], r8b
je 0x1400417f4
lea rax, [0x14019b3d8]
jmp 0x1400418e9
mov edi, 2
mov ecx, r9d
mov eax, 0x78787879
mov dword [rbp - 0x40], 0x2001b
mov dword [rbp - 0x3c], 0x2f0001
mov dword [rbp - 0x38], 0x1f0006
imul ecx, r9d
imul ecx
sar edx, 3
lea r11d, [rdi - 1]
mov dword [rbp - 0x34], 0x8000e
mov eax, edx
mov dword [rbp - 0x30], 0x110004
mov dword [rbp - 0x2c], 0x10000d
shr eax, 0x1f
mov dword [rbp - 0x28], 0x70000
mov dword [rbp - 0x24], 0x140038
add edx, eax
mov dword [rbp - 0x20], 0x10017
mov dword [rbp - 0x1c], 0x180004
lea ebx, [rdi + 0x16]
mov dword [rbp - 0x18], 0x60013
mov dword [rbp - 0x14], 0x2001d
imul edx, edx, 0x11
sub ecx, edx
mov word [rbp - 0x10], r8w
cmp ecx, 5
jne 0x140041882
add dword [0x1401a1398], r11d
lea r10, [0x14019b3d8]
lea rax, [0x14019ada0]
movzx eax, byte [r8 + rax]
xor ax, word [rbp + r8*2 - 0x40]
mov word [r10 + r8*2], ax
add r8, r11
cmp r8, rbx
jl 0x140041889
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
mov byte [0x1401a16e6], r11b
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, edi
jne 0x1400418e6
add dword [0x1401a128c], r11d
mov rax, r10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140041908
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1fc08]
mov eax, 0x1fd00
call fcn.1400be0c0
sub rsp, rax
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x1fbf0], rax
xor ebx, ebx
cmp byte [0x1401a16de], bl
je 0x140041953
lea rax, [0x14019bb30]
jmp 0x140041a6e
mov r9d, dword [0x14019fd80]
mov eax, 0x78787879
mov esi, 1
mov ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 5
jne 0x1400419f7
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x1fc00
mov word [rbp - 0x20], bx
call fcn.1400be450
mov r10, rbx
or r9, 0xffffffffffffffff
mov r11d, 0xff
mov r8, rbx
test r10, r10
je 0x1400419d1
test r8, r8
je 0x1400419d1
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x21c]
add dx, word [rbp + rax*2 - 0x20]
lea rax, [r9 + r8]
add dx, si
mov word [rbp + rax*2 - 0x1e], dx
add r8, rsi
cmp r8, r11
jl 0x1400419a6
add r9, r11
add r10, rsi
cmp r9, 0xfe00
jl 0x1400419a3
movsx r9d, word [rbp + 0x1fbe0]
mov dword [0x14019fd80], r9d
mov dword [rbp - 0x30], 0x100058
mov dword [rbp - 0x2c], 0x40010
mov dword [rbp - 0x28], 0x12
lea rdi, [0x14019bb30]
lea rax, [0x14019ada0]
movzx eax, byte [rbx + rax]
xor ax, word [rbp + rbx*2 - 0x30]
mov word [rdi + rbx*2], ax
add rbx, rsi
cmp rbx, 5
jl 0x140041a13
mov r8d, r9d
mov eax, 0x6bca1af3
mov byte [0x1401a16de], sil
imul r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 5
jne 0x140041a6b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rax, rdi
mov rcx, qword [rbp + 0x1fbf0]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x1fd00]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140041a98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor r8d, r8d
cmp byte [0x1401a1707], r8b
je 0x140041ad4
lea rax, [0x14019b8a8]
jmp 0x140041b7a
mov esi, 4
mov dword [rsp + 0x2b0], 0x40053
mov dword [rsp + 0x2b4], 0x420001
mov dword [rsp + 0x2b8], 0x4e
mov rcx, r8
lea r9, [0x14019b8a8]
lea edi, [rsi - 3]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x2b0]
mov word [r9 + rcx*2], ax
add rcx, rdi
cmp rcx, 5
jl 0x140041b07
mov r10d, dword [0x14019fd80]
mov eax, 0x66666667
mov byte [0x1401a1707], dil
lea ecx, [r10 + 1]
imul ecx, r10d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x11
jne 0x140041b77
lea r11, [rsp]
mov ebx, r10d
add r8d, edi
sub ebx, edi
add r11, rsi
movsxd rcx, r8d
cmp rcx, 0xab
jb 0x140041b63
mov rax, r9
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140041d70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
cmp byte [0x1401a16f8], r8b
je 0x140041d9f
lea rax, [0x14019b8e8]
jmp 0x140041e74
mov edx, 0xf
mov dword [rbp - 0x30], 0x60036
mov dword [rbp - 0x2c], 0x110014
mov dword [rbp - 0x28], 0x140007
mov dword [rbp - 0x24], 0x18003f
mov dword [rbp - 0x20], 0x110006
mov dword [rbp - 0x1c], edx
mov dword [rbp - 0x18], 0x1b0020
mov dword [rbp - 0x14], 0x5d
mov rcx, r8
lea r10, [0x14019b8e8]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [r10 + rcx*2], ax
inc rcx
cmp rcx, rdx
jl 0x140041de2
mov r9d, dword [0x14019fd80]
mov byte [0x1401a16f8], 1
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140041e71
mov edx, r8d
mov r11d, 8
mov ecx, edx
mov eax, edx
and ecx, 1
sar eax, 1
dec ecx
not ecx
and ecx, r9d
mov edx, ecx
xor edx, eax
dec r11
jne 0x140041e42
inc r8d
add r9d, edx
cmp r8d, 0x100
jl 0x140041e39
mov dword [0x14019fd80], r9d
mov rax, r10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x30
pop rbp
ret

Function at 0x140041e88
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp byte [0x1401a16fc], bl
je 0x140041ec7
lea rax, [0x14019b978]
jmp 0x140041f84
mov dword [rbp - 0x30], 0x19001c
mov dword [rbp - 0x2c], 0x170010
mov dword [rbp - 0x28], 0x510016
mov dword [rbp - 0x24], 0x2001b
mov dword [rbp - 0x20], 0x17001b
mov dword [rbp - 0x1c], 0xa004e
mov r14d, 0xa
mov dword [rbp - 0x18], 0xe0004
mov dword [rbp - 0x14], 2
mov rcx, rbx
lea rdi, [0x14019b978]
lea rax, [0x14019ada0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rdi + rcx*2], ax
inc rcx
cmp rcx, 0xf
jl 0x140041f0f
mov eax, dword [0x14019fd80]
imul eax, eax
and eax, 0x8000000f
jge 0x140041f43
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xf
jne 0x140041f7a
lea ecx, [rax + 0x19]
call fcn.1400b8688
mov rsi, rax
call fcn.1400b99c8
add eax, dword [0x14019fd80]
mov dword [rsi + rbx*4], eax
inc rbx
cmp rbx, r14
jl 0x140041f53
mov ecx, dword [rsi + 0x24]
mov dword [0x14019fd80], ecx
mov rcx, rsi
call fcn.1400ba0bc
mov byte [0x1401a16fc], 1
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140041fac
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp byte [0x1401a16f6], bl
je 0x140041fd7
lea rax, [0x14019bb20]
jmp 0x140042070
mov eax, dword [0x14019fd80]
mov dword [rsp + 0x20], 0x1a0058
mov dword [rsp + 0x24], 0x6001e
lea ecx, [rax + 1]
mov dword [rsp + 0x28], 0x470012
mov dword [rsp + 0x2c], 0x5f
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xf
jne 0x140042045
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x14019fd80], r8d
lea rax, [0x14019bb20]
lea rcx, [0x14019ada0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x20]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 7
jl 0x14004204c
mov byte [0x1401a16f6], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x40
pop rbx
ret
Function at 0x140042084
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x4c8]
sub rsp, 0x5c0
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x4b8], rax
mov r9d, dword [0x14019fd80]
mov eax, 0x2aaaaaab
xor edi, edi
mov ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xb
jne 0x14004213d
mov esi, edi
lea r14, [rsp + 0x20]
mov r10d, edi
lea ecx, [rsi + 1]
mov eax, r9d
lea ebx, [r10 + 1]
cdq
idiv ecx
mov eax, r9d
mov ecx, r9d
sub ecx, esi
mov r8d, edx
cdq
idiv ebx
imul r8d, ecx
lea rcx, [0x140130a90]
add r8d, eax
sub r8d, r10d
mov edx, r8d
call fcn.1400b991c
mov r9d, dword [0x14019fd80]
add r14, 4
mov r10d, ebx
cmp ebx, 0x19
jl 0x1400420ef
inc esi
cmp esi, 0xe
jl 0x1400420ec
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 8
jne 0x14004217a
mov ecx, 4
call fcn.1400b97c8
mov r9d, dword [0x14019fd80]
mov dword [rax], r9d
cmp byte [0x1401a1702], dil
je 0x14004218f
lea rax, [0x14019b6e8]
jmp 0x140042238
mov dword [rbp + 0x4a0], 0x1a0058
mov dword [rbp + 0x4a4], 0x6001e
mov dword [rbp + 0x4a8], 0x5f0012
mov dword [rbp + 0x4ac], 0x1c000f
mov dword [rbp + 0x4b0], 0x18
lea rsi, [0x14019b6e8]
lea rcx, [0x14019ada0]
movzx ecx, byte [rdi + rcx]
xor cx, word [rbp + rdi*2 + 0x4a0]
mov word [rsi + rdi*2], cx
inc rdi
cmp rdi, 9
jl 0x1400421c8
imul r9d, r9d
mov eax, 0x2aaaaaab
mov byte [0x1401a1702], 1
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r9d, eax
cmp r9d, 0x11
jne 0x140042235
lea ecx, [r9 - 0xd]
call fcn.1400b97c8
mov rbx, rax
call fcn.1400b99c8
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x14019fd80], eax
call fcn.1400b8ff4
mov rax, rsi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140042264
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x14019fd80]
mov eax, 0x2e8ba2e9
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
mov edx, 7
cmp ecx, edx
cmove r9d, r8d
xor eax, eax
cmp byte [0x1401a16d2], al
mov dword [0x14019fd80], r9d
je 0x1400422cb
lea rax, [0x14019b3a0]
jmp 0x140042351
mov dword [rbp - 0x40], 0x150016
mov dword [rbp - 0x3c], 0x4001f
mov dword [rbp - 0x38], 0x100053
mov dword [rbp - 0x34], 0x1c0007
mov dword [rbp - 0x30], 0x17001b
mov dword [rbp - 0x2c], 0x5004e
mov dword [rbp - 0x28], 6
mov dword [rbp - 0x24], 0x20002
mov dword [rbp - 0x20], 0x42001c
mov dword [rbp - 0x1c], 0xd0005
mov dword [rbp - 0x18], 0x60009
mov dword [rbp - 0x14], 0x80017
mov word [rbp - 0x10], ax
lea rdx, [0x14019b3a0]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x18
jl 0x14004232a
mov byte [0x1401a16d2], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x40
pop rbp
ret

Function at 0x140042364
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x14019fd80]
mov eax, 0x78787879
imul ecx, ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 5
jne 0x1400423aa
call fcn.1400b99c8
mov dword [0x14019fd80], eax
xor eax, eax
cmp byte [0x1401a16d4], al
je 0x1400423bd
lea rax, [0x14019ba98]
jmp 0x140042412
mov dword [rbp - 0x20], 0x110053
mov dword [rbp - 0x1c], 0x150009
mov dword [rbp - 0x18], 0x250010
mov dword [rbp - 0x14], 0x1d0002
mov dword [rbp - 0x10], 0x490011
mov word [rbp - 0xc], ax
lea rdx, [0x14019ba98]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x20]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0xa
jl 0x1400423eb
mov byte [0x1401a16d4], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x40
pop rbp
ret

Function at 0x140042424
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x1401a16e3], al
je 0x14004244e
lea rax, [0x14019b438]
jmp 0x1400424c1
mov r8d, 1
mov dword [rbp - 0x30], 0x2001b
mov dword [rbp - 0x2c], 0x2f0001
mov dword [rbp - 0x28], 0x1001a
mov dword [rbp - 0x24], 0x2f0008
mov dword [rbp - 0x20], 0xc0011
lea r9d, [r8 + 0x10]
mov dword [rbp - 0x1c], 0x1000d
mov dword [rbp - 0x18], 0x170015
mov dword [rbp - 0x14], 0x1e000e
mov dword [rbp - 0x10], r8d
lea rdx, [0x14019b438]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, r9
jl 0x14004249b
mov byte [0x1401a16e3], r8b
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x30
pop rbp
ret
Function at 0x1400424d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x3b0
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x3a8], rax
mov r8d, dword [0x14019fd80]
mov eax, 0x6bca1af3
mov edi, 3
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, edi
jne 0x140042544
lea ecx, [rdi - 2]
cmp r8d, ecx
jle 0x14004253b
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14004252c
mov r8d, ecx
mov dword [0x14019fd80], ecx
mov ecx, r8d
mov eax, 0x78787879
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 5
jne 0x14004257a
mov ecx, 4
call fcn.1400b97c8
mov r8d, dword [0x14019fd80]
mov dword [rax], r8d
mov ecx, r8d
mov eax, 0x2aaaaaab
xor r9d, r9d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 8
jne 0x1400425c1
mov r10d, r9d
lea r11, [rsp + 0x20]
mov ebx, r8d
inc r10d
dec ebx
lea r11, [r11 + 4]
movsxd rax, r10d
cmp rax, 0xda
jb 0x1400425ad
cmp byte [0x1401a16d1], r9b
lea rax, [0x14019b768]
jne 0x140042630
mov dword [rsp + 0x390], 0x11003e
mov dword [rsp + 0x394], 0x1e0003
mov dword [rsp + 0x398], 0x1d0016
mov dword [rsp + 0x39c], 0x420058
mov word [rsp + 0x3a0], r9w
lea rcx, [0x14019ada0]
movzx ecx, byte [r9 + rcx]
xor cx, word [rsp + r9*2 + 0x390]
mov word [rax + r9*2], cx
inc r9
cmp r9, 8
jl 0x140042606
mov byte [0x1401a16d1], 1
mov rcx, qword [rsp + 0x3a8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x3c0]
add rsp, 0x3b0
pop rdi
ret

Function at 0x140042654
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a16db], al
je 0x140042685
lea rax, [0x14019bbe8]
jmp 0x14004271d
mov dword [rbp - 0x50], 0x2001b
mov ebx, 1
mov dword [rbp - 0x4c], 0x2f0001
mov dword [rbp - 0x48], 0x180015
mov dword [rbp - 0x44], 0x30019
mov dword [rbp - 0x40], 0x2b0000
mov dword [rbp - 0x3c], 0xa0007
mov dword [rbp - 0x38], 0x6000f
mov dword [rbp - 0x34], 0x50004
mov dword [rbp - 0x30], 0xd0006
mov dword [rbp - 0x2c], 0x37000f
mov dword [rbp - 0x28], 0xa0003
mov dword [rbp - 0x24], 0x90006
mov dword [rbp - 0x20], 0x1b0009
mov dword [rbp - 0x1c], 0x90011
mov word [rbp - 0x18], ax
lea rdx, [0x14019bbe8]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x50]
mov word [rdx + rax*2], cx
add rax, rbx
cmp rax, 0x1c
jl 0x1400426f7
mov byte [0x1401a16db], bl
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret