joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e0d0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001e2fe
push rbp
push rsi
sub rsp, 0x48
mov qword [rsp + 0x68], rdi
mov rbp, rcx
mov qword [rsp + 0x70], r14
lea rdi, [rdx + 0x1a]
mov qword [rsp + 0x40], r15
mov r14d, 0xffffffff
lea r15, [0x1400bacc0]
mov qword [rsp + 0x60], rbx
movsxd rsi, r8d
nop word [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001e2d6
mov rcx, rbp
call fcn.14001d640
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001e191
movsxd rdx, dword [rbp + 0x5530]
mov r8, qword [rbp + 0x5538]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001e181
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001e179
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001e17c
mov rdx, rcx
test rdx, rdx
jne 0x14001e150
cmp r8, r10
je 0x14001e191
cmp dword [r8], r9d
jne 0x14001e191
mov rcx, qword [r8 + 8]
jmp 0x14001e193
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc4]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc4], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001e227
cmp qword [rcx + 0x20], 0
jne 0x14001e21c
mov qword [rcx + 0x20], rbx
jmp 0x14001e227
cmp qword [rcx + 0x28], 0
jne 0x14001e227
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001e26c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001e260
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140003c50
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001e2c8
cmp r9b, 0x23
jne 0x14001e2ab
cmp byte [r8], r9b
jne 0x14001e2ab
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001e298
not ecx
call fcn.14000c950
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001e110
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x140026040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14002608d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x140026092
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x1400260bd
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x1400260bd
mov rax, qword [rax + 0x390]
test rax, rax
je 0x1400260bd
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
jmp 0x1400260c2
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x1400260dc
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x1400260e1
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], sil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x140026163
inc ecx
test r8d, r8d
je 0x14002614e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140026153
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.140027590
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1400261a2
lea r8d, [rsi + 1]
mov rcx, rbp
call fcn.140026040
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x1400261b2
inc esi
jmp 0x140026070
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14004eab0
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x19
jb 0x14004eb30
mov byte [r8 + 0x19], 0
mov rax, r8
ret
Function at 0x140054ea0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
xor eax, eax
movdqa xmm2, xmmword [0x1400c11f0]
mov rdx, rcx
movdqa xmm3, xmmword [0x1400c1240]
movdqa xmmword [rsp], xmm0
mov r8d, dword [rsp]
nop word [rax + rax]
movd xmm1, eax
lea rdx, [rdx + 4]
pshufd xmm1, xmm1, 0
add eax, 4
movd xmm0, r8d
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm1, xmm0
movd dword [rdx - 4], xmm1
cmp eax, 0xc
jb 0x140054ed0
mov byte [rcx + 0xc], 0
mov rax, rcx
add rsp, 0x18
ret

Function at 0x140054f50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1400c11f0]
mov r8, rcx
movdqa xmm4, xmmword [0x1400c1240]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov r9d, 8
mov r10d, dword [rsp]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r9 - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea rdx, [rdx + 0x10]
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
movd xmm2, r9d
packuswb xmm1, xmm1
add eax, 0x10
packuswb xmm1, xmm1
paddb xmm1, xmm0
pshufd xmm2, xmm2, 0
movd xmm0, dword [rdx - 0x18]
paddd xmm2, xmm3
xorps xmm1, xmm0
andps xmm2, xmm4
movd dword [rdx - 0x18], xmm1
packuswb xmm2, xmm2
movd xmm1, ecx
lea ecx, [r9 + 4]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm0, r10d
paddd xmm1, xmm3
packuswb xmm2, xmm2
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx - 0x14], xmm1
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0x10]
movd xmm1, ecx
xorps xmm2, xmm0
pshufd xmm1, xmm1, 0
movd dword [rdx - 0x10], xmm2
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp r9d, 0x38
jb 0x140054f90
cmp eax, 0x37
jae 0x140055080
mov edx, eax
add rdx, r8
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0x37
jb 0x140055070
mov rax, r8
mov byte [r8 + 0x37], 0
add rsp, 0x18
ret

Function at 0x140055090
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x18
jb 0x140055110
mov byte [r8 + 0x18], 0
mov rax, r8
ret
Function at 0x140055130
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c11f0]
xor eax, eax
movdqa xmm3, xmmword [0x1400c1240]
movdqa xmmword [rsp], xmm0
mov edx, dword [rsp]
nop dword [rax]
movd xmm1, eax
lea rcx, [rcx + 4]
pshufd xmm1, xmm1, 0
add eax, 4
movd xmm0, edx
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm1, xmm0
movd dword [rcx - 4], xmm1
cmp eax, 0xc
jb 0x140055160
cmp eax, 0xe
jae 0x1400551c0
mov edx, eax
add rdx, r8
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0xe
jb 0x1400551b0
mov rax, r8
mov byte [r8 + 0xe], 0
add rsp, 0x18
ret

Function at 0x1400551d0
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x12
jb 0x140055250
mov byte [r8 + 0x12], 0
mov rax, r8
ret

Function at 0x140055270
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x1a
jb 0x1400552f0
mov byte [r8 + 0x1a], 0
mov rax, r8
ret
Function at 0x140055330
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x1d
jb 0x1400553b0
mov byte [r8 + 0x1d], 0
mov rax, r8
ret

Function at 0x1400553d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c11f0]
xor eax, eax
movdqa xmm3, xmmword [0x1400c1240]
movdqa xmmword [rsp], xmm0
mov edx, dword [rsp]
nop dword [rax]
movd xmm1, eax
lea rcx, [rcx + 4]
pshufd xmm1, xmm1, 0
add eax, 4
movd xmm0, edx
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm1, xmm0
movd dword [rcx - 4], xmm1
cmp eax, 0xc
jb 0x140055400
cmp eax, 0xf
jae 0x140055460
mov edx, eax
add rdx, r8
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0xf
jb 0x140055450
mov rax, r8
mov byte [r8 + 0xf], 0
add rsp, 0x18
ret
Function at 0x14005d660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r11d, edx
and r11d, 7
je 0x14005d6ef
cmp edx, r11d
jge 0x14005d6de
mov r8d, dword [rcx + 0x18]
mov eax, 1
mov ecx, edx
mov r9d, edx
shl eax, cl
cmp r8d, eax
jae 0x14005d6d4
mov r10, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r10
jb 0x14005d69f
xor cl, cl
jmp 0x14005d6a8
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r9 + 8]
mov ecx, r9d
mov dword [rbx + 0x10], edx
shl eax, cl
or r8d, eax
mov dword [rbx + 0x18], r8d
cmp edx, 0x18
jg 0x14005d6de
mov ecx, edx
mov eax, 1
shl eax, cl
mov r9d, edx
cmp r8d, eax
jb 0x14005d693
mov rax, qword [rbx + 8]
mov edx, r9d
mov qword [rbx], rax
mov eax, dword [rbx + 0x18]
mov ecx, r11d
shr eax, cl
sub edx, r11d
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x10], edx
xor r8d, r8d
mov r9d, edx
test edx, edx
jle 0x14005d732
mov eax, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
movzx r10d, al
nop word [rax + rax]
shr eax, 8
lea edx, [r9 - 8]
mov byte [rcx], r10b
lea rcx, [rcx + 1]
inc r8d
mov dword [rbx + 0x18], eax
mov r9d, edx
movzx r10d, al
test edx, edx
jg 0x14005d710
mov dword [rbx + 0x10], edx
jns 0x14005d758
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14005d787
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14005d771
xor dl, dl
jmp 0x14005d77a
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14005d768
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14005d734
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14005d7f1
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x14005d80b
mov rcx, rbx
call fcn.14005ca90
test eax, eax
je 0x14005d7e4
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call fcn.1400abed0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14006fe90
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x14
jb 0x14006ff10
mov byte [r8 + 0x14], 0
mov rax, r8
ret

Function at 0x14006ff80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1400c11f0]
mov r8, rcx
movdqa xmm4, xmmword [0x1400c1240]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov r9d, 8
mov r10d, dword [rsp]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r9 - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea rdx, [rdx + 0x10]
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
movd xmm2, r9d
packuswb xmm1, xmm1
add eax, 0x10
packuswb xmm1, xmm1
paddb xmm1, xmm0
pshufd xmm2, xmm2, 0
movd xmm0, dword [rdx - 0x18]
paddd xmm2, xmm3
xorps xmm1, xmm0
andps xmm2, xmm4
movd dword [rdx - 0x18], xmm1
packuswb xmm2, xmm2
movd xmm1, ecx
lea ecx, [r9 + 4]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm0, r10d
paddd xmm1, xmm3
packuswb xmm2, xmm2
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx - 0x14], xmm1
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0x10]
movd xmm1, ecx
xorps xmm2, xmm0
pshufd xmm1, xmm1, 0
movd dword [rdx - 0x10], xmm2
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp r9d, 0x28
jb 0x14006ffc0
cmp eax, 0x29
jae 0x1400700b0
mov edx, eax
add rdx, r8
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0x29
jb 0x1400700a0
mov rax, r8
mov byte [r8 + 0x29], 0
add rsp, 0x18
ret
Function at 0x140070140
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1400c11f0]
mov r8, rcx
movdqa xmm4, xmmword [0x1400c1240]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov r9d, 8
mov r10d, dword [rsp]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r9 - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea rdx, [rdx + 0x10]
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
movd xmm2, r9d
packuswb xmm1, xmm1
add eax, 0x10
packuswb xmm1, xmm1
paddb xmm1, xmm0
pshufd xmm2, xmm2, 0
movd xmm0, dword [rdx - 0x18]
paddd xmm2, xmm3
xorps xmm1, xmm0
andps xmm2, xmm4
movd dword [rdx - 0x18], xmm1
packuswb xmm2, xmm2
movd xmm1, ecx
lea ecx, [r9 + 4]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm0, r10d
paddd xmm1, xmm3
packuswb xmm2, xmm2
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx - 0x14], xmm1
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0x10]
movd xmm1, ecx
xorps xmm2, xmm0
pshufd xmm1, xmm1, 0
movd dword [rdx - 0x10], xmm2
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp r9d, 0x38
jb 0x140070180
cmp eax, 0x3e
jae 0x140070270
mov edx, eax
add rdx, r8
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0x3e
jb 0x140070260
mov rax, r8
mov byte [r8 + 0x3e], 0
add rsp, 0x18
ret

Function at 0x140070410
Capabilities:
Encode data using xor

Disassembly:
movd xmm0, dword [rcx]
mov r8, rcx
movdqa xmm2, xmmword [0x1400c1360]
mov edx, 0x10
mov eax, dword [0x1400c1100]
movd xmm1, eax
mov eax, dword [0x1400c1110]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx], xmm1
movd xmm0, dword [rcx + 4]
movd xmm1, eax
mov eax, dword [str._b_t_n_v]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 4], xmm1
movd xmm0, dword [rcx + 8]
movd xmm1, eax
mov eax, dword [0x1400c1130]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 8], xmm1
movd xmm0, dword [rcx + 0xc]
movd xmm1, eax
lea rax, [rcx + 0x10]
paddb xmm1, xmm2
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
nop
lea ecx, [rdx + 0x14]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, 0x16
jb 0x140070490
mov byte [r8 + 0x16], 0
mov rax, r8
ret
Function at 0x140070790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1400c11f0]
mov r8, rcx
movdqa xmm4, xmmword [0x1400c1240]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov r9d, 8
mov r10d, dword [rsp]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r9 - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea rdx, [rdx + 0x10]
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
movd xmm2, r9d
packuswb xmm1, xmm1
add eax, 0x10
packuswb xmm1, xmm1
paddb xmm1, xmm0
pshufd xmm2, xmm2, 0
movd xmm0, dword [rdx - 0x18]
paddd xmm2, xmm3
xorps xmm1, xmm0
andps xmm2, xmm4
movd dword [rdx - 0x18], xmm1
packuswb xmm2, xmm2
movd xmm1, ecx
lea ecx, [r9 + 4]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm0, r10d
paddd xmm1, xmm3
packuswb xmm2, xmm2
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx - 0x14], xmm1
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0x10]
movd xmm1, ecx
xorps xmm2, xmm0
pshufd xmm1, xmm1, 0
movd dword [rdx - 0x10], xmm2
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp r9d, 0x28
jb 0x1400707d0
cmp eax, 0x2f
jae 0x1400708c0
mov edx, eax
add rdx, r8
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0x2f
jb 0x1400708b0
mov rax, r8
mov byte [r8 + 0x2f], 0
add rsp, 0x18
ret

Function at 0x140070f80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x1400c1360]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1400c11f0]
mov r8, rcx
movdqa xmm4, xmmword [0x1400c1240]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov r9d, 8
mov r10d, dword [rsp]
nop dword [rax]
nop dword [rax + rax]
lea ecx, [r9 - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea rdx, [rdx + 0x10]
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
movd xmm2, r9d
packuswb xmm1, xmm1
add eax, 0x10
packuswb xmm1, xmm1
paddb xmm1, xmm0
pshufd xmm2, xmm2, 0
movd xmm0, dword [rdx - 0x18]
paddd xmm2, xmm3
xorps xmm1, xmm0
andps xmm2, xmm4
movd dword [rdx - 0x18], xmm1
packuswb xmm2, xmm2
movd xmm1, ecx
lea ecx, [r9 + 4]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm0, r10d
paddd xmm1, xmm3
packuswb xmm2, xmm2
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movd xmm0, r10d
movd dword [rdx - 0x14], xmm1
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0x10]
movd xmm1, ecx
xorps xmm2, xmm0
pshufd xmm1, xmm1, 0
movd dword [rdx - 0x10], xmm2
paddd xmm1, xmm3
movd xmm0, r10d
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp r9d, 0x38
jb 0x140070fc0
cmp eax, 0x3f
jae 0x1400710b0
mov edx, eax
add rdx, r8
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0x3f
jb 0x1400710a0
mov rax, r8
mov byte [r8 + 0x3f], 0
add rsp, 0x18
ret