joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x1defc8b4
add rsp, 0x1defc884
mov dword [rcx + 8], 0x7f4541db
sub dword [rcx + 8], 0x715e6804
add dword [rcx + 8], 0x45f630c2
sub dword [rcx + 8], 0x53dd0a98
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x14000ba78]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.140017984
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x1400f07ae
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x1400f0794
mov ecx, dword [rsi + 0x40]
mov edx, 0x75730605
sub edx, 0x34d26ea7
add edx, 0xdadcda
sub edx, 0x30c2fd2
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x6797ccb8
sub r15d, 0x34a82b78
sub r15d, 0x23895d9f
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x5a464c6
add edx, 0x6ecbed6c
sub edx, 0x74705222
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
sub r14, 0xffffffffffff0001
mov rcx, r14
shl rcx, 4
call fcn.140098680
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x140146620]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x1400f0889
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x140146620]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x1400f08ab
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.1400ea478
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffd0
neg rsp
pop r15
pop r14
pop rdi
ret
Function at 0x1400f229c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0x21566ada
sub rsp, 0x21566b8a
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140073ec0
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x1400f2316
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x690f543
add r8d, 0x76464c46
xor r8d, 0x7cd74188
inc rdi
call fcn.14008dff0
cmp byte [rdi], 0
jne 0x1400f22df
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400f2350
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x64cb87a1
sub ecx, 0x3b9012e7
xor ecx, 0x6c4c626d
sub ecx, 0x45771657
rep stosb byte [rdi], al
jmp 0x1400f2355
call fcn.140098770
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x4466
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x1400f24ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x14aad6b7
add r10d, 0x13d14b87
add r10d, 0x2f18c297
sub r10d, 0x1925a06f
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0xf6643a1
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x1400f2549
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140146620]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x1400f250d
mov eax, r9d
ret

Function at 0x1400f2634
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x481468ac
xor r10d, 0x2db747ef
add r10d, 0x7ab6ddf
sub r10d, 0x2edf58bc
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0xf6643a1
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400f26d9
mov r10, qword [rcx + 0x300]
movzx eax, ax
add rdx, 2
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140146620]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x1400f269a
mov eax, r9d
ret
Function at 0x1400f26e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400f2779
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x49b00578
add ecx, 0x20892f17
sub ecx, 0xd1ab69a
sub ecx, 0x1eaf398f
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140098610
test rsi, rsi
jle 0x1400f2796
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x17dc431b
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x1400f2755
jmp 0x1400f2796
lea rdx, [rsp + 0xb0]
call fcn.1400f28f4
test al, al
je 0x1400f27ed
mov rax, qword [rsp + 0xb0]
lea rcx, [0x14000bb80]
mov qword [rsp + 0x98], 0x7f73f9ab
xor qword [rsp + 0x98], 0x21d6326a
xor qword [rsp + 0x98], 0x28fd2975
sub qword [rsp + 0x98], 0x7658e29c
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1400f1800
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400f46e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
mov rbx, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rbp - 0x20]
mov r12, r9
call fcn.14007e424
mov r8d, 0x2fdb0097
add r8d, 0x41763124
sub r8d, 0x715131b9
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.14007e49c
test al, al
je 0x1400f4972
mov eax, dword [rdi + 0x2e8]
lea rdx, [rbp - 0x40]
and dword [rbp - 0x28], 0
mov ecx, 0x1b846e4d
xor ecx, 0x1fb40aab
add ecx, 0x3a3edf80
and dword [rbp - 0x24], 0
xor eax, ecx
mov dword [rbp - 0x38], eax
mov r8d, 0x1ef7cf2f
add r8d, 0x76f83fe
sub r8d, 0x2667530d
mov eax, dword [rdi + 0x2ec]
xor eax, ecx
mov dword [rbp - 0x40], 0x37418087
sub dword [rbp - 0x40], 0xece34c5
add dword [rbp - 0x40], 0xfc0109
add dword [rbp - 0x40], 0x8d8f67b
mov dword [rbp - 0x34], eax
mov eax, dword [rdi + 0x2f4]
xor eax, ecx
mov dword [rbp - 0x3c], 0x20d85b5a
xor dword [rbp - 0x3c], 0x59946514
sub dword [rbp - 0x3c], 0x794c3e2e
mov dword [rbp - 0x30], eax
mov eax, dword [rdi + 0x30c]
xor eax, ecx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
call fcn.140080218
test al, al
je 0x1400f4972
mov r14d, dword [rdi + 0x2d8]
mov edx, 0x231ac079
sub edx, 0xdef7b5c
sub edx, 0x152b450d
and r14d, 0x2000
mov eax, r14d
neg eax
sbb rbx, rbx
and rbx, 0xffffffffffff0100
neg rbx
add rbx, 0xffffffffffff0001
neg rbx
mov r15, rbx
shl r15, 4
mov rcx, r15
call fcn.140098680
mov rsi, rax
test rax, rax
je 0x1400f4972
mov rdx, qword [rdi + 0x300]
xor r8d, r8d
sub rdx, rax
lea edi, [r8 + 1]
movups xmm0, xmmword [rdx + rax]
add r8, rdi
xorps xmm0, xmmword [0x140146620]
movups xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp r8, rbx
jl 0x1400f4848
mov rcx, r15
call fcn.140098610
neg r14d
mov rdx, rax
mov rcx, rsi
mov rbx, rax
sbb r8d, r8d
and r8d, 0xfff01000
neg r8d
add r8d, 0xfff00010
neg r8d
mov r9d, r8d
call fcn.140094640
mov r8d, eax
mov dword [rbp - 0x28], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140080218
mov rcx, rsi
test al, al
jne 0x1400f48c3
call fcn.140098630
mov rcx, rbx
jmp 0x1400f491e
call fcn.140098630
mov rcx, rbx
call fcn.140098620
mov eax, dword [rbp - 0x34]
imul eax, dword [rbp - 0x38]
movsxd rcx, eax
shl rcx, 2
call fcn.140098610
mov r8d, dword [rbp - 0x34]
mov rdx, rax
imul r8d, dword [rbp - 0x38]
mov rcx, r12
mov rbx, rax
shl r8d, 2
mov r9d, r8d
call fcn.140094640
mov r8d, eax
mov dword [rbp - 0x24], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140080218
mov rcx, rbx
test al, al
jne 0x1400f4928
call fcn.140098620
jmp 0x1400f4972
call fcn.140098620
lea rcx, [rbp - 0x20]
call fcn.140080488
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14007fab4
test al, al
je 0x1400f4972
mov r8d, 0x5915107
xor r8d, 0x5a80f727
sub r8d, 0x5f11a600
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140080218
test al, al
jne 0x1400f4975
xor dil, dil
lea rcx, [rbp - 0x20]
call fcn.14007e494
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400f7320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140017984
mov edi, 0x722d5abd
sub edi, 0x5e3ed3f5
add edi, 0x3b72d828
mov r9, rax
mov ecx, edi
mov r15d, 0x6982b84
xor r15d, 0x117a9787
xor r15d, 0x6bc9098c
sub r15d, 0x7c2bb490
test rbp, rbp
je 0x1400f73e6
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x1400f73c5
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400f7431
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400f7431
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400f7411
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff71ed1adb
sub rdx, 0x3e41011e
add rdx, 0x2b7d12f1
add rdx, 0x7fffffff
xor rdx, 0x20d6d352
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400f7475
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140017984
cmp qword [r14 + 0x38], rbx
jbe 0x1400f74c1
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x1400f749d
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400f74f9
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x245116d7
add ecx, 0x2884837e
sub ecx, 0x268dbe7d
sub ecx, 0x2647dba8
rep stosb byte [rdi], al
jmp 0x1400f74fe
call fcn.140098770
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140104b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140104b30
mov rdi, qword [rcx + 0x640]
jmp 0x140104b37
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140104b50
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140104b53
mov rcx, rsi
cmp rdi, rcx
je 0x140104d91
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140104b78
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
jmp 0x140104b37
test r8, r8
je 0x140104c4a
cmp rdi, qword [rbx + 0x640]
jb 0x140104c4a
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140104c4a
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140104bcf
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140104bd2
mov rax, rsi
nop
sub rax, 0xffffffffee987972
add rax, 0xffffffffee98796a
cmp rdx, rax
jae 0x140104c03
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x5223d859
sub rdx, 0x5223d851
jmp 0x140104baf
test rcx, rcx
je 0x140104c4a
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140104c4a
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140104c3c
call fcn.140098770
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140104c6c
mov rax, qword [rcx]
mov edx, 0x6a2093b2
xor edx, 0x1bd5f98c
sub edx, 0x71f56a3d
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x140104d91
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400ef460
mov rcx, qword [rsp + 0x30]
mov r10d, 0x481f5a6b
sub r10d, 0x206b65c5
xor r10d, 0x27b3f406
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140104d42
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140104d42
mov r9d, r10d
xor r9d, 0x3e6f4466
xor r8d, 0x3e6f4466
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x3e6f4466
add esi, r10d
nop
sub rdx, 0x15a822c8
add rdx, 0x15a822d0
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x5f056ba7
xor dword [rcx + 0x34], 0x540ad008
xor dword [rcx + 0x34], 0x3560ffc9
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140104cf3
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140104d89
sub ecx, r8d
mov dword [rax + 0x14], 0x316862a6
xor dword [rax + 0x14], 0x5e5b3f5
add dword [rax + 0x14], 0x26de2fbd
sub dword [rax + 0x14], 0x1cfcbcaa
xor ecx, 0x3e6f4466
xor r8d, 0x3e6f4466
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400eec60
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140104db0
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1401010a0
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1401049b0
mov rcx, rbx
sub rsp, 0xffffffffffffffe0
pop rbx
jmp 0x140104db0
push rbx
nop
sub rsp, 0x2d0a2580
add rsp, 0x2d0a2560
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140104ef6
lea rdx, [rsp + 0x30]
call fcn.1400ef460
mov r8, qword [rsp + 0x30]
mov r11d, 0x739df8
xor r11d, 0x27aa85f9
xor r11d, 0x54c2e1b4
sub r11d, 0x731bf915
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140104eac
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140104ea7
mov r8d, r11d
xor r8d, 0x3e6f4466
xor r9d, 0x3e6f4466
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x3e6f4466
add r10d, r11d
nop
sub rax, 0x7d2b158d
add rax, 0x7d2b1595
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x5b11ac93
add dword [rdx + 0x34], 0x145b2a1f
sub dword [rdx + 0x34], 0x30fd924c
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140104e58
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140104eee
sub r8d, r9d
mov dword [rax + 0x14], 0x49491a9b
xor dword [rax + 0x14], 0x29a91ff8
xor dword [rax + 0x14], 0x5e8f4105
xor r8d, 0x3e6f4466
xor r9d, 0x3e6f4466
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400eec60
nop
add rsp, 0x4b54398d
sub rsp, 0x4b54396d
pop rbx
ret
Function at 0x140118724
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
mov qword [rsp + 0x18], rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rsi, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rbp, r9
mov r9, rsp
xchg rbp, r9
add rsp, 0x3c883e32
sub rsp, 0x3c883eb2
mov edi, 0x1697c9e1
add edi, 0x30528a47
add edi, 0x36fefeda
sub edi, 0x7de952ff
mov dword [rbp - 0x50], 0x7885ef38
sub dword [rbp - 0x50], 0x690ea808
add dword [rbp - 0x50], 0x4749f723
sub dword [rbp - 0x50], 0x1bc718ed
xor dword [rbp - 0x50], 0x3af625c6
xor esi, esi
mov dword [rbp - 0x4c], 0x1cc4df9
add dword [rbp - 0x4c], 0x250304b0
add dword [rbp - 0x4c], 0x567a8923
sub dword [rbp - 0x4c], 0x7d3ddb9e
mov dword [rbp - 0x48], 0x6a559c38
xor dword [rbp - 0x48], 0x2c828029
sub dword [rbp - 0x48], 0x178063b5
sub dword [rbp - 0x48], 0x2f50b7a7
mov dword [rbp - 0x44], 0xec6bf5e
xor dword [rbp - 0x44], 0x5a1ab8af
xor dword [rbp - 0x44], 0x713b99d7
sub dword [rbp - 0x44], 0x25e49df5
xchg rsi, r15
mov qword [rbp + 0x10], r15
xchg r15, rsi
lea ebx, [rdi - 2]
mov r12, r12
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
and cl, dil
mov dword [rsp - 0x34], 0xf632752
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x3f3e6322
xor eax, 0xb4a057b
add eax, 0x23195cc
add eax, 0x18bb62cb
shr eax, cl
mov dword [rsp - 0x44], ebx
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov dword [rsp - 0x28], 0x7f989726
mov rax, qword [rbp + 0x10]
add rax, rbx
xchg r14, rax
mov qword [rbp + 0x10], r14
xchg r14, rax
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
cmp rax, 8
xchg rbp, rbp
jb 0x140118803
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov dword [rsp - 0x20], 0x53411b51
xchg r10, rax
mov qword [rbp - 0x38], r10
xchg r10, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x21966975
xor dword [rbp - 0x40], 0x7f291aef
sub dword [rbp - 0x40], 0x1a86482a
xor dword [rbp - 0x40], 0x354a1cbc
sub dword [rbp - 0x40], 0x716137bc
lea r8, [rbp - 0x40]
mov dword [rsp - 0x1c], 0x600f857c
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp - 0x14], 0x134935d
xchg rbp, rsi
movups xmmword [rsi - 0x30], xmm0
xchg rbp, rsi
call fcn.140133190
mov rcx, rcx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
test rax, rax
mov dword [rsp - 0x24], ecx
je 0x14011892e
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14010ef8c
test al, al
mov r15, r15
je 0x14011892e
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14010ded8
mov dword [rsp - 0x28], 0x2726a329
test al, al
jne 0x140118931
mov bl, sil
xor eax, eax
mov rdx, rdx
lea r11, [rsp + 0x80]
xchg r9, rsi
mov r9, qword [r11 + 0x20]
xchg rsi, r9
lea rdi, [rbp - 0x20]
mov r9, r9
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x34], 0x2171997e
mov al, bl
mov rbx, qword [r11 + 0x18]
xchg rsp, r8
mov r8, r11
xchg rsp, r8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14011cec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
xchg r13, r13
mov r8, qword [0x1401413e0]
xchg rbp, rbx
mov rbp, rcx
xchg rbx, rbp
movabs rcx, 0xe77d273c216ca06f
sub rcx, 0xe38f4f3
xor rcx, 0x338e5da
sub rcx, 0x4d8a811
movabs rax, 0x3633d06e687bc231
sub rax, 0x637fa4c7
add rax, 0x32b75e2c
add rax, 0x15ac2e58
add r8, rcx
mov dword [rsp - 0x3c], esp
mov edx, 0x1001b58c
sub edx, 0xe1c5f15
add edx, 0x79fcb079
sub edx, 0x7be205ec
rol r8, 8
rol r8, 1
lea rcx, [rsp + 0x20]
xor r8, rax
mov dword [rsp - 0xc], ebp
movabs rax, 0x44698b1d11c1bf89
xor rax, 0x42102263
add rax, 0x2959ed78
add rax, 0x1517f30b
not r8
mov rbx, rbx
rol r8, 0x15
rol r8, 0xf
rol r8, 2
rol r8, 6
rol r8, 8
rol r8, 3
rol r8, 1
not r8
sub r8, rax
mov dword [rsp - 0x3c], 0x3fe1430f
call r8
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
mov dword [rsp - 0xc], 0x41c6dcbc
nop
movabs rdx, 0xffffffff10f2874c
add rdx, 0x3820bdaf
add rdx, 0xdedceb3
add rdx, 0x7fffffff
xor rdx, 0x28feec52
movups xmmword [rax], xmm0
xchg r14, rax
movups xmmword [r14 + 0x10], xmm0
xchg r14, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
lea rax, [rsp + 0x20]
xchg r10, r10
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011cfed
mov rcx, rbx
xchg r11, r11
mov qword [rbx + 0x38], rdx
call fcn.140017984
xor r8d, r8d
mov dword [rsp - 0x18], ebx
mov ecx, 0x5d45a1a1
xor ecx, 0x5a25bef4
add ecx, 0x4c134112
sub ecx, 0x4120177
cmp qword [rbx + 0x38], r8
xchg r13, r13
jbe 0x14011d09f
lea r9, [rsp + 0x20]
mov r10d, 0x5b39b1b0
xor r10d, 0x6a33d2f2
add r10d, 0x3ec635fe
sub r10d, 0x6fd09841
sub r9, rax
nop dword [rax + rax]
movzx edx, cx
xchg r12, r12
lea rax, [rax + 2]
and dx, r10w
ror ecx, 2
ror ecx, 4
ror ecx, 1
ror ecx, 1
xor dx, word [r9 + rax - 2]
inc r8
mov dword [rsp - 0x18], 0x196a4416
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
jb 0x14011d060
mov dword [rsp - 0x10], 0x24240a66
xchg r15, rax
mov r15, rbx
xchg r15, rax
add rsp, 0x230
pop rbx
ret