joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401dfd22], 0
je 0x14005b855
lea rax, [0x1401d97e8]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret
xor edx, edx
mov dword [rsp], 0x30004e
mov dword [rsp + 4], 0x9000e
mov dword [rsp + 8], 0x9003d
mov dword [rsp + 0xc], 0x190013
mov dword [rsp + 0x10], 0x6001c
mov word [rsp + 0x18], dx
mov dword [rsp + 0x14], 0x580000
lea r9, [0x1401d97e8]
lea r8, [0x1401d8d91]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 6
xor ax, word [rsp + rdx*2 - 0xc]
mov word [r9 + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rsp + rdx*2 - 8]
mov word [r9 + rdx*2 - 0xa], cx
mov word [r9 + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 - 6]
mov word [r9 + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 - 4]
mov word [r9 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 - 2]
mov word [r9 + rdx*2 - 2], ax
cmp rdx, 0xc
jl 0x14005b8a0
mov ecx, dword [0x1401ddd80]
mov byte [0x1401dfd22], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
mov eax, 0x34efd6d6
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
mov ecx, dword [0x1401df89c]
cmp r8d, 7
cmove ecx, eax
mov rax, r9
mov dword [0x1401df89c], ecx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret
Function at 0x14005b980
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401ddd80]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0xfa90f4d5
shl eax, 3
sub ecx, eax
mov eax, dword [0x1401df74c]
cmp ecx, 8
cmove eax, edx
cmp byte [0x1401dfd2f], 0
mov dword [0x1401df74c], eax
je 0x14005b9f6
lea rax, [0x1401d9b40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rdi
ret
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov qword [rsp + 0x60], rbx
xor ebx, ebx
mov dword [rsp + 0x20], 0x20006
mov dword [rsp + 0x24], 0x3a0012
imul ecx, eax
imul ecx, r8d
mov eax, 0x66666667
mov dword [rsp + 0x28], 0x180018
mov dword [rsp + 0x2c], 0x350005
mov dword [rsp + 0x30], 0x110010
mov dword [rsp + 0x34], 0xd
mov dword [rsp + 0x38], 0x18001b
imul ecx
sar edx, 2
mov dword [rsp + 0x3c], 0x80008
mov dword [rsp + 0x40], 0x1e
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x14005babd
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov r8d, dword [0x1401ddd80]
lea rdi, [0x1401d9b40]
lea rcx, [0x1401d8d90]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rbx
xor ax, word [rsp + rbx*2 + 0x1e]
mov word [rdi + rbx*2 - 2], ax
cmp rbx, 0x11
jl 0x14005bad0
mov rbx, qword [rsp + 0x60]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x92492493
mov byte [0x1401dfd2f], 1
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 2
jne 0x14005bb36
call fcn.1400d7b94
mov ecx, dword [0x1401ddd80]
cmp ecx, eax
jne 0x14005bb36
dec ecx
mov dword [0x1401ddd80], ecx
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rdi
ret
Function at 0x14005bb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401dfd0b], 0
je 0x14005bb80
lea rax, [0x1401d9a38]
jmp 0x14005bccb
xor edx, edx
mov dword [rbp - 0x40], 0x20006
mov dword [rbp - 0x3c], 0x3a0012
mov dword [rbp - 0x38], 0x2001e
mov r9d, 4
mov dword [rbp - 0x34], 0x120004
mov word [rbp - 0x10], dx
mov dword [rbp - 0x30], 0xc0005
mov dword [rbp - 0x2c], 0x11000d
mov dword [rbp - 0x28], 0x8000e
mov dword [rbp - 0x24], 0x2003e
mov dword [rbp - 0x20], 0x20008
mov dword [rbp - 0x1c], 0x3000d
mov dword [rbp - 0x18], 0xa0000
mov dword [rbp - 0x14], 0x9001b
lea rbx, [0x1401d9a38]
lea r8, [0x1401d8d91]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x14005bbf0
mov r8d, dword [0x1401ddd80]
mov byte [0x1401dfd0b], 1
mov eax, r8d
imul eax, r8d
and eax, 0x80000003
jge 0x14005bc80
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 2
jne 0x14005bcc8
mov eax, 0x51eb851f
imul r8d
mov rax, r9
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14005beb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd31], 0
je 0x14005bedf
lea rax, [0x1401d9750]
jmp 0x14005c02c
mov qword [rsp + 0x90], rbx
xor ebx, ebx
mov qword [rsp + 0x98], rdi
mov dword [rbp - 0x60], 0x6000d
mov dword [rbp - 0x5c], 0xa0010
mov dword [rbp - 0x58], 0x330019
mov word [rbp - 0x20], bx
mov dword [rbp - 0x54], 0x50002
mov dword [rbp - 0x50], 0x40018
mov edi, 4
mov dword [rbp - 0x4c], 0xb001b
mov dword [rbp - 0x48], 0xf0002
mov dword [rbp - 0x44], 0x130000
mov dword [rbp - 0x40], 0xf0019
mov dword [rbp - 0x3c], 0x2c000f
mov dword [rbp - 0x38], 0xf0010
mov dword [rbp - 0x34], 0x380018
mov dword [rbp - 0x30], 0x140000
mov dword [rbp - 0x2c], 0x2000e
mov dword [rbp - 0x28], 0x1a0007
mov dword [rbp - 0x24], 0xa0003
call fcn.140058930
test al, al
jne 0x14005bfb9
mov r8d, dword [0x1401ddd80]
mov eax, 0x51eb851f
imul r8d
mov eax, edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov rdi, qword [rsp + 0x98]
lea rax, [0x1401d9750]
lea r8, [0x1401d8d91]
nop
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x5e]
add rbx, 4
xor cx, word [rbp + rbx*2 - 0x68]
mov word [rax + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 4]
xor dx, cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x64]
mov word [rax + rbx*2 - 6], dx
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x62]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x20
jl 0x14005bfd0
mov rbx, qword [rsp + 0x90]
mov byte [0x1401dfd31], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x80
pop rbp
ret
Function at 0x14005c050
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [0x1401dfd1b], 0
je 0x14005c080
lea rax, [0x1401d9588]
jmp 0x14005c29d
mov r11d, dword [0x1401ddd80]
mov qword [rsp + 0x1e0], rbx
mov eax, 0x2aaaaaab
mov ecx, r11d
xor ebx, ebx
mov qword [rsp + 0x1c0], r13
mov dword [rsp + 0x30], 0x6002b
mov dword [rsp + 0x34], 0x40007
mov dword [rsp + 0x38], 0x9001f
imul ecx, r11d
imul ecx
sar edx, 1
mov dword [rsp + 0x3c], 0x20035
mov dword [rsp + 0x40], 0xc0007
mov eax, edx
mov dword [rsp + 0x44], 0x1000f
mov r13d, 1
shr eax, 0x1f
mov dword [rsp + 0x48], 0x14002e
mov dword [rsp + 0x4c], 0x5b
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xb
jne 0x14005c124
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r11d, dword [0x1401ddd80]
mov rdx, rbx
lea rdi, [0x1401d9588]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x32]
add rdx, 5
xor ax, word [rsp + rdx*2 + 0x26]
mov word [rdi + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 + 0x2a]
mov word [rdi + rdx*2 - 8], cx
mov word [rdi + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x2c]
mov word [rdi + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x2e]
mov word [rdi + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x14005c140
lea eax, [r11 + 1]
lea ecx, [r11 + 2]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx, r11d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 7
jne 0x14005c1d9
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov r11d, dword [0x1401ddd80]
lea ecx, [r11 + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401dfd1b], r13b
imul ecx, r11d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xd
jne 0x14005c28a
mov qword [rsp + 0x1e8], rbp
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1c8], r12
mov qword [rsp + 0x1b8], r14
lea rcx, [rsp + 0x51]
mov qword [rsp + 0x1b0], r15
nop word [rax + rax]
movzx r10d, r11b
mov esi, r13d
mov ebp, 0xe
sub r10b, bl
nop
inc esi
add rcx, 4
dec rbp
jne 0x14005c250
inc ebx
cmp ebx, 6
jl 0x14005c240
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x1e8]
mov r13, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1e0]
mov rax, rdi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x1d0
pop rdi
ret
Function at 0x14005c2c0
Capabilities:
Encode data using xor
Get disk size

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140058930
test al, al
mov eax, dword [0x1401ddd80]
jne 0x14005c2ea
inc eax
mov dword [0x1401ddd80], eax
cmp byte [0x1401dfd20], 0
je 0x14005c30c
lea rax, [0x1401d95f0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x68
ret
lea ecx, [rax + 1]
mov qword [rsp + 0x60], rbx
xor ebx, ebx
mov dword [rsp + 0x30], 0x190001
mov dword [rsp + 0x34], 0x20003
mov dword [rsp + 0x38], 0x4c000e
imul ecx, eax
mov eax, 0x2aaaaaab
mov dword [rsp + 0x3c], 0x180011
mov dword [rsp + 0x40], 0xa001a
mov dword [rsp + 0x44], 0xb004e
mov dword [rsp + 0x48], 0x1000a
mov dword [rsp + 0x4c], 4
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x13
jne 0x14005c38c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rax, [0x1401d95f0]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rsp + rbx*2 + 0x32]
add rbx, 5
xor cx, word [rsp + rbx*2 + 0x26]
mov word [rax + rbx*2 - 0xa], cx
movzx ecx, byte [rbx + r8 - 5]
xor dx, cx
movzx ecx, byte [rbx + r8 - 4]
xor cx, word [rsp + rbx*2 + 0x2a]
mov word [rax + rbx*2 - 8], dx
mov word [rax + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xf
jl 0x14005c3a0
mov byte [0x1401dfd20], 1
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x68
ret
Function at 0x14005c750
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r9d, dword [0x1401ddd80]
mov eax, 0x38e38e39
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x10
jne 0x14005c7a9
mov eax, 1
test r9d, r9d
cmove r9d, eax
mov dword [0x1401ddd80], r9d
cmp byte [0x1401dfd2d], 0
je 0x14005c7cb
lea rax, [0x1401d9bc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbp
ret
xor edx, edx
mov dword [rbp - 0x50], 0x15000b
mov dword [rbp - 0x4c], 0x11000c
mov dword [rbp - 0x48], 0xd004b
mov dword [rbp - 0x44], 0x6000d
mov dword [rbp - 0x40], 0xa001a
mov word [rbp - 0x20], dx
mov dword [rbp - 0x3c], 0x4004e
mov dword [rbp - 0x38], 0xf0008
mov dword [rbp - 0x34], 0x140004
mov dword [rbp - 0x30], 0x410003
mov dword [rbp - 0x2c], 0x16000c
mov dword [rbp - 0x28], 0xa001a
mov dword [rbp - 0x24], 0x30011
lea r8, [0x1401d9bc0]
lea r10, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r10 - 1]
movzx ecx, word [rbp + rdx*2 - 0x4e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x5c]
mov word [r8 + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r10 - 6]
xor cx, ax
movzx eax, byte [rdx + r10 - 5]
xor ax, word [rbp + rdx*2 - 0x58]
mov word [r8 + rdx*2 - 0xa], cx
mov word [r8 + rdx*2 - 8], ax
movzx eax, byte [rdx + r10 - 4]
xor ax, word [rbp + rdx*2 - 0x56]
mov word [r8 + rdx*2 - 6], ax
movzx eax, byte [rdx + r10 - 3]
xor ax, word [rbp + rdx*2 - 0x54]
mov word [r8 + rdx*2 - 4], ax
movzx eax, byte [rdx + r10 - 2]
xor ax, word [rbp + rdx*2 - 0x52]
mov word [r8 + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x14005c840
lea ecx, [r9 + 1]
mov eax, 0xb21642c9
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 8
jne 0x14005c933
movsd xmm3, qword [0x14016a2b8]
movsd xmm5, qword [0x14016a2e0]
movd xmm4, r9d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x40], xmm6
movsd xmm6, qword [0x14016a2b0]
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x14005c91a
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x14005c901
movaps xmm6, xmmword [rsp + 0x40]
mov byte [0x1401dfd2d], 1
mov rax, r8
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbp
ret
Function at 0x14005cbc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x348
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x338], rax
cmp byte [0x1401dfd09], 0
je 0x14005cc01
lea rax, [0x1401d9a98]
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x348
ret
mov r9d, dword [0x1401ddd80]
mov eax, 0x88888889
xor ecx, ecx
mov r8d, r9d
imul r8d, r9d
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xc
jne 0x14005cc61
mov edx, ecx
lea r8, [rsp]
nop dword [rax + rax]
mov eax, dword [r8]
inc edx
lea r8, [r8 + 4]
imul eax, eax, 0x2f
add r9d, eax
movsxd rax, edx
cmp rax, 0x310
jb 0x14005cc40
mov dword [0x1401ddd80], r9d
mov dword [rsp + 0x310], 0x20006
mov dword [rsp + 0x314], 0x3a0012
mov dword [rsp + 0x318], 0x1c0002
mov dword [rsp + 0x31c], 0x350002
mov dword [rsp + 0x320], 0x110010
mov dword [rsp + 0x324], 0xd
mov dword [rsp + 0x328], 0x18001b
mov dword [rsp + 0x32c], 0x80008
mov dword [rsp + 0x330], 0x1e
lea rax, [0x1401d9a98]
lea r8, [0x1401d8d90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0x30e]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x14005cce0
mov byte [0x1401dfd09], 1
mov rcx, qword [rsp + 0x338]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x348
ret

Function at 0x14005ce70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401ddd80]
mov eax, 0x6bca1af3
mov r11d, 1
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 2
jne 0x14005cec8
test r8d, r8d
cmove r8d, r11d
mov dword [0x1401ddd80], r8d
cmp byte [0x1401dfd32], 0
lea rax, [0x1401d96f8]
jne 0x14005cfac
xor r8d, r8d
mov dword [rbp - 0x50], 0x20006
mov dword [rbp - 0x4c], 0x3a0012
mov dword [rbp - 0x48], 0x5000d
mov dword [rbp - 0x44], 0x190013
mov dword [rbp - 0x40], 0x360001
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0xb0007
mov dword [rbp - 0x38], 0x90001
mov dword [rbp - 0x34], 0x130002
mov dword [rbp - 0x30], 0xe0019
mov dword [rbp - 0x2c], 0x2c0006
mov dword [rbp - 0x28], 0x60010
mov dword [rbp - 0x24], 0x20000
mov dword [rbp - 0x20], 0x50011
mov dword [rbp - 0x1c], 0xf000c
lea r9, [0x1401d8d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x14005cf50
mov byte [0x1401dfd32], r11b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbp
ret
Function at 0x14005cfc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd1d], 0
je 0x14005cff3
lea rax, [0x1401d9310]
jmp 0x14005d1ec
mov ecx, dword [0x1401ddd80]
mov eax, 0xb21642c9
xor r9d, r9d
lea r8d, [rcx + 1]
mov qword [rsp + 0x90], rdi
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 8
jne 0x14005d08c
mov eax, 0xe070381d
mov r8d, r9d
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x49
sub eax, edx
cmp eax, 0x35
je 0x14005d083
nop
mov eax, ecx
inc r8d
or eax, 0xffffffb7
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14005d083
mov eax, 0xe070381d
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x49
sub eax, edx
cmp eax, 0x35
jne 0x14005d050
mov ecx, r8d
mov dword [0x1401ddd80], ecx
mov dword [rbp - 0x60], 0x6000d
mov dword [rbp - 0x5c], 0xa0010
mov dword [rbp - 0x58], 0x4c0019
mov dword [rbp - 0x54], 0xf0006
mov dword [rbp - 0x50], 0x1d0001
mov dword [rbp - 0x4c], 0xb0007
mov dword [rbp - 0x48], 0x4c000c
mov dword [rbp - 0x44], 0xe0007
mov dword [rbp - 0x40], 0x120002
mov dword [rbp - 0x3c], 0x53001c
mov edi, 4
mov dword [rbp - 0x38], 0x110004
mov dword [rbp - 0x34], 0x4001b
mov dword [rbp - 0x30], 0x20017
mov dword [rbp - 0x2c], 0x4b001a
mov dword [rbp - 0x28], 0x1d
mov dword [rbp - 0x24], 0x1c0017
mov dword [rbp - 0x20], 0x52
lea rbx, [0x1401d9310]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx edx, word [rbp + r9*2 - 0x5e]
add r9, 3
xor ax, word [rbp + r9*2 - 0x66]
mov word [rbx + r9*2 - 6], ax
movzx eax, byte [r9 + r8 - 3]
xor dx, ax
movzx eax, byte [r9 + r8 - 2]
xor ax, word [rbp + r9*2 - 0x62]
mov word [rbx + r9*2 - 4], dx
mov word [rbx + r9*2 - 2], ax
cmp r9, 0x21
jl 0x14005d120
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x14005d1d5
mov eax, 0x51eb851f
imul ecx
mov rax, rdi
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov byte [0x1401dfd1d], 1
call fcn.140058770
mov rdi, qword [rsp + 0x90]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x14005d210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401dfd14], 0
je 0x14005d245
lea rax, [0x1401d9660]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x28
ret
mov dword [rsp], 0x11001e
mov dword [rsp + 4], 0x160010
mov dword [rsp + 8], 0x30002
mov dword [rsp + 0xc], 0x4a000f
mov dword [rsp + 0x10], 0x1b0010
mov dword [rsp + 0x14], 0x1c
xor ecx, ecx
lea r9, [0x1401d9660]
lea rdx, [0x1401d8d90]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 - 2]
mov word [r9 + rcx*2 - 2], ax
cmp rcx, 0xb
jl 0x14005d284
mov ecx, dword [0x1401ddd80]
mov eax, 0x38e38e39
mov byte [0x1401dfd14], 1
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 9
jne 0x14005d33b
test ecx, ecx
je 0x14005d33b
mov eax, ecx
and eax, 0x80000001
jge 0x14005d2e5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14005d2fa
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401ddd80], eax
jmp 0x14005d307
lea ecx, [rcx*2 + 1]
mov dword [0x1401ddd80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x14005d329
sub edx, 2
je 0x14005d32c
dec edx
je 0x14005d32e
jmp 0x14005d337
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401ddd80], ecx
test ecx, ecx
jne 0x14005d2d5
mov rax, r9
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x28
ret