joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ecd0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rsp + 0x88], rax
cmp edx, 0xffffffff
je 0x14000ee0c
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14000ed2e
mov rax, qword [rcx + 0x58]
mov r8d, dword [rax]
test r8d, r8d
jle 0x14000ed2e
mov r9d, edx
dec r8d
mov dword [rax], r8d
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
lea r8, [rcx + 1]
mov qword [rax], r8
mov byte [rcx], dl
mov ecx, edx
jmp 0x14000ee57
cmp qword [rcx + 0x80], 0
je 0x14000ee10
mov rax, qword [rcx + 0x18]
lea r8, [rcx + 0x70]
cmp qword [rax], r8
jne 0x14000ed6e
mov r8d, dword [rcx + 0x90]
mov r9, qword [rcx + 0x88]
mov qword [rax], r9
mov rax, qword [rcx + 0x38]
mov qword [rax], r9
mov eax, r9d
sub r8d, r9d
mov rax, qword [rcx + 0x50]
mov dword [rax], r8d
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x14000ee17
mov ebp, edx
mov byte [rsp + 0x5f], dl
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x60]
mov r14, rcx
lea rdx, [rcx + 0x74]
mov r10, qword [rax]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rsi, [rsp + 0x5f]
mov rcx, rax
mov r8, rsi
call qword [r10 + 0x38]
cmp eax, 2
jae 0x14000ee33
mov rbx, qword [rsp + 0x48]
sub rbx, rdi
je 0x14000edfb
mov r9, qword [r14 + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 0xffffffff
cmp rbx, rax
jne 0x14000ee57
mov byte [r14 + 0x71], 1
cmp qword [rsp + 0x50], rsi
mov eax, 0xffffffff
jmp 0x14000ee52
xor ecx, ecx
jmp 0x14000ee57
mov ecx, 0xffffffff
jmp 0x14000ee57
mov rax, qword [rcx + 0x80]
movsx ecx, dl
mov esi, edx
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, esi
jmp 0x14000ee54
mov ecx, 0xffffffff
cmp eax, 3
jne 0x14000ee57
mov rdx, qword [r14 + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, ebp
cmove ecx, eax
mov esi, ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140030980
mov eax, esi
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14000f2e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14000f315
mov rsi, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x14000f30e
mov rcx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor eax, eax
jmp 0x14000f437
mov rax, qword [rdi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x14000f379
mov rcx, qword [rdi + 0x50]
movsxd rbx, dword [rcx]
test rbx, rbx
je 0x14000f379
cmp rbx, rsi
cmovae rbx, rsi
mov rcx, rdx
mov r14, rdx
mov rdx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
add rax, rbx
mov ecx, ebx
mov rdx, qword [rdi + 0x50]
sub dword [rdx], ebx
mov rdx, qword [rdi + 0x38]
movsxd rcx, ebx
add qword [rdx], rcx
mov rcx, rsi
sub rcx, rbx
cmp qword [rdi + 0x80], 0
jne 0x14000f38d
jmp 0x14000f431
mov rcx, rsi
mov rax, rdx
cmp qword [rdi + 0x80], 0
je 0x14000f431
mov rdx, qword [rdi + 0x18]
lea r8, [rdi + 0x70]
cmp qword [rdx], r8
jne 0x14000f3bf
mov r8d, dword [rdi + 0x90]
mov r9, qword [rdi + 0x88]
mov qword [rdx], r9
mov rdx, qword [rdi + 0x38]
mov qword [rdx], r9
mov edx, r9d
sub r8d, r9d
mov rdx, qword [rdi + 0x50]
mov dword [rdx], r8d
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
nop dword [rax]
mov rbx, rcx
cmp rcx, 0x1000
jb 0x14000f40a
mov r9, qword [rdi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call r15
add r14, rax
sub rbx, rax
mov rcx, rbx
cmp rax, 0xfff
je 0x14000f3d0
sub rsi, rbx
jmp 0x14000f434
test rbx, rbx
je 0x14000f42f
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rcx, rbx
jmp 0x14000f431
xor ecx, ecx
sub rsi, rcx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rdi + 8], esi
mov eax, dword [rdi]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [rbp - 4]
pop rdi
pop rsi
xor ecx, ebp
pop rbx
call 0x14005a976
mov esp, ebp
pop rbp
ret 4
Function at 0x14000f450
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x68], 0
je case.default.0x14000f469
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov rax, qword [rax]
test rax, rax
je 0x14000f4d7
test r8, r8
jle 0x14000f4d7
mov r9, qword [rcx + 0x58]
mov r9d, dword [r9]
test r9d, r9d
jle 0x14000f4d7
mov esi, r9d
cmp rsi, r8
cmovae rsi, r8
mov rbx, rcx
mov rcx, rax
mov rdi, rdx
mov r14, r8
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
mov r8, r14
add rdi, rsi
mov edx, esi
mov r9, qword [rbx + 0x58]
sub dword [r9], esi
mov rdx, qword [rbx + 0x40]
add qword [rdx], rsi
mov rdx, r14
sub rdx, rsi
mov rax, rdi
mov rsi, rdx
test rsi, rsi
jg 0x14000f4e2
jmp 0x14000f508
mov rax, rdx
mov rsi, r8
test rsi, rsi
jle 0x14000f508
mov r9, qword [rcx + 0x80]
test r9, r9
je 0x14000f508
mov edx, 1
mov rcx, rax
mov rdi, r8
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r8, rdi
sub rsi, rax
mov rax, r8
sub rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea eax, [rcx - 0x61]
lea edx, [rdx + 2]
cmp ax, di
ja 0x140073d9c
add ecx, 0xffd9
jmp 0x140073daa
lea eax, [rcx - 0x41]
cmp ax, di
ja 0x140073daa
add ecx, 0xfff9
movzx ecx, cx
add ecx, 0xffffffd0
shl esi, 4
add esi, ecx
movzx ecx, word [rdx]
test cx, cx
jne 0x140073d89
pop rdi
mov eax, esi
pop rsi
pop rbp
ret

Function at 0x14000faf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d57a4], 1
je 0x14000fb53
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1c
mov rdx, rsi
jne 0x14000fb10
mov dword [0x1400d57a4], 1
mov eax, 0xafc11ced
pop rsi
ret

Function at 0x14000ffd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d42e4], 1
je 0x140010033
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x26
mov rdx, rsi
jne 0x14000fff0
mov dword [0x1400d42e4], 1
mov eax, 0xc8f0dda9
pop rsi
ret
Function at 0x140010590
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4440], 1
je 0x140010600
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x26
mov rax, rsi
jne 0x1400105c0
mov dword [0x1400d4440], 1
mov eax, 0x7babadbe
pop rsi
ret

Function at 0x140010710
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d4430], 1
je 0x140010747
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 7
jne 0x140010720
mov dword [0x1400d4430], 1
mov eax, 0x9807538f
ret

Function at 0x140010820
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d4464], 1
je 0x14001087d
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffed
movzx edx, byte [r8 + r9 + 0x13]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x140010840
mov dword [0x1400d4464], 1
mov eax, 0x8bfe2e77
ret

Function at 0x140011850
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d47a0], 1
je 0x1400118ad
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe2
movzx edx, byte [r8 + r9 + 0x1e]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x2b
jne 0x140011870
mov dword [0x1400d47a0], 1
mov eax, 0xfd85dc5e
ret

Function at 0x1400118c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d47c0], 1
je 0x140011927
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffeb
movzx edx, byte [r8 + r9 + 0x15]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x19
jne 0x1400118e0
mov dword [0x1400d47c0], 1
mov eax, 0xa321c9ab
ret

Function at 0x1400119a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d47d4], 1
je 0x1400119d7
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xd
jne 0x1400119b0
mov dword [0x1400d47d4], 1
mov eax, 0x2950a4b4
ret
Function at 0x140011c90
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d47e0], 1
je 0x140011cf3
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x140011cb0
mov dword [0x1400d47e0], 1
mov eax, 0x6aa3626d
pop rsi
ret

Function at 0x140011f00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d4820], 1
je 0x140011f63
mov eax, 0xcccccccd
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
shl r10d, 2
lea r10d, [r10 + r10*4]
movzx r11d, byte [rdx + r8 + 0x14]
sub r9d, r10d
movsxd r9, r9d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x3a
jne 0x140011f20
mov dword [0x1400d4820], 1
mov eax, 0x28df4dbd
ret

Function at 0x140012e50
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d57c8], 1
je 0x140012ead
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 2
mov eax, edx
imul eax, edx, 0xffffffea
movzx edx, byte [r8 + r9 + 0x16]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x140012e70
mov dword [0x1400d57c8], 1
mov eax, 0x5b167928
ret

Function at 0x1400135b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d57d8], 1
je 0x140013613
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x1400135d0
mov dword [0x1400d57d8], 1
mov eax, 0x93b3dc9
pop rsi
ret

Function at 0x140013b90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d57f8], 1
je 0x140013c09
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x26
mov r9, rax
jne 0x140013bc0
mov dword [0x1400d57f8], 1
mov eax, 0xf81f8a17
pop rsi
ret
Function at 0x140013c10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d57e0], 1
je 0x140013c89
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1c
mov r9, rax
jne 0x140013c40
mov dword [0x1400d57e0], 1
mov eax, 0x2a6af62
pop rsi
ret

Function at 0x140013f50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5804], 1
je 0x140013fb3
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x23
mov rdx, rsi
jne 0x140013f70
mov dword [0x1400d5804], 1
mov eax, 0xee883e7d
pop rsi
ret

Function at 0x140013fc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5810], 1
je 0x140014023
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1a
mov rdx, rsi
jne 0x140013fe0
mov dword [0x1400d5810], 1
mov eax, 0x6e24b5d1
pop rsi
ret

Function at 0x140014030
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d581c], 1
je 0x1400140a0
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x22
mov rax, rsi
jne 0x140014060
mov dword [0x1400d581c], 1
mov eax, 0x2bf06f00
pop rsi
ret

Function at 0x1400140b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5828], 1
je 0x140014129
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x20
mov r9, rax
jne 0x1400140e0
mov dword [0x1400d5828], 1
mov eax, 0xf5f4c43
pop rsi
ret
Function at 0x140014130
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5834], 1
je 0x1400141a9
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1d
mov r9, rax
jne 0x140014160
mov dword [0x1400d5834], 1
mov eax, 0xfc04470e
pop rsi
ret

Function at 0x1400141b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5840], 1
je 0x140014229
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1c
mov r9, rax
jne 0x1400141e0
mov dword [0x1400d5840], 1
mov eax, 0x55239d0f
pop rsi
ret

Function at 0x140014230
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5850], 1
je 0x1400142a9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x23
mov r9, rax
jne 0x140014260
mov dword [0x1400d5850], 1
mov eax, 0xbd6d4666
pop rsi
ret

Function at 0x1400142b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d585c], 1
je 0x140014329
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x1400142e0
mov dword [0x1400d585c], 1
mov eax, 0xad40e8c9
pop rsi
ret

Function at 0x140014760
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d68c0], 1
je 0x1400147c1
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
nop dword [rax + rax]
mov r10, rax
shr rax, 2
mul r9
shr rdx, 1
mov eax, edx
imul eax, edx, 0xffffffe4
movzx edx, byte [r8 + r10 + 0x1c]
mov r11d, r10d
add eax, r10d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r10], dl
inc r10
mov rax, r10
mov edx, r10d
cmp r10d, 0x33
jne 0x140014780
mov dword [0x1400d68c0], 1
mov eax, 0xb69ebca8
ret
Function at 0x140014fc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d66b8], 1
je 0x140015023
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2c
mov rdx, rsi
jne 0x140014fe0
mov dword [0x1400d66b8], 1
mov eax, 0xc5023590
pop rsi
ret

Function at 0x140018570
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d6578], 1
je 0x1400185e9
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1b
mov r9, rax
jne 0x1400185a0
mov dword [0x1400d6578], 1
mov eax, 0x7afdc810
pop rsi
ret

Function at 0x14001bb60
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d65a4], 1
je 0x14001bbc3
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x14001bb80
mov dword [0x1400d65a4], 1
mov eax, 0xe65fd86
pop rsi
ret

Function at 0x14001be90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d65bc], 1
je 0x14001bece
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x11
jne 0x14001bea0
mov dword [0x1400d65bc], 1
mov eax, 0x3f673ca7
ret

Function at 0x14001d340
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d6594], 1
je 0x14001d3b9
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, 0x17
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2d
mov r9, rax
jne 0x14001d370
mov dword [0x1400d6594], 1
mov eax, 0x1b06f37e
pop rsi
ret
Function at 0x14001e7a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d660c], 1
je 0x14001e814
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1e
jne 0x14001e7d0
mov dword [0x1400d660c], 1
mov eax, 0x9097f63e
pop rsi
ret

Function at 0x14001f210
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d6888], 1
je 0x14001f27a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, 0x14
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1d
mov rdx, rsi
jne 0x14001f230
mov dword [0x1400d6888], 1
mov eax, 0x23449021
pop rsi
ret

Function at 0x14001f420
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d66f4], 1
je 0x14001f494
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1d
jne 0x14001f450
mov dword [0x1400d66f4], 1
mov eax, 0x8a630046
pop rsi
ret

Function at 0x14001f4a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d66e4], 1
je 0x14001f50a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x14001f4c0
mov dword [0x1400d66e4], 1
mov eax, 0x8e470b13
pop rsi
ret

Function at 0x14001f520
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5794], 1
je 0x14001f599
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x18
mov r9, rax
jne 0x14001f550
mov dword [0x1400d5794], 1
mov eax, 0x3486d08a
pop rsi
ret