joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
add rsp, 0xffffffffffffff60
cmp qword [rcx + 0x2f8], 0
mov rdi, rcx
pushf
mov qword [rsp + 0xb2], 0x7a0141de
xor qword [rsp + 0xb2], 0x1496b4d4
sub qword [rsp + 0xb2], 0x6c08ed28
sub qword [rsp + 0xb2], 0x28f07e2
popf
pushf
movabs rsi, 0xffffffff7e98b1a1
sub rsi, 0x52c167a8
add rsi, 0x31a3955
add rsi, 0x7fffffff
xor rsi, 0x510e7cb2
popf
je 0x1400365f6
mov edx, dword [rcx + 0x2ec]
mov eax, dword [rcx + 0x2e8]
xor edx, 0x2ed57f6f
xor eax, 0x2ed57f6f
imul edx, eax
mov eax, 0x16b3fc86
add eax, 0x21ac90d2
xor eax, 0x38608d5c
movsxd rbx, edx
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bbf80
mov qword [rsp + 0xb0], rax
test rbx, rbx
jle 0x140036613
xor r8d, r8d
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + r8*4]
xor edx, 0x734237da
mov dword [rax + r8*4], edx
inc r8
cmp r8, rbx
jl 0x1400365d0
jmp 0x140036613
lea rdx, [rsp + 0xb0]
call fcn.1400368b0
test al, al
je 0x14003681b
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rdi + 0x318]
lea rcx, [0x140002ba0]
mov qword [rsp + 0x30], rax
movabs rdx, 0x365859e13c12079f
add rdx, 0x41c13ae1
xor rdx, 0x179151c
mov qword [rsp + 0x98], 0x734df576
sub qword [rsp + 0x98], 0x1a77de23
xor qword [rsp + 0x98], 0x3e4f19d
sub qword [rsp + 0x98], 0x5b32e6b6
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rcx, qword gs:[0x30]
mov rax, qword [rbx + 0x98]
xor rax, rdx
mov qword [rsp + 0xb8], rbp
cmp rax, qword [rcx + 0x48]
jne 0x1400366d2
lea rcx, [rsp + 0x20]
call fcn.140034b70
movzx ebp, al
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
ja 0x1400367c9
test rax, rax
je 0x14003680f
mov rax, qword [rsp + 0x20]
mov r8, qword [rax]
jmp 0x1400367f5
mov rax, qword gs:[0x30]
mov rbp, qword [rax + 0x48]
lock inc dword [rbx + 0xf8]
je 0x14003670a
cmp rbp, qword [rbx + 0xe8]
je 0x1400367a5
mov rcx, qword [rbx + 0xf0]
xor r8d, r8d
xor edx, edx
call fcn.140095030
mov qword [rbx + 0xe8], rbp
mov dword [rbx + 0xfc], 0x7abda63a
sub dword [rbx + 0xfc], 0x52ceca4a
sub dword [rbx + 0xfc], 0x2342d3f1
xor dword [rbx + 0xfc], 0x4ac07fe
lea rcx, [rbx + 0xc8]
lea rdx, [rsp + 0x20]
call fcn.140033700
test rax, rax
setne bpl
sub dword [rbx + 0xfc], 1
jne 0x1400367b0
mov qword [rbx + 0xe8], 0x24e4f8a7
xor qword [rbx + 0xe8], 0x5ea41330
sub qword [rbx + 0xe8], 0x7a40eb97
lock xadd dword [rbx + 0xf8], esi
dec esi
cmp esi, 0xffffffff
je 0x1400367b7
mov rcx, qword [rbx + 0xf0]
xor edx, edx
call fcn.140094fd0
jmp 0x1400367b7
inc dword [rbx + 0xfc]
jmp 0x140036739
lock dec dword [rbx + 0xf8]
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
jbe 0x1400367e4
mov rcx, qword [rsp + 0x20]
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rsp + 0x20]
call fcn.1400bc0d0
jmp 0x14003680f
test rax, rax
je 0x14003680f
mov rcx, qword [rsp + 0x20]
mov r8, qword [rcx]
lea rax, [0x140034b80]
cmp r8, rax
je 0x14003680f
xor edx, edx
lea rcx, [rsp + 0x20]
call r8
movzx eax, bpl
mov rbp, qword [rsp + 0xb8]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400447e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x3f545bde
add rsp, 0x3f545b7e
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140018ab0
mov edi, 0x5369d4c8
sub edi, 0x4ad12c8f
xor edi, 0x458bfdcb
mov r9, rax
mov ecx, edi
mov r15d, 0x49f51ca2
sub r15d, 0x1cfaca44
sub r15d, 0x1bd8bbc7
xor r15d, 0x11219668
test rbp, rbp
je 0x1400448b1
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x140044890
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400448fc
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400448fc
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400448dc
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff36f600ff
sub rdx, 0x26965a7
add rdx, 0x7fffffff
add rdx, 0x4b7364a8
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x140044939
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140018ab0
cmp qword [r14 + 0x38], rbx
jbe 0x140044985
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x140044961
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400449b7
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0xf420a65
add ecx, 0x56e76640
sub ecx, 0x66297075
rep stosb byte [rdi], al
jmp 0x1400449bc
call fcn.1400bc0d0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400483f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 0x1206eb43
add rsp, 0x1206eb23
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14004842b
mov rdi, qword [rcx + 0x640]
jmp 0x140048432
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14004844b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14004844e
mov rcx, rsi
cmp rdi, rcx
je 0x14004868a
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140048478
nop
add rdi, 0x3447f728
sub rdi, 0x3447f720
jmp 0x140048432
test r8, r8
je 0x140048541
cmp rdi, qword [rbx + 0x640]
jb 0x140048541
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140048541
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1400484cf
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1400484d2
mov rax, rsi
add rax, 0xfffffffffffffff8
cmp rdx, rax
jae 0x1400484fa
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x18e6796f
sub rdx, 0x18e67967
jmp 0x1400484af
test rcx, rcx
je 0x140048541
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140048541
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140048533
call fcn.1400bc0d0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140048569
mov rax, qword [rcx]
mov edx, 0x4725db77
sub edx, 0x106df895
sub edx, 0x29ebd7f7
sub edx, 0xccc0aea
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14004868a
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400480a0
mov rcx, qword [rsp + 0x30]
mov r10d, 0x6b8f2f78
xor r10d, 0x757240a1
add r10d, 0xf85b15b
sub r10d, 0x2e832094
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x14004863b
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x14004863b
mov r9d, r10d
xor r9d, 0x2ed57f6f
xor r8d, 0x2ed57f6f
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x2ed57f6f
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x5c478686
sub dword [rcx + 0x34], 0x47355c7d
add dword [rcx + 0x34], 0x19c35566
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x1400485f7
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140048682
sub ecx, r8d
mov dword [rax + 0x14], 0x6cde004
xor dword [rax + 0x14], 0x2c2920ef
add dword [rax + 0x14], 0x4d7fbd7
sub dword [rax + 0x14], 0xe73d53
xor ecx, 0x2ed57f6f
xor r8d, 0x2ed57f6f
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400430a0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
nop
add rsp, 0x256cd4ea
sub rsp, 0x256cd4ca
pop rdi
ret
Function at 0x140048769
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140029d40
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.14002dea0
mov rcx, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rbx
jmp 0x1400486b0
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1400487f1
lea rdx, [rsp + 0x30]
call fcn.1400480a0
mov r8, qword [rsp + 0x30]
mov r11d, 0x325bed17
sub r11d, 0x25a291f0
add r11d, 0x168924ae
sub r11d, 0x23427f35
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1400487a7
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x1400487a2
mov r8d, r11d
xor r8d, 0x2ed57f6f
xor r9d, 0x2ed57f6f
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x2ed57f6f
add r10d, r11d
nop
add rax, 0x174cc9cd
sub rax, 0x174cc9c5
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x53119455
sub dword [rdx + 0x34], 0x1482bcb8
xor dword [rdx + 0x34], 0x105ba8f2
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140048753
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1400487e9
sub r8d, r9d
mov dword [rax + 0x14], 0x7703c0cb
sub dword [rax + 0x14], 0x1b85db62
sub dword [rax + 0x14], 0x2ca865fa
xor r8d, 0x2ed57f6f
xor r9d, 0x2ed57f6f
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400430a0
sub rsp, 0xffffffffffffffe0
pop rbx
ret
Function at 0x140052c70
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg r8, rbx
mov qword [rax + 0x10], r8
xchg rbx, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x1d9cbbb
add rsp, 0x1d9cb5b
movabs rbx, 0x365859e1487c274a
xor rbx, 0x701e276
xor rbx, 0x4445fb0d
xor rbx, 0x779269ad
mov rdi, rcx
xchg rcx, rcx
cmp qword [rcx + 0x30], rbx
jne 0x140052ea9
mov dword [rax - 0x48], 0x42d26719
add dword [rax - 0x48], 0x262ea67b
xor dword [rax - 0x48], 0x7916014f
add dword [rax - 0x48], 0x60e003c6
sub dword [rax - 0x48], 0x70c60fee
xor r8d, r8d
mov dword [rax - 0x44], 0x32a58ebf
xor dword [rax - 0x44], 0x66dc652a
xor dword [rax - 0x44], 0x3e811aa0
sub dword [rax - 0x44], 0x6accf0d0
mov dword [rax - 0x40], 0x18ac3262
xor dword [rax - 0x40], 0x361a0a8d
add dword [rax - 0x40], 0x2c4bfd0
sub dword [rax - 0x40], 0x313ef83d
mov dword [rax - 0x3c], 0x13ae1629
add dword [rax - 0x3c], 0x2b896a23
add dword [rax - 0x3c], 0x220521a0
sub dword [rax - 0x3c], 0x26459a47
sub dword [rax - 0x3c], 0x3a780785
mov dword [rax - 0x38], 0xe4d7769
add dword [rax - 0x38], 0x33670013
add dword [rax - 0x38], 0xdc59996
sub dword [rax - 0x38], 0x4f491036
mov dword [rax - 0x34], 0x576b00a2
sub dword [rax - 0x34], 0x4e29a678
add dword [rax - 0x34], 0x721f270e
sub dword [rax - 0x34], 0x7b3f80b9
mov qword [rsp + 0x70], r8
xchg r15, r15
mov rax, qword [rsp + 0x70]
nop word [rax + rax]
mov rcx, qword [rsp + 0x70]
mov dword [rsp - 0x24], 0x1ddc9d31
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
and cl, 3
mov dword [rsp - 0x34], ebp
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
xchg r13, r13
mov eax, 0xfba6eb5
xor eax, 0x8ed6215
add eax, 0x53e3871c
sub eax, 0xe273dca
shr eax, cl
movzx ecx, al
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
xor cx, dx
xchg r11, r11
mov word [rsp + rax*2 + 0x38], cx
xchg r11, rax
mov r11, qword [rsp + 0x70]
xchg r11, rax
inc rax
xchg r12, rax
mov qword [rsp + 0x70], r12
xchg r12, rax
mov rax, qword [rsp + 0x70]
cmp rax, 0xc
mov rcx, rcx
jb 0x140052d95
xor edx, edx
mov word [rsp + 0x50], r8w
lea rcx, [rsp + 0x38]
mov dword [rsp - 0x20], edx
call fcn.14009cdd0
xchg rdx, r10
mov r10, rax
xchg r10, rdx
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
xor rdx, rbx
xor eax, eax
xchg rdx, rcx
mov qword [rdi + 0x30], rcx
xchg rcx, rdx
lea rdi, [rsp + 0x38]
xchg rsp, rsp
mov ecx, 0x31b1a687
sub ecx, 0x1cab8056
add ecx, 0x1a1f8429
sub ecx, 0x2f25aa4e
rep stosb byte [rdi], al
cmp rdx, rbx
xchg r11, r11
je 0x140052eb1
lea rdx, [0x1404e02e0]
xchg r8, r9
mov rcx, r9
xchg r9, r8
call fcn.14005b250
mov r15, r15
test al, al
setne al
xchg rbx, rdx
mov rdx, qword [rsp + 0x78]
xchg rbx, rdx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
mov al, 0x2d
xor al, 0x56
add al, 2
sub al, 0x7c
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140052ed0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x50
mov rbp, rbp
movabs rbx, 0x365859e1552486f5
sub rbx, 0x4e904160
add rbx, 0x3973b6e3
sub rbx, 0x34ef38f2
xor rbx, 0x77b2941a
mov rdi, rcx
xchg r10, r10
cmp qword [rcx + 0x28], rbx
jne 0x1400530f8
mov eax, 0x368683a8
add eax, 0x380413cb
xor eax, 0x1a1b30a1
sub eax, 0x7491a734
mov dword [rsp + 0x20], 0x1d5b956d
add dword [rsp + 0x20], 0x5671568f
sub dword [rsp + 0x20], 0x3cca7578
sub dword [rsp + 0x20], 0x36c975c7
mov word [rsp + 0x30], ax
xor r8d, r8d
mov rbx, rbx
mov dword [rsp + 0x24], 0x569d8003
sub dword [rsp + 0x24], 0xfb0b014
add dword [rsp + 0x24], 0xf8f4b72
sub dword [rsp + 0x24], 0x55fe1aeb
mov dword [rsp + 0x28], 0x3f2bf630
add dword [rsp + 0x28], 0x343c1e44
sub dword [rsp + 0x28], 0x4ee86ce9
sub dword [rsp + 0x28], 0x2404a6cb
mov dword [rsp + 0x2c], 0x6845449a
sub dword [rsp + 0x2c], 0x2463a9df
sub dword [rsp + 0x2c], 0x2a4c0497
add dword [rsp + 0x2c], 0x39ba56cd
xor dword [rsp + 0x2c], 0x536eec86
xchg r8, rdx
mov qword [rsp + 0x60], rdx
xchg r8, rdx
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
mov dword [rsp - 0x34], 0x6c137dcc
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
and cl, 3
xchg r15, r15
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x3fd1486a
add eax, 0x305225eb
sub eax, 0x6bbfc343
xor eax, 0x4970fee0
shr eax, cl
movzx ecx, al
mov r10, r10
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg r13, rax
mov r13, qword [rsp + 0x60]
xchg r13, rax
inc rax
xchg r10, r10
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 9
jb 0x140052fe9
mov rdi, rdi
xor edx, edx
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
call fcn.14009cdd0
mov dword [rsp - 0x18], 0x455c5894
xchg rdx, r12
mov r12, rax
xchg rdx, r12
xchg r8, r10
mov r10, rax
xchg r8, r10
xor rdx, rbx
xor eax, eax
mov dword [rsp - 0x34], 0x76b60263
xchg rdx, r15
mov qword [rdi + 0x28], r15
xchg r15, rdx
lea rdi, [rsp + 0x32]
xchg r12, r12
mov ecx, 0x396e00ef
add ecx, 0x157e40f0
xor ecx, 0x33e835c2
xor ecx, 0x7d047414
rep stosb byte [rdi], al
cmp rdx, rbx
mov rsp, rsp
je 0x140053100
lea rdx, [0x1404e0830]
xchg r11, rcx
mov r11, r8
xchg r11, rcx
call fcn.140066380
mov dword [rsp - 0x18], 0x470b9abc
test al, al
setne al
xchg rbx, r11
mov r11, qword [rsp + 0x68]
xchg r11, rbx
sub rsp, 0xffffffffffffffb0
mov r14, r14
pop rdi
ret
mov al, 0x55
xor al, 7
xor al, 0x73
xor al, 0x20
xchg rcx, rbx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
nop
add rsp, 0x48cf6350
sub rsp, 0x48cf6300
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400537e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg rbx, r9
push rdi
nop
sub rsp, 0x1a846659
add rsp, 0x1a846609
movabs rbx, 0x365859e168b01e49
add rbx, 0x50cdb4a
xor rbx, 0x7618cb26
xor rbx, 0x1eb0c93a
xor rbx, 0x79beac13
mov rdi, rcx
mov r10, r10
cmp qword [rcx + 0x20], rbx
jne 0x140053a3b
mov eax, 0x17bddf99
add eax, 0x32cec2b8
sub eax, 0x467a4cba
sub eax, 0x4125518
mov dword [rsp + 0x20], 0x304c940a
xor dword [rsp + 0x20], 0x34fbf193
xor dword [rsp + 0x20], 0x70c6b919
xor dword [rsp + 0x20], 0x2012c249
sub dword [rsp + 0x20], 0x54261e28
mov word [rsp + 0x34], ax
xor r8d, r8d
xchg r13, r13
mov dword [rsp + 0x24], 0x5f772ed8
sub dword [rsp + 0x24], 0x3e3ca3d
add dword [rsp + 0x24], 0x19eecbd3
sub dword [rsp + 0x24], 0x75612ff8
mov dword [rsp + 0x28], 0x3425e85a
xor dword [rsp + 0x28], 0x2784a928
sub dword [rsp + 0x28], 0xd8de299
xor dword [rsp + 0x28], 0x26b9146d
sub dword [rsp + 0x28], 0x20444a16
mov dword [rsp + 0x2c], 0x4f117573
xor dword [rsp + 0x2c], 0x56b5fb3e
sub dword [rsp + 0x2c], 0x11a455d0
add dword [rsp + 0x2c], 0x75a29d0e
sub dword [rsp + 0x2c], 0x7d3fd56a
mov dword [rsp + 0x30], 0x15cd0081
xor dword [rsp + 0x30], 0x66e7eaed
sub dword [rsp + 0x30], 0x7288fcbb
sub dword [rsp + 0x30], 0x68ed1b
xchg r14, r8
mov qword [rsp + 0x60], r14
xchg r14, r8
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
xchg r14, rcx
mov r14, qword [rsp + 0x60]
xchg rcx, r14
mov rax, qword [rsp + 0x60]
and cl, 3
mov rsp, rsp
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x64db6df5
sub eax, 0x561190ae
xor eax, 0x7fa7ba10
sub eax, 0x245b1165
shr eax, cl
mov dword [rsp - 0x2c], 0x1872c85b
movzx ecx, al
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
xor cx, dx
mov dword [rsp - 0x44], 0xb2880d
mov word [rsp + rax*2 + 0x36], cx
xchg r10, rax
mov r10, qword [rsp + 0x60]
xchg r10, rax
inc rax
mov dword [rsp - 0x3c], ebp
xchg rsi, rax
mov qword [rsp + 0x60], rsi
xchg rsi, rax
mov rax, qword [rsp + 0x60]
cmp rax, 0xb
mov dword [rsp - 0x3c], 0x295adcbf
jb 0x14005391c
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
mov dword [rsp - 0x24], ebp
call fcn.14009cdd0
xchg rdx, r14
mov r14, rax
xchg r14, rdx
mov r8, rax
xor rdx, rbx
mov rbx, rbx
xor eax, eax
xchg r12, rdx
mov qword [rdi + 0x20], r12
xchg r12, rdx
lea rdi, [rsp + 0x36]
mov ecx, 0x29428303
sub ecx, 0x266a9a05
add ecx, 0x5a1cbbf3
sub ecx, 0x5cf4a4e6
rep stosb byte [rdi], al
cmp rdx, rbx
mov r10, r10
je 0x140053a43
lea rdx, [0x1404e02b8]
xchg r8, rbp
mov rcx, rbp
xchg rbp, r8
call fcn.140066890
mov r12, r12
test al, al
setne al
xchg r9, rbx
mov r9, qword [rsp + 0x68]
xchg r9, rbx
nop
sub rsp, 0x5eeb93c3
add rsp, 0x5eeb9413
pop rdi
ret
mov al, 0x48
xor al, 0x2a
sub al, 0x5b
xor al, 6
xchg r10, rbx
mov r10, qword [rsp + 0x68]
xchg r10, rbx
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14006c5d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x2c], 0x7a58efe5
push rdi
nop
sub rsp, 0x2d4f3435
add rsp, 0x2d4f3415
mov rbx, rdx
xchg r14, r14
mov rdi, rcx
nop
movabs rdx, 0xffffffff65ca74ea
sub rdx, 0x17b33b5
add rdx, 0xa3b594a
sub rdx, 0x1834efa3
add rdx, 0x7fffffff
add rdx, 0x29aa5524
nop word [rax + rax]
xchg rsi, rsi
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x14006c630
mov qword [rcx + 0x38], rdx
mov dword [rsp - 0x18], edi
call fcn.140018ab0
xor r8d, r8d
mov edx, 0x5541bc3e
sub edx, 0x4410310b
add edx, 0x52d1805b
xor edx, 0x164071c2
sub edx, 0x2530245a
cmp qword [rdi + 0x38], r8
mov dword [rsp - 0x28], esi
jbe 0x14006c6d8
sub rbx, rax
mov r9d, 0x2b15b6a8
xor r9d, 0x3358e507
add r9d, 0x2d99050a
xor r9d, 0x45e65846
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x10], edx
lea rax, [rax + 2]
and cx, r9w
ror edx, 1
ror edx, 4
ror edx, 2
ror edx, 1
xor cx, word [rbx + rax - 2]
inc r8
mov dword [rsp - 0x44], ebx
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x14006c69d
mov dword [rsp - 0x28], 0x680958db
mov rbx, qword [rsp + 0x30]
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
nop
sub rsp, 0x66c97ea8
add rsp, 0x66c97ec8
pop rdi
xchg rdx, rdx
ret
Function at 0x14006d080
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg r8, rsi
mov qword [rsp + 0x10], r8
xchg rsi, r8
nop
push 0x31a99b0e
mov qword [rsp], rdi
nop
add rsp, 0x7b820c48
sub rsp, 0x7b820c68
xchg rsi, r10
mov r10, qword [rcx + 0x38]
xchg r10, rsi
xchg r13, rdx
mov rbx, r13
xchg rdx, r13
xchg r9, r8
mov r9, qword [rdx + 0x38]
xchg r9, r8
mov rdi, rcx
xchg r8, r8
add r8, rsi
xchg rdi, rdx
mov rdi, rsi
xchg rdi, rdx
mov qword [rcx + 0x38], r8
call fcn.14006dca0
mov r9, qword [rbx]
mov dword [rsp - 0x38], esi
mov ecx, esi
and ecx, 3
mov r8d, 0x3d806fc1
sub r8d, 0x28f5abc5
xor r8d, 0x6aed0cda
sub r8d, 0x1b1e2ce9
sub r8d, 0x16364c4b
shl ecx, 2
shl ecx, 1
mov edx, r8d
mov r15, r15
ror edx, cl
mov r10, rax
xor ecx, ecx
mov dword [rsp - 0x28], 0x33ad38da
cmp qword [rbx + 0x38], rcx
jbe 0x14006d1aa
lea rax, [rsi + rsi]
mov r11d, 0x16ab4299
add r11d, 0x5fe19500
sub r11d, 0x95a2f05
sub r11d, 0x6d32a795
sub rax, r9
mov dword [rsp - 0x28], 0x26854998
add r10, rax
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
mov dword [rsp - 0x10], 0x237c986e
xor ax, r8w
ror edx, 5
ror edx, 2
ror edx, 1
and ax, r11w
ror r8d, 8
mov r15, r15
xor ax, word [r9 - 2]
inc rcx
mov word [r10 + r9 - 2], ax
mov rsp, rsp
cmp rcx, qword [rbx + 0x38]
jb 0x14006d169
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x38], ecx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14006d1e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xchg r11, r11
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x675b8042
add rsp, 0x675b8022
xchg r12, r14
mov r12, qword [rcx + 0x38]
xchg r14, r12
xchg rdx, r15
mov rdi, r15
xchg r15, rdx
xchg r9, rsi
mov r9, rcx
xchg r9, rsi
nop
movabs rbx, 0xffffffff068ce880
xor rbx, 0x32dbd022
add rbx, 0x4062d15e
sub rbx, 0x2a42878f
add rbx, 0x7fffffff
add rbx, 0x35887d8f
inc rbx
cmp word [rdx + rbx*2], 0
mov r15, r15
jne 0x14006d25b
lea r8, [r14 + rbx]
xchg rdx, rcx
mov rcx, r14
xchg rcx, rdx
xchg rbx, r8
mov qword [rcx + 0x38], rbx
xchg r8, rbx
call fcn.14006dca0
mov ecx, r14d
mov edx, 0x418aa56d
sub edx, 0x234a03d9
add edx, 0x5b232e88
sub edx, 0x15633b85
sub edx, 0x16ed3ea5
and ecx, 3
shl ecx, 1
shl ecx, 1
shl ecx, 1
ror edx, cl
test rbx, rbx
je 0x14006d31b
xchg r15, r15
lea r8, [r14 + r14]
mov ecx, 0x2ae8172a
add ecx, 0x4e8c6f74
xor ecx, 0x5a056658
sub ecx, 0x2371dfc7
sub r8, rdi
add r8, rax
mov dword [rsp - 0x30], ecx
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov rdi, rdi
lea rdi, [rdi + 2]
and ax, cx
ror edx, 8
xchg r11, r11
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
sub rbx, 1
mov dword [rsp - 0x38], edx
jne 0x14006d2f0
mov rbx, qword [rsp + 0x30]
xchg r10, rax
mov r10, rsi
xchg r10, rax
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x10], ebp
xchg r15, rdi
mov r15, qword [rsp + 0x40]
xchg r15, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
ret