joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x2c6170cf
add rsp, 0x2c61709f
mov dword [rcx + 8], 0x308ca9ff
xor dword [rcx + 8], 0x1d1a25c0
add dword [rcx + 8], 0x45c902d
sub dword [rcx + 8], 0x31f31c6b
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x1400012d8]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.140016fc0
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x140030cbe
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x140030ca4
mov ecx, dword [rsi + 0x40]
mov edx, 0x6522a698
add edx, 0xc55ad1d
xor edx, 0x3ffc9d62
sub edx, 0x18e265ac
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x2f619804
sub r15d, 0x99bda01
add r15d, 0x111ab6ec
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x334c2a40
sub edx, 0x97a1a22
sub edx, 0x29d2100e
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
add r14, 0x18f78d10
sub r14, 0x18f68d11
mov rcx, r14
shl rcx, 4
call fcn.1400bb300
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x1404d1530]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140030da0
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x1404d1530]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x140030dc2
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.1400308c4
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop
sub rsp, 0x260e8dc5
add rsp, 0x260e8df5
pop r15
pop r14
pop rdi
ret
Function at 0x14003125e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 0x698a1a76
add rsp, 0x698a1a16
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov qword [rsp + 0x78], rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140016fc0
mov edx, 0x729067b6
sub edx, 0x38ddfbe7
xor edx, 0x74d91caf
sub edx, 0x49c3fa46
test rbp, rbp
je 0x140031330
mov rdi, rax
sub rbx, rax
mov r9, rbp
mov r8d, 0x6874e06d
sub r8d, 0x43791045
sub r8d, 0x24fbcf29
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x14003130f
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
call fcn.140095e80
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14003139f
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x65850770
xor ecx, 0x5625a1c1
add ecx, 0x2c03dd5a
xor ecx, 0x5fa4843b
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
nop
sub rsp, 0x2fd7ae13
add rsp, 0x2fd7ae73
pop rdi
ret
call fcn.1400bb460
mov rax, rsi
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x140032f88
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x2340f1d
xor r10d, 0x37a79e76
add r10d, 0xed7c0
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x36e074ef
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x14003301e
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1404d1530]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x140032fe2
mov eax, r9d
ret

Function at 0x140033120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0xce933e3
add r10d, 0x2474b3d1
add r10d, 0x4448177
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x36e074ef
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400331be
mov r10, qword [rcx + 0x300]
movzx eax, ax
add rdx, 2
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1404d1530]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x14003317f
mov eax, r9d
ret

Function at 0x140033228
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
add rsp, 0x4b5eb871
sub rsp, 0x4b5eb911
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400332c2
mov edx, dword [rcx + 0x2ec]
mov ecx, 0xec39ded
add ecx, 0x150ec291
add ecx, 0x11d008ad
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400bb280
test rsi, rsi
jle 0x1400332df
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x27310a4
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x14003329e
jmp 0x1400332df
lea rdx, [rsp + 0xb0]
call fcn.1400334b8
test al, al
je 0x14003332a
mov rax, qword [rsp + 0xb0]
lea rcx, [0x140001470]
mov qword [rsp + 0x98], 0x5b8933e6
xor qword [rsp + 0x98], 0x61e817df
sub qword [rsp + 0x98], 0x3a612421
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.140031f84
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140049ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140016fc0
mov edi, 0x1ceba675
add edi, 0x4531024f
sub edi, 0x5560c596
xor edi, 0xf1c9e34
mov r9, rax
mov ecx, edi
mov r15d, 0x6e67c787
add r15d, 0xc4f2779
sub r15d, 0x7ab6ee01
test rbp, rbp
je 0x14004a0bb
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14004a09a
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x14004a106
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x14004a106
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x14004a0e6
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff3c465316
sub rdx, 0x1fe8f773
xor rdx, 0x63a9999a
add rdx, 0x7fffffff
xor rdx, 0xb3dc7
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14004a14a
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140016fc0
cmp qword [r14 + 0x38], rbx
jbe 0x14004a196
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x14004a172
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14004a1c8
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x6b294c22
xor ecx, 0x4bf99e99
sub ecx, 0x20d0d28b
rep stosb byte [rdi], al
jmp 0x14004a1cd
call fcn.1400bb460
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140055320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
add rsp, 0x5dbfb10d
sub rsp, 0x5dbfb12d
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14005535b
mov rdi, qword [rcx + 0x640]
jmp 0x140055362
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14005537b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14005537e
mov rcx, rsi
cmp rdi, rcx
je 0x1400555bf
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x1400553a3
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
jmp 0x140055362
test r8, r8
je 0x14005546a
cmp rdi, qword [rbx + 0x640]
jb 0x14005546a
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14005546a
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1400553fa
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1400553fd
mov rax, rsi
nop
sub rax, 0xffffffff9bcfd530
add rax, 0xffffffff9bcfd528
cmp rdx, rax
jae 0x140055423
mov rax, qword [rdx + 8]
mov qword [rdx], rax
sub rdx, 0xfffffffffffffff8
jmp 0x1400553da
test rcx, rcx
je 0x14005546a
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14005546a
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x14005545c
call fcn.1400bb460
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005548c
mov rax, qword [rcx]
mov edx, 0x40dbd260
add edx, 0x28d43a31
xor edx, 0x69b00c90
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x1400555bf
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004e8d0
mov rcx, qword [rsp + 0x30]
mov r10d, 0x7dbd7bd9
xor r10d, 0x7a53dc6b
add r10d, 0x5e34d371
xor r10d, 0x66237b83
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140055570
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140055570
mov r9d, r10d
xor r9d, 0x35a2692b
xor r8d, 0x35a2692b
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x35a2692b
add esi, r10d
nop
sub rdx, 0x3a665a8e
add rdx, 0x3a665a96
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x4a488651
add dword [rcx + 0x34], 0x201458ca
xor dword [rcx + 0x34], 0x6ddfdd17
add dword [rcx + 0x34], 0x2e1f671f
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x14005551a
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1400555b7
sub ecx, r8d
mov dword [rax + 0x14], 0x2bc144d2
xor dword [rax + 0x14], 0x797c9a26
xor dword [rax + 0x14], 0x63f7314f
add dword [rax + 0x14], 0x4577970
xor ecx, 0x35a2692b
xor r8d, 0x35a2692b
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400418c0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret
Function at 0x1400555e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140041e70
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1400551e0
mov rcx, rbx
nop
sub rsp, 0x50c392b1
add rsp, 0x50c392d1
pop rbx
jmp 0x1400555e0
push rbx
nop
sub rsp, 0x70334631
add rsp, 0x70334611
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x14005572a
lea rdx, [rsp + 0x30]
call fcn.14004e8d0
mov r8, qword [rsp + 0x30]
mov r11d, 0x24d4f700
add r11d, 0x3d748b9c
add r11d, 0x10a153c7
sub r11d, 0x72ead5c3
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1400556e0
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x1400556db
mov r8d, r11d
xor r8d, 0x35a2692b
xor r9d, 0x35a2692b
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x35a2692b
add r10d, r11d
neg rax
add rax, 0xfffffffffffffff8
neg rax
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x208a5797
add dword [rdx + 0x34], 0x4ac35e0b
sub dword [rdx + 0x34], 0x5136ee6c
add dword [rdx + 0x34], 0x1b8ba1f5
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140055688
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140055722
sub r8d, r9d
mov dword [rax + 0x14], 0x380aa208
xor dword [rax + 0x14], 0x2c34b5fe
xor dword [rax + 0x14], 0x219c7edd
xor r8d, 0x35a2692b
xor r9d, 0x35a2692b
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400418c0
add rsp, 0x20
pop rbx
ret

Function at 0x140057360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, r11
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x63410bbb
sub rsp, 0x63410bdb
xchg rdx, rcx
mov rbx, rcx
xchg rcx, rdx
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
nop
movabs rdx, 0xffffffff0f404689
xor rdx, 0x3e16cf07
sub rdx, 0x25a3a645
add rdx, 0x253db808
add rdx, 0x7fffffff
add rdx, 0x4f0f64af
nop word [rax + rax]
mov rdi, rdi
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x1400573cd
xchg rdx, r14
mov qword [rcx + 0x38], r14
xchg r14, rdx
call fcn.140016fc0
xor r8d, r8d
mov edx, 0x655a8d4e
add edx, 0xfe8b6ec
sub edx, 0x4b337c48
sub edx, 0x26684ad8
cmp qword [rdi + 0x38], r8
jbe 0x14005746a
mov r15, r15
sub rbx, rax
mov r9d, 0xfbfc9b8
xor r9d, 0x29640b2e
xor r9d, 0x32d8875d
sub r9d, 0x140344cc
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x3c], ebx
lea rax, [rax + 2]
and cx, r9w
ror edx, 2
ror edx, 4
ror edx, 1
ror edx, 1
xor cx, word [rbx + rax - 2]
mov r13, r13
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x140057435
xchg rcx, rcx
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
xchg r8, rax
mov r8, rdi
xchg r8, rax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140057e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x721e39cb
add rsp, 0x721e39ab
xchg r12, rsi
mov r12, qword [rcx + 0x38]
xchg r12, rsi
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
mov r8, qword [rdx + 0x38]
xchg rbp, rdi
mov rbp, rcx
xchg rdi, rbp
add r8, rsi
mov dword [rsp - 0x10], esi
xchg rsp, rdx
mov rsp, rsi
xchg rsp, rdx
mov qword [rcx + 0x38], r8
mov dword [rsp - 0x10], 0x2969ff3b
call fcn.140058ab0
xchg rdi, r9
mov rdi, qword [rbx]
xchg r9, rdi
mov ecx, esi
mov dword [rsp - 0xc], edi
and ecx, 3
mov r8d, 0x3058f21
xor r8d, 0x37f2e5bc
sub r8d, 0x44f04b0
sub r8d, 0x2d00e8d3
shl ecx, 3
mov rbp, rbp
mov edx, r8d
ror edx, cl
xchg r10, rax
mov rax, r10
xchg r10, rax
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov rcx, rcx
jbe 0x140057f6e
lea rax, [rsi + rsi]
mov r11d, 0x69260e96
sub r11d, 0x3e3e8607
add r11d, 0x1d0304c3
sub r11d, 0x3a432030
sub r11d, 0xda76c23
sub rax, r9
mov dword [rsp - 0x3c], edx
add r10, rax
nop dword [rax]
movzx eax, dx
mov r14, r14
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 6
ror edx, 2
and ax, r11w
mov r14, r14
ror r8d, 3
ror r8d, 4
ror r8d, 1
xor ax, word [r9 - 2]
xchg r15, r15
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140057f25
mov dword [rsp - 0x34], 0x8a0059f
mov rbx, qword [rsp + 0x30]
mov rax, rdi
xchg rsi, rbp
mov rbp, qword [rsp + 0x38]
xchg rbp, rsi
add rsp, 0x20
mov rsp, rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x140057fa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rdi, rdi
mov qword [rsp + 0x10], rsi
xchg rbp, rdi
mov qword [rsp + 0x18], rbp
xchg rbp, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x4950ad35
add rsp, 0x4950ad15
xchg r14, r11
mov r11, qword [rcx + 0x38]
xchg r14, r11
xchg rdi, r8
mov r8, rdx
xchg r8, rdi
xchg rbp, rcx
mov rsi, rbp
xchg rbp, rcx
nop
movabs rbx, 0xffffffff2fd51946
add rbx, 0x2b015ad
xor rbx, 0xda1ac1d
add rbx, 0x14091f71
add rbx, 0x7fffffff
add rbx, 0x2cd25da1
inc rbx
cmp word [rdx + rbx*2], 0
xchg r9, r9
jne 0x14005801b
lea r8, [r14 + rbx]
xchg r14, rbp
mov rdx, rbp
xchg rbp, r14
mov qword [rcx + 0x38], r8
mov dword [rsp - 0x44], ecx
call fcn.140058ab0
mov ecx, r14d
mov edx, 0x1ce8555c
xor edx, 0x47aa0fac
sub edx, 0xe56e448
add edx, 0x1117baee
sub edx, 0x5a5bb47c
and ecx, 3
shl ecx, 2
shl ecx, 1
ror edx, cl
mov rdx, rdx
test rbx, rbx
je 0x1400580ed
lea r8, [r14 + r14]
mov dword [rsp - 0x1c], 0x6a69e0a8
mov ecx, 0x5d80ea22
sub ecx, 0xa4deef6
add ecx, 0x20ebafc6
sub ecx, 0x1d025886
xor ecx, 0x571c5293
sub r8, rdi
mov dword [rsp - 0x2c], 0x5e1924e6
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov r14, r14
lea rdi, [rdi + 2]
and ax, cx
ror edx, 5
ror edx, 3
xor ax, word [rdi - 2]
mov dword [rsp - 0xc], ebx
mov word [r8 + rdi - 2], ax
sub rbx, 1
jne 0x1400580bf
xchg r8, r8
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x3c], 0x4a292a31
mov rdi, qword [rsp + 0x40]
nop
sub rsp, 0xbc7fc33
add rsp, 0xbc7fc53
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140058911
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x30], ebx
push rsi
nop
push 0x6eaa4f24
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
lea rsi, [rdx + 8]
mov dword [rsp - 0x14], ecx
xorps xmm0, xmm0
xchg r8, rsi
mov qword [rdx], r8
xchg rsi, r8
xor edi, edi
xchg rbp, rsi
movups xmmword [rbp], xmm0
xchg rbp, rsi
xchg r9, rbp
mov r14, rbp
xchg rbp, r9
xchg r15, rbp
mov r15, r8
xchg r15, rbp
xchg rsi, rbp
movups xmmword [rbp + 0x10], xmm0
xchg rsi, rbp
mov rbx, rdx
xchg rsi, r15
movups xmmword [r15 + 0x20], xmm0
xchg rsi, r15
xchg rbp, rdi
mov qword [rdx + 0x38], rbp
xchg rbp, rdi
xchg rdx, rax
mov rdx, qword [rcx + 0x38]
xchg rdx, rax
cmp r8, rax
mov dword [rsp - 0x40], 0x23bb4246
jae 0x140058a48
sub rax, r8
mov qword [rsp + 0x40], r15
mov r8, r8
cmp rax, r9
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov rax, qword [rcx]
mov dword [rsp - 0x28], edx
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x1400588e4
mov rbp, rbp
call fcn.1400bb460
cmp r14, 0x18
jbe 0x14005891c
mov r15, r15
lea rcx, [r14 + r14]
call fcn.1400bb6f0
mov qword [rbx], rax
test rax, rax
mov dword [rsp - 0x14], 0x45acc31e
jne 0x140058926
mov qword [rbx], rsi
mov r9, rdi
mov rcx, rcx
jmp 0x14005894a
mov qword [rbx], rsi
xchg rbx, rax
mov rbx, rsi
xchg rbx, rax
xorps xmm0, xmm0
mov dword [rsp - 0xc], 0xa043211
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rax
movups xmmword [rax + 0x20], xmm0
mov r9, qword [rbx]
mov rdx, rdx
and ebp, 3
mov r8d, 0x6d75fc3
add r8d, 0x35f554de
add r8d, 0xb058866
sub r8d, 0x442abfed
shl ebp, 2
shl ebp, 1
mov edx, r8d
movzx ecx, bpl
ror edx, cl
mov rdi, rdi
cmp qword [rbx + 0x38], rdi
jbe 0x1400589fb
sub r15, r9
mov ecx, 0x759fb5a1
xor ecx, 0x7cb76de4
xor ecx, 0x76b07bb3
sub ecx, 0x7f98a2f7
nop dword [rax]
mov dword [rsp - 0x3c], esi
nop word [rax + rax]
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
mov dword [rsp - 0x38], 0x700cc1a
ror edx, 7
ror edx, 1
and ax, cx
mov dword [rsp - 0x38], esp
ror r8d, 3
ror r8d, 1
ror r8d, 3
ror r8d, 1
xor ax, word [r15 + r9 - 2]
inc rdi
mov dword [rsp - 0x1c], 0x795ab7e3
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x1400589ae
mov r15, qword [rsp + 0x40]
mov dword [rsp - 0x18], 0x2306201c
mov rax, rbx
mov rbx, qword [rsp + 0x48]
xchg rbp, r8
mov r8, qword [rsp + 0x50]
xchg r8, rbp
nop
add rsp, 0x33f6b6da
sub rsp, 0x33f6b6ba
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
mov rax, rbx
jmp 0x140058a0b
Function at 0x14005b97c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg rbp, r13
xchg rsi, r15
mov qword [rsp + 0x18], r15
xchg r15, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0xb0
mov r9, r9
mov r15d, edx
xchg r10, rbp
mov r10, rcx
xchg rbp, r10
xchg rdx, r11
mov r11, r9
xchg rdx, r11
lea rcx, [rsp + 0x20]
mov r14d, r8d
call fcn.140031250
mov rbp, rbp
xchg rbx, r9
mov r9, qword [rsp + 0xa8]
xchg rbx, r9
mov eax, 0x1f482175
add eax, 0x164223c9
add eax, 0x3f3c4a18
sub eax, 0x74c60f57
cmp rbx, rax
mov r14, r14
cmova rbx, rax
xchg rbx, rdi
mov rcx, rdi
xchg rdi, rbx
call fcn.1400bb280
mov dword [rsp - 0x3c], 0x338cab60
xor edi, edi
mov rsi, rax
test rbx, rbx
mov rsi, rsi
je 0x14005ba55
xchg rcx, rsi
mov rsi, qword [rsp + 0x20]
xchg rsi, rcx
mov dl, byte [rcx + rdi]
xchg r15, r15
xor dl, 0x37
mov byte [rdi + rax], dl
inc rdi
mov rsp, rsp
cmp rdi, rbx
jb 0x14005ba2f
mov r8d, r14d
xchg r14, r14
mov edx, r15d
xchg rdx, rcx
mov rdx, rbp
xchg rdx, rcx
call fcn.140059ab8
mov r9, r9
mov qword [rax + 8], rsi
mov byte [rax + 4], 0x1e
add byte [rax + 4], 0xb
add byte [rax + 4], 0x3e
sub byte [rax + 4], 0x63
mov word [rax + 5], bx
mov dword [rsp - 0x24], 0x5518f8a6
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov byte [rbp + 8], 0x74
sub byte [rbp + 8], 0x4f
xor byte [rbp + 8], 6
xor byte [rbp + 8], 0x22
cmp rcx, rax
mov dword [rsp - 0x20], edx
jne 0x14005bae1
lea rdi, [rsp + 0x28]
xor eax, eax
mov rcx, rcx
mov ecx, 0x2f7ca1c4
add ecx, 0x47ab3a30
xor ecx, 0x15660857
sub ecx, 0x6241d323
rep stosb byte [rdi], al
mov r8, r8
jmp 0x14005bae6
call fcn.1400bb460
lea r11, [rsp + 0xb0]
mov dword [rsp - 0x14], esp
xchg rbx, r10
mov r10, qword [r11 + 0x20]
xchg rbx, r10
xchg rbp, r14
mov r14, qword [r11 + 0x28]
xchg r14, rbp
xchg r15, rsi
mov r15, qword [r11 + 0x30]
xchg r15, rsi
xchg rsp, rbx
mov rbx, r11
xchg rbx, rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret