joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c876
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg rbp, r11
mov qword [rsp + 0x18], r11
xchg r11, rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
nop
sub rsp, 0x28989c3d
add rsp, 0x28989c1d
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov r11, r11
xchg r8, rsi
mov qword [rdx], r8
xchg r8, rsi
xor edi, edi
mov rdi, rdi
movups xmmword [rsi], xmm0
mov r14, r9
mov rbp, r8
movups xmmword [rsi + 0x10], xmm0
mov dword [rsp - 0x28], esi
xchg rdx, r11
mov rbx, r11
xchg rdx, r11
xchg r10, rsi
movups xmmword [r10 + 0x20], xmm0
xchg r10, rsi
mov qword [rdx + 0x38], rdi
mov rcx, rcx
xchg r10, rax
mov r10, qword [rcx + 0x38]
xchg r10, rax
cmp r8, rax
mov dword [rsp - 0x34], 0x163ffac4
jae 0x14005ca7e
sub rax, r8
xchg r15, r10
mov qword [rsp + 0x40], r10
xchg r15, r10
cmp rax, r9
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov dword [rsp - 0x1c], 0x4b5604aa
xchg r15, rax
mov r15, qword [rcx]
xchg r15, rax
mov rcx, qword [rdx]
mov dword [rsp - 0x30], ecx
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14005c910
call fcn.140092c10
mov dword [rsp - 0x38], 0x427c67f2
cmp r14, 0x18
jbe 0x14005c944
lea rcx, [r14 + r14]
call fcn.140092ed0
mov dword [rsp - 0x3c], ebx
mov qword [rbx], rax
test rax, rax
jne 0x14005c958
xchg r15, rsi
mov qword [rbx], r15
xchg r15, rsi
mov r9, rdi
jmp 0x14005c97d
xchg rsi, rbp
mov qword [rbx], rbp
xchg rbp, rsi
mov rax, rsi
mov dword [rsp - 0x1c], 0x3e5b6306
xorps xmm0, xmm0
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
movups xmmword [rax + 0x10], xmm0
xchg rsp, rsp
xchg r9, rax
movups xmmword [r9 + 0x20], xmm0
xchg r9, rax
xchg r8, r9
mov r8, qword [rbx]
xchg r8, r9
and ebp, 3
mov r8d, 0x7ed66645
sub r8d, 0x258d346d
sub r8d, 0x19782e4b
xor r8d, 0x12c53b46
shl ebp, 2
shl ebp, 1
mov edx, r8d
mov rcx, rcx
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x14005ca2e
xchg rsi, rsi
sub r15, r9
mov ecx, 0x48b1c8b8
xor ecx, 0xe393e55
xor ecx, 0x7fb6ac89
xor ecx, 0x723edd00
sub ecx, 0x4b008665
nop dword [rax]
nop word [rax + rax]
mov rsp, rsp
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 8
mov dword [rsp - 0x44], 0x483d852c
and ax, cx
ror r8d, 2
ror r8d, 4
ror r8d, 1
ror r8d, 1
xor ax, word [r15 + r9 - 2]
inc rdi
xchg r10, r10
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x14005c9e9
mov r12, r12
xchg r15, r11
mov r11, qword [rsp + 0x40]
xchg r11, r15
xchg rbx, rsi
mov rax, rsi
xchg rbx, rsi
mov rbx, qword [rsp + 0x48]
mov dword [rsp - 0x38], 0x1abc1812
xchg r12, rbp
mov r12, qword [rsp + 0x50]
xchg r12, rbp
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
mov dword [rsp - 0x10], ecx
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
mov rax, rbx
jmp 0x14005ca42
Function at 0x14005ce60
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [rsp - 0x38], 0x21bd8d88
mov qword [r11 + 0x10], rbp
xchg rsi, rbp
mov qword [r11 + 0x18], rbp
xchg rsi, rbp
mov qword [r11 + 0x20], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x6c4f1bca
sub rsp, 0x6c4f1c2a
xchg r15, rsp
mov rsp, qword [rcx + 0x38]
xchg r15, rsp
lea rax, [r11 - 0x50]
mov dword [rsp - 0x44], 0x2ad7f8c2
mov rsi, qword [rcx]
xorps xmm0, xmm0
xchg r9, rax
mov qword [r11 - 0x58], r9
xchg r9, rax
mov r14, rcx
mov dword [rsp - 0x34], edx
lea rcx, [r11 - 0x58]
lea rdx, [r15 + 1]
xchg rsp, r11
movups xmmword [r11 + 0x28], xmm0
xchg rsp, r11
xchg rsi, rsp
movups xmmword [rsi + 0x38], xmm0
xchg rsp, rsi
xchg rsp, r13
movups xmmword [r13 + 0x48], xmm0
xchg r13, rsp
call fcn.140016760
mov ebx, 0x6637566
add ebx, 0x1f528ae1
add ebx, 0x2581649e
sub ebx, 0x1e232c1a
mov r8, rax
mov dword [rsp - 0x30], 0x22498f31
mov ecx, ebx
mov r12d, 0x7550a6ae
sub r12d, 0x120d769c
sub r12d, 0x38ddb3eb
add r12d, 0xa9b5851
xor r12d, 0x3500d487
test r15, r15
mov dword [rsp - 0x24], ebp
je 0x14005cf96
mov rdx, rax
sub rsi, rax
mov rdi, r15
mov dword [rsp - 0x18], esp
nop dword [rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r12w
mov r13, r13
ror ecx, 8
xor ax, word [rsi + rdx - 2]
mov word [rdx - 2], ax
mov dword [rsp - 0x14], 0x54ff39d
sub rdi, 1
jne 0x14005cf6a
xor ebp, ebp
xchg rbx, rbx
mov word [r8 + r15*2], bp
mov esi, ebp
mov rdi, qword [rsp + 0x20]
mov rdi, rdi
cmp qword [r14 + 0x38], rbp
jbe 0x14005cfe1
movzx ecx, word [rdi]
mov rdx, rdx
call fcn.1400939b0
mov word [rdi], ax
lea rdi, [rdi + 2]
inc rsi
mov rdx, rdx
cmp rsi, qword [r14 + 0x38]
jb 0x14005cfb4
xchg rdi, r10
mov r10, qword [rsp + 0x20]
xchg r10, rdi
nop
movabs rdx, 0xffffffff3a28ec36
sub rdx, 0x2bbdba06
xor rdx, 0x7ddb89cc
add rdx, 0x7fffffff
add rdx, 0xc4f4404
inc rdx
mov dword [rsp - 0x34], 0x39bab890
cmp word [rdi + rdx*2], bp
jne 0x14005d008
mov rcx, r14
xchg rdx, rsi
mov qword [r14 + 0x38], rsi
xchg rdx, rsi
call fcn.140016760
cmp qword [r14 + 0x38], rbp
mov rsi, rsi
jbe 0x14005d07f
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x1c], edi
movzx ecx, bx
lea rax, [rax + 2]
and cx, r12w
ror ebx, 5
ror ebx, 2
ror ebx, 1
xor cx, word [rdi + rax - 2]
mov r11, r11
inc rbp
mov word [rax - 2], cx
cmp rbp, qword [r14 + 0x38]
jb 0x14005d050
mov r11, r11
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x24], esp
jne 0x14005d0c1
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x1bb988a9
xor ecx, 0xf392cea
add ecx, 0x1cb24a8f
xor ecx, 0x712b78c0
xor ecx, 0x40199622
rep stosb byte [rdi], al
jmp 0x14005d0c9
call fcn.140092c10
xchg rbx, rbx
lea r11, [rsp + 0x60]
xchg rbx, rsp
mov rsp, qword [r11 + 0x20]
xchg rbx, rsp
xchg r15, rbp
mov r15, qword [r11 + 0x28]
xchg r15, rbp
mov rsi, qword [r11 + 0x30]
mov dword [rsp - 0x10], ecx
mov rdi, qword [r11 + 0x38]
xchg r8, rsp
mov r8, r11
xchg rsp, r8
pop r15
xchg r13, r13
pop r14
nop
mov r12, qword [rsp]
add rsp, 8
ret
Function at 0x14005d110
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f598
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eee90]
mov rbx, rbx
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov dword [rsp - 0x2c], ebx
ret

Function at 0x14005d130
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
jmp 0x14008fc0a
xchg rcx, r11
mov r10, r11
xchg rcx, r11
mov eax, dword [0x1400eef28]
cmp qword [0x1400eef78], 0
mov r14, r14
jne 0x14008f330
syscall
ret

Function at 0x14005d140
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f39b
xchg r8, r10
mov r8, rcx
xchg r10, r8
mov eax, dword [0x1400eee60]
cmp qword [0x1400eef78], 0
jne 0x14008f330
mov rdx, rdx
syscall
ret

Function at 0x14005d150
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f807
mov r10, rcx
mov eax, dword [0x1400eeec8]
cmp qword [0x1400eef78], 0
mov rsi, rsi
jne 0x14008f330
syscall
ret

Function at 0x14005d160
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f3f5
xchg rdx, rcx
mov r10, rdx
xchg rdx, rcx
mov eax, dword [0x1400eee68]
cmp qword [0x1400eef78], 0
mov rdx, rdx
jne 0x14008f330
syscall
ret

Function at 0x14005d170
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fa05
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eeef8]
cmp qword [0x1400eef78], 0
mov rbx, rbx
jne 0x14008f330
syscall
ret

Function at 0x14005d180
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f5c5
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eee94]
cmp qword [0x1400eef78], 0
mov dword [rsp - 0x20], 0x356edd5a
jne 0x14008f330
syscall
ret

Function at 0x14005d190
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f8aa
xchg r10, r12
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1400eeed8]
cmp qword [0x1400eef78], 0
mov dword [rsp - 0x2c], edi
jne 0x14008f330
syscall
ret

Function at 0x14005d1a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f3c8
xchg r11, rcx
mov r10, r11
xchg rcx, r11
mov eax, dword [0x1400eee64]
xchg r15, r15
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d1b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f982
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1400eeeec]
xchg r14, r14
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d1c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f7b1
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eeec0]
cmp qword [0x1400eef78], 0
jne 0x14008f330
xchg r11, r11
syscall
ret

Function at 0x14005d1d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f7da
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eeec4]
xchg r15, r15
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov dword [rsp - 0x3c], ebx
ret

Function at 0x14005d1e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f64a
xchg rdi, rcx
mov r10, rdi
xchg rcx, rdi
mov eax, dword [0x1400eeea0]
mov dword [rsp - 0x20], 0x192dd9d3
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret
Function at 0x14005d1f0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
mov rcx, rcx
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x14008fbdd
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1400eef24]
mov dword [rsp - 0xc], ebp
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov rsi, rsi
ret

Function at 0x14005d210
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f4ba
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eee7c]
mov dword [rsp - 0x30], 0xa216903
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d220
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f4e8
xchg rbp, r10
mov rbp, rcx
xchg rbp, r10
mov eax, dword [0x1400eee80]
mov dword [rsp - 0x2c], 0x538af86
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d230
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f516
mov r10, rcx
mov eax, dword [0x1400eee84]
cmp qword [0x1400eef78], 0
xchg r11, r11
jne 0x14008f330
syscall
ret

Function at 0x14005d240
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f539
xchg rbx, r10
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1400eee88]
cmp qword [0x1400eef78], 0
mov dword [rsp - 0x44], 0x2caae939
jne 0x14008f330
syscall
ret

Function at 0x14005d250
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f494
mov r10, rcx
xchg r13, r13
mov eax, dword [0x1400eee78]
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov r13, r13
ret

Function at 0x14005d260
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fa2e
mov r10, rcx
mov eax, dword [0x1400eeefc]
mov dword [rsp - 0x14], 0x52c063fd
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d270
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f567
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1400eee8c]
mov r13, r13
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov dword [rsp - 0x44], 0x755d3f5e
ret

Function at 0x14005d280
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f41e
mov r10, rcx
mov eax, dword [0x1400eee6c]
cmp qword [0x1400eef78], 0
mov dword [rsp - 0x1c], ebx
jne 0x14008f330
syscall
ret

Function at 0x14005d290
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f5f3
xchg rdi, rcx
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1400eee98]
mov r9, r9
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d2a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f853
xchg r10, rbp
mov rbp, rcx
xchg rbp, r10
mov eax, dword [0x1400eeed0]
mov dword [rsp - 0x2c], 0x4733e955
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d2b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f8d4
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eeedc]
mov dword [rsp - 0x24], 0x34e9fd9c
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret
Function at 0x14005d2c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fc33
add rsp, 0xfffffffffffffee0
lea rcx, [0x14008f38e]
nop
mov qword [rsp - 8], rcx
sub rsp, 8
push rbp
xchg r11, r11
push rsi
push rdi
push qword [0x1400eef80]
lea rsi, [rsp + 0x170]
mov dword [rsp - 0x1c], ebp
lea rdi, [rsp + 0x28]
mov ecx, 0x238d40a7
add ecx, 0x4b8ed42d
sub ecx, 0x16ef9afe
sub ecx, 0x315651
sub ecx, 0x57fb2375
rep movsq qword [rdi], qword [rsi]
mov r11, r11
jmp qword [0x1400eef78]
mov r10, rcx
mov dword [rsp - 0xc], esp
mov eax, dword [0x1400eef2c]
cmp qword [0x1400eef78], 0
jne 0x14008f330
mov dword [rsp - 0x38], 0x7e946ef0
syscall
ret

Function at 0x14005d2d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f46b
xchg rcx, r9
mov r10, r9
xchg r9, rcx
mov eax, dword [0x1400eee74]
cmp qword [0x1400eef78], 0
jne 0x14008f330
mov r11, r11
syscall
ret

Function at 0x14005d2e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fbaf
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400eef20]
cmp qword [0x1400eef78], 0
jne 0x14008f330
mov dword [rsp - 0x3c], 0x3515101b
syscall
ret

Function at 0x14005d2f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fb55
xchg r11, rcx
mov r10, r11
xchg r11, rcx
mov eax, dword [0x1400eef18]
mov rdi, rdi
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d300
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008fb7e
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1400eef1c]
mov r10, r10
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov dword [rsp - 0x30], 0x6b0a1fd6
ret

Function at 0x14005d310
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f442
xchg rcx, r12
mov r10, r12
xchg rcx, r12
mov eax, dword [0x1400eee70]
xchg r13, r13
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
ret

Function at 0x14005d320
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f61c
xchg r10, r15
mov r15, rcx
xchg r15, r10
mov eax, dword [0x1400eee9c]
mov dword [rsp - 0x18], ecx
cmp qword [0x1400eef78], 0
jne 0x14008f330
syscall
mov dword [rsp - 0x1c], ecx
ret

Function at 0x140064500
Capabilities:
Hash data using murmur3

Disassembly:
push r14
mov qword [rsp], rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
mov edx, 0x34b96ba4
sub edx, 0x2a987316
add edx, 0x375f216a
sub edx, 0x1192ccaa
add edx, 0xb49a4beb
call fcn.1400818d0
xchg r13, rax
mov rcx, r13
xchg r13, rax
xor eax, eax
mov dword [rsp - 0x18], esi
test rcx, rcx
je 0x1400645eb
movabs rax, 0xfb3729ef119a6e85
add rax, 0x369cd177
add rax, 0x3768aae7
sub rax, 0x54f02a9
add rax, rcx
movabs rcx, 0x454d9a1f460159b1
sub rcx, 0x19c6dea8
xor rcx, 0x28db317c
xor rcx, 0x793afa1f
sub rcx, 0x188bcee
rol rax, 3
rol rax, 0xd
rol rax, 0xf
rol rax, 1
rol rax, 1
rol rax, 1
xor rax, rcx
mov r14, r14
movabs rcx, 0x2a0a3cdd7e6be567
xor rcx, 0x6a0656a5
add rcx, 0x680a9760
add rcx, 0x7fffffff
sub rcx, 0x45a4f616
sub rax, rcx
xchg rdx, rdx
mov qword [rbx + 0x78], rax
mov al, 0x18
xor al, 0x19
add al, 0x33
add al, 0x22
sub al, 0x55
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1400702e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
xchg rcx, rsi
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x3c], 0x5a8858c0
push rdi
mov qword [rsp], rbp
xchg rbp, r15
mov r15, rsp
xchg rbp, r15
nop
add rsp, 0x523207cb
sub rsp, 0x5232082b
movabs rbx, 0xf36add4179fe55
sub rbx, 0x2dc99aee
add rbx, 0x60d10670
sub rbx, 0x54f64e9b
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0xc], 0x52908efb
jne 0x14007050e
xor esi, esi
mov dword [rbp - 0x40], 0x75ef4e6d
sub dword [rbp - 0x40], 0x6a824eba
add dword [rbp - 0x40], 0x6c96fca4
sub dword [rbp - 0x40], 0x77a7fbcd
mov dword [rbp - 0x3c], 0x50f64c1a
sub dword [rbp - 0x3c], 0x34aa6378
add dword [rbp - 0x3c], 0x2ef98bb
xor dword [rbp - 0x3c], 0x49e8878d
sub dword [rbp - 0x3c], 0x5687066e
mov dword [rbp - 0x38], 0x4b755b14
sub dword [rbp - 0x38], 0x37222639
add dword [rbp - 0x38], 0x40554e5
sub dword [rbp - 0x38], 0x18078905
mov dword [rbp - 0x34], 0x2df4255
xor dword [rbp - 0x34], 0x4e46d4aa
add dword [rbp - 0x34], 0x68df5fd
sub dword [rbp - 0x34], 0x170fa892
sub dword [rbp - 0x34], 0x3bf8e443
mov dword [rbp - 0x30], 0x4c798f8d
add dword [rbp - 0x30], 0x1c1994b0
xor dword [rbp - 0x30], 0x5d5d58b4
add dword [rbp - 0x30], 0x5b1d305
sub dword [rbp - 0x30], 0x3b244ea9
mov dword [rbp - 0x2c], 0x13bbc4f
add dword [rbp - 0x2c], 0x1eaae6a1
add dword [rbp - 0x2c], 0x548e3f19
sub dword [rbp - 0x2c], 0x7433e191
mov qword [rbp + 0x10], rsi
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
mov rcx, qword [rbp + 0x10]
mov rbx, rbx
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
xchg rbx, rbx
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x75ab5d47
xor eax, 0x48f2e61c
add eax, 0x30e62737
sub eax, 0x992ea98
sub eax, 0x3798bf2f
shr eax, cl
mov dword [rsp - 0x10], edx
movzx ecx, al
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
xor cx, dx
mov dword [rsp - 0xc], edx
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg rbp, rbp
xchg r14, rax
mov qword [rbp + 0x10], r14
xchg r14, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xc
jb 0x140070425
mov dword [rsp - 0x20], 0x4e90630b
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
mov dword [rsp - 0x24], 0x4317616b
call fcn.140086500
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
xor eax, eax
mov dword [rsp - 0x20], ebp
xor rdx, rbx
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov rsi, rsi
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140070516
lea rdx, [0x1400ee2c0]
mov dword [rsp - 0x28], edi
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.140074bb4
mov dword [rsp - 0x44], 0x10865ef8
test al, al
setne al
jmp 0x140070516
mov al, 0x25
sub al, 0xa
add al, 0x4a
xor al, 0x64
lea r11, [rsp + 0x60]
xchg rbp, rbp
xchg rbx, rsp
mov rsp, qword [r11 + 0x18]
xchg rsp, rbx
xchg rsi, r14
mov r14, qword [r11 + 0x20]
xchg rsi, r14
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x14], ebx
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140070550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov rdi, rdi
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg r15, rsi
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg r13, rdi
push rbp
xchg rcx, rcx
mov rbp, rsp
nop
add rsp, 0x32c83c13
sub rsp, 0x32c83c63
movabs rbx, 0xf36add2f4f8d25
add rbx, 0x4ccc52
sub rbx, 0xc3f3ede
add rbx, 0x23cf372e
sub rbx, 0x27a1368b
xchg rcx, r15
mov rdi, r15
xchg r15, rcx
cmp qword [rcx + 0x28], rbx
mov dword [rsp - 0x44], 0xe78407b
jne 0x14007074f
mov eax, 0x31d4d5fd
xor eax, 0x26ef2034
add eax, 0x146ee776
xor eax, 0x318a8747
sub eax, 0x1a2059d1
mov dword [rbp - 0x30], 0x52b8e401
xor dword [rbp - 0x30], 0x51273e36
add dword [rbp - 0x30], 0x76976f18
sub dword [rbp - 0x30], 0x79e348cb
mov word [rbp - 0x20], ax
xor esi, esi
xchg r9, r9
mov dword [rbp - 0x2c], 0x1bd4c292
xor dword [rbp - 0x2c], 0x781e2b94
xor dword [rbp - 0x2c], 0x229ceb6a
xor dword [rbp - 0x2c], 0x3d63cb79
xor dword [rbp - 0x2c], 0x7c2bc964
mov dword [rbp - 0x28], 0x1cf258a6
xor dword [rbp - 0x28], 0x56dd9935
xor dword [rbp - 0x28], 0x44b44af9
xor dword [rbp - 0x28], 0xe8d8b93
mov dword [rbp - 0x24], 0xd00492
xor dword [rbp - 0x24], 0x2d29708a
sub dword [rbp - 0x24], 0x2d6851aa
sub dword [rbp - 0x24], 0x5021fe
mov qword [rbp + 0x10], rsi
mov rbp, rbp
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
xchg rcx, r12
mov r12, qword [rbp + 0x10]
xchg r12, rcx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
and cl, 3
xchg r8, r8
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x6fcfca27
add eax, 0xd5e37aa
xor eax, 0x65a80ac5
xor eax, 0x359233df
shr eax, cl
mov dword [rsp - 0x38], ebx
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov dword [rsp - 0xc], 0x29212b5d
mov word [rbp + rax*2 - 0x1e], cx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
inc rax
xchg rsi, rax
mov qword [rbp + 0x10], rsi
xchg rsi, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x2c], 0x585797fc
cmp rax, 9
jb 0x14007066d
xor edx, edx
mov word [rbp - 0xc], si
xchg rsi, rsi
lea rcx, [rbp - 0x1e]
call fcn.140086500
mov rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov dword [rsp - 0x34], edx
xor rdx, rbx
mov qword [rdi + 0x28], rdx
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
mov dword [rsp - 0x18], edi
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140070757
lea rdx, [0x1400ee810]
mov dword [rsp - 0x2c], 0x42adf723
mov rcx, r8
call fcn.140079264
test al, al
setne al
mov dword [rsp - 0x3c], 0x5a43aa50
jmp 0x140070757
mov al, 0x73
xor al, 0x45
xor al, 0x54
sub al, 0x61
mov rbx, qword [rsp + 0x68]
xchg rsi, r13
mov r13, qword [rsp + 0x70]
xchg r13, rsi
xchg r15, rdi
mov r15, qword [rsp + 0x78]
xchg r15, rdi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rbp
mov dword [rsp - 0x20], 0x5bb6f0c0
ret
Function at 0x140070788
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r11, rsi
mov qword [rsp + 0x18], r11
xchg rsi, r11
xchg rdi, r10
mov qword [rsp + 0x20], r10
xchg r10, rdi
nop
push r8
mov qword [rsp], rbp
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
sub rsp, 0x50
movabs rbx, 0xf36add0c3ed24f
add rbx, 0x591123f1
xor rbx, 0x3e81d119
xor rbx, 0x125d3f20
sub rbx, 0x2a07fd3d
xchg rbp, rdi
mov rbp, rcx
xchg rbp, rdi
cmp qword [rcx + 0x38], rbx
mov dword [rsp - 0x30], esi
jne 0x140070975
xor esi, esi
mov dword [rbp - 0x30], 0x2462e6b3
xor dword [rbp - 0x30], 0x3f849656
xor dword [rbp - 0x30], 0x49dd645e
sub dword [rbp - 0x30], 0x51f31422
mov dword [rbp - 0x2c], 0x5f89eb21
xor dword [rbp - 0x2c], 0x47055346
xor dword [rbp - 0x2c], 0x1423bb1b
xor dword [rbp - 0x2c], 0xea6edcc
sub dword [rbp - 0x2c], 0x1aaee39
mov dword [rbp - 0x28], 0x5db1d07f
xor dword [rbp - 0x28], 0x404cd7a
sub dword [rbp - 0x28], 0x179a1183
xor dword [rbp - 0x28], 0x326f5da5
sub dword [rbp - 0x28], 0x70685568
mov dword [rbp - 0x24], 0x6c406955
add dword [rbp - 0x24], 0x22f5c69
xor dword [rbp - 0x24], 0x501197f7
sub dword [rbp - 0x24], 0x3e35520f
mov dword [rbp - 0x20], 0x78668597
sub dword [rbp - 0x20], 0x4c534b20
add dword [rbp - 0x20], 0x3cfe3506
sub dword [rbp - 0x20], 0x68bd6ed6
mov qword [rbp + 0x10], rsi
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x18], 0x2ec0b122
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x71855e7a
sub eax, 0x3d96cdef
add eax, 0x19800bb5
sub eax, 0x205a6375
shr eax, cl
mov dword [rsp - 0x10], ebp
movzx ecx, al
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
xchg r10, r10
inc rax
xchg rsi, rax
mov qword [rbp + 0x10], rsi
xchg rsi, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xa
jb 0x14007089c
mov r13, r13
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.140086500
mov dword [rsp - 0x34], 0x7aca2506
xchg rdx, rdi
mov rdi, rax
xchg rdi, rdx
mov r8, rax
mov dword [rsp - 0x34], ebx
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
mov dword [rsp - 0x3c], esp
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14007097f
mov r12, r12
lea rdx, [0x1400ee830]
xchg rsp, rcx
mov rsp, r8
xchg rcx, rsp
call fcn.140079704
mov dword [rsp - 0x14], ebx
test al, al
setne al
jmp 0x14007097f
mov al, 0x6b
sub al, 0x43
add al, 0x49
add al, 0xb
sub al, 0x7b
mov rbx, qword [rsp + 0x68]
xchg rcx, rcx
mov rsi, qword [rsp + 0x70]
xchg rdi, r10
mov r10, qword [rsp + 0x78]
xchg rdi, r10
sub rsp, 0xffffffffffffffb0
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret