joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d690
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
push 0x68f6a479
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
push r13
mov qword [rsp], rdi
push r12
mov dword [rsp - 0x34], 0x39ccc345
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r13
mov qword [rsp], r15
nop
add rsp, 0x66d933da
sub rsp, 0x66d933fa
movzx eax, word [rcx]
mov dword [rsp - 0x30], 0x44b7f559
mov r15d, edx
xor eax, 0x1ac04423
mov rsi, rcx
mov r10, r10
cmp eax, 0x1ac01e6e
jne 0x14009d854
movsxd rdx, dword [rcx + 0x3c]
mov dword [rsp - 0x34], 0x672f0de1
mov eax, dword [rdx + rcx]
xor eax, 0x1ac04423
cmp eax, 0x1ac00173
mov r11, r11
jne 0x14009d854
mov edx, dword [rdx + rcx + 0x88]
call fcn.14009d5b0
mov rcx, rsi
mov r12, r12
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.14009d5b0
mov r13, r13
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg r8, rax
mov r12, r8
xchg r8, rax
call fcn.14009d5b0
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x18], 0x4c402d91
xchg rcx, r15
mov r15, rsi
xchg rcx, r15
xchg r9, r13
mov r9, rax
xchg r13, r9
call fcn.14009d5b0
xchg rdi, rdi
xor edi, edi
xchg rdi, rax
mov qword [rsp + 0x70], rdi
xchg rdi, rax
cmp dword [r14 + 0x18], edi
mov r10, r10
jbe 0x14009d854
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, r14
mov r14, rsi
xchg rcx, r14
call fcn.14009d5b0
mov dword [rsp - 0x40], 0x3e8329ab
mov ecx, 0x6ca1fc29
sub ecx, 0x1f1c330a
sub ecx, 0x5d0a0ce
add ecx, 0xb84ad7ae
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x24], edx
cmp byte [rax], 0
je 0x14009d836
nop dword [rax]
mov rdx, rbx
mov dword [rsp - 0x34], 0x32375ca6
lea rcx, [rsp + 0x60]
mov r8d, 0x758683e8
xor r8d, 0x1ec8242e
sub r8d, 0x47f8c1b9
sub r8d, 0x2355e60c
inc rbx
call fcn.1400a79a0
mov dword [rsp - 0xc], esi
cmp byte [rbx], 0
jne 0x14009d7ef
mov ecx, dword [rsp + 0x60]
xchg r8, r8
not ecx
cmp ecx, r15d
je 0x14009d890
xchg r12, r12
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14009d7a3
mov dword [rsp - 0x44], esi
xor eax, eax
mov rbx, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov dword [rsp - 0x10], 0x358e3e84
pop r14
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg r10, r10
xchg rdi, rsi
mov rcx, rdi
xchg rdi, rsi
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x30], 0x8397343
call fcn.14009d5b0
jmp 0x14009d856
Function at 0x1400a1985
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
nop
push 0xe203099
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
mov rbx, qword [rcx]
mov dword [rsp - 0x3c], edx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, rdx
mov qword [rsp + 0x70], rdx
xchg rsi, rdx
mov rsi, qword [rcx + 0x38]
xchg rbx, rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rsp, r13
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x2c], 0x2e9939e8
xchg rsp, r13
movups xmmword [r13 + 0x38], xmm0
xchg rsp, r13
xchg rcx, rsp
movups xmmword [rcx + 0x48], xmm0
xchg rsp, rcx
call fcn.140011430
xchg r13, r13
mov edx, 0x62a6a39
xor edx, 0x296b2c02
add edx, 0x12a42850
xor edx, 0x76877d80
test rsi, rsi
je 0x1400a1a7e
xchg r11, rdi
mov r11, rax
xchg r11, rdi
sub rbx, rax
mov dword [rsp - 0x10], 0x2c7e803f
xchg rsi, r10
mov r8, r10
xchg rsi, r10
mov r9d, 0x7f9aada4
xor r9d, 0x81cc10a
sub r9d, 0x56092740
sub r9d, 0x217d446f
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x40], 0x7859621f
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 5
ror edx, 1
ror edx, 2
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
sub r8, 1
xchg rsp, rsp
jne 0x1400a1a4d
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x1c], edi
call fcn.1400a1b20
xchg rbx, rcx
mov rbx, qword [rsp + 0x20]
xchg rbx, rcx
mov ebx, eax
mov r14, r14
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400a1af7
mov r8, r8
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x33941f93
add ecx, 0x2e008e5f
xor ecx, 0x48712a1c
xor ecx, 0x29e587de
rep stosb byte [rdi], al
mov eax, ebx
mov dword [rsp - 0x38], ecx
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x3813b04b
sub rsp, 0x3813afeb
pop rdi
xchg rdx, rdx
ret
call fcn.1400c1b60
mov eax, ebx
mov rbx, qword [rsp + 0x78]
xchg r9, r9
nop
sub rsp, 0xf1a4f38
add rsp, 0xf1a4f98
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400a2c63
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
xchg rbx, rsp
mov qword [r11 + 0x20], rsp
xchg rsp, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
lea rax, [r11 - 0x40]
xchg rbx, rbx
xchg rbp, r15
mov qword [r11 + 8], r15
xchg r15, rbp
xorps xmm0, xmm0
xchg rbp, rax
mov qword [r11 - 0x48], rbp
xchg rbp, rax
mov ebp, r8d
xchg rcx, rsi
mov qword [r11 + 0x10], rcx
xchg rsi, rcx
xchg rsi, r12
mov r12, qword [rcx + 0x38]
xchg rsi, r12
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov rbp, rbp
xchg r10, rdx
mov r14, r10
xchg r10, rdx
xchg r15, rsp
movups xmmword [r15 + 0x28], xmm0
xchg r15, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x18], ebx
movups xmmword [rsp + 0x48], xmm0
call fcn.140011430
mov edx, 0xa461413
add edx, 0x7515a80f
sub edx, 0x7c53acc0
xor edx, 0x346a1c69
test rsi, rsi
xchg r8, r8
je 0x1400a2d7e
mov rdi, rax
sub rbx, rax
mov dword [rsp - 0x44], 0x6c5df234
xchg rbx, r8
mov rbx, rsi
xchg r8, rbx
mov r9d, 0x6c7a5278
sub r9d, 0x1a92ed95
sub r9d, 0x1a52811
sub r9d, 0x4cd44e7a
xor r9d, 0x36deea7
nop word [rax + rax]
xchg r15, r15
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
xchg r11, r11
ror edx, 3
ror edx, 3
ror edx, 2
xor cx, word [rdi + rbx - 2]
mov dword [rsp - 0x28], edi
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400a2d4d
mov r9, r9
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg r13, r13
xchg rdx, r14
mov r14, rdx
xchg rdx, r14
mov rcx, qword [rsp + 0x20]
xchg r11, r11
call fcn.1400a2e40
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg r14, rbp
mov rbp, qword [rsp + 0x80]
xchg r14, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x10], 0x7aa81e72
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x1400a2e18
mov dword [rsp - 0x14], ebp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x7a3a0293
sub ecx, 0x4aea492
sub ecx, 0x3334fd79
sub ecx, 0x42566058
rep stosb byte [rdi], al
mov dword [rsp - 0x24], edx
mov eax, ebx
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
xchg rcx, rcx
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400c1b60
mov dword [rsp - 0x20], ecx
mov eax, ebx
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400a2e40
Capabilities:
Access peb ldr_data

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov dword [rsp + 0x18], r8d
mov rsp, rsp
nop
push 0x5401b27c
mov qword [rsp], rdi
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
xchg r12, rbx
mov r12, rdx
xchg r12, rbx
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x394d1429
sub r8d, 0x186809b7
sub r8d, 0x95e944e
add r8d, 0x4e4f12e
sub r8d, 0x1c6b654a
call fcn.1400c2100
mov rax, qword gs:[0x60]
mov dword [rsp - 0x30], esi
mov r8, qword [rax + 0x18]
xchg r15, rax
mov r15, qword [r8 + 0x10]
xchg r15, rax
mov r8, qword [rax]
test r8, r8
xchg rcx, rcx
je 0x1400a311d
mov r8, qword [r8 + 0x50]
test r8, r8
mov r10, r10
je 0x1400a311d
mov edx, 0x5f486462
sub edx, 0x1dcd77ea
xor edx, 0x2b988e46
sub edx, 0x70ae1e7
sub edx, 0x63d77f53
lea rcx, [rsp + 0x30]
mov r9d, 0x3d0077cd
add r9d, 0x2db39b9e
sub r9d, 0x44de8ac6
xor r9d, 0x25d589a6
call fcn.1400c2c80
mov r13, r13
mov edx, 0x34d008f8
sub edx, 0x27718113
add edx, 0x57219a67
sub edx, 0x5756bced
xor edx, 0xd296503
lea rcx, [rsp + 0x30]
call fcn.1400c2d90
test rax, rax
mov dword [rsp - 0x3c], 0x6bdc1ef1
je 0x1400a30eb
xor ecx, ecx
xchg r8, rdi
mov rdx, r8
xchg rdi, r8
mov word [rax], cx
mov dword [rsp - 0xc], ebx
movabs rcx, 0x4005b885191dadbf
xor rcx, 0x31ef2862
xor rcx, 0x31ad9a60
xor rcx, 0x77f11d30
mov rax, qword [0x1404ec370]
xor rax, rcx
mov dword [rsp - 0x30], edx
movabs rcx, 0x6174347833104866
xor rcx, 0x5cc3dd61
sub rcx, 0x2ffdfbd2
add rcx, 0x638af7a
add rcx, 0x1a6d4f8a
not rax
sub rax, rcx
mov r14, r14
movabs rcx, 0xb52022540e28c583
add rcx, 0x332180a6
sub rcx, 0x10dafeff
sub rcx, 0x15eea584
xor rax, rcx
lea rcx, [rsp + 0x20]
rol rax, 3
rol rax, 0xd
rol rax, 9
rol rax, 1
rol rax, 1
rol rax, 1
call rax
mov r10, qword [0x1404ec360]
xchg r9, r9
lea r8, [rsp + 0x20]
ror r10, 0xb
ror r10, 0x15
ror r10, 0xb
ror r10, 1
lea rdx, [rsp + 0x260]
movabs rcx, 0x76f1ba8f732c3674
sub rcx, 0x6392ce97
add rcx, 0x4ab4d7a1
add rcx, 0x143caf6b
sub rcx, 0x38bf4605
movabs rax, 0x7e1bb5b42ff8027a
add rax, 0x1b9e676c
sub rax, 0x35a3b5b7
add rax, 0x398aeefe
xor rax, 0x526a5aad
add r10, rcx
xchg rdi, rdi
xchg r10, r9
mov r10, rbx
xchg r9, r10
not r10
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x20], ebx
rol r10, 6
rol r10, 6
xor r10, rax
mov dword [rsp - 0xc], ecx
movabs rax, 0x4912cfcf3c8519a9
sub rax, 0x39cecf63
add rax, 0x6c756192
add rax, 0xb1464ca
sub r10, rax
call r10
xchg r12, rbx
mov r12, qword [rsp + 0x250]
xchg rbx, r12
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x57e5ddc3
add eax, 0x24833c5c
sub eax, 0x3765a387
xor eax, 0x85037699
xchg rbx, r14
mov r14, qword [rsp + 0x250]
xchg rbx, r14
sub rsp, 0x7a41968a
add rsp, 0x7a4198ca
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x20], edi
mov eax, 0x521381ee
sub eax, 0xba4ae39
sub eax, 0x454b0b52
add eax, 0x284af77b
add eax, 0x96914157
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
xchg r9, r9
ret
Function at 0x1400a6840
Capabilities:
Encode data using xor

Disassembly:
push rbx
xchg r12, r12
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x1404ec0f0]
mov r12, r12
mov rbx, rcx
movabs rcx, 0x1e250f5b579f8364
add rcx, 0x9346817
add rcx, 0x188ac895
sub rcx, 0x28deaa32
add rcx, 0x30336dbe
mov edx, 0x65e276f8
sub edx, 0xfd8137a
xor edx, 0x4578eeec
add edx, 0x596fab00
sub edx, 0x6ce2378e
xor rax, rcx
mov rdx, rdx
movabs rcx, 0x3c5b5b895cdb9748
sub rcx, 0x4d232336
xor rcx, 0x7960efdf
add rcx, 0x7fffffff
sub rcx, 0x662a1ef8
add rax, rcx
movabs rcx, 0xf3e2e5c2214552e8
add rcx, 0x9824635
sub rcx, 0xed86a29
xor rcx, 0x1f034d67
ror rax, 0x2b
ror rax, 1
ror rax, 1
ror rax, 2
ror rax, 1
add rax, rcx
movabs rcx, 0xb242a7fe045d3c21
add rcx, 0x25f77ede
xor rcx, 0x49eb1b20
add rcx, 0x7fffffff
xor rcx, 0x64b73c01
xor rax, rcx
mov rsp, rsp
movabs rcx, 0x75471aef10d1fee3
add rcx, 0x6ace2894
sub rcx, 0x105f687c
xor rcx, 0xb86596d
xor rcx, 0x2b6cc481
add rax, rcx
mov rbx, rbx
lea rcx, [rsp + 0x20]
call rax
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x1c], 0x2897f765
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff121357f9
add rdx, 0x2748ea87
sub rdx, 0x1699084e
xor rdx, 0x7c5c9e64
add rdx, 0x7fffffff
add rdx, 0x21605baa
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg r8, rax
movups xmmword [r8 + 0x10], xmm0
xchg r8, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
lea rax, [rsp + 0x20]
inc rdx
cmp word [rax + rdx*2], 0
xchg rsi, rsi
jne 0x1400a69c3
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
xchg rdx, r12
mov qword [rbx + 0x38], r12
xchg rdx, r12
call fcn.140011430
mov rdi, rdi
xor r8d, r8d
mov ecx, 0x7c40d0bc
xor ecx, 0x3740291c
sub ecx, 0x4842a5c8
add ecx, 0x34a3bf33
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x1c], 0x7785a3e9
jbe 0x1400a6a92
lea r9, [rsp + 0x20]
mov r10d, 0x3a4b769
add r10d, 0x275f5f1f
sub r10d, 0xca9c6a9
xor r10d, 0x6eb27ae0
xor r10d, 0x70e835c0
sub r9, rax
mov rbx, rbx
nop word [rax + rax]
movzx edx, cx
lea rax, [rax + 2]
mov dword [rsp - 0x10], 0x6c49b258
and dx, r10w
ror ecx, 3
ror ecx, 2
ror ecx, 2
ror ecx, 1
xor dx, word [rax + r9 - 2]
inc r8
mov dword [rsp - 0x2c], 0x43fb5758
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
jb 0x1400a6a51
mov dword [rsp - 0x18], esi
mov rax, rbx
sub rsp, 0x6f843634
add rsp, 0x6f843864
pop rbx
ret
Function at 0x1400a7d20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404ed114], 0
mov dword [rsp - 0x10], ebx
jne 0x1400a7e2f
xor edx, edx
lea r8, [0x1404ed110]
mov r9, r9
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x14], esi
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
xchg rdx, rdx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov dword [rsp - 0x14], ebp
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg rdi, rdi
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x1c], 0x49773f63
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x44], 0x3fb6abde
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg rdx, rdx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x24], 0x197c2a1e
shr eax, 1
and ecx, 1
neg ecx
xchg r10, r10
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x10], 0x166cfa2f
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov r14, r14
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r8, r8
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r8, r8
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov r10, r10
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x40], 0x22810a55
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov dword [rsp - 0x1c], ebx
jb 0x1400a7d47
ret
Function at 0x1400ae0c2
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
push r12
mov dword [rsp - 0x28], 0x5e9b8f3d
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffd8
xchg rcx, rdx
mov r14, rcx
xchg rcx, rdx
mov r13d, r8d
mov dword [rsp - 0xc], 0x4f9bf8a0
mov edx, 0x6cfac0b0
sub edx, 0x2a9592e
xor edx, 0x513e07b8
sub edx, 0x3b6b603a
cmp r8d, edx
mov dword [rsp - 0x18], ebx
jae 0x1400ae054
mov edx, r13d
nop
movabs rcx, 0xffffffff01aed49d
xor rcx, 0x5b5978b7
sub rcx, 0x2cc5060e
xor rcx, 0x74095508
add rcx, 0x7fffffff
add rcx, 0x25c40cec
mov eax, 0x4f14759d
add eax, 0x2c394ee7
sub eax, 0x7b46ed76
sub eax, 0x6d70a
mul rdx
xchg rbx, rbx
cmovb rax, rcx
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call fcn.1400c1980
xchg r12, rax
mov r15, r12
xchg r12, rax
mov byte [rsp + 0x70], 0x1f
xor byte [rsp + 0x70], 0xf
xor byte [rsp + 0x70], 0x67
sub byte [rsp + 0x70], 0x1c
sub byte [rsp + 0x70], 0x5a
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
lea r12d, [r13 + 0xfffff]
mov rsi, rsi
xor esi, esi
shr r12d, 0x14
mov ebp, dword [rax + 0x18]
mov dword [rsp - 0x28], ebp
test r12d, r12d
je 0x1400ae216
xchg r11, rbx
mov qword [rsp + 0x68], r11
xchg r11, rbx
mov ecx, 0x6d515311
xor ecx, 0xdef1b60
sub ecx, 0x1ac7c052
sub ecx, 0x45e6881f
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
mov edi, esi
mov dword [rsp - 0x24], 0x2690806b
mov ebx, r13d
shl edi, 7
shl edi, 0xb
shl edi, 1
shl edi, 1
xchg rbp, rdx
mov rbp, r15
xchg rbp, rdx
sub ebx, edi
xchg r12, r12
cmp ebx, ecx
cmova ebx, ecx
xchg r15, rcx
mov r15, rax
xchg rcx, r15
mov r8d, ebx
call fcn.1400aa500
mov dword [rsp - 0x34], edi
test al, al
je 0x1400ae1f0
shr ebx, 1
shr ebx, 1
xor eax, eax
xchg rsp, rsp
shr edi, 2
test ebx, ebx
je 0x1400ae1b3
mov dword [rsp - 0x28], esp
xchg r9, r15
mov r15, r9
xchg r15, r9
lea ecx, [rdi + rax]
mov r8d, ebp
xor r8d, dword [r9]
mov dword [rsp - 0x30], edi
lea r9, [r9 + 4]
xor r8d, 0x1ac04423
inc eax
mov dword [r14 + rcx*4], r8d
mov r15, r15
cmp eax, ebx
jb 0x1400ae18a
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
inc esi
xchg rcx, rcx
mov ecx, 0x2090c272
add ecx, 0xc798387
xor ecx, 0x1883dc93
xor ecx, 0x4f9858df
sub ecx, 0x7a01c1b5
cmp esi, r12d
jb 0x1400ae122
mov dword [rsp - 0x44], esp
jmp 0x1400ae209
mov byte [rsp + 0x70], 0x3f
add byte [rsp + 0x70], 3
add byte [rsp + 0x70], 3
sub byte [rsp + 0x70], 0x21
sub byte [rsp + 0x70], 0x24
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20]
xchg r10, r10
xchg r15, r8
mov rcx, r8
xchg r8, r15
call fcn.1400c1990
mov dword [rsp - 0x10], ecx
movzx eax, byte [rsp + 0x70]
nop
sub rsp, 0x3577a5e0
add rsp, 0x3577a608
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov r15, r15
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400ae280
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x3c], ecx
mov qword [rsp + 0x20], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r14d, r8d
mov dword [rsp - 0x14], 0x6632050e
mov rdi, rdx
mov r9d, r14d
mov r13, rcx
mov dword [rsp - 0x3c], 0x103710aa
cmp r8d, 0x40000
jb 0x1400ae30f
mov r9d, 0x32bed481
add r9d, 0x3db8cc3d
sub r9d, 0x5ea6d294
xor r9d, 0x3b04bb75
xor r9d, 0x2ad0755f
nop
movabs rcx, 0xffffffff75ded59a
xor rcx, 0x704f80b6
xor rcx, 0x6da9a7b0
add rcx, 0x7fffffff
add rcx, 0x17c70d64
mov eax, 0x227b9a8c
xor eax, 0x6964dd1f
add eax, 0x3fde3f5
xor eax, 0x45e5ffb
sub eax, 0x4b43746f
mul r9
cmovb rax, rcx
mov r11, r11
xchg rdi, rax
mov rcx, rdi
xchg rdi, rax
call fcn.1400c1980
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
xchg rdx, rdx
shr r15d, 0x11
shr r15d, 2
shr r15d, 1
xor ebx, ebx
mov dword [rsp - 0x1c], 0x76535908
mov rbp, rax
mov r12b, 0x14
add r12b, 0x3d
xor r12b, 0x6c
xor r12b, 0x10
sub r12b, 0x2c
test r15d, r15d
mov r13, r13
je 0x1400ae4cc
nop
mov r8d, ebx
mov r8, r8
mov r10d, r14d
shl r8d, 2
shl r8d, 3
shl r8d, 4
shl r8d, 2
shl r8d, 3
shl r8d, 2
shl r8d, 2
shl r8d, 1
shl r8d, 1
xor eax, eax
xchg r11, r11
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov r13, r13
jbe 0x1400ae437
mov r10d, 0x4e840045
xor r10d, 0x6ce032ee
xor r10d, 0xad0dac0
sub r10d, 0xa0d677b
sub r10d, 0x1e9780f0
mov r11d, 0x577790a
add r11d, 0xc2c352a
add r11d, 0x632f6512
sub r11d, 0x74cf1346
jmp 0x1400ae451
mov r11d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
mov dword [rsp - 0x1c], 0x2daab36c
je 0x1400ae492
xchg rdx, rbp
mov r9, rdx
xchg rdx, rbp
nop dword [rax]
lea edx, [r8 + rax]
mov dword [rsp - 0x3c], 0x8e90019
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xor ecx, 0x1ac04423
xchg r11, r11
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x1400ae461
mov dword [rsp - 0x44], esp
mov r8d, r10d
mov rdx, rbp
xchg r13, rcx
mov r13, rcx
xchg r13, rcx
call fcn.1400aab10
mov dword [rsp - 0x28], 0x55e5594a
test al, al
je 0x1400ae4c9
inc ebx
cmp ebx, r15d
xchg rdi, rdi
jb 0x1400ae3ac
jmp 0x1400ae4cc
xor r12b, r12b
xchg rbp, rdi
mov rcx, rdi
xchg rdi, rbp
call fcn.1400c1990
mov rbx, qword [rsp + 0x50]
xchg r9, r9
movzx eax, r12b
xchg rbp, rbx
mov rbx, qword [rsp + 0x58]
xchg rbx, rbp
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
xchg r9, r9
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400ae520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x14], 0xefb2337
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r14
xchg r12, r12
nop
push 0x4c19f279
mov qword [rsp], r15
mov eax, 0x65a30f49
sub eax, 0x4446e1f1
sub eax, 0x212386a7
add eax, 0x1ced1cc8
sub eax, 0x1d25b359
call fcn.1400c37b0
mov dword [rsp - 0x1c], 0x2ff68d22
sub rsp, rax
mov r15, rcx
call fcn.1400c3660
mov ebp, eax
mov rsi, rsi
and ebp, 0x3fc
jbe 0x1400ae5dc
lea rdi, [rsp + 0x20]
mov rbp, rbp
mov esi, ebp
call fcn.1400c3660
movzx ebx, ax
mov dword [rsp - 0x14], ebx
shl ebx, 4
shl ebx, 3
shl ebx, 2
shl ebx, 5
shl ebx, 1
shl ebx, 1
call fcn.1400c3660
movzx ecx, ax
mov dword [rsp - 0x34], 0x60950abe
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
xchg r11, r11
sub rsi, 1
jne 0x1400ae59a
lea r14d, [rbp*4]
xchg rbx, rbx
mov eax, 0x5b8e25e4
xor eax, 0x30b91df9
sub eax, 0x1c159b9e
xor eax, 0x4f219c7b
mov ecx, r14d
mul rcx
mov dword [rsp - 0x30], 0x7cc92aeb
pushf
movabs rcx, 0xffffffff6a03c621
sub rcx, 0x53295cbc
add rcx, 0xc5553bf
add rcx, 0x7fffffff
add rcx, 0x5cd042dc
popf
cmovb rax, rcx
mov dword [rsp - 0x34], edx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400c1980
xchg r9, r9
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 5
shr ebp, 8
shr ebp, 5
shr ebp, 1
shr ebp, 1
xor ebx, ebx
mov dword [rsp - 0x38], 0x50a9f8f1
xchg r14, rsi
mov r14, rax
xchg rsi, r14
mov r12b, 1
add r12b, 0x23
add r12b, 0x1f
add r12b, 0x2b
xor r12b, 0x6f
test ebp, ebp
je 0x1400ae793
nop
xchg r14, r14
mov r8d, ebx
mov r10d, r14d
shl r8d, 0xd
shl r8d, 1
shl r8d, 5
shl r8d, 1
xor eax, eax
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
jbe 0x1400ae706
mov rsi, rsi
mov r10d, 0x48e24554
add r10d, 0x206becc4
xor r10d, 0x715a300d
sub r10d, 0x18040215
mov r11d, 0x48faaa85
xor r11d, 0xee98521
sub r11d, 0x1a7566e2
add r11d, 0x3082a768
sub r11d, 0x5c1c702a
jmp 0x1400ae71e
mov r11d, r10d
mov rbp, rbp
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x1400ae75a
xchg r10, r10
xchg r9, rsi
mov rsi, r9
xchg r9, rsi
nop dword [rax]
mov rcx, rcx
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
mov r9, r9
lea r9, [r9 + 4]
xor ecx, 0x1ac04423
inc eax
mov dword [r9 - 4], ecx
mov rbx, rbx
cmp eax, r11d
jb 0x1400ae731
mov r8d, r10d
mov rdx, rsi
mov dword [rsp - 0x44], esi
xchg r15, rbx
mov rcx, rbx
xchg r15, rbx
call fcn.1400aab10
mov dword [rsp - 0xc], ebp
test al, al
je 0x1400ae790
inc ebx
mov rdi, rdi
cmp ebx, ebp
jb 0x1400ae695
jmp 0x1400ae793
xor r12b, r12b
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
call fcn.1400c1990
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov dword [rsp - 0xc], 0x57054ee
mov rbx, qword [r11 + 0x38]
xchg rbp, r15
mov r15, qword [r11 + 0x40]
xchg r15, rbp
xchg r10, r11
mov rsp, r10
xchg r10, r11
pop r15
xchg rsp, rsp
pop r14
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
pop rsi
mov dword [rsp - 0x40], 0x24d55c00
ret
Function at 0x1400b5540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r9, r9
mov r8d, ecx
test ecx, ecx
jne 0x1400b5560
xor eax, eax
xchg r14, r14
mov rbx, qword [rsp + 8]
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
mov dword [rsp - 0x28], 0x6b94e8af
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
xchg rdi, rdi
mov ecx, edx
xor ecx, r9d
mov r9d, eax
mov dword [rsp - 0x44], edi
test r11b, 1
cmove ecx, edx
xor r9d, ebx
cmp eax, 0x100
mov dword [rsp - 0x40], 0x788f7629
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
mov dword [rsp - 0x44], 0xef6eadd
jne 0x1400b5582
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov r12, r12
je 0x1400b5609
lea eax, [r11 + r11]
mov ecx, r9d
xchg r12, r12
xor ecx, r11d
mov r11d, eax
test dl, 1
cmove ecx, r9d
mov dword [rsp - 0x28], esi
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
cmovb r11d, eax
xchg r13, r13
shr edx, 1
jne 0x1400b55d4
mov r11d, r9d
xchg rdx, rdx
mov edx, r10d
test r9d, r9d
je 0x1400b566a
mov dword [rsp - 0x10], edi
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov dword [rsp - 0x3c], 0x5fb0291f
mov ecx, edx
xor ecx, r11d
mov r11d, eax
test r9b, 1
mov dword [rsp - 0x44], edx
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
xchg r13, r13
cmovb r11d, eax
shr r9d, 1
jne 0x1400b562d
mov dword [rsp - 0x18], edi
test edx, edx
je 0x1400b56b5
nop word [rax + rax]
mov ecx, r10d
mov r14, r14
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov r10d, ecx
mov dword [rsp - 0x2c], 0xbf05f08
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
xchg r13, r13
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
jne 0x1400b5678
mov r10, r10
xchg r14, rbx
mov r14, qword [rsp + 8]
xchg rbx, r14
mov eax, r10d
mov dword [rsp - 0x10], ecx
ret