joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006fff0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x1800a7040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [0x1800aa902]
mov r8d, 0x6d1
call sub.VCRUNTIME140.dll_memset
lea r14, [rsp + 0x40]
mov qword [rsp + 0x1d0], rdi
sub r14, 0x480
lea rbp, [0x1800aa688]
xor r12d, r12d
lea r15, [0x1800aa9a2]
mov ebx, 0x20
movsx esi, word [rbp]
cmp esi, 0xffffffff
je 0x1800701a8
cmp ebx, 0x140
jb 0x18007010f
cmp ebx, 0x14e
ja 0x18007010f
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 0x61
mov dword [rsp + 0x48], 0x62
mov dword [rsp + 0x4c], 0x63
mov dword [rsp + 0x50], 0x64
mov dword [rsp + 0x54], 0x65
mov dword [rsp + 0x58], 0x66
mov dword [rsp + 0x5c], 0x67
mov dword [rsp + 0x60], 0x68
mov dword [rsp + 0x64], 0x69
mov dword [rsp + 0x68], WSAStartup
mov dword [rsp + 0x6c], WSAStartup
mov dword [rsp + 0x70], 0x6a
mov dword [rsp + 0x74], WSAStartup
mov dword [rsp + 0x78], 0x6b
mov edi, dword [r14]
jmp 0x18007011e
mov edx, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x180070171
mov dword [rsp + 0x28], r12d
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x1800701a8
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], r12
mov r9d, 1
mov dword [rsp + 0x28], 5
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc ebx
add r15, 5
add r14, 4
add rbp, 2
cmp ebx, 0x15c
jle 0x180070071
mov rdi, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1800648c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180072ea0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800a7040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1800ab220], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x180072ef5
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800648c0
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800ab220], rax
mov rcx, rax
test rax, rax
jne 0x180072f25
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x180072f00
mov rbx, qword [rsp + 0x40]
test rcx, rcx
jne 0x180072f54
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.180068d40
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800648c0
add rsp, 0x48
ret
lea rdx, str.OSMesaCreateContextExt
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x1800ab228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaDestroyContext
mov qword [0x1800ab230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x1800ab238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x1800ab240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x1800ab248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ab220]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x1800ab250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1800ab228], 0
mov qword [0x1800ab258], rax
je 0x180073045
cmp qword [0x1800ab238], 0
je 0x180073045
cmp qword [0x1800ab240], 0
je 0x180073045
cmp qword [0x1800ab248], 0
je 0x180073045
cmp qword [0x1800ab250], 0
je 0x180073045
test rax, rax
jne 0x180072ede
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.180068d40
mov rcx, qword [0x1800ab220]
test rcx, rcx
je 0x180073073
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1800ab220], 0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800648c0
add rsp, 0x48
ret
Function at 0x1400072e0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1400073d7
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
xchg r9, rbp
mov qword [rsp + 0x18], r9
xchg rbp, r9
push rsi
sub rsp, 0x20
xchg rdx, rdi
mov qword [rsp + 0x30], rdx
xchg rdi, rdx
mov rbx, rdx
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
neg rdi
add rdi, 0xffffffffffffff10
neg rdi
dec rsi
shr rsi, 2
shr rsi, 2
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
mov rcx, rbx
call fcn.140007ac0
mov ecx, 0x6af7d895
sub ecx, 0x6197575
xor ecx, 0x7b5bfba4
add ecx, 0x842fc1a
add ecx, 0x4923d3a8
sub ecx, 0x46729dec
sub ecx, 0x2a79ca4a
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140007386
sub rdi, 0x10
xchg r9, rbp
movups xmmword [r9 + 0xf0], xmm0
xchg r9, rbp
sub rsi, 1
jne 0x14000733c
mov rdi, qword [rsp + 0x30]
xchg rbx, r13
mov r13, qword [rsp + 0x38]
xchg rbx, r13
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
ret

Function at 0x1400073e0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
xchg r14, rbp
mov qword [rsp + 0x10], r14
xchg r14, rbp
xchg rbx, rsi
mov qword [rsp + 0x18], rbx
xchg rbx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg r11, rdx
mov rbx, r11
xchg r11, rdx
lea r9, [rcx + 0xf0]
xchg rsi, r9
mov r9, rcx
xchg r9, rsi
test r8d, r8d
je 0x1400074db
dec rdi
shr rdi, 1
shr rdi, 3
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, 0x7ef1bec8
xor edx, 0x128f0699
xor edx, 0x1c3f1543
xor edx, 0x4c430b8
xor edx, 0x1519d192
xor edx, 0x52cf5e49
sub edx, 0x25162848
sub edx, 0xad5393c
sub edx, 0x367b0dd
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14000748d
xchg r13, rdx
mov r13, rsi
xchg rdx, r13
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140007580
xchg rbx, r9
mov rbx, r9
xchg rbx, r9
nop
sub rbx, 0x7a6eae35
add rbx, 0x7a6eae45
sub rdi, 1
jne 0x14000744d
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rdi, rsi
movups xmmword [rdi + 0xf0], xmm0
xchg rdi, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140008b80
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rcx, rbx
mov r10, rbx
xchg rcx, rbx
test r8b, 0xf
je 0x140008bd9
xor al, al
xchg rbx, rbp
mov rbp, qword [rsp + 0x20]
xchg rbx, rbp
add rsp, 0x10
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140008c9a
movdqa xmm2, xmmword [rsp]
nop
xchg r12, rdx
movdqu xmm1, xmmword [r12 + rbx]
xchg rdx, r12
test edx, edx
jne 0x140008c0c
xchg r10, rdx
movdqu xmm2, xmmword [rdx + 0x200]
xchg r10, rdx
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x10a696a
add ecx, 0x18579b9d
sub ecx, 0x67a6b45
add ecx, 0x57f2723
add ecx, 0x5cb13795
sub ecx, 0x5716fc87
sub ecx, 0xd472a16
sub ecx, 0x10b9d1d0
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140008c54
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, r12
movups xmmword [r12 + r9], xmm0
xchg rdx, r12
nop
add edx, 0x7e3eaff8
sub edx, 0x7e3eafe8
cmp edx, r8d
jb 0x140008bea
mov rbx, qword [rsp + 0x20]
mov al, 0x72
add al, 0xb
xor al, 0x13
xor al, 4
xor al, 0x40
xor al, 0x2b
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14000de00
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov rax, qword gs:[0x30]
xchg r9, rdi
mov r9, qword [rax + 0x60]
xchg rdi, r9
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0x35a8031e
sub rcx, 0x35a80256
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x3385fc77
xor dword [rsp + 0x20], 0x5496b759
sub dword [rsp + 0x20], 0x42fa6497
add dword [rsp + 0x20], 0x32204dcc
sub dword [rsp + 0x20], 0x3a45f610
sub dword [rsp + 0x20], 0x590356b
xor dword [rsp + 0x20], 0x7717153e
sub dword [rsp + 0x20], 0x3a1a484d
sub dword [rsp + 0x20], 0x2759d581
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14000ca10
test eax, eax
js 0x14000dee1
cmp qword [rsp + 0x40], rbx
je 0x14000dee1
lea eax, [rbx + 1]
jmp 0x14000e000
mov rax, qword gs:[0x60]
xchg rdx, rcx
mov rdx, qword [rax + 0x30]
xchg rcx, rdx
cmp dword [rcx + 0x70], 2
jbe 0x14000df21
mov eax, 0x42e1f4e8
add eax, 0x3a4b9840
sub eax, 0x583a3aee
xor eax, 0x6a7c23c9
sub eax, 0xb19b311
sub eax, 0x4375bee0
jmp 0x14000e000
cmp dword [rcx + 0x74], ebx
jbe 0x14000df52
mov eax, 0x235449
add eax, 0x3e990016
xor eax, 0x1d9d862a
xor eax, 0x39acc5ea
xor eax, 0x553903da
sub eax, 0x257cfc48
sub eax, 0x2a3717fa
jmp 0x14000e000
cmp byte [rdi + 2], bl
je 0x14000df83
mov eax, 0x6204eef8
xor eax, 0x7d295e26
sub eax, 0x1cdb0a25
add eax, 0xbf28722
xor eax, 0xb37266d
xor eax, 0x574a6ae4
xor eax, 0x52386156
jmp 0x14000e000
cmp r14d, 0xa
jb 0x14000dfc5
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14000dfc5
mov eax, 0x5c3a305d
sub eax, 0x44aac3a0
xor eax, 0x3748f6db
sub eax, 0xcf6bb5a
xor eax, 0x3aa30381
xor eax, 0x2973dc85
jmp 0x14000e000
lea rcx, [rsi + 0xb8]
mov edx, 0x67f43096
sub edx, 0xa70eaa6
add edx, 0xf7728ac
xor edx, 0x69601b7e
add edx, 0x6ba39ab3
add edx, 0x285b8904
call fcn.14000d370
jmp 0x14000dffe
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xchg rdi, rbx
mov rbx, qword [rsp + 0x58]
xchg rbx, rdi
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140019d00
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x1c
sub byte [rcx + rax + 6], 0xc
add byte [rcx + rax + 6], 0x29
xor byte [rcx + rax + 6], 0x30
add byte [rcx + rax + 6], 0x2b
sub byte [rcx + rax + 6], 0x1f
xor byte [rcx + rax + 6], 0x23
sub byte [rcx + rax + 6], 0x14
sub byte [rcx + rax + 6], 0x22
inc rax
cmp rax, 8
jb 0x140019d02
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140019d50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x19
xor byte [rcx + rax + 6], 0x5b
add byte [rcx + rax + 6], 0x20
sub byte [rcx + rax + 6], 0xf
add byte [rcx + rax + 6], 0x17
xor byte [rcx + rax + 6], 0x17
sub byte [rcx + rax + 6], 0xa
sub byte [rcx + rax + 6], 0x73
inc rax
cmp rax, 0xa
jb 0x140019d52
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002d560
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r9
mov rcx, r9
xchg r9, rcx
mov r8d, 0x3a8ef8d3
sub r8d, 0x1d88515b
add r8d, 0x47fc9d5d
sub r8d, 0x364f5173
add r8d, 0x4cbd0962
sub r8d, 0x6e1d3709
xor r8d, 0xf2ac3a44
test rcx, rcx
je 0x14002d668
cmp byte [rcx], 0
je 0x14002d668
test rdx, rdx
jne 0x14002d600
nop
movabs rdx, 0xffffffff2a5f6fb7
add rdx, 0x2054a92
sub rdx, 0x4a5c093
add rdx, 0x23c87f98
xor rdx, 0x4b4a0308
add rdx, 0x7fffffff
xor rdx, 0x7f3285ba
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14002d5ea
test rdx, rdx
je 0x14002d665
xor r10d, r10d
lea r11, [0x140001ae0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14002d612
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140032430
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rax
mov rdi, qword [rcx + 0x10]
xchg rdi, rax
xchg rcx, rdi
mov rdx, rdi
xchg rcx, rdi
test rax, rax
jne 0x140032455
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14003249e
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140032483
xchg rdi, rax
mov rdi, qword [rdx + 0x10]
xchg rdi, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140032463
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x58
sub byte [rdx], 0xa
sub byte [rdx], 0x40
add byte [rdx], 0x37
add byte [rdx], 2
add byte [rdx], 0x19
sub byte [rdx], 0x52
xor byte [rdx], 0x62
sub byte [rdx], 0x6b
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400324b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, qword [rcx + 0x10]
xchg rbp, rax
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x1400324d5
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x140032511
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x1400324fc
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x1400324e3
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x7d
xor byte [rdx], 8
sub byte [rdx], 0x54
add byte [rdx], 0x49
sub byte [rdx], 0x42
add byte [rdx], 2
sub byte [rdx], 0x29
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140032870
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0x10]
xchg r13, rax
xchg rdi, rcx
mov rdx, rdi
xchg rcx, rdi
test rax, rax
jne 0x14003288f
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x1400328d9
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x1400328be
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x1400328a2
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x36
xor byte [rdx], 0x51
xor byte [rdx], 0x2f
xor byte [rdx], 0x16
sub byte [rdx], 0x17
sub byte [rdx], 0x33
add byte [rdx], 0x34
xor byte [rdx], 0x40
sub byte [rdx], 7
ret
Function at 0x140033040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rdx, rcx
lea rbx, [rdx + 4]
xchg rdx, rsi
mov rsi, rbx
xchg rsi, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x6f
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x54
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x29
inc rax
cmp rax, 6
jb 0x14003306d
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x1400330c0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 6]
xchg rdi, rdx
mov rdi, rbx
xchg rdx, rdi
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x34
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x38
add byte [rbx + rax], 0x32
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 8
jb 0x140033102
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x140033150
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 6]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x37
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x48
add byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x56
inc rax
cmp rax, 0xa
jb 0x14003318f
xchg r13, rdi
mov rax, r13
xchg rdi, r13
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400331f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 8]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x68
xor byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x4d
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x3a
inc rax
cmp rax, 0xe
jb 0x140033226
xchg r8, rax
mov r8, rdi
xchg r8, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033270
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x7a
add byte [rbx + rax], 0xc
add byte [rbx + rax], 3
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x1b
inc rax
cmp rax, 0x10
jb 0x1400332ab
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
push rbx
push rbx
push rax
push rax
push rbx
push rax
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033310
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg rcx, r13
lea rbx, [rdx + 0xa]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0xa
inc rax
cmp rax, 0x12
jb 0x140033352
mov rax, rdi
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x1400333a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x10]
xchg r11, rbx
mov rdx, r11
xchg rbx, r11
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x74
add byte [rbx + rax], 2
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x3d
add byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x7a
xor byte [rbx + rax], 0x7c
inc rax
cmp rax, 0x1e
jb 0x1400333e1
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rax
push rcx
push rcx
push rdx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x5d
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x34
xor byte [rbx + rax], 4
sub byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x20
jb 0x140033461
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r9, rdi
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x51
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 1
sub byte [rbx + rax], 0x76
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x4a
inc rax
cmp rax, 0x24
jb 0x140033565
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x1400335a0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg r11, rdi
lea rbx, [rdx + 0x14]
xchg r8, rdx
mov r8, rbx
xchg rdx, r8
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 4
add byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x47
add byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x44
inc rax
cmp rax, 0x26
jb 0x1400335db
xchg rdx, rdi
mov rax, rdx
xchg rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x6f
add byte [rbx + rax], 1
add byte [rbx + rax], 0x49
add byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x62
add byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x28
jb 0x140033666
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rcx
push rdx
push rdx
push rbx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x1400336c0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x16]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x66
xor byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x65
add byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x62
add byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x50
sub byte [rbx + rax], 0x1f
xor byte [rbx + rax], 8
inc rax
cmp rax, 0x2a
jb 0x1400336fb
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]