joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017d20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017d48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017d48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400012ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 5]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 5]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov byte [rax + 4], cl
add rax, 5
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 5
jb 0x140001300
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.14000a164
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x7a]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000a164
mov qword [rdi], rax
lea r8d, [rsi + 0x7a]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x7a]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000cc20
lea rax, [rbx + 0x7a]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc esi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x7a
jb 0x1400013c3
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001428
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x14000147b
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x1a]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x1a]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], cx
add rax, 0x1a
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x1a
jb 0x140001539
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001598
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x1400015f0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400016a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042460]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 2
jb 0x1400016fa
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400027e4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 4
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x1400425e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 4
jb 0x140002810
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000286c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 0x1a
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x1400425e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0x1a
jb 0x140002898
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400028f4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 0xd
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x1400425e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xd
jb 0x140002920
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400034f4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 8
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x140042750]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x140003520
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000357c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 5
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x140042750]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x1400035a8
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140003604
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 9
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x140042750]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x140003630
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000368c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xc]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xc]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
add rax, 0xc
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, [0x140042750]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xc
jb 0x1400036e1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400037cc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 3
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x140042750]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x1400037f8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140003854
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 2
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, [0x140042750]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x140003880
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400074ec
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a164
mov edx, 0xc
mov rcx, rax
call fcn.14000297c
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x642c8590b21642c9
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x170
lea rcx, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x140007518
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140007574
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x1400075ca
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007628
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007681
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400076e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x14000773b
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000779c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x1400077f8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007858
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x18]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x18]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x18
jb 0x1400078b1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 6]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 6]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov word [rax + 4], cx
add rax, 6
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 6
jb 0x140007965
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400079c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a164
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x11]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a164
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x11]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov byte [rax + 0x10], cl
add rax, 0x11
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x642c8590b21642c9
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x170
sub r8, rax
lea rax, str.fgLcggLwgxjmFTQFpO_qFdwwiMZbYvuNkl_VnSlEVaqrJbUKyIRZgMfLRpaMlU_BsGhgXxKMcBcKwQPaZhAtJXJmELlxKPUkRTFFj_jeBxzUiTaOAphwntVPKcKOzlkyqCwKjqwmSqhMXiDEpwKcKzpLugHdsacTPPGgqUKqMwNkdvTPuFJBZpYtdDkdGPXDDUEemsphKuL_bhRH_nXMjvl_BlkTOalrOJDtWZTEcELOLDdFzChYfmKlDPECcsbZFipGmcwKyrBZuzqPzQoZsBdPzAtFpYRrbSyhZBeSUldmbk_KcvuQzbLcdF_Gmomnh_twiTJSgbgRwwTGEISzIJWIfwZtXmAfQhweFYyBwQaiXFV
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x11
jb 0x140007a1c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret