joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008e070
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140143084], 0
mov rbx, rbx
jne 0x14008e175
xor edx, edx
lea r8, [0x140143080]
mov rdi, rdi
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
xchg r15, r15
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0x14], 0x6a1aa28
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x18], 0x378ed6ed
shr ecx, 1
and eax, 1
neg eax
mov rcx, rcx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r9, r9
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r13, r13
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov rbx, rbx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x38], 0x2665f5d7
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov rdx, rdx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x40], edi
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rsi, rsi
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r15, r15
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x10], 0x70c9bd03
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x28], esi
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
xchg rdx, rdx
jb 0x14008e096
ret
Function at 0x1400934e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
xchg r11, rbp
mov qword [rsp + 0x10], r11
xchg rbp, r11
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg r15, rsi
push rdi
nop
push 0x7e095f9f
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
xchg rbp, rbp
movzx eax, byte [rdx + 1]
xchg r8, r15
mov r8, r15
xchg r8, r15
movzx ebx, byte [rdx]
xchg r13, r13
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 4
shl ebx, 1
shl ebx, 2
shl ebx, 1
dec r8d
mov dword [rsp - 0x20], ecx
or ebx, eax
shl edi, 3
shl edi, 5
movzx eax, byte [rdx + 2]
shl ebx, 4
shl ebx, 1
shl ebx, 2
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
xchg r9, r9
shl ebx, 1
shl ebx, 5
shl ebx, 1
shl ebx, 1
or ebx, eax
xchg r13, r13
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 7
shl edi, 1
or edi, eax
mov rdi, rdi
test r8d, r8d
jle 0x140093626
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov r8, r8
movsxd rax, r8d
shr r14d, 1
inc r14d
mov dword [rsp - 0x2c], 0x17b714db
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
xchg r15, r15
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rsi, r14
mov rdx, r14
xchg r14, rsi
mov ecx, edi
call fcn.140093d8c
xchg rbp, rbp
xor ebx, eax
xchg rbp, r14
mov rdx, r14
xchg rbp, r14
mov ecx, ebx
mov dword [rsp - 0x2c], 0x6e6d1b6e
call fcn.140093d8c
xor edi, eax
add rsi, 0xffffffffffffffe8
nop
sub rbp, 0x22f763df
add rbp, 0x22f763c7
sub r14, 1
mov dword [rsp - 0x40], esi
jne 0x1400935d6
lea rax, [r15 + 7]
mov ecx, 0x2d92949c
xor ecx, 0x3054b067
xor ecx, 0x6d908f40
sub ecx, 0x7056abb7
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x30], ebx
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 8
mov dword [rsp - 0x20], 0x42cbde71
sub rcx, 1
jne 0x140093641
mov rbx, qword [rsp + 0x40]
xchg r10, rbp
mov r10, qword [rsp + 0x48]
xchg rbp, r10
mov rsi, qword [rsp + 0x50]
xchg rsi, rsi
nop
sub rsp, 0x31b57fe6
add rsp, 0x31b58006
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400936a8
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg r14, rbx
mov qword [rax + 8], r14
xchg r14, rbx
mov qword [rax + 0x10], rbp
xchg r11, rsi
mov qword [rax + 0x18], r11
xchg r11, rsi
mov qword [rax + 0x20], rdi
mov dword [rsp - 0x2c], 0x653095ab
push r14
nop
sub rsp, 0x418734a8
add rsp, 0x41873488
movzx eax, byte [rdx + 1]
xchg rdx, r14
mov rdx, r8
xchg r14, rdx
movzx ebx, byte [rdx]
mov dword [rsp - 0x28], 0x2c2b71e8
movzx edi, byte [rdx + 4]
shl ebx, 4
shl ebx, 4
or ebx, eax
mov rdi, rdi
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 4
shl ebx, 3
shl ebx, 1
or ebx, eax
xchg rdx, rdx
movzx eax, byte [rdx + 3]
shl ebx, 3
shl ebx, 4
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
mov dword [rsp - 0x24], 0x794c2070
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x38], esi
shl edi, 4
shl edi, 4
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x2c], ebx
test eax, eax
jle 0x1400937c0
mov rsi, qword [rcx + 8]
lea ebp, [rax - 1]
mov dword [rsp - 0x20], 0x6a63cf21
shr ebp, 1
inc ebp
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
mov dword [rsp - 0x3c], esp
call fcn.140093d8c
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
xchg rbp, rbp
call fcn.140093d8c
xor edi, eax
nop
add rsi, 0x16cc7aff
sub rsi, 0x16cc7ae7
sub rbp, 1
xchg r9, r9
jne 0x14009377e
lea rax, [r14 + 7]
mov ecx, 0x193a282
add ecx, 0x49caa8fd
xor ecx, 0x225dfc9a
xor ecx, 0x6903b7e1
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
xchg r13, r13
shr ebx, 2
shr ebx, 4
shr ebx, 1
shr ebx, 1
shr edi, 1
shr edi, 1
shr edi, 4
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x1400937db
mov dword [rsp - 0x20], 0x6347d268
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg r8, rsi
mov r8, qword [rsp + 0x40]
xchg rsi, r8
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x24], 0x5da2d2e2
nop
sub rsp, 0x5e0f83c3
add rsp, 0x5e0f83e3
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140093a34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x20], 0x40628e02
push rbp
push rdi
push r14
xchg r13, r13
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140001de0]
mov rbx, rbx
xor edi, edi
movdqa xmm1, xmmword [0x140001e60]
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg r14, rbp
movdqu xmmword [r14 - 0x39], xmm0
xchg r14, rbp
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov edx, edi
mov dword [rsp - 0x3c], esp
movdqa xmm0, xmmword [0x140001db0]
mov r8d, edi
xchg r10, rbp
movdqu xmmword [r10 - 0x29], xmm1
xchg rbp, r10
movdqa xmm1, xmmword [0x140001e50]
mov dword [rsp - 0x24], ecx
xchg rbp, rdi
movdqu xmmword [rdi - 0x19], xmm0
xchg rdi, rbp
movdqu xmmword [rbp - 9], xmm1
mov ecx, edx
mov dword [rsp - 0x34], 0x235dd3d0
lea r8, [r8 + 4]
mov eax, 0x388333ba
xor eax, 0x5bc49d3a
sub eax, 0x33eb0ad5
xor eax, 0x7b016986
xor eax, 0x7f9a9762
inc rdx
rol eax, cl
mov dword [rsp - 0x34], 0x6efa15a8
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140093ac5
mov dword [rsp - 0xc], 0x7296412b
cmp dword [rsi + 4], 8
jne 0x140093b80
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
mov dword [rsp - 0x10], 0x4d3b61eb
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 4
shl cx, 1
shl cx, 2
shl cx, 1
or cx, ax
mov word [rdx], cx
xchg rsp, rsp
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140093b23
lea r9, [rbp + 7]
xchg r8, r8
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rsi, r8
mov rcx, r8
xchg rsi, r8
call fcn.14009384c
xchg r10, r10
jmp 0x140093c4b
cmp dword [rsi], edi
jle 0x140093c4b
mov dword [rsp - 0x44], ebx
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x5ece7938
xor r8d, 0xc44d310
xor r8d, 0x767372de
add r8d, 0x5ba2814
xor r8d, 0x2ab4010e
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
add rbx, 2
mov dword [rsp - 0x38], 0x7e72fac1
shl ax, 7
shl ax, 1
or cx, ax
mov word [rdx], cx
mov dword [rsp - 0x20], 0x526c54d3
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140093bb5
lea r9, [rbp + 7]
mov dword [rsp - 0x30], 0x60f14657
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
call fcn.14009384c
mov dword [rsp - 0x14], 0x577587b1
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
xchg r14, r14
nop
add r8d, 0x19b5148a
sub r8d, 0x19b51492
mov rcx, rsi
xchg r10, r10
call fcn.14009384c
inc edi
sub r14d, 0xfffffff8
mov rdi, rdi
cmp edi, dword [rsi]
jl 0x140093b8f
xor eax, eax
mov rbx, rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
lea rdi, [rbp + 7]
mov rdx, rdx
xchg rsi, rdx
mov rdx, qword [r11 + 0x30]
xchg rsi, rdx
lea ecx, [rax + 0x40]
xchg r14, r14
rep stosb byte [rdi], al
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140093d34
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov dword [rsp - 0x24], edi
test edx, edx
je 0x140093d85
lea ecx, [r11 + r11]
mov dword [rsp - 0x40], 0x309a94dc
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov dword [rsp - 0x20], 0x48667fdb
test dl, 1
cmove r9d, r10d
xor r11d, r8d
mov rsp, rsp
cmp ecx, 0x100
mov r10d, r9d
cmovb r11d, ecx
mov dword [rsp - 0x10], 0x4ff3d6bb
shr edx, 1
jne 0x140093d42
mov eax, r10d
ret
Function at 0x14009efe0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
mov dword [rsp - 0x30], edx
xchg r9, r12
mov r12, rdx
xchg r12, r9
test rax, rax
mov dword [rsp - 0x30], esi
je 0x14009f048
mov ecx, r8d
mov edx, 0x7026d683
xor edx, 0x530f20a4
sub edx, 0x8b69e95
xor edx, 0x31b40add
rol edx, cl
xor dl, byte [rax]
mov dword [rsp - 0x38], esp
inc rax
mov byte [r8 + r9], dl
inc r8
xchg r13, r13
cmp r8, 0x20
jb 0x14009f004
mov al, 0x58
sub al, 0x4d
xor al, 0x46
add al, 0x29
xor al, 0x77
ret
xchg r8, rax
mov r8, qword [rcx + 0x100]
xchg r8, rax
test rax, rax
je 0x14009f08a
mov dword [rsp - 0x3c], 0x6adcb545
movups xmm0, xmmword [rax]
xchg r13, rdx
movups xmmword [r13], xmm0
xchg r13, rdx
xchg rbx, rax
movups xmm1, xmmword [rbx + 0x10]
xchg rbx, rax
xchg rdx, r11
movups xmmword [r11 + 0x10], xmm1
xchg r11, rdx
jmp 0x14009f03d
xorps xmm0, xmm0
xor al, al
xchg r9, rdx
movups xmmword [r9], xmm0
xchg rdx, r9
xchg r15, rdx
movups xmmword [r15 + 0x10], xmm0
xchg rdx, r15
ret
Function at 0x1400b5c8c
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg r11, rsp
mov qword [r11 + 8], rbx
mov dword [rsp - 0x1c], 0x7ce8216e
mov qword [r11 + 0x18], rsi
xchg rdi, rsi
mov qword [r11 + 0x20], rsi
xchg rsi, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
add rsp, 0x73c2911e
sub rsp, 0x73c2915e
mov rax, qword [0x1401424c8]
lea rdx, [r11 + 0x10]
mov rcx, rcx
ror rax, 3
ror rax, 5
ror rax, 2
ror rax, 2
ror rax, 1
xchg r13, rbx
mov r13, rcx
xchg rbx, r13
movabs rcx, 0xffad7add1cc00e65
xor rcx, 0x6a8e84fe
xor rcx, 0x49f9387
xor rcx, 0x10a3baac
mov dword [rsp + 0x58], 0x5843aa92
sub dword [rsp + 0x58], 0x50015273
xor dword [rsp + 0x58], 0x3e169ab2
xor dword [rsp + 0x58], 0x3654c2bd
xor rax, rcx
movabs rcx, 0xe8a90af6545973cd
xor rcx, 0x16143a24
xor rcx, 0x1f135f7c
xor rcx, 0x1511acd9
add rcx, 0x7fffffff
add rcx, 0x13efa441
rol rax, 0x11
rol rax, 1
rol rax, 1
add rax, rcx
lea rcx, [r11 - 0x28]
mov dword [rsp - 0x18], 0x33883cc6
not rax
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov r9, r9
mov qword [rbx], rdi
xor esi, esi
movups xmmword [rdi], xmm0
xchg r12, r12
xchg rdi, r9
movups xmmword [r9 + 0x10], xmm0
xchg rdi, r9
xchg rdi, rsp
movups xmmword [rsp + 0x20], xmm0
xchg rdi, rsp
test eax, eax
jne 0x1400b5dbe
xchg r10, r10
mov qword [rbx + 0x38], rsi
jmp 0x1400b5ee0
lea rax, [rsp + 0x20]
mov dword [rsp - 0x30], edx
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov dword [rsp - 0xc], ebx
jne 0x1400b5dcb
xchg r14, r12
mov qword [rbx + 0x38], r12
xchg r14, r12
cmp qword [rbx], rdi
xchg rsi, rsi
je 0x1400b5dfb
mov rcx, qword [rbx]
call fcn.1400986e0
cmp r14, 0x18
mov dword [rsp - 0x40], ecx
jbe 0x1400b5e33
lea rcx, [r14 + r14]
call fcn.1400989b0
xchg r12, rax
mov qword [rbx], r12
xchg r12, rax
test rax, rax
xchg rbx, rbx
jne 0x1400b5e45
mov qword [rbx], rdi
mov rcx, rsi
mov r12, r12
jmp 0x1400b5e67
xchg rdi, r9
mov qword [rbx], r9
xchg rdi, r9
xchg r9, rdi
mov rax, r9
xchg rdi, r9
xorps xmm0, xmm0
mov rbp, rbp
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rbx]
xchg rbp, rbp
mov edx, 0x7e509d20
xor edx, 0x1fedc13a
sub edx, 0xc3fa3b6
sub edx, 0x522a07d
cmp qword [rbx + 0x38], rsi
jbe 0x1400b5ee0
xchg r12, r12
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov r9d, 0x31d70ef9
add r9d, 0x2e4234e5
add r9d, 0x1d69b88c
sub r9d, 0x7d82fb6b
and ax, r9w
ror edx, 4
ror edx, 4
xor ax, word [r8 + rcx]
inc rsi
mov word [rcx], ax
mov dword [rsp - 0x30], 0x5c23dd9a
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400b5e93
mov dword [rsp - 0x24], ebp
mov rsi, qword [rsp + 0x60]
xchg rbx, rdx
mov rax, rdx
xchg rdx, rbx
xchg rdi, rbx
mov rdi, qword [rsp + 0x50]
xchg rbx, rdi
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400c7e78
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r11, rsi
mov qword [rsp + 0x18], r11
xchg r11, rsi
push rdi
mov dword [rsp - 0x3c], 0x22594b19
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov dword [rsp - 0xc], 0x40f5f8c5
sub rsp, 0x20
movzx esi, word [rdx + 0x14]
lea rbx, [rdx + 0x18]
movzx eax, word [rdx + 6]
xchg r8, r8
mov r13, rcx
add rbx, rsi
mov ecx, 0x17daabbc
add ecx, 0x389d0220
sub ecx, 0x30a03ab9
add ecx, 0x12a119cb
sub ecx, 0x32788ced
xchg r15, rdx
mov rdx, r9
xchg rdx, r15
xchg r8, rsi
mov r12, rsi
xchg rsi, r8
xchg r9, rdx
mov rdi, r9
xchg rdx, r9
cmp cx, ax
mov dword [rsp - 0x24], edi
jae 0x1400c7f7c
lea rbp, [rdx + 0x40]
add rbp, rsi
sub ax, cx
mov r8, r8
movzx r14d, ax
xchg rdx, r14
mov r14, rbp
xchg r14, rdx
mov rcx, r13
call fcn.1400c8c60
mov dword [rsp - 0x24], 0x6154e68d
test al, al
xchg r11, rbp
mov rcx, r11
xchg r11, rbp
cmove rcx, rbx
mov r10, r10
nop
add rbp, 0x15a53423
sub rbp, 0x15a533fb
xchg rcx, r11
mov rbx, r11
xchg r11, rcx
sub r14, 1
mov rbx, rbx
jne 0x1400c7f2c
mov eax, dword [rsi + rdi + 0x24]
xchg rsi, rdx
mov rsi, rbx
xchg rdx, rsi
xchg rcx, r8
mov r8, rdi
xchg rcx, r8
mov dword [r12], eax
xchg r12, r12
call fcn.1400851a0
add eax, dword [rbx + 0xc]
mov rbx, qword [rsp + 0x50]
mov dword [rsp - 0x3c], ecx
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov dword [r15], eax
mov dword [rsp - 0x2c], 0x2f0e2bcd
nop
add rsp, 0x63ca9893
sub rsp, 0x63ca9873
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400d6a2c
Capabilities:
Execute syscall

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov rcx, qword [rcx + 0x1a8]
mov rcx, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400d6b17
mov rax, qword [rbx + 0x258]
movabs rdx, 0x7f63b7c4743ac479
xor rdx, 0x740025b9
add rdx, 0x2027eeef
add rdx, 0x5adf3e3c
add rax, rdx
xchg r14, r14
movabs rdx, 0x6d8596e06b9bc4b1
add rdx, 0x9b50823
sub rdx, 0x627e504f
add rdx, 0x4a4a6afa
add rdx, 0x29d653ad
ror rax, 6
ror rax, 0xb
ror rax, 1
xor rax, rdx
xchg rdx, rdx
movabs rdx, 0x68d7657b5c678edb
xor rdx, 0x2d00cc1
sub rdx, 0x19154823
add rdx, 0x7fffffff
sub rdx, 0x3ac12742
add rax, rdx
mov dword [rsp - 0xc], edx
movabs rdx, 0x25a366640a8c2786
add rdx, 0x48603668
add rdx, 0x26a99b7c
xor rdx, 0x3bbd9514
add rdx, 0x7fffffff
xor rdx, 0xbd5cc0c
not rax
mov r14, r14
sub rax, rdx
call rax
mov rcx, qword [rbx + 0x198]
mov r14, r14
test rcx, rcx
je 0x1400d6b63
cmp qword [rbx + 0x1a0], 0
mov dword [rsp - 0x3c], 0x12c0b9cd
jne 0x1400d6b63
mov rcx, qword [rcx + 0x20]
call fcn.1400986e0
xchg r14, rcx
mov r14, qword [rbx + 0x198]
xchg r14, rcx
call fcn.1400986e0
mov dword [rsp - 0x30], 0x22de06b0
mov rcx, qword [rbx + 0x1a0]
test rcx, rcx
je 0x1400d6bea
xchg r13, rax
mov r13, qword [rbx + 0x248]
xchg r13, rax
movabs rdx, 0x7753ef697a9bd6e9
sub rdx, 0x57271ff8
xor rdx, 0x5e56bf66
xor rdx, 0x6d1fd2d2
not rax
mov dword [rsp - 0x20], 0x6b74bb83
ror rax, 1
xor rax, rdx
movabs rdx, 0x3b11dbb63fe61e96
xor rdx, 0x5646da59
add rdx, 0x4a6d7c2
xor rdx, 0xa74df45
add rdx, 0x36857e60
not rax
mov rbp, rbp
ror rax, 2
ror rax, 3
xor rax, rdx
xchg r15, r15
call rax
cmp qword [rbx + 0x200], 0
je 0x1400d6c91
mov r12, r12
xchg r10, rax
mov r10, qword [rbx + 0x210]
xchg r10, rax
movabs rcx, 0xffcbb1655c018c
sub rcx, 0x1e02f576
xor rcx, 0x1672acc1
sub rcx, 0xcf635ba
add rax, rcx
mov dword [rsp - 0x30], ebp
movabs rcx, 0x5d9c8c56478c9594
sub rcx, 0x72346
xor rcx, 0x3ee1f6bd
sub rcx, 0x335e79fc
ror rax, 0x14
ror rax, 5
ror rax, 1
sub rax, rcx
rol rax, 1
rol rax, 6
rol rax, 3
rol rax, 0xc
rol rax, 0xa
rol rax, 4
rol rax, 3
rol rax, 1
call rax
mov rcx, qword [rbx + 0x200]
mov dword [rsp - 0xc], esi
call fcn.14008d0b0
and qword [rbx + 0x200], 0
mov rcx, qword [rbx + 0x1f0]
add rsp, 0x20
xchg rcx, rcx
pop rbx
jmp fcn.140055ae0
Function at 0x1400d6eac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x40], ecx
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
lea rbp, [rsp - 0x47]
xchg rsp, rsp
sub rsp, 0xe0
xor ebx, ebx
mov dword [rbp - 0x79], 0x3297ca60
add dword [rbp - 0x79], 0xef145d5
add dword [rbp - 0x79], 0x35cdf3b8
sub dword [rbp - 0x79], 0x76de036a
mov dword [rbp - 0x75], 0x7139cdc3
sub dword [rbp - 0x75], 0x6705d93a
add dword [rbp - 0x75], 0x18168272
add dword [rbp - 0x75], 0x299ff97
sub dword [rbp - 0x75], 0x24b3766a
xchg r14, rbp
mov rbp, rdx
xchg r14, rbp
mov dword [rbp - 0x71], 0x66b84561
xor dword [rbp - 0x71], 0x677310e0
xor dword [rbp - 0x71], 0x3b90bb52
xor dword [rbp - 0x71], 0x3a25ee44
mov dword [rbp - 0x6d], 0x7a859f64
xor dword [rbp - 0x6d], 0x7a9ba09
sub dword [rbp - 0x6d], 0x4eb4da9d
xor dword [rbp - 0x6d], 0x19172c1b
sub dword [rbp - 0x6d], 0x372c6656
mov dword [rbp - 0x69], 0x6cdee8c9
xor dword [rbp - 0x69], 0x1fe3e9eb
sub dword [rbp - 0x69], 0x8091443
xor dword [rbp - 0x69], 0x6b48ec54
mov qword [rbp + 0x77], rbx
xchg rdx, rax
mov rdx, qword [rbp + 0x77]
xchg rdx, rax
mov rcx, qword [rbp + 0x77]
mov rax, qword [rbp + 0x77]
and cl, 3
mov rsp, rsp
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x79]
mov dword [rsp - 0x10], 0x1594215c
mov eax, 0x3cfb151a
xor eax, 0x384d2e23
xor eax, 0x7f4ffc1c
sub eax, 0x6ef1f80a
xor eax, 0x5d5cd8fc
shr eax, cl
mov dword [rsp - 0x30], edx
movzx ecx, al
mov rax, qword [rbp + 0x77]
xor cx, dx
mov word [rbp + rax*2 - 0x65], cx
mov dword [rsp - 0x28], edx
mov rax, qword [rbp + 0x77]
inc rax
xchg rdx, rax
mov qword [rbp + 0x77], rdx
xchg rdx, rax
xchg r8, rax
mov r8, qword [rbp + 0x77]
xchg r8, rax
cmp rax, 0xa
mov r15, r15
jb 0x1400d6f8f
xor edx, edx
mov word [rbp - 0x51], bx
mov dword [rsp - 0x28], edi
lea rcx, [rbp - 0x65]
call fcn.14008ab50
xchg rsi, rcx
mov rcx, rax
xchg rsi, rcx
lea rdi, [rbp - 0x65]
mov dword [rsp - 0x24], 0xe93671e
xor eax, eax
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x44], 0x62e4386b
test rsi, rsi
je 0x1400d70fb
mov edx, 0xe92fefc
add edx, 0x6d3905f9
xor edx, 0x542fd75a
add edx, 0x5bb561f2
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140082ec0
mov r13, r13
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
test rax, rax
je 0x1400d70ea
xchg r14, r9
mov rdx, r9
xchg r14, r9
lea rcx, [rbp - 0x49]
call fcn.140073bd0
mov rcx, qword [rbp - 0x49]
mov dword [rsp - 0x38], ebp
call rdi
xchg rcx, r10
mov r10, qword [rbp - 0x49]
xchg rcx, r10
cmp eax, 1
mov dword [rsp - 0x18], 0x3b5156b8
lea rax, [rbp - 0x41]
sete bl
cmp rcx, rax
xchg r11, r11
jne 0x1400d70e5
lea rdi, [rbp - 0x41]
xor eax, eax
mov ecx, 0x695af2b8
sub ecx, 0xd95aaae
xor ecx, 0x490f4b19
xor ecx, 0x12ca0393
rep stosb byte [rdi], al
jmp 0x1400d70ea
call fcn.1400986e0
xchg rcx, r9
mov r9, rsi
xchg rcx, r9
call fcn.14008d0b0
xchg r9, r9
lea r11, [rsp + 0xe0]
mov al, bl
xchg rbx, rsi
mov rsi, qword [r11 + 0x20]
xchg rsi, rbx
mov rsi, qword [r11 + 0x28]
mov rsp, r11
mov dword [rsp - 0x38], edx
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
ret
Function at 0x1400d92e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rbp, rdi
mov qword [rsp + 0x20], rbp
xchg rdi, rbp
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
xor esi, esi
xchg rbp, rbp
mov dword [rbp - 0x30], 0x435d50d4
xor dword [rbp - 0x30], 0x77e243c2
add dword [rbp - 0x30], 0x44d111fe
sub dword [rbp - 0x30], 0x792c2464
mov dword [rbp - 0x2c], 0x30349282
add dword [rbp - 0x2c], 0x3b751c5f
sub dword [rbp - 0x2c], 0x29cbb6de
sub dword [rbp - 0x2c], 0x41cef79a
xchg rbp, rcx
mov rbx, rbp
xchg rcx, rbp
mov dword [rbp - 0x28], 0x34cfe603
add dword [rbp - 0x28], 0x468b3045
sub dword [rbp - 0x28], 0x9bcefda
sub dword [rbp - 0x28], 0x7179259a
mov dword [rbp - 0x24], 0x2b95b5a
add dword [rbp - 0x24], 0x1c57298d
xor dword [rbp - 0x24], 0x61b3f590
xor dword [rbp - 0x24], 0xa8105f0
sub dword [rbp - 0x24], 0x73ee7412
mov dword [rbp - 0x20], 0x66676031
sub dword [rbp - 0x20], 0xe3be1ca
sub dword [rbp - 0x20], 0x44472f8b
xor dword [rbp - 0x20], 0x139f4e57
mov qword [rbp + 0x10], rsi
xchg rcx, rcx
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
mov rcx, qword [rbp + 0x10]
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x6a741be5
sub eax, 0x3a9a963c
xor eax, 0x599ec854
sub eax, 0x25ec3616
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x28], 0x144e35db
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov r9, r9
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
cmp rax, 0xa
jb 0x1400d93c2
xchg r15, r15
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008ab50
mov dword [rsp - 0x30], ebp
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x200], rax
xor eax, eax
xchg rsi, rsi
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x38], 0x956ab4e
test r8, r8
je 0x1400d94be
lea rdx, [rbx + 0x208]
xchg rcx, r13
mov r13, r8
xchg r13, rcx
call fcn.1400d9b44
mov r12, r12
test al, al
jne 0x1400d94b4
xchg rcx, rdi
mov rdi, qword [rbx + 0x200]
xchg rdi, rcx
call fcn.14008d0b0
xor al, al
mov rdx, rdx
xchg r14, rsi
mov qword [rbx + 0x200], r14
xchg rsi, r14
jmp 0x1400d94be
mov al, 0x11
add al, 0x29
add al, 5
add al, 0x33
sub al, 0x71
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x10], esi
xchg rcx, rsi
mov rcx, qword [rsp + 0x70]
xchg rcx, rsi
xchg rsi, rdi
mov rsi, qword [rsp + 0x78]
xchg rsi, rdi
nop
sub rsp, 0x7945f0c4
add rsp, 0x7945f114
nop
mov rbp, qword [rsp]
add rsp, 8
ret