joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006494
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 8
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, [0x140042b40]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x1400064c0
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006510
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 5
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, [0x140042b40]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x14000653c
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000658c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 9
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, [0x140042b40]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x1400065b8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006694
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 3
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, [0x140042b40]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x1400066c0
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006710
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 2
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, [0x140042b40]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x14000673c
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400070ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, [0x140042ec0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x140007144
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400072e4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 0xc
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x140007310
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140007360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x1400073b6
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007408
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007461
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400074b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x14000750f
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007564
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x1400075b7
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000760c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x140007668
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400076bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x18]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x18]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x18
jb 0x140007715
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007768
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 6]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 6]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov word [rax + 4], cx
add rax, 6
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 6
jb 0x1400077bd
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007810
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x11]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x11]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov byte [rax + 0x10], cl
add rax, 0x11
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x11
jb 0x140007868
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400078bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x13]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x13]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov word [rax + 0x10], cx
mov byte [rax + 0x12], cl
add rax, 0x13
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x13
jb 0x140007918
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000796c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xd]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xd]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov byte [rax + 0xc], cl
add rax, 0xd
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xd
jb 0x1400079c4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007a18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a07c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xf]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a07c
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xf]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
mov byte [rax + 0xe], cl
add rax, 0xf
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x49a2cdf358049a2d
mul r8
inc edi
shr rdx, 7
imul rax, rdx, 0x1bd
sub r8, rax
lea rax, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xf
jb 0x140007a74
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007ac8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 6
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 6
jb 0x140007af4
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140007b44
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a07c
mov edx, 0xb
mov rcx, rax
call fcn.140002174
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
movabs rax, 0x49a2cdf358049a2d
inc r8d
mul r10
mov al, byte [r11 + rbx]
shr rdx, 7
imul rcx, rdx, 0x1bd
sub r10, rcx
lea rcx, str.NZbAKjmVZzweMijrEWDMTGPBkCxfLpBsHtqUJUTmpeuFpjzRNwCRIukxLXoAzKLUWtqpfXAoREjwwNhRXmIFgxpbIHBlyvfEDLtctsapNsuJfhMGAYEoFXKLxZfUqjkSJEVBBzWxaImucslXzKXJXQUlDTDaQbqdvWxpCLXeLpxqWgtNrKwFVUOKleOeWWosSbMbLOfuvFXRpWDjuugOePfEmAiMgysIIUkviSpCXRlSAWAZfPhTsGDBWfsQZQURjCRRJsAFMrmGaYSGDvyftBNNyCUTOfTfigwNwHynSMKThonXfvKFVzBLsVBxJtAsIGVkpuPmPjPCbGeAqCoJBiIwmZgTgWqeliKisurTnWlsCmZVvBHkdnXKzlahSlTKeOYmRSJZAbsQSPdDnApJciphJvZJtgWzNgEOgaJtETeHhLbgxTZMzLzfEpgE
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xb
jb 0x140007b70
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140009998
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400099c6
xor eax, eax
jmp 0x140009aac
cmp qword [rcx + 0x68], 0
je 0x1400099d7
call fcn.14000354c
jmp 0x140009aac
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400099ee
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400099f0
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009a22
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14000c320
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140009aa6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140009a59
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140009a82
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140015e60
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140009aa6
cmp rsi, rbx
ja 0x140009a60
test rsi, rsi
je 0x140009aa6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140015e60
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000ac04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ac4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ac4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ac4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ac4e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ac4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ac50
xor al, al
add rsp, 0x28
ret
Function at 0x14001a590
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a380