joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041bc0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov r14, qword [0x14018f550]
mov rax, qword [r14 + 0x3ed8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebp, dword [rcx + rdx*4 - 4]
movzx r9d, byte [rbx]
test r9b, r9b
je 0x140041c51
not ebp
lea rcx, [rbx + 2]
lea rdx, [0x140157270]
mov r8d, ebp
jmp 0x140041c2e
movzx r9d, r9b
movzx r11d, r8b
shr r8d, 8
xor r11d, r9d
xor r8d, dword [rdx + r11*4]
inc rcx
mov r9d, r10d
test r10b, r10b
je 0x140041c4b
movzx r10d, byte [rcx - 1]
cmp r9b, 0x23
jne 0x140041c10
cmp r10b, 0x23
jne 0x140041c10
cmp byte [rcx], 0x23
cmove r8d, ebp
mov r10b, 0x23
jmp 0x140041c10
not r8d
mov ebp, r8d
mov rcx, qword [rax]
mov rax, r14
cmp dword [rcx + 0x3f20], ebp
jne 0x140041c78
mov ecx, ebp
mov edx, 0xb
mov r8, rbx
xor r9d, r9d
call fcn.14002d640
mov rax, qword [0x14018f550]
movsxd rcx, dword [rax + 0x4898]
cmp dword [rax + 0x4888], ecx
jle 0x140041d58
mov rdx, qword [rax + 0x4890]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], ebp
jne 0x140041d58
test byte [r14 + 0x47b8], 1
jne 0x140041cf0
mov rcx, qword [rax + 0x48c8]
mov rcx, qword [rcx]
movsd xmm0, qword [rcx + 4]
movsd xmm1, qword [rcx + 0xc]
mulps xmm1, xmmword [0x140158310]
addps xmm1, xmm0
or dword [rax + 0x47b8], 1
movlps qword [rax + 0x47c8], xmm1
movabs rcx, 0x3f0000003f000000
mov qword [rax + 0x47d0], rcx
mov dword [rax + 0x47bc], 4
or edi, 0xc000020
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
call fcn.140035720
test al, al
je 0x140041d70
mov al, 1
test rsi, rsi
je 0x140041d65
cmp byte [rsi], 0
jne 0x140041d65
mov rsi, qword [0x14018f550]
mov rax, qword [rsi + 0x3ed8]
cmp qword [rsi + 0x48d0], rax
je 0x140041dc8
test byte [rax + 0x17], 1
je 0x140041d3c
mov byte [rsi + 0x3e3e], 1
call fcn.14003b680
mov byte [rsi + 0x3e3e], 0
mov ecx, dword [r14 + 0x4898]
mov dl, 1
call fcn.1400418e0
jmp 0x140041d63
mov dword [r14 + 0x47b8], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rsi, qword [0x14018f550]
mov rax, qword [rsi + 0x3ed8]
cmp qword [rsi + 0x48d0], rax
je 0x140041da2
test byte [rax + 0x17], 1
je 0x140041d94
mov byte [rsi + 0x3e3e], 1
call fcn.14003b680
mov byte [rsi + 0x3e3e], 0
jmp 0x140041d63
cmp byte [rsi + 0x4949], 0
je 0x140041d87
cmp dword [rsi + 0x4908], 0
jne 0x140041d87
mov ecx, dword [rsi + 0x494c]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rsi + 0x494c], ecx
jmp 0x140041d87
cmp byte [rsi + 0x4949], 0
je 0x140041d2f
cmp dword [rsi + 0x4908], 0
jne 0x140041d2f
mov ecx, dword [rsi + 0x494c]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rsi + 0x494c], ecx
jmp 0x140041d2f
Function at 0x140042a50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5cb8]
cmp qword [rcx + 0x5cb0], 0
je 0x140042b57
mov rsi, rcx
cmp dword [rcx + 0x5cbc], 0
jns 0x140042afd
mov rax, qword [0x14018f550]
test rax, rax
je 0x140042a94
inc dword [rax + 0xf0]
mov rdx, qword [0x14018f560]
xor ecx, ecx
call qword [0x14018e1f8]
mov r15, rax
mov rdx, qword [rsi + 0x5cc0]
test rdx, rdx
je 0x140042aec
movsxd r8, dword [rsi + 0x5cb8]
mov rcx, r15
call fcn.140124380
mov rcx, qword [rsi + 0x5cc0]
test rcx, rcx
je 0x140042adf
mov rax, qword [0x14018f550]
test rax, rax
je 0x140042adf
dec dword [rax + 0xf0]
mov rdx, qword [0x14018f560]
call qword [0x14018e200]
mov qword [rsi + 0x5cc0], r15
mov dword [rsi + 0x5cbc], 0
mov dword [rsi + 0x5cb8], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140026380
mov r9, qword [rsi + 0x5cb0]
mov eax, dword [rsi + 0x5cb8]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5cc0]
test rax, rax
lea rcx, [0x14018f558]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140138568
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140026380
Function at 0x140043140
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14, qword [0x14018f550]
cmp byte [r14 + 0x7b], 0
jne 0x140043177
lea rdx, [0x140173a6b]
mov rcx, rsi
call fcn.140124cec
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call fcn.14013cf20
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14004323f
test eax, eax
je 0x1400431bf
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x1400431c5
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14004323f
movsxd rcx, r13d
inc dword [r14 + 0xf0]
mov rdx, qword [0x14018f560]
call qword [0x14018e1f8]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x140043231
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call fcn.140124380
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x140043224
mov rax, qword [0x14018f550]
test rax, rax
je 0x140043224
dec dword [rax + 0xf0]
mov rdx, qword [0x14018f560]
call qword [0x14018e200]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x1400432d2
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x140157270]
mov r10d, 0xffffffff
jmp 0x1400432b2
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x140043347
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x140043290
cmp rax, 2
jb 0x140043290
cmp byte [rcx - 1], 0x23
jne 0x140043290
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x140043290
movzx r8d, byte [rsi]
test r8b, r8b
je 0x140043341
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x140157270]
mov r10d, 0xffffffff
jmp 0x140043324
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x140043347
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x140043300
cmp r11b, 0x23
jne 0x140043300
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x140043300
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call fcn.140124380
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140054430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movaps xmm6, xmm2
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x140054468
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x140054476
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x14005448b
jmp 0x1400545df
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x1400545df
mov eax, dword [rbx]
test al, 2
je 0x1400545df
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
xorps xmm0, xmm0
ucomiss xmm6, xmm0
jae 0x1400544bb
movss xmm6, dword [0x140156344]
jmp 0x1400544c0
divss xmm6, dword [rcx + 0x14]
movsd xmm0, qword [r9]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm7, xmm0
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.140046c70
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
shufps xmm6, xmm6, 0
movsd xmm1, qword [rbx + 8]
movsd xmm0, qword [rbx + 0x10]
mulps xmm1, xmm6
addps xmm1, xmm7
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm0, xmm6
addps xmm0, xmm7
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
movlps qword [r9], xmm1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
movss dword [r9 + 0x14], xmm0
movss dword [r9 + 0x18], xmm2
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
movlps qword [r8 + 0x28], xmm0
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
movss dword [rdx + 0x3c], xmm1
shufps xmm0, xmm0, 0x55
movss dword [rdx + 0x40], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400640d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, edx
mov edi, edx
sar edi, 0x1f
and edi, edx
dec edi
mov ebp, 0x8000
jmp 0x140064121
call fcn.140064860
or r15b, bl
and r15b, r12b
xor bl, 1
movzx ecx, r15b
movzx edx, bl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140064191
mov rax, r14
test eax, eax
jle 0x140064194
lea r14, [rax - 1]
xor ecx, ecx
test r14d, r14d
je 0x14006411d
mov edx, dword [rsi + 0xe88]
and edx, ebp
jne 0x14006411d
add eax, 0xfffffffe
mov r12, qword [rsi + 0x20]
movzx ecx, word [r12 + rax*2]
mov r15b, 1
cmp ecx, 9
je 0x140064161
cmp ecx, 0x20
je 0x140064161
cmp ecx, 0x3000
je 0x140064161
xor r15d, r15d
call fcn.140064860
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x140064100
cmp ecx, 0x20
je 0x140064100
cmp ecx, 0x3000
je 0x140064100
mov r12b, 1
jmp 0x140064100
mov edi, r14d
xor eax, eax
test edi, edi
cmovg eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400641b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x59], 0
mov esi, dword [rcx + 0xc]
je 0x140064275
inc edi
cmp edi, esi
jge 0x140064328
mov r14d, dword [rbx + 0xe88]
jmp 0x140064218
or r15b, al
call fcn.140064860
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x140064328
inc edi
cmp esi, edi
je 0x140064321
test r14w, r14w
js 0x14006420e
mov r12d, edi
dec r12d
js 0x14006420e
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x14006424a
cmp ecx, 0x20
je 0x14006424a
cmp ecx, 0x3000
je 0x14006424a
mov r15b, 1
call fcn.140064860
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x1400641f0
cmp ecx, 0x20
je 0x1400641f0
cmp ecx, 0x3000
je 0x1400641f0
xor eax, eax
jmp 0x1400641f0
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x1400642b3
call fcn.140064860
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140064328
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x140064325
xor ecx, ecx
test eax, eax
js 0x1400642af
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x1400642af
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x1400642f1
cmp ecx, 0x20
je 0x1400642f1
cmp ecx, 0x3000
je 0x1400642f1
xor r12d, r12d
call fcn.140064860
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x140064290
cmp ecx, 0x20
je 0x140064290
cmp ecx, 0x3000
je 0x140064290
mov r13b, 1
jmp 0x140064290
mov edi, esi
jmp 0x140064328
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400932d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rax, r9
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x10010]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
mov rdx, r8
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14009331e
mov qword [rsi], 0
jmp 0x1400933c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rbp - 0x28]
mov rcx, rbx
mov edx, eax
call fcn.140092650
mov rax, qword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jb 0x140093341
mov rbx, qword [rbp - 0x28]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rax
cmp qword [rdi + 0x10030], 0x10
jb 0x14009335c
mov rax, qword [rdi + 0x10018]
jmp 0x140093363
lea rax, [rdi + 0x10018]
mov qword [rbp - 0x38], rax
mov rax, qword [rdi + 0x10028]
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x38]
lea r9, [rbp - 0x48]
mov rcx, rsi
mov edx, 5
call fcn.140085680
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x1400933c2
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400933bd
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400933ce
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14011fa98
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.140135390
int3

Function at 0x140094420
Capabilities:
Encode data using xor

Disassembly:
lea r9, [rcx + rdx]
imul eax, edx, 0xc6a4a793
xor eax, r8d
cmp rdx, 4
jge 0x140094440
mov rdx, rcx
jmp 0x14009445f
add eax, dword [rcx]
imul edx, eax, 0xc6a4a793
mov eax, edx
shr eax, 0x10
xor eax, edx
lea rdx, [rcx + 4]
add rcx, 8
cmp rcx, r9
mov rcx, rdx
jbe 0x140094440
sub r9, rdx
cmp r9, 1
je 0x140094486
cmp r9, 2
je 0x14009447d
cmp r9, 3
jne 0x140094498
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
add eax, ecx
movzx ecx, byte [rdx + 1]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rdx]
add ecx, eax
imul ecx, ecx, 0xc6a4a793
mov eax, ecx
shr eax, 0x18
xor eax, ecx
ret
Function at 0x1400a0ce0
Capabilities:
Encode data using xor

Disassembly:
lea eax, [rdx + 0xf]
test edx, edx
cmovns eax, edx
cmp edx, 0x10
jl 0x1400a0dd6
sar eax, 4
lea edx, [r8 + 2]
movd xmm0, edx
pshufd xmm0, xmm0, 0
movd xmm1, r8d
pshufd xmm1, xmm1, 0
xor edx, edx
movdqa xmm2, xmmword [0x140158300]
pxor xmm0, xmm2
nop dword [rax]
movsxd rdx, edx
lea r8, [rdx*4]
movdqu xmm3, xmmword [rcx + rdx*4]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [rcx + rdx*4], xmm5
mov r9, r8
or r9, 0x10
movdqu xmm3, xmmword [rcx + r9]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [rcx + r9], xmm5
mov r9, r8
or r9, 0x20
movdqu xmm3, xmmword [rcx + r9]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [rcx + r9], xmm5
or r8, 0x30
movdqu xmm3, xmmword [rcx + r8]
movdqa xmm4, xmm3
psubd xmm4, xmm1
pxor xmm3, xmm2
movdqa xmm5, xmm0
pcmpgtd xmm5, xmm3
pandn xmm5, xmm4
movdqu xmmword [rcx + r8], xmm5
add edx, 0x10
dec eax
jne 0x1400a0d20
ret
Function at 0x1400a8c00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
movdqa xmmword [rsp + 0x20], xmm6
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
lea r13, [r8 + r9]
mov r12d, dword [rdx]
lea r8d, [r12 + 1]
shl r8, 2
xor ebx, ebx
xor edx, edx
call fcn.140124a30
test r15, r15
je 0x1400a8c81
jle 0x1400a8c60
nop word cs:[rax + rax]
movzx eax, byte [r14]
inc r14
inc dword [rsi + rax*4]
cmp r14, r13
jb 0x1400a8c50
nop
mov eax, r12d
dec r12d
cmp dword [rsi + rax*4], 0
je 0x1400a8c60
inc r12d
mov dword [rdi], r12d
cmp r12d, 7
jae 0x1400a8c8c
xor eax, eax
xor ebx, ebx
jmp 0x1400a8d8d
mov dword [rdi], 0
jmp 0x1400a8da1
lea rcx, [r12 + 1]
mov rax, rcx
and rax, 0xfffffffffffffff8
mov edx, r12d
inc rdx
and rdx, 0xfffffffffffffff8
pxor xmm1, xmm1
xor r8d, r8d
movdqa xmm0, xmmword [0x140158300]
pxor xmm2, xmm2
nop word cs:[rax + rax]
movdqu xmm3, xmmword [rsi + r8*4]
movdqu xmm4, xmmword [rsi + r8*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm3
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm3, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm3
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm0
pcmpgtd xmm5, xmm3
pand xmm4, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm4
add r8, 8
cmp rdx, r8
jne 0x1400a8cc0
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm2, xmm3
pand xmm4, xmm2
pandn xmm2, xmm1
por xmm2, xmm4
pshufd xmm1, xmm2, 0x55
movdqa xmm3, xmm2
pxor xmm3, xmm0
pxor xmm0, xmm1
pcmpgtd xmm3, xmm0
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
movd ebx, xmm3
cmp rcx, rax
je 0x1400a8da1
dec rax
mov ecx, dword [rsi + rax*4 + 4]
cmp ecx, ebx
cmova ebx, ecx
inc rax
cmp rax, r12
jb 0x1400a8d90
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400a8dc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
movdqa xmmword [rsp + 0x30], xmm6
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp r9, 0x5db
ja 0x1400a8e44
mov r15d, dword [rdi]
lea r8d, [r15 + 1]
shl r8, 2
mov rcx, rsi
xor edx, edx
call fcn.140124a30
test rbx, rbx
je 0x1400a8e98
add rbx, r14
nop word [rax + rax]
movzx eax, byte [r14]
inc r14
inc dword [rsi + rax*4]
cmp r14, rbx
jb 0x1400a8e10
nop
mov eax, r15d
dec r15d
cmp dword [rsi + rax*4], 0
je 0x1400a8e20
inc r15d
mov dword [rdi], r15d
mov eax, r15d
cmp r15d, 7
jae 0x1400a8ea5
xor ecx, ecx
xor edx, edx
jmp 0x1400a8f9d
mov rcx, qword [rsp + 0x90]
mov rax, 0xffffffffffffffff
test cl, 3
jne 0x1400a8fb5
mov rax, 0xffffffffffffffbe
cmp qword [rsp + 0x98], 0x1000
jb 0x1400a8fb5
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.1400a8fd0
jmp 0x1400a8fb5
mov dword [rdi], 0
xor eax, eax
jmp 0x1400a8fb5
inc r15
mov rcx, r15
and rcx, 0xfffffffffffffff8
lea rdx, [rax + 1]
and rdx, 0xfffffffffffffff8
pxor xmm1, xmm1
xor r8d, r8d
movdqa xmm0, xmmword [0x140158300]
pxor xmm2, xmm2
nop word [rax + rax]
movdqu xmm3, xmmword [rsi + r8*4]
movdqu xmm4, xmmword [rsi + r8*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm3
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm3, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm3
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm0
pcmpgtd xmm5, xmm3
pand xmm4, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm4
add r8, 8
cmp rdx, r8
jne 0x1400a8ed0
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm2, xmm3
pand xmm4, xmm2
pandn xmm2, xmm1
por xmm2, xmm4
pshufd xmm1, xmm2, 0x55
movdqa xmm3, xmm2
pxor xmm3, xmm0
pxor xmm0, xmm1
pcmpgtd xmm3, xmm0
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
movd edx, xmm3
cmp r15, rcx
je 0x1400a8fb3
inc rax
mov r8d, dword [rsi + rcx*4]
cmp r8d, edx
cmova edx, r8d
inc rcx
cmp rax, rcx
jne 0x1400a8fa0
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a9370
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rcx, qword [rsp + 0x90]
mov rax, 0xffffffffffffffff
test cl, 3
jne 0x1400a9459
mov rax, 0xffffffffffffffbe
cmp qword [rsp + 0x98], 0x1000
jb 0x1400a9459
mov rbx, r9
mov r14, r8
mov rdi, rdx
cmp dword [rdx], 0xfe
ja 0x1400a93d3
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
jmp 0x1400a9448
mov dword [rdi], 0xff
cmp rbx, 0x5db
ja 0x1400a943b
mov r8d, 0x400
mov rcx, rsi
xor edx, edx
call fcn.140124a30
test rbx, rbx
je 0x1400a9468
add rbx, r14
nop word [rax + rax]
movzx eax, byte [r14]
inc r14
inc dword [rsi + rax*4]
cmp r14, rbx
jb 0x1400a9400
mov ecx, 0x100
nop word cs:[rax + rax]
dec ecx
cmp dword [rsi + rcx*4], 0
je 0x1400a9420
mov eax, ecx
mov dword [rdi], ecx
cmp ecx, 7
jae 0x1400a9472
xor ecx, ecx
xor r8d, r8d
jmp 0x1400a956e
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.1400a8fd0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rdi], 0
xor eax, eax
jmp 0x1400a9459
lea rdx, [rax + 1]
mov rcx, rdx
and rcx, 0xfffffffffffffff8
lea r8, [rax + 1]
and r8, 0xfffffffffffffff8
pxor xmm1, xmm1
xor r9d, r9d
movdqa xmm0, xmmword [0x140158300]
pxor xmm2, xmm2
nop dword [rax + rax]
movdqu xmm3, xmmword [rsi + r9*4]
movdqu xmm4, xmmword [rsi + r9*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm3
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm3, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm3
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm0
pcmpgtd xmm5, xmm3
pand xmm4, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm4
add r9, 8
cmp r8, r9
jne 0x1400a94a0
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
pand xmm1, xmm4
pandn xmm4, xmm2
por xmm4, xmm1
pshufd xmm1, xmm4, 0xee
movdqa xmm2, xmm4
pxor xmm2, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm2, xmm3
pand xmm4, xmm2
pandn xmm2, xmm1
por xmm2, xmm4
pshufd xmm1, xmm2, 0x55
movdqa xmm3, xmm2
pxor xmm3, xmm0
pxor xmm0, xmm1
pcmpgtd xmm3, xmm0
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
movd r8d, xmm3
cmp rdx, rcx
je 0x1400a9592
inc rax
nop word cs:[rax + rax]
mov edx, dword [rsi + rcx*4]
cmp edx, r8d
cmova r8d, edx
inc rcx
cmp rax, rcx
jne 0x1400a9580
mov eax, r8d
jmp 0x1400a9459