joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400536b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f88], 0
lea rax, [0x1401c2a60]
jne 0x1400537bc
xor r8d, r8d
mov dword [rbp - 0x60], 0x100015
mov dword [rbp - 0x5c], 0x1001d
mov dword [rbp - 0x58], 0x3b0018
mov dword [rbp - 0x54], 0x1d000b
mov dword [rbp - 0x50], 0x1f000e
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0xf001a
mov dword [rbp - 0x48], 0xe001c
mov dword [rbp - 0x44], 0x10003
mov dword [rbp - 0x40], 0x5000f
mov dword [rbp - 0x3c], 0x3d000c
mov dword [rbp - 0x38], 0x1c0014
mov dword [rbp - 0x34], 0x3e000a
mov dword [rbp - 0x30], 0xc0000
mov dword [rbp - 0x2c], 0xb0012
mov dword [rbp - 0x28], 0x160014
mov dword [rbp - 0x24], 0x1b0014
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x140053760
mov byte [0x1401c7f88], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x60
pop rbp
ret

Function at 0x1400537d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401c7f91], 0
je 0x140053805
lea rax, [0x1401c28b0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret
mov dword [rsp], 0x100033
mov dword [rsp + 4], 0xf000a
mov dword [rsp + 8], 0x1001e
mov dword [rsp + 0xc], 0x1a003c
mov dword [rsp + 0x10], 0x170011
mov dword [rsp + 0x14], 0x5000e
mov dword [rsp + 0x18], 0x150030
mov dword [rsp + 0x1c], 0x58
xor r8d, r8d
lea rdx, [0x1401c28b0]
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140053860
mov byte [0x1401c7f91], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret
Function at 0x1400538f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [0x1401c7fad], 0
je 0x140053925
lea rax, [0x1401c2988]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x68
ret
mov ecx, dword [0x1401c6d80]
mov eax, 0x4ec4ec4f
mov qword [rsp + 0x60], rbx
xor ebx, ebx
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x140053965
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rsp + 0x30], 0xf0019
mov dword [rsp + 0x34], 0x9000e
mov dword [rsp + 0x38], 0x44000f
mov dword [rsp + 0x3c], 0x18
mov dword [rsp + 0x40], 0x11000c
mov dword [rsp + 0x44], 0xf004f
mov dword [rsp + 0x48], 0x14
mov dword [rsp + 0x4c], 7
lea rdx, [0x1401c2988]
lea r8, [0x1401c1da1]
nop word [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x32]
add rbx, 5
xor ax, word [rsp + rbx*2 + 0x26]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rsp + rbx*2 + 0x2a]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0xf
jl 0x1400539c0
mov rbx, qword [rsp + 0x60]
mov byte [0x1401c7fad], 1
mov rax, rdx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x68
ret
Function at 0x140053bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp + 8], rax
cmp byte [0x1401c7fa1], 0
je 0x140053c25
lea rax, [0x1401c23f0]
jmp 0x140053d47
xor edx, edx
mov dword [rbp - 0x30], 0x30013
mov dword [rbp - 0x2c], 0x1a0001
mov dword [rbp - 0x28], 0x5004a
mov dword [rbp - 0x24], 0x1e0004
mov dword [rbp - 0x20], 0x11000c
mov word [rbp], dx
mov dword [rbp - 0x1c], 0x4f
mov dword [rbp - 0x18], 0xe0016
mov dword [rbp - 0x14], 0x60007
mov dword [rbp - 0x10], 0x4b0015
mov dword [rbp - 0xc], 0x7000f
mov dword [rbp - 8], 0x19001e
mov dword [rbp - 4], 0x50003
lea rbx, [0x1401c23f0]
lea r8, [0x1401c1da1]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x2e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x3c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x38]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x36]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x34]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x32]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140053c90
mov ecx, dword [0x1401c6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x140053d3d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [0x1401c7fa1], 1
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400cc8b0
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rbp
ret
Function at 0x140053e90
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0xc20
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0xc18], rax
mov ecx, dword [0x1401c6d80]
lea eax, [rcx + 1]
imul eax, eax
imul eax, ecx
imul eax, ecx
and eax, 0x80000003
jge 0x140053ecb
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
test eax, eax
je 0x140053f7e
mov qword [rsp + 0xc30], rbx
mov qword [rsp + 0xc38], rsi
mov qword [rsp + 0xc40], r14
lea r14, [rsp + 0x20]
mov esi, edi
nop word [rax + rax]
mov r9d, edi
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14014e57c]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400cd1bc
add r14, 4
mov r9d, ebx
cmp ebx, 0x1a
jge 0x140053f57
mov ecx, dword [0x1401c6d80]
jmp 0x140053f10
inc esi
cmp esi, 0x1d
jge 0x140053f66
mov ecx, dword [0x1401c6d80]
jmp 0x140053f00
mov rsi, qword [rsp + 0xc38]
mov rbx, qword [rsp + 0xc30]
mov r14, qword [rsp + 0xc40]
cmp byte [0x1401c7f86], dil
lea rax, [0x1401c2498]
jne 0x140054021
mov dword [rsp + 0xbf0], 0x14001e
mov dword [rsp + 0xbf4], 0x31001f
mov dword [rsp + 0xbf8], 0x140003
mov dword [rsp + 0xbfc], 0x2d000b
mov dword [rsp + 0xc00], 0xa0006
mov dword [rsp + 0xc04], 0x4000c
mov dword [rsp + 0xc08], 0x190005
mov dword [rsp + 0xc0c], 0x1a000b
mov dword [rsp + 0xc10], 8
lea rdx, [0x1401c1da0]
nop dword [rax]
movzx ecx, byte [rdi + rdx]
inc rdi
xor cx, word [rsp + rdi*2 + 0xbee]
mov word [rax + rdi*2 - 2], cx
cmp rdi, 0x11
jl 0x140054000
mov byte [0x1401c7f86], 1
mov rcx, qword [rsp + 0xc18]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0xc20
pop rdi
ret
Function at 0x1400540f0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov qword [r11 + 0x20], r12
mov r12d, dword [0x1401c6d80]
mov eax, 0x66666667
mov ecx, r12d
xor r10d, r10d
imul ecx, r12d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xf
jne 0x1400541ef
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x10], r14
mov qword [r11 - 0x18], r15
mov eax, r12d
cdq
lea r11d, [r10 + 0x54]
mov r14d, r10d
sub eax, edx
sar eax, 1
mov r15d, eax
test r15d, r15d
jle 0x1400541cb
mov eax, r12d
mov ebx, r10d
mov rsi, r15
cdq
and edx, 3
lea edi, [rdx + rax]
sar edi, 2
nop
mov r8d, r10d
mov r9d, r10d
mov edx, r10d
cmp edi, 2
jl 0x1400541b1
lea edx, [rdi - 2]
mov ecx, ebx
shr edx, 1
inc edx
mov eax, edx
add edx, edx
nop dword [rax + rax]
dec r9d
add r8d, ecx
add r9d, ecx
sub ecx, 2
dec rax
jne 0x1400541a0
cmp edx, edi
jge 0x1400541bc
mov eax, ebx
sub eax, edx
add r11d, eax
lea eax, [r9 + r8]
add ebx, r14d
add r11d, eax
dec rsi
jne 0x140054180
inc r14d
cmp r14d, r11d
jl 0x140054166
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp byte [0x1401c7f90], r10b
mov r12, qword [rsp + 0x88]
je 0x140054219
lea rax, [0x1401c2be8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x60
pop rbp
ret
mov dword [rbp - 0x60], 0x14001e
mov dword [rbp - 0x5c], 0x31001f
mov dword [rbp - 0x58], 0xd000c
mov dword [rbp - 0x54], 0x1001a
mov dword [rbp - 0x50], 0x2d0017
mov dword [rbp - 0x4c], 0xf0006
mov dword [rbp - 0x48], 0x8001f
mov dword [rbp - 0x44], 0x10001
mov dword [rbp - 0x40], 0x4000f
mov dword [rbp - 0x3c], 0x3d0005
mov dword [rbp - 0x38], 0x150014
mov dword [rbp - 0x34], 0x40012
mov dword [rbp - 0x30], 0x1d0011
mov dword [rbp - 0x2c], 0x60010
mov word [rbp - 0x28], r10w
lea rdx, [0x1401c2be8]
lea r8, [0x1401c1da1]
nop
movzx eax, byte [r10 + r8 - 1]
movzx ecx, word [rbp + r10*2 - 0x5e]
add r10, 4
xor ax, word [rbp + r10*2 - 0x68]
mov word [rdx + r10*2 - 8], ax
movzx eax, byte [r10 + r8 - 4]
xor cx, ax
mov word [rdx + r10*2 - 6], cx
movzx ecx, byte [r10 + r8 - 3]
xor cx, word [rbp + r10*2 - 0x64]
mov word [rdx + r10*2 - 4], cx
movzx ecx, byte [r10 + r8 - 2]
xor cx, word [rbp + r10*2 - 0x62]
mov word [rdx + r10*2 - 2], cx
cmp r10, 0x1c
jl 0x140054290
mov byte [0x1401c7f90], 1
mov rax, rdx
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x60
pop rbp
ret
Function at 0x140054310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401c6d80]
mov eax, 0x4ec4ec4f
mov ebx, 4
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 8
jne 0x1400543a0
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x7b
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400cbef8
mov rcx, rax
call fcn.1400cd9ec
mov ecx, dword [0x1401c6d80]
cmp byte [0x1401c7faa], 0
je 0x1400543b5
lea rax, [0x1401c2650]
jmp 0x140054525
xor r9d, r9d
mov dword [rbp - 0x60], 0x100015
mov dword [rbp - 0x5c], 0x1001d
mov dword [rbp - 0x58], 0x440018
mov dword [rbp - 0x54], 0x17000f
mov dword [rbp - 0x50], 0x60017
mov r8d, r9d
mov dword [rbp - 0x4c], 0xf0006
mov dword [rbp - 0x48], 0x4d0012
mov dword [rbp - 0x44], 0x1c0004
mov dword [rbp - 0x40], 0x180014
mov dword [rbp - 0x3c], 0x42001f
mov dword [rbp - 0x38], 0x20000
mov dword [rbp - 0x34], 0x20009
mov dword [rbp - 0x30], 0x1a0017
mov dword [rbp - 0x2c], 0x420006
mov dword [rbp - 0x28], 0xc000e
mov dword [rbp - 0x24], 0xd0000
mov dword [rbp - 0x20], 0x55
lea r10, [0x1401c2650]
lea r11, [0x1401c1da1]
movzx eax, byte [r8 + r11 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 3
xor ax, word [rbp + r8*2 - 0x66]
mov word [r10 + r8*2 - 6], ax
movzx eax, byte [r8 + r11 - 3]
xor dx, ax
movzx eax, byte [r8 + r11 - 2]
xor ax, word [rbp + r8*2 - 0x62]
mov word [r10 + r8*2 - 4], dx
mov word [r10 + r8*2 - 2], ax
cmp r8, 0x21
jl 0x140054440
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov byte [0x1401c7faa], 1
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x140054522
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x94
sub eax, edx
cmp eax, 5
je 0x14005451b
nop dword [rax + rax]
mov eax, ecx
inc r9d
or eax, 0xffffff32
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r9d, eax
jg 0x14005451b
mov eax, 0xdd67c8a7
mov r8d, ecx
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x94
sub r8d, edx
cmp r8d, 5
jne 0x1400544e0
mov dword [0x1401c6d80], r9d
mov rax, r10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140054550
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401c7fa0], 0
lea rax, [0x1401c29e0]
jne 0x1400545cf
mov dword [rsp], 0x70006
mov dword [rsp + 4], 0x1d001d
mov dword [rsp + 8], 0xb0003
mov dword [rsp + 0xc], 0x520006
mov dword [rsp + 0x10], 6
xor ecx, ecx
mov dword [rsp + 0x14], 0x1d
lea r8, [0x1401c1da0]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x1400545b0
mov byte [0x1401c7fa0], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x28
ret

Function at 0x1400545f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1401c6d80]
xor ebx, ebx
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 3
jne 0x14005469b
mov eax, 0x7a44c6b
mov r8d, ebx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x43
sub eax, edx
cmp eax, 0xd1
je 0x140054692
nop dword [rax + rax]
mov eax, ecx
inc r8d
or eax, 0xffffff94
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x140054692
mov eax, 0x7a44c6b
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x43
sub eax, edx
cmp eax, 0xd1
jne 0x140054660
mov ecx, r8d
mov dword [0x1401c6d80], ecx
cmp byte [0x1401c7f9e], bl
je 0x1400546bd
lea rax, [0x1401c29f8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbx
ret
imul ecx, ecx
mov eax, 0x30c30c31
mov dword [rsp + 0x20], 0x12003f
imul ecx
mov dword [rsp + 0x24], 0xa
mov dword [rsp + 0x28], 0x16003a
sar edx, 2
mov dword [rsp + 0x2c], 0x110007
mov dword [rsp + 0x30], 0x10006
mov eax, edx
mov dword [rsp + 0x34], 0x41001c
mov dword [rsp + 0x38], 0x180016
shr eax, 0x1f
mov dword [rsp + 0x3c], 0x10
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xe
jne 0x140054732
call fcn.1400cd268
mov ecx, dword [0x1401c6d80]
cmp ecx, eax
jne 0x140054732
dec ecx
mov dword [0x1401c6d80], ecx
lea rdx, [0x1401c29f8]
lea r8, [0x1401c1da1]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x22]
add rbx, 5
xor ax, word [rsp + rbx*2 + 0x16]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rsp + rbx*2 + 0x1a]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x1c]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0xf
jl 0x140054740
mov byte [0x1401c7f9e], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbx
ret
Function at 0x1400547c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f98], 0
lea rax, [0x1401c24d0]
jne 0x14005488f
mov dword [rbp - 0x50], 0x100033
mov dword [rbp - 0x4c], 0xf000a
mov dword [rbp - 0x48], 0x1001e
mov dword [rbp - 0x44], 0x1d003c
mov dword [rbp - 0x40], 0x1e000c
mov dword [rbp - 0x3c], 0x40007
mov dword [rbp - 0x38], 0x1d0019
mov dword [rbp - 0x34], 0x470051
mov dword [rbp - 0x30], 0x50035
mov dword [rbp - 0x2c], 0x12000a
mov dword [rbp - 0x28], 0x180003
mov dword [rbp - 0x24], 0x150009
mov dword [rbp - 0x20], 0xf0052
mov dword [rbp - 0x1c], 0xb0014
mov dword [rbp - 0x18], 0x7000b
mov dword [rbp - 0x14], 2
xor ecx, ecx
lea r8, [0x1401c1da0]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x140054870
mov byte [0x1401c7f98], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbp
ret
Function at 0x1400548b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f8e], 0
je 0x1400548e9
lea rax, [0x1401c2590]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
mov edx, dword [0x1401c6d80]
xor r8d, r8d
mov dword [rbp - 0x40], 0x100027
lea eax, [rdx + 1]
mov dword [rbp - 0x3c], 0x1a0006
mov dword [rbp - 0x38], 0x34000f
mov dword [rbp - 0x34], 0x1d001a
mov dword [rbp - 0x30], 0x170000
mov dword [rbp - 0x2c], 0x12001c
imul eax, eax
imul eax, edx
imul eax, edx
mov dword [rbp - 0x28], 0x80038
mov dword [rbp - 0x24], 0x1a000f
mov dword [rbp - 0x20], 0x120014
mov dword [rbp - 0x1c], 0x420051
mov word [rbp - 0x18], r8w
and eax, 0x80000003
jge 0x140054957
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1400549f6
mov r9d, r8d
mov ecx, r9d
mov eax, r9d
inc r9d
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
add edx, eax
cmp r9d, 0x100
jl 0x140054962
mov dword [0x1401c6d80], edx
lea rax, [0x1401c2590]
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x140054a10
mov byte [0x1401c7f8e], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
Function at 0x140054a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401c7fb7], 0
je 0x140054ac5
lea rax, [0x1401c2698]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x58
ret
mov ecx, dword [0x1401c6d80]
mov eax, 0x88888889
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov dword [rsp + 0x20], 0x70006
mov dword [rsp + 0x24], 0x1d001d
imul ecx, ecx
imul ecx
add edx, ecx
mov dword [rsp + 0x28], 0xb0003
mov dword [rsp + 0x2c], 0x480006
sar edx, 3
mov dword [rsp + 0x30], 0x420043
mov dword [rsp + 0x34], 0x510041
mov eax, edx
mov dword [rsp + 0x38], 0x5d005b
mov dword [rsp + 0x3c], 0x45004c
shr eax, 0x1f
mov word [rsp + 0x40], bx
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xe
jne 0x140054b4e
call fcn.1400cd268
mov ecx, dword [0x1401c6d80]
cmp ecx, eax
jne 0x140054b4e
dec ecx
mov dword [0x1401c6d80], ecx
lea rax, [0x1401c2698]
lea r8, [0x1401c1da1]
nop dword [rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rsp + rbx*2 + 0x22]
add rbx, 4
xor cx, word [rsp + rbx*2 + 0x18]
mov word [rax + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 4]
xor dx, cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x1c]
mov word [rax + rbx*2 - 6], dx
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x10
jl 0x140054b60
mov byte [0x1401c7fb7], 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x58
ret

Function at 0x140054bd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401c7fac], 0
je 0x140054c05
lea rax, [0x1401c2c28]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret
mov dword [rsp], 0xf0019
mov dword [rsp + 4], 0x9000e
mov dword [rsp + 8], 0x44000f
mov dword [rsp + 0xc], 0x130006
mov dword [rsp + 0x10], 0x17000e
mov dword [rsp + 0x14], 0x12004f
mov dword [rsp + 0x18], 0x10010
mov dword [rsp + 0x1c], 4
xor r8d, r8d
lea rdx, [0x1401c2c28]
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140054c60
mov byte [0x1401c7fac], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret