joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp - 0x10], esi
lea rdx, [rcx + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140005870
xchg r8, r8
mov rbx, qword [rax]
mov eax, 0x61c47834
sub eax, 0x3b934c0c
add eax, 0x22055554
mov dword [rsp - 0x38], 0x28fde73f
add eax, 0x50720d6
xor eax, 0x2ed2e667
add eax, 0x9c10bbca
mov dword [rsp + 0x40], eax
mov dword [rsp - 0xc], esi
cmp byte [rbx], 0
je 0x1400314b2
nop dword [rax]
mov r10, r10
mov r8d, 0x1378bbfe
xor r8d, 0x57499392
add r8d, 0x288c307
mov dword [rsp - 0x34], ecx
xor r8d, 0x5665fc92
add r8d, 0x245ae635
xor r8d, 0x7635e2a0
xor r8d, 0x43031cb7
mov rsp, rsp
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140069660
inc rbx
xchg r10, r10
cmp byte [rbx], 0
jne 0x14003145f
mov eax, dword [rsp + 0x40]
mov ebx, dword [rdi + 0x58]
xchg rdi, rdi
not eax
xor ebx, 0x2ea4
shl ebx, 0x10
mov rcx, rcx
or ebx, dword [rdi + 0x40]
xor ebx, eax
cmp byte [rsp + 0x28], 0
mov r9, r9
je 0x1400314e7
mov rcx, qword [rsp + 0x20]
call fcn.140072210
mov dword [rsp - 0x14], 0x4922b841
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
xchg r15, r15
pop rdi
ret

Function at 0x140031500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rcx, rcx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov dword [rsp - 0x30], edi
mov eax, dword [rcx + 0x50]
mov r14, rdx
mov edi, dword [rcx + 0x5c]
xor eax, 0x49322ea4
mov dword [rsp - 0x30], 0x1db290c5
movaps xmmword [rsp + 0x20], xmm6
mov rbp, rcx
xor ebx, ebx
xor edi, 0x49322ea4
mov r15, r15
xor edx, edx
mov rcx, r14
movd xmm6, eax
add edi, edi
mov rdi, rdi
cvtdq2ps xmm6, xmm6
mov esi, ebx
call fcn.1400695e0
mov dword [rsp - 0x3c], ebx
test ax, ax
je 0x1400315d5
nop dword [rax]
mov rbp, rbp
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x60]
mov r13, r13
add rcx, rcx
mov rdx, rsi
movups xmm1, xmmword [rax + rcx*8]
xorps xmm1, xmmword [0x1400a7f40]
mov dword [rsp - 0x3c], 0x8a7a4b1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm6
mov dword [rsp - 0xc], edx
cvttss2si ecx, xmm0
sub ecx, edi
add ebx, ecx
mov dword [rsp - 0x10], 0x5fdb3058
mov rcx, r14
call fcn.1400695e0
test ax, ax
jne 0x14003157c
mov r8, r8
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov dword [rsp - 0x24], esp
mov rdi, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
mov dword [rsp - 0x44], 0x4593ff69
pop r14
ret
Function at 0x1400317a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x50]
xor r8d, r8d
mov r13, r13
mov r9d, dword [rcx + 0x5c]
xor eax, 0x49322ea4
xor r9d, 0x49322ea4
add r9d, r9d
mov dword [rsp - 0x28], 0x2758aea3
movd xmm3, eax
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
mov dword [rsp - 0x44], 0x86b6765
test ax, ax
je 0x140031837
mov r10, qword [rcx + 0x60]
movaps xmm2, xmmword [0x1400a7f40]
xchg r13, r13
nop dword [rax]
nop word [rax + rax]
movzx eax, ax
add rdx, 2
xchg rsi, rsi
add rax, rax
movups xmm1, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm1, xmm2
mov dword [rsp - 0x24], ecx
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm3
mov dword [rsp - 0x10], esp
cvttss2si ecx, xmm0
sub ecx, r9d
add r8d, ecx
test ax, ax
mov rsi, rsi
jne 0x1400317f6
mov eax, r8d
ret
Function at 0x14003e800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg rsi, rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov dword [rsp - 0x34], esi
sub rsp, 0x20
lea r14, [rcx + 0x118]
mov r15, rdx
mov rbp, qword [r14 + 8]
mov rsp, rsp
mov rsi, rcx
cmp rbp, 4
jbe 0x14003e846
mov dword [rsp - 0x38], esi
mov r14, qword [r14]
lea rcx, [rbp + 1]
mov eax, 0x33483dc6
mov r13, r13
xor eax, 0x1a5377da
add eax, 0xe453883
sub eax, 0x2259d919
mov dword [rsp - 0x44], 0x1380c3f6
sub eax, 0x1506a984
mul rcx
pushf
mov rdx, rdx
movabs r12, 0xffffffff5dc08cdd
add r12, 0xc0e1fd5
sub r12, 0x547a46ca
xor r12, 0x294d01fb
mov rcx, rcx
sub r12, 0x100c888f
add r12, 0x7fffffff
add r12, 0x53f3247c
popf
mov dword [rsp - 0x40], 0xaeec1a5
cmovo rax, r12
mov rcx, rax
call fcn.140072200
mov dword [rsp - 0x1c], ecx
xor edi, edi
mov rbx, rax
mov r8d, edi
mov dword [rsp - 0x10], ecx
test rbp, rbp
je 0x14003e93a
mov rdx, rax
sub r14, rax
xchg rdx, rdx
nop word [rax + rax]
movzx ecx, r8b
lea rdx, [rdx + 2]
mov dword [rsp - 0x30], 0x13dab816
and cl, 3
mov eax, 0x4c636c0e
add eax, 0x252e06b7
xor eax, 0x292539db
mov dword [rsp - 0x3c], edx
xor eax, 0x739e32f7
add eax, 0x25f6e47c
shl cl, 3
xchg r9, r9
inc r8
sar eax, cl
movsx eax, al
xor ax, word [r14 + rdx - 2]
mov rcx, rcx
mov word [rdx - 2], ax
cmp r8, rbp
jb 0x14003e8e7
xchg rdi, rdi
mov word [rbx + rbp*2], di
cmp word [rsi + 0x140], di
je 0x14003e986
mov rcx, rdi
mov dword [rsp - 0x2c], 0x35c096e2
cmp qword [rsi + 0x120], rcx
jbe 0x14003e986
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x2c], esi
movzx eax, word [rsi + 0x140]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, qword [rsi + 0x120]
xchg rcx, rcx
jb 0x14003e96c
mov qword [r15], rdi
mov rcx, r12
nop dword [rax]
xchg rcx, rcx
inc rcx
cmp word [rbx + rcx*2], di
jne 0x14003e992
mov rsp, rsp
mov qword [r15 + 8], rcx
mov rdx, r15
cmp rcx, 4
xchg r11, r11
jbe 0x14003e9eb
mov eax, 0x4b74dda1
add eax, 0x66fbbd
mov r12, r12
xor eax, 0x6c95abfe
xor eax, 0x7ca9e317
sub eax, 0x103d9168
xor eax, 0x4baa004d
xchg rbx, rbx
mul rcx
cmovo rax, r12
mov rcx, rax
mov dword [rsp - 0x28], ecx
call fcn.140072200
mov rdx, rax
mov qword [r15], rax
cmp qword [r15 + 8], rdi
mov dword [rsp - 0x1c], ebp
jbe 0x14003ea58
mov r8, rbx
sub r8, rdx
nop dword [rax]
mov dword [rsp - 0x14], 0x2c94c88c
movzx ecx, dil
lea rdx, [rdx + 2]
and cl, 3
mov dword [rsp - 0x10], ebp
mov eax, 0x812147c
xor eax, 0x3c561d7c
sub eax, 0x10ced240
xchg r13, r13
add eax, 0xe6a9226
add eax, 0x1f41957f
shl cl, 3
inc rdi
mov dword [rsp - 0x1c], 0x7f5bedd
sar eax, cl
movsx eax, al
xor ax, word [r8 + rdx - 2]
mov rbp, rbp
mov word [rdx - 2], ax
cmp rdi, qword [r15 + 8]
jb 0x14003ea07
mov rcx, rbx
mov r15, r15
call fcn.140072210
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov r14, r14
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov dword [rsp - 0x34], ecx
add rsp, 0x20
pop r15
pop r14
pop r12
xchg rsi, rsi
ret
Function at 0x14005cff0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov r15, r15
mov qword [rsp + 0x20], rdi
push r14
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x2c], 0x1922cc8f
xor ebp, ebp
add rbx, rcx
mov rdi, rdx
xchg rdx, rdx
mov r14, rcx
movzx r9d, bp
movzx eax, word [rbx + 0x14]
lea r8, [rbx + 0x18]
mov rbx, rbx
movzx r11d, word [rbx + 6]
add r8, rax
mov r10d, dword [rbx + 0xb0]
cmp bp, r11w
mov dword [rsp - 0x2c], ebp
jae 0x14005d08a
mov eax, dword [r8 + 8]
test eax, eax
mov r10, r10
jne 0x14005d05a
mov eax, dword [r8 + 0x10]
mov edx, dword [r8 + 0xc]
xchg r15, r15
cmp r10d, edx
jb 0x14005d079
add eax, edx
cmp r10d, eax
mov dword [rsp - 0x3c], 0x56d901b1
jb 0x14005d167
inc r9w
add r8, 0x28
mov rdx, rdx
cmp r9w, r11w
jb 0x14005d04b
mov r10, rbp
mov dword [rsp - 0x20], edi
sub rdi, qword [rbx + 0x30]
mov esi, dword [rbx + 0xb4]
mov ebx, ebp
test esi, esi
mov r14, r14
je 0x14005d1b7
nop dword [rax + rax]
movsxd rcx, dword [r14 + 0x3c]
xchg r9, r9
lea rdx, [r14 + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, bp
mov rsp, rsp
movzx eax, word [rcx + r14 + 0x14]
movzx ecx, word [rcx + r14 + 6]
add rdx, rax
cmp bp, cx
mov dword [rsp - 0xc], esp
jae 0x14005d119
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14005d0ef
mov dword [rsp - 0x18], 0x305cbabe
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14005d107
mov dword [rsp - 0x28], esi
add eax, r9d
cmp r11d, eax
jb 0x14005d17c
xchg rbp, rbp
inc r8w
add rdx, 0x28
cmp r8w, cx
jb 0x14005d0dd
mov dword [rsp - 0x10], ebx
mov rdx, rbp
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
sub rax, 8
mov rbx, rbx
add r10, 8
shr rax, 1
test eax, eax
mov r13, r13
je 0x14005d1a8
mov r8d, eax
nop dword [rax]
movzx eax, word [r10]
xchg r14, r14
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
xchg rsi, rsi
je 0x14005d192
cmp ecx, 0xa
jne 0x14005d19a
xchg r10, r10
and eax, 0xfff
add qword [rax + rdx], rdi
jmp 0x14005d19a
mov eax, dword [r8 + 0x14]
sub rax, rdx
add rax, r14
mov r8, r8
add r10, rax
jmp 0x14005d091
mov edx, dword [rdx + 0x14]
sub rdx, r9
add rdx, r14
add rdx, r11
mov dword [rsp - 0x18], 0x7a4c3640
jmp 0x14005d11c
and eax, 0xfff
add dword [rax + rdx], edi
add r10, 2
sub r8, 1
mov dword [rsp - 0x44], edx
jne 0x14005d140
add ebx, dword [r9]
cmp ebx, esi
mov dword [rsp - 0x30], ebp
jb 0x14005d0ad
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
xchg rdx, rdx
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14005e370
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov dword [rsp - 0x24], ebx
mov r10d, edx
mov rbx, rcx
movzx eax, word [r8 + 0x14]
mov dword [rsp - 0x44], ecx
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
mov dword [rsp - 0x44], ebx
cmp r9w, r11w
jae 0x14005e3e5
nop dword [rax]
mov ecx, dword [rax + 8]
mov dword [rsp - 0x28], ebx
test ecx, ecx
jne 0x14005e3ba
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
mov r14, r14
cmp r10d, edx
jb 0x14005e3d4
add ecx, edx
cmp r10d, ecx
mov dword [rsp - 0x40], 0x7568aabc
jb 0x14005e3f0
inc r9w
add rax, 0x28
xchg rsi, rsi
cmp r9w, r11w
jb 0x14005e3ac
xor eax, eax
mov rbx, qword [rsp + 8]
xchg r10, r10
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
mov r10, r10
mov rbx, qword [rsp + 8]
add rax, r10
ret

Function at 0x14005e410
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
mov dword [rsp - 0x10], ebx
push rdi
push r12
push r13
push r14
xchg r9, r9
push r15
sub rsp, 0x20
movzx eax, word [rcx]
xchg r9, r9
mov r15d, edx
xor eax, 0x2fa0562a
mov rsi, rcx
cmp eax, 0x2fa00c67
mov rdi, rdi
jne 0x14005e590
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rcx + rsi]
xor eax, 0x2fa0562a
mov dword [rsp - 0x20], ecx
cmp eax, 0x2fa0137a
jne 0x14005e590
mov edx, dword [rcx + rsi + 0x88]
xchg r11, r11
mov rcx, rsi
call fcn.14005e370
mov rcx, rsi
mov dword [rsp - 0x28], 0x774845e3
mov r14, rax
mov edx, dword [rax + 0x20]
call fcn.14005e370
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0x30], ebx
mov rcx, rsi
mov r12, rax
call fcn.14005e370
xchg r12, r12
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
mov r13, rax
mov dword [rsp - 0x14], edx
call fcn.14005e370
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x34], esi
jbe 0x14005e590
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
xchg rsi, rsi
call fcn.14005e370
mov ecx, 0x4b9f5eae
sub ecx, 0x43fa8ce6
add ecx, 0x55c53024
mov dword [rsp - 0x28], ebx
sub ecx, 0x31846c45
xor ecx, 0x322a1b22
sub ecx, 0xa06ac72
mov dword [rsp - 0x28], 0x7e7f1a15
add ecx, 0xf0371dec
mov rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
xchg r10, r10
je 0x14005e572
nop dword [rax]
mov r8d, 0x16cb36c2
xchg r15, r15
sub r8d, 0x12084026
add r8d, 0x7a446718
xor r8d, 0xb727f6a
mov dword [rsp - 0x30], 0x4107d635
sub r8d, 0x747522dd
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.140069660
mov dword [rsp - 0xc], ecx
inc rbx
cmp byte [rbx], 0
jne 0x14005e525
mov r12, r12
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
je 0x14005e5b1
mov dword [rsp - 0x20], 0x2aace9e4
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14005e4cf
mov r8, r8
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
mov dword [rsp - 0x24], edx
pop r14
pop r13
pop r12
mov r10, r10
pop rdi
pop rsi
pop rbp
xchg r14, r14
ret
movzx eax, word [r13 + rdi*2]
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + rax*4]
mov dword [rsp - 0x1c], ebx
mov rcx, rsi
call fcn.14005e370
jmp 0x14005e592
Function at 0x14005ebf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
mov dword [rsp - 0x30], 0x51d74f7c
sub rsp, 0x240
mov rbx, rcx
xor edx, edx
mov dword [rsp - 0x10], esp
lea rcx, [rsp + 0x30]
mov r8d, 0x2e9f9914
add r8d, 0x29569ed2
mov r10, r10
add r8d, 0x1e243491
sub r8d, 0x674d6bf7
add r8d, 0x1cca7fde
mov rcx, rcx
add r8d, 0x3afc831c
sub r8d, 0x66940172
call fcn.140072650
mov rax, qword gs:[0x60]
mov dword [rsp - 0x38], ebx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov r8, qword [rax]
mov rbx, rbx
test r8, r8
je 0x14005edc0
mov r8, qword [r8 + 0x50]
xchg r8, r8
test r8, r8
je 0x14005edc0
mov edx, 0xed807bf
mov dword [rsp - 0x24], 0x102d5562
xor edx, 0x4e5168a
add edx, 0x53e5d4bf
xor edx, 0x7f304f36
sub edx, 0x2112a9be
mov dword [rsp - 0x28], 0x51e48b13
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.140072bb0
mov edx, 0x200e8efe
mov dword [rsp - 0x20], esi
xor edx, 0x779f3db1
sub edx, 0x4fb6be03
xor edx, 0x7114afeb
xchg r13, r13
sub edx, 0x3e6e83f0
xor edx, 0x385fd6eb
lea rcx, [rsp + 0x30]
call fcn.140072c80
mov dword [rsp - 0x14], 0x6e0a2e3d
test rax, rax
je 0x14005edc0
mov qword [rsp + 0x250], rdi
mov rbp, rbp
lea rcx, [rsp + 0x20]
xor edi, edi
mov rdx, rbx
mov dword [rsp - 0x34], 0xda7fe93
mov word [rax], di
mov rax, qword [0x1400a2ad0]
xor rax, qword [0x1400a2a90]
call rax
mov dword [rsp - 0x30], ecx
mov rax, qword [0x1400a2ab0]
lea r9, [rsp + 0x260]
xor rax, qword [0x1400a2a90]
mov r14, r14
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x258]
mov qword [rsp + 0x260], rdi
lea rcx, [rsp + 0x30]
mov r12, r12
call rax
mov rdi, qword [rsp + 0x250]
test eax, eax
jns 0x14005edac
mov dword [rsp - 0x14], edi
mov rdx, qword [0x1400a2b50]
mov ecx, eax
xor rdx, qword [0x1400a2a90]
mov dword [rsp - 0x14], 0x566d9c26
call rdx
mov rdx, qword [0x1400a2e30]
mov ecx, eax
xor rdx, qword [0x1400a2a90]
xchg rdi, rdi
call rdx
mov rax, qword [rsp + 0x260]
add rsp, 0x240
pop rbx
xchg rsi, rsi
ret
xor eax, eax
add rsp, 0x240
xchg r14, r14
pop rbx
ret

Function at 0x14005ee80
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, qword [0x1400a2a78]
xchg r10, r10
test rdi, rdi
je 0x14005ef5d
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rbx
mov dword [rsp - 0x30], 0x11a911a7
test rcx, rcx
je 0x14005eefb
mov rbx, qword [rdi]
mov qword [rsp + 0x38], rsi
mov r13, r13
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
je 0x14005eef6
mov rax, qword [0x1400a2ac0]
mov dword [rsp - 0x38], 0x124e4061
xor rax, qword [0x1400a2a90]
mov rcx, qword [rbx]
call rax
mov dword [rsp - 0x44], ebp
add rbx, 8
cmp rbx, rsi
jne 0x14005eec3
mov rdi, qword [0x1400a2a78]
mov dword [rsp - 0x28], esi
mov rsi, qword [rsp + 0x38]
xor ebx, ebx
test rdi, rdi
je 0x14005ef4e
mov dword [rsp - 0x40], edi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005ef19
xchg r11, r11
call fcn.140072210
mov qword [rdi], rbx
mov edx, 0x57b1b70e
xor edx, 0x1ff7e38
mov dword [rsp - 0x44], 0x28249544
add edx, 0x1dea4347
add edx, 0x80ba570
sub edx, 0x7c44b1cd
mov rcx, rdi
mov dword [rsp - 0x40], 0x410f37b7
call fcn.140072210
mov qword [0x1400a2a78], rbx
mov rbx, qword [rsp + 0x30]
xchg r14, r14
add rsp, 0x20
pop rdi
ret
Function at 0x140061170
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x80]
mov r12, r8
mov rdi, qword [rsp + 0x70]
mov r15, rdx
mov ebp, r9d
mov r14, rcx
test ebx, ebx
jne 0x1400611cb
cmp byte [rcx + 9], 0
mov ebx, 5
jne 0x1400611cb
cmp rdx, rdi
mov r10, rdx
mov rax, rdi
cmovb rax, rdx
cmovb r10, rdi
sub r10, rax
mov eax, 0xe
cmp r10, 0x7ffff000
cmova ebx, eax
cmp byte [rcx + 9], 0
mov qword [rsp + 0x50], rsi
jne 0x140061231
cmp ebx, 5
je 0x140061211
mov eax, ebx
cmp ebx, 0xe
jne 0x140061341
lea ecx, [rbp + 1]
mov byte [rbp + r8], 0xff
mov byte [rcx + r8], 0x25
xor esi, esi
lea ecx, [rbp + 2]
mov dword [rcx + r8], esi
lea ecx, [rbp + 6]
mov r8d, dword [rsp + 0x78]
add r8, rdi
mov qword [rcx + r12], r8
jmp 0x140061341
mov edx, dword [rsp + 0x78]
lea eax, [rbp + 1]
sub edi, r15d
mov byte [rbp + r8], 0xe9
sub edi, ebp
add edx, 0xfffffffb
add edx, edi
mov dword [rax + r8], edx
jmp 0x14006133f
mov rax, qword [rcx]
mov qword [rsp + 0x58], r13
call qword [rax + 0x30]
mov ecx, 0x5a4d
xor esi, esi
cmp word [rax], cx
jne 0x140061257
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14006125a
mov rcx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
lea r9d, [r15 + rbp]
add rdx, rax
movzx r8d, si
cmp si, r10w
jae 0x14006129b
test r9d, r9d
je 0x14006128d
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x14006128d
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x14006129e
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x140061278
mov rdx, rsi
mov r13d, dword [rdx + 0xc]
mov rcx, r14
sub r13d, dword [rdx + 0x14]
mov rax, qword [r14]
add r13d, r15d
add r13d, ebp
call qword [rax + 0x30]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400612ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400612d1
mov rcx, rsi
mov r11d, dword [rsp + 0x78]
lea rdx, [rcx + 0x18]
movzx eax, word [rcx + 0x14]
movzx r8d, si
movzx r10d, word [rcx + 6]
add rdx, rax
lea r9d, [rdi + r11]
cmp si, r10w
jae 0x140061317
test r9d, r9d
je 0x140061309
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x140061309
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x14006131a
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x1400612f4
mov rdx, rsi
mov eax, dword [rdx + 0x14]
mov edx, dword [rdx + 0xc]
sub edx, eax
mov byte [rbp + r12], 0xe9
add edx, edi
lea eax, [rbp + 1]
add edx, r11d
sub edx, r13d
mov r13, qword [rsp + 0x58]
sub edx, 5
mov dword [rax + r12], edx
mov eax, ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140068310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
xchg r15, r15
sub rsp, 0x20
cmp qword [rcx + 8], 4
mov rdi, rdx
mov rbx, rcx
mov dword [rsp - 0x34], 0x12bff0c2
jbe 0x14006833e
mov rcx, qword [rcx]
call fcn.140072210
mov dword [rsp - 0x3c], esi
nop
movabs r8, 0xffffffff7a546a82
sub r8, 0x1f934fdd
xchg r13, r13
sub r8, 0x2a3f341
add r8, 0x33b8c39
sub r8, 0x401f9eed
add r8, 0x7fffffff
xchg r9, r9
add r8, 0x64c6eb50
mov rcx, r8
nop dword [rax]
inc rcx
mov r8, r8
cmp word [rdi + rcx*2], 0
jne 0x140068383
mov qword [rbx + 8], rcx
mov dword [rsp - 0x10], 0x664f9fd7
mov rdx, rbx
cmp rcx, 4
jbe 0x1400683f6
xchg rsp, rsp
inc rcx
mov eax, 0x428cd329
add eax, 0x52c7afc
mov r13, r13
add eax, 0x31f01c3f
sub eax, 0x71dd104f
add eax, 0x2449009
xor eax, 0x328068c7
mov dword [rsp - 0x44], 0xb6ea0ea
xor eax, 0x389082db
mul rcx
cmovo rax, r8
mov rcx, rax
mov dword [rsp - 0x28], 0x4ba411c1
call fcn.140072200
mov rdx, rax
mov qword [rbx], rax
xor r8d, r8d
mov dword [rsp - 0x14], edx
cmp qword [rbx + 8], r8
jbe 0x14006846b
sub rdi, rdx
mov dword [rsp - 0x2c], ecx
movzx ecx, r8b
lea rdx, [rdx + 2]
and cl, 3
mov eax, 0x544ffa1c
xchg r8, r8
xor eax, 0x18474b37
add eax, 0x32d524b2
sub eax, 0x4467ec94
xor eax, 0x7bcede2
mov dword [rsp - 0x3c], 0x55e8e944
xor eax, 0x23282365
add eax, 0x32403697
shl cl, 3
inc r8
mov r9, r9
sar eax, cl
movsx eax, al
xor ax, word [rdi + rdx - 2]
mov dword [rsp - 0xc], 0x458191bf
mov word [rdx - 2], ax
cmp r8, qword [rbx + 8]
jb 0x14006840a
xchg rdx, rdx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
mov dword [rsp - 0x3c], ecx
pop rdi
ret
Function at 0x140068d60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
xchg r8, r8
sub rsp, 0x28
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov rsp, rsp
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov qword [rsp + 0x50], r14
mov r14, qword [rcx + 8]
xchg r8, r8
mov rcx, qword [rdx + 8]
add rcx, r14
mov qword [rsp + 0x20], r15
mov r10, r10
mov qword [rbx + 8], rcx
lea r15, [rdx + 8]
cmp rcx, 4
mov dword [rsp - 0x24], 0x2624a22c
jbe 0x140068e7d
cmp r14, 4
jbe 0x140068dc0
xchg r10, r10
mov rdi, qword [rbx]
jmp 0x140068dc3
mov rdi, rbx
mov eax, 0x788668c0
sub eax, 0x6035bbb
add eax, 0x1dfe843
mov dword [rsp - 0x2c], 0x65584d81
sub eax, 0x44430d81
sub eax, 0xddb0f44
xor eax, 0x58238308
sub eax, 0x7a675b89
mov dword [rsp - 0x28], edi
mul rcx
pushf
movabs rcx, 0xffffffff7c07e13c
mov r9, r9
sub rcx, 0x7a66550
xor rcx, 0x589ec57c
sub rcx, 0x9efed7a
mov dword [rsp - 0x14], ebx
add rcx, 0x7fffffff
xor rcx, 0x5cf02eea
popf
mov dword [rsp - 0xc], esi
cmovo rax, rcx
mov rcx, rax
call fcn.140072200
mov rdx, rdx
mov rbp, rax
test r14, r14
je 0x140068e80
mov dword [rsp - 0x30], ecx
mov rdx, rax
sub rdi, rax
mov r8, r14
mov rbp, rbp
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdi + rdx]
mov r12, r12
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140068e64
mov r13, r13
jmp 0x140068e80
mov rbp, rbx
mov rax, qword [r15]
xor r8d, r8d
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0xc], 0x7bfa2dc1
cmp rax, 4
ja 0x140068ea7
test rax, rax
xchg rdi, rdi
je 0x140068f66
jmp 0x140068eaa
mov rsi, qword [rsi]
lea r9, [r14 + r14]
xchg rbx, rbx
sub r9, rsi
add r9, rbp
nop dword [rax + rax]
xchg r9, r9
lea ecx, [r14 + r8]
mov edx, 0x614a4fdc
add edx, 0x228b9b0
mov dword [rsp - 0x20], edi
xor edx, 0x139a23f9
sub edx, 0x706a4069
add edx, 0xa16c58d
add edx, 0x5905d2dc
mov dword [rsp - 0x34], ebx
sub edx, 0x127a2410
and cl, 3
lea rsi, [rsi + 2]
mov rdx, rdx
shl cl, 3
mov eax, 0x6cc761c8
sub eax, 0x2869f395
sub eax, 0x2f485063
mov r14, r14
add eax, 0x5a94e056
xor eax, 0x37890a1b
sub eax, 0x6ff95d8
mov dword [rsp - 0x34], 0x50859423
sar edx, cl
movzx ecx, r8b
and cl, 3
inc r8
mov rdi, rdi
shl cl, 3
sar eax, cl
xor dl, al
mov dword [rsp - 0x40], 0x48b1299b
movsx eax, dl
xor ax, word [rsi - 2]
mov word [r9 + rsi - 2], ax
cmp r8, qword [r15]
mov dword [rsp - 0xc], 0x3c1833ce
jb 0x140068ebf
mov r15, qword [rsp + 0x20]
cmp r14, 4
mov r14, qword [rsp + 0x50]
mov rdi, rdi
mov rsi, qword [rsp + 0x40]
jbe 0x140068f89
mov rcx, qword [rbx]
call fcn.140072210
mov rdi, rdi
cmp qword [rbx + 8], 4
mov rax, rbx
jbe 0x140068f99
mov qword [rbx], rbp
mov rsi, rsi
add rsp, 0x28
pop rbp
pop rbx
mov dword [rsp - 0x14], 0xd9ba650
ret