joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f470
Capabilities:
Encode data using xor

Disassembly:
push rbp
xchg rsp, rbp
mov rsp, rbp
xchg rbp, rsp
nop
sub rsp, 0x4f102bbe
add rsp, 0x4f102b9e
lea r10, [rbp - 0x1f]
mov dword [rsp - 0x3c], ebx
mov dword [rbp - 0x20], 0x312f02d9
add dword [rbp - 0x20], 0x13357aed
add dword [rbp - 0x20], 0x371c19ef
sub dword [rbp - 0x20], 0x47aac018
xor dword [rbp - 0x20], 0x1e0e9917
nop
movabs r9, 0xffffffff57efa87d
sub r9, 0x7539496
add r9, 0x1bfe84be
add r9, 0x7fffffff
add r9, 0x1365675a
mov dword [rbp - 0x1c], 0x3976d664
add dword [rbp - 0x1c], 0x6554226
add dword [rbp - 0x1c], 0x18ff9e63
sub dword [rbp - 0x1c], 0x410fcfce
sub dword [rbp - 0x1c], 0xa48f38a
sub r10, rcx
mov dword [rbp - 0x18], 0x3ae82e02
xor dword [rbp - 0x18], 0x2c127f4
sub dword [rbp - 0x18], 0x291a8fd
sub dword [rbp - 0x18], 0x3514a145
sub r9, rcx
mov dword [rbp - 0x14], 0x40494ab8
xor dword [rbp - 0x14], 0x37ef64bd
xor dword [rbp - 0x14], 0x234cc5b4
xor dword [rbp - 0x14], 0x5f838437
add dword [rbp - 0x14], 0x21d8dc14
lea r11, [rbp - 0x20]
mov dword [rbp - 0x10], 0x1883b302
xor dword [rbp - 0x10], 0x60a63fcc
xor dword [rbp - 0x10], 0x76b4bca9
add dword [rbp - 0x10], 0x10c57d78
sub r11, rcx
mov dword [rbp - 0xc], 0x7c90c11a
xor dword [rbp - 0xc], 0x50922764
add dword [rbp - 0xc], 0x4e9b64a2
sub dword [rbp - 0xc], 0x6526ee90
xor dword [rbp - 0xc], 0xd2807313
mov dword [rbp - 8], 0x4eb8887
add dword [rbp - 8], 0x22710285
sub dword [rbp - 8], 0x5044388
xor dword [rbp - 8], 0x56e90a3f
lea r8, [rcx + 2]
mov dword [rbp - 4], 0x6d1fb35d
add dword [rbp - 4], 0xe1b357e
xor dword [rbp - 4], 0x7b42682
sub dword [rbp - 4], 0x2a70cb26
xor dword [rbp - 4], 0x4bad71fb
nop dword [rax]
lea edx, [r9 + r8]
mov r11, r11
mov eax, 0x128fd4c4
add eax, 0xad34ca1
add eax, 0x2a1bc24f
xor eax, 0x16ae8001
mov ecx, edx
mov dword [rsp - 0x18], esi
lea r8, [r8 + 4]
rol eax, cl
lea ecx, [rdx + 1]
mov dword [rsp - 0x44], esp
xor al, byte [r11 + r8 - 6]
mov byte [r8 - 6], al
mov eax, 0x1367f9d0
xor eax, 0xea9fd7e
xor eax, 0xe6eb0bf
add eax, 0x3e2fafa4
rol eax, cl
mov dword [rsp - 0x20], ebp
lea ecx, [rdx + 2]
xor al, byte [r10 + r8 - 6]
mov byte [r8 - 5], al
mov eax, 0x445928ab
xor eax, 0x2d536cb2
sub eax, 0x17bb78b7
add eax, 0x819853
rol eax, cl
lea ecx, [rdx + 3]
xchg rdx, rdx
xor al, byte [r11 + r8 - 4]
mov byte [r8 - 4], al
mov eax, 0x5884eb85
add eax, 0x26accf4d
sub eax, 0x6ad2aa02
xor eax, 0x458f7365
rol eax, cl
xchg r13, r13
xor al, byte [r10 + r8 - 4]
mov byte [r8 - 3], al
lea rax, [r9 + r8]
cmp rax, 0x20
mov dword [rsp - 0x24], edi
jb 0x14000f5d0
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140012cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg rbp, r13
mov qword [rsp + 0x18], rsi
push rdi
mov r14, r14
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
nop
sub rsp, 0x25a2ff93
add rsp, 0x25a2ff63
mov rax, qword [0x1404a82a0]
mov r10, r10
xchg rdi, r12
mov r12, rcx
xchg r12, rdi
mov rbx, rdx
xchg r12, r12
movabs rcx, 0x4bbfcff92d61c2b5
add rcx, 0x2911251e
xor rcx, 0x452122fa
add rcx, 0x6e96af1
sub rcx, 0x130058bf
xor rax, rcx
mov dword [rsp - 0x18], 0x2e5f3400
add byte [rdi + rbx*2], dh
movabs r13, 0xc30759fc7048549a
Function at 0x14001942e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
xchg rsp, rsp
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xchg r11, r11
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
xchg rbp, r14
mov qword [rsp + 0x78], r14
xchg r14, rbp
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
lea rcx, [rsp + 0x20]
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
xchg rsi, rax
movups xmmword [rsi + 0x30], xmm0
xchg rsi, rax
xchg rsp, rax
movups xmmword [rsp + 0x40], xmm0
xchg rsp, rax
xchg rbx, rax
movups xmmword [rbx + 0x50], xmm0
xchg rbx, rax
movups xmmword [rax + 0x60], xmm0
xchg r14, rax
movups xmmword [r14 + 0x70], xmm0
xchg r14, rax
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x24], 0x3733e542
xchg rbx, r9
mov r9, qword [rdx]
xchg r9, rbx
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
xchg r10, rsp
movups xmmword [r10 + 0x28], xmm0
xchg r10, rsp
lea rdx, [rbp + 1]
xchg rbx, rbx
xchg rsp, r12
movups xmmword [r12 + 0x38], xmm0
xchg r12, rsp
xchg rsp, r9
movups xmmword [r9 + 0x48], xmm0
xchg rsp, r9
call fcn.14000ef00
mov edx, 0x465795e7
add edx, 0x38b75853
xor edx, 0x3f525b5d
add edx, 0xa55dfe1
add edx, 0x20dac9ec
test rbp, rbp
je 0x14001958c
xchg rbp, rbp
mov rdi, rax
sub rbx, rax
xchg r12, r9
mov r12, rbp
xchg r9, r12
mov r8d, 0x686d6f17
sub r8d, 0x19530c05
add r8d, 0xfe07431
xor r8d, 0x432dece6
sub r8d, 0x1dd73aa6
nop word [rax + rax]
mov dword [rsp - 0x40], esp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
mov dword [rsp - 0x34], 0xdf0d2bd
ror edx, 5
ror edx, 2
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov dword [rsp - 0x20], 0x5870ae6a
mov word [rdi - 2], cx
sub r9, 1
jne 0x140019556
xor ecx, ecx
mov rbx, rbx
xchg rbp, r8
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
xchg rsi, rdi
mov rcx, rdi
xchg rsi, rdi
mov rdx, qword [rsp + 0x20]
xchg r12, r12
call fcn.140073940
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x3c], 0x36ba6210
xchg rbp, rbx
mov rbx, qword [rsp + 0x78]
xchg rbp, rbx
mov rbx, qword [rsp + 0x70]
xchg r13, r13
cmp rcx, rax
jne 0x140019639
xor eax, eax
mov dword [rsp - 0x14], esi
lea rdi, [rsp + 0x28]
mov ecx, 0x6ccec4b
xor ecx, 0x7d3380f9
sub ecx, 0x49e39ee9
add ecx, 0x40096e94
sub ecx, 0x72253c2d
rep stosb byte [rdi], al
mov rax, rsi
mov rdx, rdx
xchg r9, rsi
mov r9, qword [rsp + 0x80]
xchg rsi, r9
nop
sub rsp, 0x14f58a21
add rsp, 0x14f58a81
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400996a0
xchg rsi, r10
mov rax, r10
xchg rsi, r10
xchg rsi, r10
mov r10, qword [rsp + 0x80]
xchg r10, rsi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140030ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
sub rsp, 0x3e404b7e
add rsp, 0x3e404b4e
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov r14, rdx
mov qword [rcx], rax
mov rdi, rcx
mov dword [rcx + 8], 0x44adf555
sub dword [rcx + 8], 0x320bb1d1
xor dword [rcx + 8], 0x777efcdb
sub dword [rcx + 8], 0x65dcbf5e
lea rax, [rsi + 8]
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ef00
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140030d4e
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140030d34
mov ecx, dword [rbx + 0x40]
mov esi, 0x63cc6caa
sub esi, 0x53e66756
add esi, 0x5c9e5e22
sub esi, 0x6c836377
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x25c9a069
add edx, 0x509cef5
sub edx, 0x10e03fc9
xor edx, 0x19f32f85
mov eax, dword [rbx + 0x54]
xor eax, 0x39877b80
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x39877b80
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x39877b80
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x39877b80
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x7c603c8f
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x39877b80
mov word [rdi + 0x310], bp
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0xd86b370
sub eax, 0x8d4ce98
add eax, 0x71aef73
xor eax, 0xbccd4b4
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.1400995b0
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a9590]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140030e2f
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rdx + rax - 0x10]
xor ecx, 0x7c603c8f
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rdx + rax - 0xc]
xor ecx, 0x7c603c8f
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rdx + rax - 8]
xor ecx, 0x7c603c8f
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rdx + rax - 4]
xor ecx, 0x7c603c8f
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a9590]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140030e53
lea rcx, [r14 + 0xa8]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.1400122f0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140032ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
add rsp, 0xffffffffffffffc0
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x39877b80
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x39877b80
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x7c603c8f
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.140053a20
test ax, ax
je 0x1400330ae
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404a9590]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.140053a20
test ax, ax
jne 0x140033064
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
sub rsp, 0xffffffffffffffc0
pop r14
pop rdi
pop rsi
ret

Function at 0x1400330d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x39877b80
xor r9d, 0x39877b80
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x7c603c8f
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x14003315d
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a9590]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x140033124
mov eax, r8d
ret

Function at 0x140033170
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x39877b80
xor r9d, 0x39877b80
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x7c603c8f
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x14003320b
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a9590]
movzx eax, ax
nop
sub rdx, 0x2dec9130
add rdx, 0x2dec9132
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x1400331c5
mov eax, r8d
ret
Function at 0x14003323b
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
add rsp, 0xffffffffffffff50
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x14003335b
mov edx, dword [rcx + 0x2ec]
mov qword [rax + 0x10], rsi
xor edx, 0x39877b80
mov eax, dword [rcx + 0x2e8]
nop
movabs rcx, 0xffffffff6f42a7b2
sub rcx, 0x2ca9cc4a
add rcx, 0x7fffffff
add rcx, 0x3d672498
xor eax, 0x39877b80
imul edx, eax
mov eax, 0x55714649
xor eax, 0x14bda699
sub eax, 0x2700ff40
xor eax, 0x1acbe194
movsxd rsi, edx
mul rsi
cmovb rax, rcx
mov rcx, rax
call fcn.140099540
mov qword [rsp + 0xc0], rax
test rsi, rsi
jle 0x1400332d3
nop
mov rax, qword [rdi + 0x2f8]
mov ecx, dword [rax + rbx*4]
mov rax, qword [rsp + 0xc0]
xor ecx, 0x797b4946
mov dword [rax + rbx*4], ecx
inc rbx
cmp rbx, rsi
jl 0x1400332ac
mov rsi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xc0]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rax
lea rax, [0x140001bb0]
mov qword [rsp + 0x20], rdi
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0xa8], 0x331142ff
sub qword [rsp + 0xa8], 0x26a1b0d5
add qword [rsp + 0xa8], 0x4b3f5681
sub qword [rsp + 0xa8], 0x57aee893
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x38], xmm0
call fcn.140032260
mov rbx, qword [rsp + 0xd0]
neg rsp
add rsp, 0xffffffffffffff50
neg rsp
pop rdi
ret
lea rdx, [rsp + 0xc0]
call fcn.140033390
test al, al
jne 0x1400332db
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
ret
Function at 0x140036baa
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov qword [rsp + 0x40], rsi
mov rsi, rcx
mov rcx, qword [0x1404a8bd8]
call fcn.14002e860
mov rbx, rax
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x48]
lock inc dword [rbx + 0x10]
je 0x140036bf5
cmp rdi, qword [rbx]
je 0x140036cc0
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
call fcn.140054260
mov qword [rbx], rdi
mov dword [rbx + 0x14], 0x7cca6b80
sub dword [rbx + 0x14], 0x68e20ec9
sub dword [rbx + 0x14], 0x13e85cb6
cmp byte [rsi + 0x21], 0
mov qword [rsp + 0x38], rbp
jne 0x140036cc8
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x140036c70
mov ebp, dword [rax + 0x2a0]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi + 0x18]
xor ebp, 0x39877b80
mov edi, dword [rax + 0x29c]
call fcn.140038340
xor edi, 0x39877b80
cmp edi, dword [rax]
jne 0x140036c60
cmp ebp, dword [rax + 4]
je 0x140036c70
mov rcx, rsi
call fcn.140036d80
test al, al
je 0x140036cc8
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140036cc8
cmp byte [rcx + 0x2a5], 0
je 0x140036cc8
mov rax, qword [rcx]
call qword [rax + 0x60]
test al, al
je 0x140036cc8
mov rcx, qword [0x1404a8bd8]
call fcn.14002e860
mov rcx, rax
call fcn.1400372e0
mov dil, 0x24
xor dil, 8
xor dil, 6
sub dil, 0x29
jmp 0x140036ccb
inc dword [rbx + 0x14]
jmp 0x140036c0d
xor dil, dil
sub dword [rbx + 0x14], 1
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
jne 0x140036d36
mov qword [rbx], 0x8c5732
add qword [rbx], 0x281bede3
add qword [rbx], 0x5271f974
sub qword [rbx], 0x7b1a3e89
mov ecx, 0x142be10f
add ecx, 0x19d274d5
add ecx, 0xd201aa1b
lock xadd dword [rbx + 0x10], ecx
dec ecx
cmp ecx, 0xffffffff
je 0x140036d3a
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.140054220
movzx eax, dil
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lock dec dword [rbx + 0x10]
mov rbx, qword [rsp + 0x48]
movzx eax, dil
nop
add rsp, 0x4b670ee4
sub rsp, 0x4b670ec4
pop rdi
ret
Function at 0x14003eeb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x3c468b81
add rsp, 0x3c468b21
mov rbp, qword [rcx + 0xaf8]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xac0]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14000ef00
mov edi, 0x438f7c65
add edi, 0x230760aa
xor edi, 0xd1b823b
mov r9, rax
mov ecx, edi
mov r15d, 0x10aeeb65
add r15d, 0x33f83915
sub r15d, 0x44a7237b
test rbp, rbp
je 0x14003ef7a
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rdx + rbx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14003ef59
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb48], bx
je 0x14003efca
mov r8d, ebx
cmp qword [rsi + 0xaf8], rbx
jbe 0x14003efca
mov edx, ebx
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
lea rdx, [rdx + 2]
movzx ecx, word [rsi + 0xb48]
inc r8
mov word [rdx + rax - 2], cx
cmp r8, qword [rsi + 0xaf8]
jb 0x14003efa5
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff3bc6f2ce
sub rdx, 0x3714edd4
add rdx, 0x74a75a54
add rdx, 0x7fffffff
xor rdx, 0x6a6a0b2
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14003f00b
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14000ef00
cmp qword [r14 + 0x38], rbx
jbe 0x14003f055
sub rsi, rax
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rax + rsi - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x14003f031
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14003f08d
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x4d2a2b69
sub ecx, 0xfbf719c
xor ecx, 0x491abc28
xor ecx, 0x747005d5
rep stosb byte [rdi], al
jmp 0x14003f092
call fcn.1400996a0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140047ada
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
add rsp, 0xffffffffffffffe0
mov r8, qword [rcx + 0x650]
xor edi, edi
mov r9, rdx
mov rbx, rcx
test r8, r8
je 0x1400479fe
mov rax, qword [rcx + 0x648]
jmp 0x140047a07
mov rax, rdi
nop word [rax + rax]
test r8, r8
je 0x140047a20
mov rcx, qword [rbx + 0x648]
lea rdx, [rcx + r8*8]
jmp 0x140047a23
mov rdx, rdi
cmp rax, rdx
je 0x140047c62
mov rcx, qword [rax]
cmp qword [rcx + 0x30], r9
je 0x140047a42
add rax, 8
jmp 0x140047a07
mov qword [rsp + 0x38], rsi
mov rsi, rax
test r8, r8
je 0x140047b14
cmp rax, qword [rbx + 0x648]
jb 0x140047b14
mov rcx, qword [rbx + 0x648]
lea rdx, [rcx + r8*8]
cmp rax, rdx
jae 0x140047b14
nop dword [rax + rax]
mov rdx, qword [rbx + 0x650]
test rdx, rdx
je 0x140047a99
mov rcx, qword [rbx + 0x648]
lea rcx, [rcx + rdx*8]
jmp 0x140047a9c
mov rcx, rdi
nop
sub rcx, 0xffffffff92a07a41
add rcx, 0xffffffff92a07a39
cmp rax, rcx
jae 0x140047acd
mov rcx, qword [rax + 8]
mov qword [rax], rcx
nop
add rax, 0x3f0d970d
sub rax, 0x3f0d9705
jmp 0x140047a79
test rdx, rdx
je 0x140047b14
lea rax, [rdx - 1]
mov qword [rbx + 0x650], rax
test rax, rax
jne 0x140047b14
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140047b06
call fcn.1400996a0
mov qword [rbx + 0x648], rdi
mov qword [rbx + 0x658], rdi
mov qword [rbx + 0x650], rdi
mov rcx, qword [rsi]
mov rsi, qword [rsp + 0x38]
test rcx, rcx
je 0x140047b3b
mov rax, qword [rcx]
mov edx, 0x3c55e674
add edx, 0x16131ec0
sub edx, 0x52690533
call qword [rax]
cmp qword [rbx + 0x650], rdi
je 0x140047c62
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140038340
mov rcx, qword [rsp + 0x30]
mov r10d, 0x44273b20
sub r10d, 0x34256bd8
add r10d, 0xc659f38
sub r10d, 0x1c676de0
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x650]
sub eax, r8d
cdq
idiv dword [rbx + 0x650]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140047c1a
mov rdx, qword [rbx + 0x648]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140047c1a
mov r9d, r10d
xor r9d, 0x39877b80
xor r8d, 0x39877b80
nop
mov rcx, qword [rdx]
mov eax, edi
xor eax, 0x39877b80
add edi, r10d
nop
add rdx, 0x42d553fc
sub rdx, 0x42d553f4
mov dword [rcx + 0x38], eax
mov dword [rcx + 0x3c], 0x2d276b9f
add dword [rcx + 0x3c], 0x46509cc1
xor dword [rcx + 0x3c], 0x73598414
xor dword [rcx + 0x3c], 0x39a6f7f4
mov dword [rcx + 0x40], r9d
mov dword [rcx + 0x44], r8d
cmp rdx, r11
jne 0x140047bc4
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x668]
test rax, rax
je 0x140047c5a
sub ecx, r8d
mov dword [rax + 0x1c], 0x7aeb5c05
xor dword [rax + 0x1c], 0x1caa854e
sub dword [rax + 0x1c], 0x2cba5dcb
xor ecx, 0x39877b80
xor r8d, 0x39877b80
mov dword [rax + 0x18], ecx
mov dword [rax + 0x20], r8d
mov dword [rax + 0x24], r8d
mov rcx, rbx
call fcn.140037370
mov rbx, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
pop rdi
ret
Function at 0x140047d29
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
nop
sub rsp, 0x27ce7b21
add rsp, 0x27ce7b01
mov rax, qword [rcx]
mov rdi, rcx
call qword [rax + 0x78]
mov rdx, qword [rdi + 0x650]
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x30], rax
call fcn.140037c40
mov rcx, rdi
call fcn.1400372d0
mov rcx, qword [0x1404a8bd8]
mov rdx, qword [rax + 0x98]
call fcn.14002e880
mov rcx, rax
call fcn.14003b210
lea rcx, [rdi + 0x648]
mov qword [rbx + 0x20], rax
lea rdx, [rsp + 0x30]
call fcn.14002c150
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
nop
add rsp, 0x737af31a
sub rsp, 0x737af2fa
pop rdi
jmp 0x140047c70
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
cmp qword [rcx + 0x650], 0
mov rbx, rcx
je 0x140047daf
lea rdx, [rsp + 0x30]
call fcn.140038340
mov r8, qword [rsp + 0x30]
mov r11d, 0x3febff06
add r11d, 0xf311c04
xor r11d, 0x45bb0d70
sub r11d, 0xaa615da
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x650]
mov rdx, qword [rbx + 0x650]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140047d65
mov rax, qword [rbx + 0x648]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140047d60
mov r8d, r11d
xor r8d, 0x39877b80
xor r9d, 0x39877b80
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x39877b80
add r10d, r11d
sub rax, 0xfffffffffffffff8
mov dword [rdx + 0x38], ecx
mov dword [rdx + 0x3c], 0x7ea9d8e2
sub dword [rdx + 0x3c], 0xd36ef45
sub dword [rdx + 0x3c], 0x613db5c6
xor dword [rdx + 0x3c], 0x29b24857
mov dword [rdx + 0x40], r8d
mov dword [rdx + 0x44], r9d
cmp rax, rdi
jne 0x140047d13
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x668]
test rax, rax
je 0x140047da7
sub r8d, r9d
mov dword [rax + 0x1c], 0x4e577df
xor dword [rax + 0x1c], 0x590a4c56
sub dword [rax + 0x1c], 0x2467c009
xor r8d, 0x39877b80
xor r9d, 0x39877b80
mov dword [rax + 0x18], r8d
mov dword [rax + 0x20], r9d
mov dword [rax + 0x24], r9d
mov rcx, rbx
call fcn.140037370
sub rsp, 0xffffffffffffffe0
pop rbx
ret
Function at 0x140052120
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov dword [rsp - 0x28], esp
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
nop
movabs rdx, 0xffffffff60fa5790
add rdx, 0x11bff50f
sub rdx, 0x311ea641
add rdx, 0x7fffffff
xor rdx, 0x3e6459a2
nop word [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
mov dword [rsp - 0x18], esi
jne 0x140052170
mov qword [rcx + 0x38], rdx
call fcn.14000ef00
xor r8d, r8d
mov dword [rsp - 0x44], 0x16826adc
mov edx, 0x6554b0db
sub edx, 0x2827249d
sub edx, 0xc9f6e9d
add edx, 0x455f2d8
add edx, 0x36a94ebb
cmp qword [rdi + 0x38], r8
mov dword [rsp - 0x28], 0x49cdd9f4
jbe 0x140052229
sub rbx, rax
mov r9d, 0x6f0c442e
sub r9d, 0x5651f940
xor r9d, 0x6e64b6d9
xor r9d, 0x5f2d580
sub r9d, 0x732c28b8
nop word [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
mov dword [rsp - 0x24], 0x4d2dc071
and cx, r9w
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rax + rbx - 2]
inc r8
mov word [rax - 2], cx
mov dword [rsp - 0x24], 0x784aeb17
cmp r8, qword [rdi + 0x38]
jb 0x1400521f0
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
xchg r11, rax
mov r11, rdi
xchg r11, rax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret