joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402330c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r12d, r9d
mov r8d, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r13, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov ecx, r8d
mov dword [rsp + 0x78], r8d
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, rax
imul r14, rax
cmp eax, r8d
je 0x140233128
cmp byte [r13 + 0x12], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x14023324e
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x140233230
mov rax, rdi
movsxd rbp, r8d
mov qword [rsp + 0x20], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x140417154]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x140233225
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.140223920
mov ebx, eax
test eax, eax
jne 0x140233211
mov rcx, qword [rsp + 0x20]
call fcn.140224100
mov ebx, eax
test eax, eax
jne 0x140233211
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1402b7460
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x140233211
test r12d, r12d
jne 0x140233211
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140233220
call fcn.140223c90
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x140233143
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140248b50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r14
sub rsp, 0x30
mov r12d, r8d
mov r14, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140248b74
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov edx, 0x10
mov qword [rsp + 0x58], rsi
call fcn.140215e40
mov rsi, rax
test rax, rax
jne 0x140248b9a
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov dword [rax + 4], r15d
mov eax, dword [r14]
mov dword [rsi], eax
test r12b, 1
jne 0x140248bc6
mov ecx, dword [r14]
mov eax, 1
cmp ecx, eax
jle 0x140248bc6
nop dword [rax]
add eax, eax
cmp eax, ecx
jl 0x140248bc0
lea edx, [rax + rax*4]
mov rcx, rbp
shl edx, 3
call fcn.140215e40
mov qword [rsi + 8], rax
test rax, rax
jne 0x140248bef
mov rdx, rsi
mov rcx, rbp
call fcn.140215b70
xor eax, eax
jmp 0x140248c95
mov qword [rsp + 0x50], rbx
mov rbx, qword [r14 + 8]
cmp dword [r14], r15d
jle 0x140248c8d
mov qword [rsp + 0x60], rdi
lea rdi, [rax + 0x1c]
sub rax, rbx
mov qword [rsp + 0x28], r13
lea r13, [rax - 0x10]
nop word [rax + rax]
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, r12d
mov rcx, rbp
call fcn.1402487d0
mov rcx, rbp
mov qword [r13 + rbx + 0x10], rax
mov rdx, qword [rbx + 8]
call fcn.140215fb0
mov rcx, rbp
mov qword [rdi - 0x14], rax
mov rdx, qword [rbx + 0x10]
call fcn.140215fb0
inc r15d
lea rdi, [rdi + 0x28]
mov qword [rdi - 0x34], rax
movzx eax, byte [rbx + 0x18]
and dword [rdi - 0x28], 0xfffffffe
mov byte [rdi - 0x2c], al
mov ecx, dword [rbx + 0x1c]
lea rbx, [rbx + 0x28]
xor ecx, dword [rdi - 0x28]
and ecx, 2
xor dword [rdi - 0x28], ecx
mov eax, dword [rbx - 8]
mov dword [rdi - 0x24], eax
cmp r15d, dword [r14]
jl 0x140248c20
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
Function at 0x14024ab80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
mov ebx, r9d
mov esi, r8d
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
lea rax, [rcx + 0x88]
nop
cmp dword [rax + 0xc], 0
jle 0x14024abc3
cmp dword [rax], ebx
jne 0x14024abc3
movsx edx, word [rax + 4]
cmp edx, r8d
je 0x14024ac11
inc r10d
add rax, 0x14
cmp r10d, 0xa
jl 0x14024abb0
mov r9d, r8d
mov qword [rsp + 0x40], rbp
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.14024aaa0
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x14024ac2a
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14024ac3a
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x14024ac3a
mov ecx, dword [rcx + 0x78]
mov dword [rax + 0x10], ecx
inc dword [rdi + 0x78]
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.14024aa00
mov eax, dword [rax + 0xc]
jmp 0x14024ac41
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.14024a7d0
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14024d010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14024d199
test rdx, rdx
je 0x14024d199
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x14024d084
and r9d, r11d
bt r9d, 0xa
jae 0x14024d18f
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x14024d18f
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x14024d0cc
cmp r8b, 0x5f
jne 0x14024d0a4
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.14024d010
cmp eax, 2
jl 0x14024d0c5
cmp byte [rbx], 0x5f
jne 0x14024d18f
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.14024d010
cmp eax, 2
jge 0x14024d18f
mov eax, 1
jmp 0x14024d06f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x14024d10c
mov rax, qword [rcx + 8]
test rax, rax
je 0x14024d10c
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x14024d0f7
inc rax
test ecx, ecx
jne 0x14024d0e4
test edx, edx
je 0x14024d10c
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x14024d06f
xor r9d, r11d
test r9b, 0x10
jne 0x14024d18f
bt esi, 0xe
jb 0x14024d06d
bt esi, 0xb
jb 0x14024d18f
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.14024d010
test eax, eax
jne 0x14024d18f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.14024d010
test eax, eax
jne 0x14024d18f
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.14024d1c0
test eax, eax
jne 0x14024d18f
bt esi, 0xd
jb 0x14024d06d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x14024d18f
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x14024d06d
cmp ecx, ebp
jne 0x14024d18f
test eax, eax
js 0x14024d06d
mov eax, 2
jmp 0x14024d06f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor ecx, ecx
cmp rdx, rdi
mov eax, 2
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140251f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rsi, r8
mov rbp, rdx
mov r15, rcx
mov rdi, rdx
test rdx, rdx
jne 0x140251f81
mov edi, r10d
jmp 0x140251f96
cmp byte [rdx], r10b
je 0x140251f8e
inc rdi
cmp byte [rdi], r10b
jne 0x140251f86
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r10d
test r14d, r14d
jle 0x140252068
mov qword [rsp + 0x40], r12
lea r12, [0x14032a100]
mov r9d, ebx
cmp ebx, 2
jge 0x140251fbe
xor r9d, 1
test rsi, rsi
je 0x140252015
mov rcx, qword [r15 + 0x20]
movsxd rdx, r9d
mov rax, rsi
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [rsi]
test dl, dl
je 0x140252000
nop dword [rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x140252000
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140251fe0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14025203c
mov rax, qword [r15 + 0x20]
movsxd rcx, r9d
mov r8d, edi
shl rcx, 5
mov rdx, rbp
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140219b90
mov r10, rax
test rax, rax
jne 0x14025204a
inc ebx
cmp ebx, r14d
jl 0x140251fb2
mov rax, r10
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, r10
jmp 0x14025204f

Function at 0x1402521c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r9d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rdx
test rdx, rdx
jne 0x1402521e8
mov edi, r9d
jmp 0x140252200
cmp byte [rdx], r9b
je 0x1402521f8
nop dword [rax]
inc rdi
cmp byte [rdi], r9b
jne 0x1402521f0
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r9d
test r14d, r14d
jle 0x1402522c3
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r15
mov r15, qword [rcx + 0x20]
lea r12, [0x14032a100]
mov eax, ebx
cmp ebx, 2
jge 0x14025222f
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r15 + 0x18]
test rsi, rsi
je 0x140252285
movzx edx, byte [rsi]
mov r8, qword [r8 + r15]
mov rax, rsi
test dl, dl
je 0x140252270
nop
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x140252270
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140252250
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14025229c
lea rcx, [r10 + 0x20]
mov r8d, edi
mov rdx, rbp
call fcn.140219b90
mov r9, rax
test rax, rax
jne 0x1402522a6
inc ebx
cmp ebx, r14d
jl 0x140252225
mov rax, r9
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x1402522b0
Function at 0x14025b070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rdx + 0x18]
mov r14, qword [rcx + 0x10]
mov r12d, r9d
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x88], rax
test rdi, rdi
je 0x14025b0e9
cmp qword [rdx + 0x48], 0
je 0x14025b0e3
mov rcx, r14
call fcn.140235840
mov r9d, 8
mov rcx, rbx
mov dword [rdi], eax
mov dword [rbx + 0x70], esi
mov r8d, dword [rdi]
mov rdx, qword [rbp + 0x48]
call fcn.14024cbb0
jmp 0x14025b0e9
mov dword [rdi], 0
cmp dword [rsp + 0xa0], 0
je 0x14025b100
test byte [rbp + 0x64], 8
je 0x14025b100
movzx r13d, word [rbp + 0x5e]
jmp 0x14025b105
movzx r13d, word [rbp + 0x60]
mov ecx, dword [rbx + 0x48]
mov esi, dword [rbx + 0x4c]
mov dword [rsp + 0xa0], esi
cmp r13d, ecx
jg 0x14025b126
lea eax, [rsi + r13]
sub ecx, r13d
mov dword [rbx + 0x4c], eax
mov dword [rbx + 0x48], ecx
jmp 0x14025b139
mov eax, dword [rbx + 0x58]
lea esi, [rax + 1]
add eax, r13d
mov dword [rsp + 0xa0], esi
mov dword [rbx + 0x58], eax
mov r15, qword [rsp + 0xb0]
test r15, r15
je 0x14025b159
cmp esi, dword [rsp + 0xb8]
jne 0x14025b156
cmp qword [r15 + 0x48], 0
je 0x14025b159
xor r15d, r15d
xor edi, edi
movsxd rax, r13d
test r13d, r13d
jle 0x14025b1ff
mov ebx, dword [rsp + 0x90]
mov r12d, esi
mov rsi, qword [rsp + 0x88]
nop dword [rax]
test r15, r15
je 0x14025b197
mov rax, qword [rbp + 8]
mov rdx, qword [r15 + 8]
movzx ecx, word [rax + rdi*2]
cmp word [rdx + rdi*2], cx
je 0x14025b1da
mov rax, qword [rbp + 8]
mov r8d, ebx
mov rdx, rsi
movsx r9d, word [rax + rdi*2]
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.14024aaa0
movsxd rcx, dword [r14 + 0x3c]
mov rax, qword [r14 + 0x30]
lea edx, [rcx - 1]
cmp edx, dword [rax + 0x68]
jle 0x14025b1da
mov rax, qword [r14 + 8]
lea rcx, [rcx + rcx*2]
cmp byte [rax + rcx*8 - 0x18], 0x27
jne 0x14025b1da
mov rcx, r14
call fcn.140235d70
inc rdi
movsxd rax, r13d
inc r12d
cmp rdi, rax
jl 0x14025b180
mov rbx, qword [rsp + 0x80]
mov esi, dword [rsp + 0xa0]
mov r12d, dword [rsp + 0x98]
test r12d, r12d
je 0x14025b21c
mov r9d, r13d
mov r8d, esi
mov edx, 0x30
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.1402355c0
lea r9d, [r13 - 1]
lea rcx, [rbx + 0x94]
mov r8d, 0xa
add r9d, esi
xor r10d, r10d
mov edx, dword [rcx]
cmp edx, esi
jl 0x14025b25d
cmp edx, r9d
jg 0x14025b25d
cmp byte [rcx - 6], r10b
je 0x14025b25a
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14025b256
movzx eax, al
mov dword [rbx + rax*4 + 0x28], edx
inc byte [rbx + 0x1f]
mov byte [rcx - 6], r10b
mov dword [rcx], r10d
add rcx, 0x14
dec r8
jne 0x14025b233
mov eax, esi
cmp r13d, dword [rbx + 0x48]
jle 0x14025b275
mov dword [rbx + 0x48], r13d
mov dword [rbx + 0x4c], esi
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140260050
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x14026006f
cmp byte [rdx], 0
je 0x140260068
inc rax
cmp byte [rax], 0
jne 0x140260060
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x70]
mov r8d, eax
add rcx, 0x50
jmp fcn.140219b90
Function at 0x140292040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, r8d
mov rbx, r9
mov rbp, rdx
sar esi, 4
test r8b, 0xf
je 0x140292076
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea rdx, [0x140428fcc]
mov rax, rcx
mov qword [rsp + 0x30], rdi
sub rax, rdx
mov qword [rsp + 0x38], r14
test al, 3
jne 0x1402920ec
mov rax, rbx
sub rax, rdx
test al, 3
jne 0x1402920ec
test esi, esi
je 0x140292190
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 8]
nop dword [rax]
mov eax, dword [rdi - 8]
mov r8, r14
mov rdx, rbx
xor dword [rbx], eax
mov eax, dword [rdi - 4]
mov rcx, rbx
xor dword [rbx + 4], eax
mov eax, dword [rdi]
xor dword [rbx + 8], eax
mov eax, dword [rdi + 4]
xor dword [rbx + 0xc], eax
call section..text
lea rbp, [rbp + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x10], xmm0
lea rdi, [rdi + 0x10]
dec esi
jne 0x1402920b0
jmp 0x140292190
test esi, esi
je 0x140292190
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 2]
sub rbp, rcx
movzx eax, byte [rdi - 2]
mov r8, r14
mov rdx, rbx
xor byte [rbx], al
movzx eax, byte [rdi - 1]
mov rcx, rbx
xor byte [rbx + 1], al
movzx eax, byte [rdi]
xor byte [rbx + 2], al
movzx eax, byte [rdi + 1]
xor byte [rbx + 3], al
movzx eax, byte [rdi + 2]
xor byte [rbx + 4], al
movzx eax, byte [rdi + 3]
xor byte [rbx + 5], al
movzx eax, byte [rdi + 4]
xor byte [rbx + 6], al
movzx eax, byte [rdi + 5]
xor byte [rbx + 7], al
movzx eax, byte [rdi + 6]
xor byte [rbx + 8], al
movzx eax, byte [rdi + 7]
xor byte [rbx + 9], al
movzx eax, byte [rdi + 8]
xor byte [rbx + 0xa], al
movzx eax, byte [rdi + 9]
xor byte [rbx + 0xb], al
movzx eax, byte [rdi + 0xa]
xor byte [rbx + 0xc], al
movzx eax, byte [rdi + 0xb]
xor byte [rbx + 0xd], al
movzx eax, byte [rdi + 0xc]
xor byte [rbx + 0xe], al
movzx eax, byte [rdi + 0xd]
xor byte [rbx + 0xf], al
call section..text
lea rdi, [rdi + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rdi + rbp - 0x12], xmm0
dec esi
jne 0x140292100
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1402921b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov r14d, r8d
mov rsi, r9
mov rbp, rcx
sar r14d, 4
test r8b, 0xf
je 0x1402921da
mov eax, 1
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x50], rbx
lea rcx, [0x140428fcc]
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
test al, 3
jne 0x140292268
mov rax, r9
sub rax, rcx
test al, 3
jne 0x140292268
test r14d, r14d
je 0x14029231e
mov r15, qword [rsp + 0x70]
lea rbx, [rdx + 8]
nop word [rax + rax]
movups xmm0, xmmword [rbp]
lea rdx, [rbx - 8]
mov r8, r15
mov rcx, rbp
movups xmmword [rsp + 0x20], xmm0
call fcn.140001a00
mov eax, dword [rsi]
xor dword [rbx - 8], eax
mov eax, dword [rsi + 4]
movups xmm0, xmmword [rsp + 0x20]
xor dword [rbx - 4], eax
mov eax, dword [rsi + 8]
add rbp, 0x10
xor dword [rbx], eax
mov eax, dword [rsi + 0xc]
lea rbx, [rbx + 0x10]
xor dword [rbx - 0xc], eax
movups xmmword [rsi], xmm0
dec r14d
jne 0x140292220
jmp 0x14029231e
test r14d, r14d
je 0x14029231e
mov r15, qword [rsp + 0x70]
sub rbp, rdx
lea rdi, [rdx + 2]
add rbp, 0xfffffffffffffffe
movups xmm0, xmmword [rdi + rbp]
lea rcx, [rdi + rbp]
lea rdx, [rdi - 2]
mov r8, r15
movups xmmword [rsp + 0x20], xmm0
call fcn.140001a00
movzx eax, byte [rsi]
movups xmm0, xmmword [rsp + 0x20]
xor byte [rdi - 2], al
movzx eax, byte [rsi + 1]
lea rdi, [rdi + 0x10]
xor byte [rdi - 0x11], al
movzx eax, byte [rsi + 2]
xor byte [rdi - 0x10], al
movzx eax, byte [rsi + 3]
xor byte [rdi - 0xf], al
movzx eax, byte [rsi + 4]
xor byte [rdi - 0xe], al
movzx eax, byte [rsi + 5]
xor byte [rdi - 0xd], al
movzx eax, byte [rsi + 6]
xor byte [rdi - 0xc], al
movzx eax, byte [rsi + 7]
xor byte [rdi - 0xb], al
movzx eax, byte [rsi + 8]
xor byte [rdi - 0xa], al
movzx eax, byte [rsi + 9]
xor byte [rdi - 9], al
movzx eax, byte [rsi + 0xa]
xor byte [rdi - 8], al
movzx eax, byte [rsi + 0xb]
xor byte [rdi - 7], al
movzx eax, byte [rsi + 0xc]
xor byte [rdi - 6], al
movzx eax, byte [rsi + 0xd]
xor byte [rdi - 5], al
movzx eax, byte [rsi + 0xe]
xor byte [rdi - 4], al
movzx eax, byte [rsi + 0xf]
xor byte [rdi - 3], al
movups xmmword [rsi], xmm0
dec r14d
jne 0x140292281
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x1402a3db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
add edx, edx
shr ecx, 7
shr rax, 8
movzx r10d, word [rbx + rax*2]
and ecx, 1
neg ecx
shr r10, 4
sar rcx, 4
and ecx, 0x7f
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x1402a3dc0
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x1402a3e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, 0x100
xor ebx, ebx
mov r11d, r8d
or edx, r10d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
mov ecx, edx
shr ecx, 7
shr r8d, 8
mov eax, r10d
and ecx, 1
and eax, r11d
add edx, edx
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
movzx r8d, word [rdi + r8*2]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
mov ecx, edx
add ebx, dword [r9 + r8*4]
xor ecx, r11d
not ecx
and r10d, ecx
cmp edx, 0x10000
jb 0x1402a3e20
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402a4180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
movzx r10d, word [rcx]
mov ebp, r8d
movzx r8d, word [rcx + 2]
mov eax, r10d
xor r10, 0x7f0
shr rax, 4
shr r10, 4
mov r13, r9
mov r14d, dword [r11 + rax*4]
mov eax, r8d
xor r8, 0x7f0
shr rax, 4
shr r8, 4
mov r15d, edx
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
mov rbx, rcx
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov rsi, r13
nop dword [rax + rax]
cmp r9d, ebp
jae 0x1402a4361
mov r8d, r9d
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402a4252
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 4]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402a4221
lea eax, [r10 + r14]
inc r9d
add rsi, 4
mov dword [rsi - 4], eax
cmp r9d, 8
jb 0x1402a4200
cmp r9d, 0x10
jae 0x1402a42ec
lea r14, [r9*4]
lea esi, [r9 - 8]
add r14, r13
nop
cmp r9d, ebp
jae 0x1402a4361
mov r8d, esi
xor r10d, r10d
or r8d, 8
cmp r8d, 1
je 0x1402a42d5
lea edi, [r15*8]
mov ecx, r8d
mov eax, r8d
shr r8d, 1
and ecx, 1
shr rax, 1
neg ecx
add rax, rdi
movzx edx, word [rbx + rax*2 + 0x104]
sar rcx, 4
shr rdx, 4
and ecx, 0x7f
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x1402a42a1
lea eax, [r10 + r12]
inc r9d
add r14, 4
mov dword [r14 - 4], eax
inc esi
cmp r9d, 0x10
jb 0x1402a4280
cmp r9d, ebp
jae 0x1402a4361
lea rdi, [r9*4]
lea r10d, [r9 - 0x10]
add rdi, r13
sub ebp, r9d
mov esi, ebp
mov ebp, dword [rsp + 0x48]
nop dword [rax]
mov eax, r10d
xor r9d, r9d
bts eax, 8
cmp eax, 1
je 0x1402a434e
nop
mov edx, eax
mov ecx, eax
shr eax, 1
and edx, 1
shr rcx, 1
movzx r8d, word [rbx + rcx*2 + 0x204]
neg edx
sar rdx, 4
shr r8, 4
and edx, 0x7f
xor r8, rdx
add r9d, dword [r11 + r8*4]
cmp eax, 1
jne 0x1402a4320
lea eax, [r9 + rbp]
add rdi, 4
inc r10d
mov dword [rdi - 4], eax
dec rsi
jne 0x1402a4310
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1402a6300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rsi, rcx
xor r11d, r11d
lea rdi, [rcx + 0x33b84]
nop dword [rax]
xor r9d, r9d
mov r10d, r11d
lea eax, [r9 + 1]
lea ebx, [rax + 3]
nop dword [rax]
mov ecx, eax
mov r8d, r10d
add eax, eax
movzx edx, word [rsi + rcx*2 + 0x3422c]
and r8d, 1
shr r10d, 1
mov ecx, r8d
shr rdx, 4
or eax, r8d
neg ecx
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [rsi + rdx*4 + 0x324d4]
dec ebx
jne 0x1402a6330
inc r11d
mov dword [rdi], r9d
add rdi, 4
cmp r11d, 0x10
jb 0x1402a6320
mov rdi, qword [rsp + 0x18]
mov dword [rsi + 0x33bc4], ebx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret