joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400255b8
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [0x1400e7a70]
call fcn.14002159e
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1401c4780], rax
xor eax, eax
lea rcx, [0x1400e7b60]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400255f2
mov eax, 0x59f86fa6
mov sil, 1
mov edi, 0xc77b0d8
lea r14, [0x1400e7a90]
lea rbx, [0x1400e7b58]
mov r15d, 0x5b7261a0
mov ebp, dword [rsp + 0x38]
xor ebp, edi
cmp eax, 0xe97711d
je 0x140025689
cmp eax, 0x23b3651a
je 0x140025646
cmp eax, 0x59f86fa6
jne 0x14002562f
jmp 0x140025652
mov rcx, r14
call fcn.1400215b5
mov eax, ebp
jmp 0x14002562f
mov rax, qword [rsp + 0x28]
test sil, 1
je 0x140025675
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x14002565f
test rax, rax
mov eax, 0x765675a7
cmove eax, r15d
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x140025629
mov rcx, qword [0x1401c4780]
lea rdx, str.GetCurrentProcessId
call fcn.140021921
mov qword [0x1401c4788], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.OpenProcess
call fcn.140021921
mov qword [0x1401c4790], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.VirtualAllocEx
call fcn.140021921
mov qword [0x1401c4798], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.VirtualProtect
call fcn.140021921
mov qword [0x1401c47a0], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.CreateFileA
call fcn.140021921
mov qword [0x1401c47a8], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.GetFileSize
call fcn.140021921
mov qword [0x1401c47b0], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.HeapAlloc
call fcn.140021921
mov qword [0x1401c47b8], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.GetProcessHeap
call fcn.140021921
mov qword [0x1401c47c0], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.ReadFile
call fcn.140021921
mov qword [0x1401c47c8], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.lstrcmpA
call fcn.140021921
mov qword [0x1401c47d0], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.VirtualAllocExNuma
call fcn.140021921
mov qword [0x1401c47d8], rax
mov rcx, qword [0x1401c4780]
lea rdx, str.GetCurrentProcess
call fcn.140021921
mov qword [0x1401c47e0], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140027930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [0x1400e8060]
call fcn.14002159e
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1401c6f80], rax
xor eax, eax
lea rcx, [0x1400e80ac]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x14002796a
mov eax, 0x59f86fa6
mov sil, 1
mov edi, 0xc77b0d8
lea r14, [0x1400e8078]
lea rbx, [0x1400e80a4]
mov r15d, 0x5b7261a0
mov ebp, dword [rsp + 0x38]
xor ebp, edi
cmp eax, 0xe97711d
je 0x140027a01
cmp eax, 0x23b3651a
je 0x1400279be
cmp eax, 0x59f86fa6
jne 0x1400279a7
jmp 0x1400279ca
mov rcx, r14
call fcn.1400215b5
mov eax, ebp
jmp 0x1400279a7
mov rax, qword [rsp + 0x28]
test sil, 1
je 0x1400279ed
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x1400279d7
test rax, rax
mov eax, 0x765675a7
cmove eax, r15d
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x1400279a1
mov rcx, qword [0x1401c6f80]
lea rdx, str.CLRCreateInstance
call fcn.140021921
mov qword [0x1401c6f88], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140027a28
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp], xmm0
mov dword [rsp + 0x10], 0
xor eax, eax
lea r8, [0x1400e80c4]
movsxd rdx, dword [rax + r8]
xor dword [rsp + rdx*4], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x140027a45
test ecx, ecx
mov eax, 0x765675a7
mov r9d, 0x3225c030
cmove r9d, eax
mov ecx, 0x28a16966
mov r8b, 1
lea rsi, [0x1400e80b8]
mov r10d, dword [rsp + 8]
mov r11d, dword [rsp + 0xc]
cmp ecx, 0x3d971518
jg 0x140027a9e
cmp ecx, 0xe97711d
je 0x140027ab5
cmp ecx, 0x28a16966
jne 0x140027a84
jmp 0x140027ac2
cmp ecx, 0x3d971519
je 0x140027aea
cmp ecx, 0x4ae4c48a
jne 0x140027a84
mov al, 1
mov ecx, r11d
jmp 0x140027aba
xor eax, eax
mov ecx, r10d
xor ecx, 0x3f77d4dc
jmp 0x140027a84
test r8b, 1
je 0x140027adf
xor ecx, ecx
movsxd rdx, dword [rcx + rsi]
xor dword [rsp + rdx*4], 0x7a21c57f
add rcx, 4
cmp rcx, 0xc
jne 0x140027aca
mov ecx, dword [rsp]
xor ecx, r9d
xor r8d, r8d
jmp 0x140027a7a
and al, 1
add rsp, 0x20
pop rsi
ret
Function at 0x1400395ce
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov qword [rsp + 0x20], 0
movzx eax, cl
mov dword [rsp + 0xc], eax
xor eax, eax
lea rdx, [0x1400efc40]
movsxd rbp, dword [rax + rdx]
xor dword [rsp + rbp*4 + 0x10], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x1400395fb
mov edi, 0x23b3651a
mov r14b, 1
xor r11d, r11d
mov r8d, 0x452455bd
lea rdx, [0x1400efc2c]
mov r9d, 0x3225c030
mov r10d, 0x3f77d4dc
mov ebx, dword [rsp + 0x20]
xor ebx, r8d
mov r15d, dword [rsp + 0x18]
mov esi, dword [rsp + 0x1c]
mov ebp, esi
xor ebp, 0x16cd739b
cmp edi, 0x3d971518
jle 0x140039673
cmp edi, 0x3d971519
je 0x140039689
cmp edi, 0x47c49478
je 0x1400396f7
cmp edi, 0x4ae4c48a
jne 0x14003964d
jmp 0x140039693
cmp edi, 0x23b3651a
je 0x1400396b9
cmp edi, 0x2f7d4ef2
jne 0x14003964d
mov eax, ecx
mov edi, ebx
jmp 0x14003964d
mov eax, dword [rsp + 0xc]
xor al, 0x20
mov edi, ebp
jmp 0x14003964d
mov edi, dword [rsp + 0xc]
mov ebp, esi
xor ebp, 0x53e92626
test r11b, r11b
cmove esi, ebp
cmp edi, 0x5b
mov edi, 0x2d9d8f37
cmovl edi, r10d
xor edi, r15d
mov r11b, 1
jmp 0x140039645
mov dword [rsp + 0x1c], esi
mov esi, dword [rsp + 0xc]
test r14b, 1
je 0x1400396df
xor edi, edi
movsxd rbx, dword [rdi + rdx]
xor dword [rsp + rbx*4 + 0x10], 0x7a21c57f
add rdi, 4
cmp rdi, 0x10
jne 0x1400396c9
cmp esi, 0x40
mov edi, 0x57bc4a48
cmovg edi, r9d
xor edi, dword [rsp + 0x10]
xor r14d, r14d
jmp 0x140039635
mov dword [rsp + 0x1c], esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003a418
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
cmp rcx, 0xffffffff80000000
setl byte [rsp + 0x2e]
cmp rcx, 0x7fffffff
setg byte [rsp + 0x2f]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
xor eax, eax
lea rcx, [0x1400f01c0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x14003a450
mov eax, 0x59f86fa6
mov bpl, 1
mov r15d, 0xc77b0d8
lea rbx, [0x1400f01b8]
mov r14d, 0x5b7261a0
mov edi, dword [rsp + 0x38]
xor edi, r15d
cmp eax, 0xe97711d
je 0x14003a4f1
cmp eax, 0x23b3651a
je 0x14003a49f
cmp eax, 0x59f86fa6
jne 0x14003a488
jmp 0x14003a4b8
mov r8d, 0x7fffffff
mov rcx, rsi
mov rdx, 0xffffffff80000000
call fcn.14001c234
mov eax, edi
jmp 0x14003a488
mov al, byte [rsp + 0x2e]
or al, byte [rsp + 0x2f]
test bpl, 1
je 0x14003a4de
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x14003a4c8
test al, 1
mov eax, 0x765675a7
cmovne eax, r14d
xor eax, dword [rsp + 0x30]
xor ebp, ebp
jmp 0x14003a481
mov eax, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003aaf6
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
inc rcx
mov qword [rsp + 0x50], rcx
seto byte [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x23], al
xor eax, eax
lea rcx, [0x1400f05d0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x1c
jne 0x14003ab36
mov eax, 0x4ae4c48a
mov cl, 1
mov dword [rsp + 0x24], ecx
xor r14d, r14d
lea rsi, [0x1400f01cc]
lea rdi, [0x1400f05b0]
lea r15, [0x1400f01dc]
xor r12d, r12d
mov ebx, dword [rsp + 0x48]
mov ecx, 0x6793fd2a
xor ebx, ecx
mov ebp, dword [rsp + 0x40]
mov ecx, 0x50c1eb83
xor ebp, ecx
mov r13d, dword [rsp + 0x38]
mov ecx, 0x452455bd
xor r13d, ecx
cmp eax, 0x4ae4c489
jle 0x14003abb6
cmp eax, 0x775b11f7
jg 0x14003abd0
cmp eax, 0x4ae4c48a
je 0x14003ac10
cmp eax, 0x634c96ff
jne 0x14003ab95
jmp 0x14003ac59
cmp eax, 0x13cd7de5
je 0x14003abe3
cmp eax, 0x2f7d4ef2
je 0x14003abfd
cmp eax, 0x47c49478
jne 0x14003ab95
jmp 0x14003ac9e
cmp eax, 0x775b11f8
je 0x14003ac07
cmp eax, 0x7cbfe930
jne 0x14003ab95
jmp 0x14003ace6
mov rcx, qword [rsp + 0x28]
xor edx, edx
movabs r8, 0x7fffffffffffffff
call fcn.14001c234
mov eax, ebx
jmp 0x14003ab95
call fcn.140011264
mov eax, r13d
jmp 0x14003ab95
call fcn.140011264
mov eax, ebp
jmp 0x14003ab95
mov al, byte [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
test r12b, r12b
jne 0x14003ac3b
xor eax, eax
movsxd rcx, dword [rax + rdi]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x18
jne 0x14003ac25
cmp byte [rsp + 0x23], 0
mov eax, 0x3f0590c2
mov ecx, 0x57bc4a48
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
mov r12b, 1
jmp 0x14003ab72
mov rax, qword [rsp + 0x28]
test byte [rsp + 0x24], 1
je 0x14003ac7d
xor ecx, ecx
movsxd rdx, dword [rcx + r15]
xor dword [rsp + rdx*4 + 0x30], 0x28a16966
add rcx, 4
cmp rcx, 8
jne 0x14003ac67
test rax, rax
mov eax, 0x4f32944c
mov ecx, 0x20400099
cmovs eax, ecx
xor eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], 0
jmp 0x14003ab72
mov rcx, qword [rsp + 0x60]
add rcx, rcx
seto al
mov qword [rsp + 0x28], rcx
test r14b, r14b
jne 0x14003accb
xor ecx, ecx
movsxd rdx, dword [rcx + rsi]
xor dword [rsp + rdx*4 + 0x30], 0x316dbcb9
add rcx, 4
cmp rcx, 0x10
jne 0x14003acb5
test al, al
mov eax, 0x61ac573a
mov ecx, 0x75bbd03d
cmovne eax, ecx
xor eax, dword [rsp + 0x3c]
mov r14b, 1
jmp 0x14003ab72
mov rcx, qword [rsp + 0x28]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14001c7b6
Function at 0x14003c74a
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea rcx, [0x1400f00b0]
call fcn.14002159e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [0x1401c6fa0], rax
xor eax, eax
lea rcx, [0x1400f04f0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x14003c791
mov eax, 0x23b3651a
mov r15b, 1
xor r12d, r12d
mov ebp, 0x7449e904
mov edi, 0x3f77d4dc
lea rbx, [0x1400f04dc]
lea r13, [0x1400f0504]
mov r14d, dword [rsp + 0x30]
xor r14d, ebp
mov esi, dword [rsp + 0x28]
xor esi, edi
cmp eax, 0x3d971518
jle 0x14003c808
cmp eax, 0x3d971519
je 0x14003c827
cmp eax, 0x47c49478
je 0x14003c8cc
cmp eax, 0x4ae4c48a
jne 0x14003c7d8
lea rcx, [0x1400f00d0]
call fcn.1400215b5
mov eax, esi
jmp 0x14003c7d8
cmp eax, 0x23b3651a
je 0x14003c88d
cmp eax, 0x2f7d4ef2
jne 0x14003c7d8
lea rcx, [0x1400f0128]
call fcn.1400215b5
mov eax, r14d
jmp 0x14003c7d8
mov rcx, qword [0x1401c6fa0]
lea rdx, str.WideCharToMultiByte
call fcn.140021921
mov qword [0x1401c6f90], rax
lea rcx, [0x1400f0108]
call fcn.14002159e
mov qword [0x1401c6fa8], rax
test r12b, r12b
jne 0x14003c871
xor ecx, ecx
movsxd rdx, dword [rcx + r13]
xor dword [rsp + rdx*4 + 0x20], 0x316dbcb9
add rcx, 4
cmp rcx, 8
jne 0x14003c85b
test rax, rax
mov eax, 0x452455bd
mov ecx, 0x2d9d8f37
cmove eax, ecx
xor eax, dword [rsp + 0x2c]
mov r12b, 1
jmp 0x14003c7ca
mov rax, qword [rsp + 0x40]
test r15b, 1
je 0x14003c8b0
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x20], 0x7a21c57f
add rcx, 4
cmp rcx, 0x10
jne 0x14003c89a
test rax, rax
mov eax, 0x455611a3
mov ecx, 0x3225c030
cmove eax, ecx
xor eax, dword [rsp + 0x20]
xor r15d, r15d
jmp 0x14003c7ca
mov rcx, qword [0x1401c6fa8]
lea rdx, str.SysStringLen
call fcn.140021921
mov qword [0x1401c6fb0], rax
mov rcx, qword [0x1401c6fa0]
lea rdx, str.lstrlenW
call fcn.140021921
mov qword [0x1401c6fb8], rax
mov rcx, qword [0x1401c6fa0]
lea rdx, str.MultiByteToWideChar
call fcn.140021921
mov qword [0x1401c6f98], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140040324
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdx
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.14001bb4c
add rdi, 8
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
mov qword [rax], rbx
lea rax, [0x1400f1ef0]
movsxd rcx, dword [rbx + rax]
xor dword [rsp + rcx*4 + 0x30], 0x78c104ba
add rbx, 4
cmp rbx, 0x14
jne 0x140040372
test rsi, rsi
mov eax, 0x3225c030
mov ebx, 0x455611a3
cmovs ebx, eax
mov eax, 0x23b3651a
mov r13b, 1
xor r14d, r14d
lea rbp, [0x1400f1ed8]
lea rdi, [0x1400f1f04]
mov r15d, dword [rsp + 0x40]
mov ecx, 0x7449e904
xor r15d, ecx
mov r12d, dword [rsp + 0x38]
mov ecx, 0x3f77d4dc
xor r12d, ecx
cmp eax, 0x3d971518
jle 0x140040404
cmp eax, 0x3d971519
je 0x14004042d
cmp eax, 0x47c49478
je 0x1400404b0
cmp eax, 0x4ae4c48a
jne 0x1400403cb
mov rcx, rsi
xor edx, edx
movabs r8, 0x7fffffffffffffff
call fcn.14001c234
mov eax, r12d
jmp 0x1400403cb
cmp eax, 0x23b3651a
je 0x140040484
cmp eax, 0x2f7d4ef2
jne 0x1400403cb
mov rcx, qword [rsp + 0x28]
xor edx, edx
movabs r8, 0x7fffffffffffffff
call fcn.14001c234
mov eax, r15d
jmp 0x1400403cb
mov rcx, rsi
call fcn.1400404de
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov rax, qword [rsp + 0x28]
test r14b, r14b
jne 0x140040468
xor ecx, ecx
movsxd rdx, dword [rcx + rdi]
xor dword [rsp + rdx*4 + 0x30], 0x316dbcb9
add rcx, 4
cmp rcx, 8
jne 0x140040452
test rax, rax
mov eax, 0x452455bd
mov ecx, 0x2d9d8f37
cmovs eax, ecx
xor eax, dword [rsp + 0x3c]
mov r14b, 1
jmp 0x1400403b1
test r13b, 1
je 0x1400404a2
xor eax, eax
movsxd rcx, dword [rax + rbp]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x10
jne 0x14004048c
mov eax, dword [rsp + 0x30]
xor eax, ebx
xor r13d, r13d
jmp 0x1400403b1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [0x1401adc80]
call fcn.14001a7a8
mov rcx, qword [rsp + 0x48]
mov rdx, rax
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14001bb4c
Function at 0x1400404de
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx - 1]
mov rdx, rax
sar rdx, 0x20
or rdx, rax
mov rax, rdx
sar rax, 0x10
or rax, rdx
mov rdx, rax
sar rdx, 8
or rdx, rax
mov rax, rdx
sar rax, 4
or rax, rdx
mov rdx, rax
sar rdx, 2
or rdx, rax
mov rax, rdx
sar rax, 1
or rax, rdx
xor edx, edx
test rcx, rcx
setle dl
add rax, rdx
inc rax
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
imul rax, rcx, 3
mov qword [rsp + 0x48], rax
seto byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov al, byte [rsp + 0x50]
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x1400f1ef0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x140040523
mov eax, 0x23b3651a
mov dil, 1
xor esi, esi
mov r12d, 0x7449e904
mov r13d, 0x3f77d4dc
lea rbx, [0x1400f1ed8]
lea rbp, [0x1400f1f04]
mov r14d, dword [rsp + 0x40]
xor r14d, r12d
mov r15d, dword [rsp + 0x38]
xor r15d, r13d
cmp eax, 0x3d971518
jle 0x140040597
cmp eax, 0x3d971519
je 0x1400405af
cmp eax, 0x47c49478
je 0x140040643
cmp eax, 0x4ae4c48a
jne 0x14004056d
call fcn.140011264
mov eax, r15d
jmp 0x14004056d
cmp eax, 0x23b3651a
je 0x1400405fa
cmp eax, 0x2f7d4ef2
jne 0x14004056d
call fcn.140011264
mov eax, r14d
jmp 0x14004056d
mov rax, qword [rsp + 0x58]
mov rcx, rax
shr rcx, 0x3f
add rcx, rax
sar rcx, 1
add rcx, 4
mov qword [rsp + 0x60], rcx
test sil, sil
jne 0x1400405e7
xor eax, eax
movsxd rcx, dword [rax + rbp]
xor dword [rsp + rcx*4 + 0x30], 0x316dbcb9
add rax, 4
cmp rax, 8
jne 0x1400405d1
mov eax, dword [rsp + 0x3c]
mov ecx, 0x452455bd
xor eax, ecx
mov sil, 1
jmp 0x14004055d
mov al, byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
test dil, 1
je 0x140040626
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x10
jne 0x140040610
cmp byte [rsp + 0x2f], 0
mov eax, 0x455611a3
mov ecx, 0x3225c030
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor edi, edi
jmp 0x14004055d
mov rcx, qword [rsp + 0x60]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x14002a4dc
Function at 0x1400458c3
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
xor eax, eax
lea rcx, [0x1400f406c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400458e3
test r15, r15
mov eax, 0x765675a7
mov edi, 0x5b7261a0
cmove edi, eax
mov eax, 0x59f86fa6
mov bpl, 1
mov r14d, 0xc77b0d8
lea rbx, [0x1400f4064]
mov esi, dword [rsp + 0x28]
xor esi, r14d
cmp eax, 0xe97711d
je 0x140045970
cmp eax, 0x23b3651a
je 0x14004593c
cmp eax, 0x59f86fa6
jne 0x140045925
jmp 0x140045948
mov rcx, r15
call fcn.14000e654
mov eax, esi
jmp 0x140045925
test bpl, 1
je 0x140045966
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor dword [rsp + rcx*4 + 0x20], 0x7a21c57f
add rax, 4
cmp rax, 8
jne 0x140045950
mov eax, dword [rsp + 0x20]
xor eax, edi
xor ebp, ebp
jmp 0x14004591e
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005cfe8
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], rcx
test rcx, rcx
sete byte [rsp + 0xf]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x10], xmm0
xor eax, eax
lea rdx, [0x1400f6270]
movsxd rbp, dword [rax + rdx]
xor dword [rsp + rbp*4 + 0x10], 0x78c104ba
add rax, 4
cmp rax, 0x2c
jne 0x14005d020
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x50], rax
mov r10d, 0x775b11f8
xor ecx, ecx
lea rdx, [0x1400f62c0]
lea rbp, [0x1400f62a0]
lea rbx, [0x1400f6240]
xor r12d, r12d
xor r8d, r8d
xor r15d, r15d
cmp r10d, 0x5fcc2876
jle 0x14005d0e1
cmp r10d, 0x771e161a
jle 0x14005d12d
cmp r10d, 0x771e161b
je 0x14005d1b9
cmp r10d, 0x7cbfe930
je 0x14005d1e6
cmp r10d, 0x775b11f8
jne 0x14005d06a
mov r11b, byte [rsp + 0xf]
test cl, cl
jne 0x14005d0c4
xor edi, edi
movsxd rsi, dword [rdi + rbx]
xor dword [rsp + rsi*4 + 0x10], 0x7a21c57f
add rdi, 4
cmp rdi, 0x28
jne 0x14005d0ae
cmp byte [rsp + 0xf], 0
mov r10d, 0x6b0c795f
mov ecx, 0x47eed8a
cmovne r10d, ecx
xor r10d, dword [rsp + 0x10]
mov cl, 1
jmp 0x14005d06a
cmp r10d, 0x23b1fc5e
jle 0x14005d162
cmp r10d, 0x23b1fc5f
je 0x14005d223
cmp r10d, 0x2529ff56
je 0x14005d238
cmp r10d, 0x5c59b6c3
jne 0x14005d06a
mov r10d, dword [rsp + 0x24]
mov edi, 0x28158bd0
xor r10d, edi
xor r14d, r14d
lea r9, [0x1400f3e42]
jmp 0x14005d06a
cmp r10d, 0x5fcc2877
je 0x14005d24f
cmp r10d, 0x69603052
jne 0x14005d28d
mov r10d, dword [rsp + 0x20]
mov edi, 0x28158bd0
xor r10d, edi
mov r14d, 3
xor r9d, r9d
jmp 0x14005d06a
cmp r10d, 0x13cd7de5
je 0x14005d26e
cmp r10d, 0x1b98f6ac
jne 0x14005d06a
test r8b, r8b
jne 0x14005d199
xor edi, edi
movsxd rsi, dword [rdi + rdx]
xor dword [rsp + rsi*4 + 0x10], 0x23b3651a
add rdi, 4
cmp rdi, 0x14
jne 0x14005d183
cmp r14d, 3
mov r10d, 0x44936b67
mov edi, 0x6c41550b
cmovl r10d, edi
xor r10d, dword [rsp + 0x28]
mov r8b, 1
jmp 0x14005d06a
test r15b, r15b
jne 0x14005d1c6
xor dword [rsp + 0x34], 0xe97711d
cmp r14d, 3
mov r10d, 0x727e4714
mov eax, 0x3517e730
cmove r10d, eax
xor r10d, dword [rsp + 0x2c]
mov r15b, 1
jmp 0x14005d06a
test r12b, r12b
jne 0x14005d203
xor edi, edi
movsxd rsi, dword [rdi + rbp]
xor dword [rsp + rsi*4 + 0x10], 0x316dbcb9
add rdi, 4
cmp rdi, 0x20
jne 0x14005d1ed
test r11b, 1
mov r10d, 0x5eb97706
mov esi, 0x6b80f197
cmove r10d, esi
xor r10d, dword [rsp + 0x1c]
mov r12b, 1
jmp 0x14005d06a
mov r10d, dword [rsp + 0x38]
mov eax, 0x727e4714
xor r10d, eax
mov rax, r13
jmp 0x14005d06a
mov r10d, dword [rsp + 0x34]
mov esi, 0x3d189524
xor r10d, esi
mov r13, qword [rsp + 0x50]
jmp 0x14005d06a
test r14d, r14d
mov r10d, 0x727e4714
mov eax, 0x338fe439
cmove r10d, eax
xor r10d, dword [rsp + 0x30]
mov r13, r9
jmp 0x14005d06a
mov rdi, qword [rsp + 0x48]
cmp qword [rdi], 0
sete r11b
mov r10d, dword [rsp + 0x18]
mov esi, 0x7e5f28f5
xor r10d, esi
jmp 0x14005d06a
cmp r10d, 0x62405f72
jne 0x14005d06a
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140065202
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, r8
mov rdi, rcx
mov ecx, edx
call fcn.1400235fc
mov rcx, rdi
mov rdx, rax
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140064991
Function at 0x14006a1c9
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x60], rcx
call fcn.140069a71
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x1400fd1f0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x20
jne 0x14006a205
mov eax, 0x3d971519
xor r12d, r12d
mov ebx, 0x32789e31
lea rsi, [0x1400fd1d0]
mov ebp, 0x61ac573a
lea rdi, [0x1400fd210]
lea r13, [0x1400fa000]
xor r14d, r14d
cmp eax, 0x634c96fe
jle 0x14006a272
cmp eax, 0x775b11f7
jg 0x14006a2ca
cmp eax, 0x634c96ff
je 0x14006a30c
cmp eax, 0x69603052
jne 0x14006a245
mov eax, dword [rsp + 0x4c]
mov ecx, 0x74118a0
xor eax, ecx
jmp 0x14006a245
cmp eax, 0x47c49477
jg 0x14006a2f4
cmp eax, 0x13cd7de5
je 0x14006a346
cmp eax, 0x3d971519
jne 0x14006a245
mov al, byte [rsp + 0x2f]
test r12b, r12b
jne 0x14006a2ac
xor eax, eax
movsxd rcx, dword [rax + rsi]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x1c
jne 0x14006a296
cmp byte [rsp + 0x2f], 0
mov eax, 0xf9a1542
mov ecx, 0x3f0590c2
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
mov r12b, 1
jmp 0x14006a245
cmp eax, 0x775b11f8
je 0x14006a35b
cmp eax, 0x7cbfe930
jne 0x14006a245
test r15d, r15d
mov eax, 0x74118a0
cmove eax, ebx
xor eax, dword [rsp + 0x48]
jmp 0x14006a245
cmp eax, 0x47c49478
jne 0x14006a373
mov eax, dword [rsp + 0x38]
xor eax, ebp
mov r15d, 2
jmp 0x14006a245
test r14b, r14b
jne 0x14006a329
xor eax, eax
movsxd rcx, dword [rax + rdi]
xor dword [rsp + rcx*4 + 0x30], 0x59f86fa6
add rax, 4
cmp rax, 0x10
jne 0x14006a313
cmp r15d, 2
mov eax, 0x112dbc20
mov ecx, 0x7e5f28f5
cmovl eax, ecx
xor eax, dword [rsp + 0x40]
mov r14b, 1
jmp 0x14006a245
cmp r15d, 2
mov eax, 0x74118a0
cmove eax, ebx
xor eax, dword [rsp + 0x44]
jmp 0x14006a245
xor r15d, r15d
mov rcx, r13
xor edx, edx
call fcn.140065230
mov eax, dword [rsp + 0x3c]
xor eax, ebp
jmp 0x14006a245
cmp eax, 0x5c59b6c3
jne 0x14006a245
mov rax, qword [rsp + 0x60]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret