joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400321d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140030b90
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x140032254
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x33358572
xor r8d, 0x3e3abbde
add r8d, 0x37c1aa8e
sub r8d, 0x44d0e939
inc rdi
call fcn.140078ce0
cmp byte [rdi], 0
jne 0x140032216
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x140032288
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x5487f46e
sub ecx, 0x425f79ff
xor ecx, 0x12287aef
rep stosb byte [rdi], al
jmp 0x14003228d
call fcn.14007fbb0
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x3b3f
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x1400323a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x39c39861
xor r10d, 0x3dcd961d
add r10d, 0x571d2cc3
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x73d35ad6
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x140032436
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400da580]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x1400323fa
mov eax, r9d
ret

Function at 0x14003253c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x22989b7f
add r10d, 0x30da5bd8
xor r10d, 0x859cc68
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x73d35ad6
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400325e5
mov r10, qword [rcx + 0x300]
movzx eax, ax
nop
sub rdx, 0x2b8c163
add rdx, 0x2b8c165
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400da580]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x14003259b
mov eax, r9d
ret
Function at 0x1400325ec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
add rsp, 0xffffffffffffff60
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x14003267f
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x28202269
xor ecx, 0x5739b505
sub ecx, 0x23ee5c2d
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.14007fa60
test rsi, rsi
jle 0x14003269c
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x525c63e7
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x14003265b
jmp 0x14003269c
lea rdx, [rsp + 0xb0]
call fcn.1400327f0
test al, al
je 0x1400326e7
mov rax, qword [rsp + 0xb0]
lea rcx, [0x140003d48]
mov qword [rsp + 0x98], 0x11d4f8a6
add qword [rsp + 0x98], 0x2bac978
sub qword [rsp + 0x98], 0x148fc206
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.14003175c
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140034568
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rbp - 0x20]
mov r12, r9
call fcn.14006b024
mov r8d, 0x23416cf4
add r8d, 0x277be007
sub r8d, 0x4abd4cf9
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.14006b0a8
test al, al
je 0x140034802
mov eax, dword [rdi + 0x2e8]
lea rdx, [rbp - 0x40]
and dword [rbp - 0x28], 0
mov ecx, 0xbe76205
xor ecx, 0x75c39c5c
sub ecx, 0x22f9c31a
and dword [rbp - 0x24], 0
xor eax, ecx
mov dword [rbp - 0x38], eax
mov r8d, 0x3ea2fda
xor r8d, 0x35eee248
add r8d, 0x418759c1
xor r8d, 0x778c2773
mov eax, dword [rdi + 0x2ec]
xor eax, ecx
mov dword [rbp - 0x40], 0x24a2ae12
sub dword [rbp - 0x40], 0x22da17d0
add dword [rbp - 0x40], 0x307fad04
mov dword [rbp - 0x34], eax
mov eax, dword [rdi + 0x2f4]
xor eax, ecx
mov dword [rbp - 0x3c], 0x5303932a
xor dword [rbp - 0x3c], 0x61e37167
sub dword [rbp - 0x3c], 0x32e0e22d
mov dword [rbp - 0x30], eax
mov eax, dword [rdi + 0x30c]
xor eax, ecx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
call fcn.14006d004
test al, al
je 0x140034802
mov r14d, dword [rdi + 0x2d8]
mov edx, 0x60510f18
xor edx, 0x252b73e
sub edx, 0x42e2d9e0
sub edx, 0x1f20de36
and r14d, 0x2000
mov eax, r14d
neg eax
sbb rbx, rbx
and rbx, 0xffffffffffff0100
add rbx, 0x474c7457
sub rbx, 0x474b7458
mov r15, rbx
shl r15, 4
mov rcx, r15
call fcn.14007fad0
mov rsi, rax
test rax, rax
je 0x140034802
mov rdx, qword [rdi + 0x300]
xor r8d, r8d
sub rdx, rax
lea edi, [r8 + 1]
movups xmm0, xmmword [rdx + rax]
add r8, rdi
xorps xmm0, xmmword [0x1400da580]
movups xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp r8, rbx
jl 0x1400346d1
mov rcx, r15
call fcn.14007fa60
neg r14d
mov rdx, rax
mov rcx, rsi
mov rbx, rax
sbb r8d, r8d
and r8d, 0xfff01000
neg r8d
add r8d, 0xfff00010
neg r8d
mov r9d, r8d
call fcn.140079150
mov r8d, eax
mov dword [rbp - 0x28], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14006d004
mov rcx, rsi
test al, al
jne 0x14003474c
call fcn.14007fa80
mov rcx, rbx
jmp 0x1400347a7
call fcn.14007fa80
mov rcx, rbx
call fcn.14007fa70
mov eax, dword [rbp - 0x34]
imul eax, dword [rbp - 0x38]
movsxd rcx, eax
shl rcx, 2
call fcn.14007fa60
mov r8d, dword [rbp - 0x34]
mov rdx, rax
imul r8d, dword [rbp - 0x38]
mov rcx, r12
mov rbx, rax
shl r8d, 2
mov r9d, r8d
call fcn.140079150
mov r8d, eax
mov dword [rbp - 0x24], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14006d004
mov rcx, rbx
test al, al
jne 0x1400347b1
call fcn.14007fa70
jmp 0x140034802
call fcn.14007fa70
lea rcx, [rbp - 0x20]
call fcn.14006d280
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14006c698
test al, al
je 0x140034802
mov r8d, 0x71ec3c71
sub r8d, 0x2a13f4e2
xor r8d, 0xa49144e
xor r8d, 0x4d9153e1
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14006d004
test al, al
jne 0x140034805
xor dil, dil
lea rcx, [rbp - 0x20]
call fcn.14006b0a0
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400394c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140016528
mov edi, 0x1275b3ed
xor edi, 0x6bf99417
xor edi, 0x55a3b07f
add edi, 0x2a9dfcb
mov r9, rax
mov ecx, edi
mov r15d, 0x564ff76
sub r15d, 0x534fe33
add r15d, 0x2ba78a9e
sub r15d, 0x2bd78ae2
test rbp, rbp
je 0x140039592
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x140039571
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400395dd
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400395dd
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400395bd
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff466a443e
add rdx, 0x2248754
sub rdx, 0x953cb98
add rdx, 0x7fffffff
add rdx, 0x40c50006
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x140039621
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140016528
cmp qword [r14 + 0x38], rbx
jbe 0x14003966d
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x140039649
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400396a5
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x69a20438
sub ecx, 0x6238d43a
add ecx, 0x68a50fde
xor ecx, 0x700e3fec
rep stosb byte [rdi], al
jmp 0x1400396aa
call fcn.14007fbb0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14003fb10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 0xa7dd82f
add rsp, 0xa7dd80f
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14003fb4b
mov rdi, qword [rcx + 0x640]
jmp 0x14003fb52
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14003fb6b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14003fb6e
mov rcx, rsi
cmp rdi, rcx
je 0x14003fd91
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x14003fb8d
add rdi, 8
jmp 0x14003fb52
test r8, r8
je 0x14003fc4b
cmp rdi, qword [rbx + 0x640]
jb 0x14003fc4b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14003fc4b
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x14003fbe4
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x14003fbe7
mov rax, rsi
add rax, 0xfffffffffffffff8
cmp rdx, rax
jae 0x14003fc04
mov rax, qword [rdx + 8]
mov qword [rdx], rax
add rdx, 8
jmp 0x14003fbc4
test rcx, rcx
je 0x14003fc4b
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14003fc4b
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x14003fc3d
call fcn.14007fbb0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14003fc73
mov rax, qword [rcx]
mov edx, 0xe945f6d
add edx, 0x4d1e4111
xor edx, 0x5cd257ce
sub edx, 0x760f7af
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14003fd91
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140036780
mov rcx, qword [rsp + 0x30]
mov r10d, 0x1973d355
xor r10d, 0x5178fa95
sub r10d, 0x480b2920
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x14003fd49
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x14003fd49
mov r9d, r10d
xor r9d, 0x5b2b3b3f
xor r8d, 0x5b2b3b3f
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x5b2b3b3f
add esi, r10d
nop
add rdx, 0x6b1404c2
sub rdx, 0x6b1404ba
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x30f32298
xor dword [rcx + 0x34], 0x51ff313c
xor dword [rcx + 0x34], 0x3a27289b
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x14003fcfa
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x14003fd89
sub ecx, r8d
mov dword [rax + 0x14], 0x2c1e8345
sub dword [rax + 0x14], 0x172a38fb
xor dword [rax + 0x14], 0x4fdf7175
xor ecx, 0x5b2b3b3f
xor r8d, 0x5b2b3b3f
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.140035780
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret
Function at 0x14003fdb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140036090
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.14003f9d0
mov rcx, rbx
nop
add rsp, 0x698ad124
sub rsp, 0x698ad104
pop rbx
jmp 0x14003fdb0
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x14003fee9
lea rdx, [rsp + 0x30]
call fcn.140036780
mov r8, qword [rsp + 0x30]
mov r11d, 0x1fcbb254
add r11d, 0x562ad9b1
sub r11d, 0x3ee59d57
sub r11d, 0x3710ee0e
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x14003fe9f
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x14003fe9a
mov r8d, r11d
xor r8d, 0x5b2b3b3f
xor r9d, 0x5b2b3b3f
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x5b2b3b3f
add r10d, r11d
add rax, 8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x3d63a0df
add dword [rdx + 0x34], 0x3215a29b
xor dword [rdx + 0x34], 0x3e2eb79b
add dword [rdx + 0x34], 0x9d3465e
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x14003fe4d
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x14003fee1
sub r8d, r9d
mov dword [rax + 0x14], 0x264bd3e7
add dword [rax + 0x14], 0x388e08d0
sub dword [rax + 0x14], 0x3aea178
xor r8d, 0x5b2b3b3f
xor r9d, 0x5b2b3b3f
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.140035780
sub rsp, 0xffffffffffffffe0
pop rbx
ret

Function at 0x140048530
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
nop
push r10
mov qword [rsp], rdi
nop
add rsp, 0x53b05b61
sub rsp, 0x53b05b81
xchg r15, rdx
mov rbx, r15
xchg r15, rdx
xchg r13, rcx
mov rdi, r13
xchg rcx, r13
nop
movabs rdx, 0xffffffff2843a111
xor rdx, 0x4fba005a
add rdx, 0xdceec66
xor rdx, 0x68910ce4
add rdx, 0x7fffffff
add rdx, 0x62a67eab
nop word [rax + rax]
mov rbp, rbp
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x14004859d
xchg r14, rdx
mov qword [rcx + 0x38], r14
xchg rdx, r14
call fcn.140016528
xor r8d, r8d
mov rdi, rdi
mov edx, 0x57825291
sub edx, 0xcbc7038
add edx, 0x29796360
add edx, 0x3ba9536
sub edx, 0x4920639f
cmp qword [rdi + 0x38], r8
jbe 0x140048648
mov rdi, rdi
sub rbx, rax
mov r9d, 0x734dbdc7
xor r9d, 0x13b452f
sub r9d, 0x43dff7f2
sub r9d, 0x2e96fff7
nop word [rax + rax]
mov dword [rsp - 0x30], ebp
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
xchg rbp, rbp
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rax - 2]
xchg rdi, rdi
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x140048612
mov dword [rsp - 0x1c], 0x5f1f759f
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg rbx, r11
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
sub rsp, 0xffffffffffffffe0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140049a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r8
mov qword [rsp + 0x18], r8
xchg rbp, r8
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x35d0672c
add rsp, 0x35d0670c
lea rsi, [rdx + 8]
xorps xmm0, xmm0
xchg r9, r9
mov qword [rdx], rsi
xor edi, edi
xchg rdi, rsi
movups xmmword [rdi], xmm0
xchg rsi, rdi
mov r14, r9
mov r10, r10
xchg rbp, r11
mov r11, r8
xchg r11, rbp
xchg rcx, rsi
movups xmmword [rcx + 0x10], xmm0
xchg rsi, rcx
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
movups xmmword [rsi + 0x20], xmm0
mov qword [rdx + 0x38], rdi
xchg rsp, rax
mov rsp, qword [rcx + 0x38]
xchg rsp, rax
cmp r8, rax
xchg rsi, rsi
jae 0x140049c68
sub rax, r8
mov qword [rsp + 0x40], r15
mov r10, r10
cmp rax, r9
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov dword [rsp - 0x14], 0x79ec5da1
mov rax, qword [rcx]
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
cmp rcx, rsi
mov dword [rsp - 0x38], 0x5d2d3245
je 0x140049b06
call fcn.14007fbb0
cmp r14, 0x18
mov dword [rsp - 0x24], ebx
jbe 0x140049b43
lea rcx, [r14 + r14]
call fcn.14007fed0
mov qword [rbx], rax
xchg r9, r9
test rax, rax
jne 0x140049b53
xchg r11, rsi
mov qword [rbx], r11
xchg rsi, r11
xchg r9, rdi
mov rdi, r9
xchg r9, rdi
jmp 0x140049b74
xchg rsi, r15
mov qword [rbx], r15
xchg r15, rsi
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xorps xmm0, xmm0
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
mov r9, qword [rbx]
mov r8, r8
and ebp, 3
mov r8d, 0x369fdf34
add r8d, 0x278f1d9f
xor r8d, 0x6cb01c9f
xor r8d, 0x781f5e7c
sub r8d, 0x1ba846e0
shl ebp, 3
mov dword [rsp - 0x18], edi
mov edx, r8d
movzx ecx, bpl
ror edx, cl
xchg rsp, rsp
cmp qword [rbx + 0x38], rdi
jbe 0x140049c34
sub r15, r9
mov dword [rsp - 0x40], esi
mov ecx, 0x7284b857
sub ecx, 0x4bc4139a
add ecx, 0x3e1e6b8f
sub ecx, 0x3f1671a3
sub ecx, 0x25c89daa
nop dword [rax]
mov dword [rsp - 0x34], 0x3ef454e
nop word [rax + rax]
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
mov r10, r10
ror edx, 6
ror edx, 1
ror edx, 1
and ax, cx
ror r8d, 1
ror r8d, 3
ror r8d, 3
ror r8d, 1
xor ax, word [r15 + r9 - 2]
mov dword [rsp - 0x30], ecx
inc rdi
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
mov rdx, rdx
jb 0x140049bef
mov r15, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdx, rdx
mov rbp, qword [rsp + 0x50]
nop
sub rsp, 0x270621f9
add rsp, 0x27062219
pop r14
xchg r13, r13
nop
mov rdi, qword [rsp]
add rsp, 8
pop rsi
ret
xchg r12, rax
mov r12, rbx
xchg r12, rax
jmp 0x140049c3c
Function at 0x14004a458
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x24], esi
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov rsi, rdx
mov r8, r8
nop
add rcx, 0x3bdb9ecb
sub rcx, 0x3bdb9ec3
xor edx, edx
mov dword [rsp - 0x38], edi
mov r8d, 0x7ec2ec6c
sub r8d, 0x5e375dbd
xor r8d, 0x4725cec0
sub r8d, 0x67ae3f6f
mov qword [rbx], rcx
call fcn.140080180
mov rsi, rsi
mov rdx, qword [rsi + 0x38]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
xchg r12, rdx
mov qword [rbx + 0x108], r12
xchg rdx, r12
inc rdx
xchg r13, r13
call fcn.140038200
mov r14, rax
test rax, rax
je 0x14004a558
mov dword [rsp - 0x14], 0x4bb13083
xorps xmm0, xmm0
mov qword [rsp + 0x70], rbp
mov rbp, qword [rsi + 0x38]
lea rax, [rsp + 0x28]
mov r12, r12
mov rsi, qword [rsi]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp - 0x40], ebx
lea rdx, [rbp + 1]
xchg rsp, r13
movups xmmword [r13 + 0x28], xmm0
xchg rsp, r13
xchg rsp, rbx
movups xmmword [rbx + 0x38], xmm0
xchg rsp, rbx
movups xmmword [rsp + 0x48], xmm0
mov rbx, rbx
call fcn.140016528
mov edx, 0x4f879031
sub edx, 0x2c3882ef
add edx, 0x2d4217ef
sub edx, 0x21b7ade1
test rbp, rbp
mov rdi, rdi
je 0x14004a4c2
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rsi, rax
mov r8, rbp
xchg rsp, rsp
mov r9d, 0x7d091732
xor r9d, 0x6e926b0c
sub r9d, 0xc110f43
xor r9d, 0x623942dd
sub r9d, 0x65b32d27
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x1c], edx
and cx, r9w
ror edx, 3
ror edx, 3
ror edx, 2
xor cx, word [rsi + rdi - 2]
mov word [rdi - 2], cx
xchg r10, r10
sub r8, 1
jne 0x14004a494
xor ecx, ecx
mov word [rax + rbp*2], cx
xchg r13, r13
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
xchg r14, rdx
mov r14, qword [rbx + 0x108]
xchg rdx, r14
xchg r8, r10
mov r10, qword [rsp + 0x20]
xchg r10, r8
inc rdx
xchg rsi, rsi
call fcn.140080960
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
xchg rbp, r8
mov r8, qword [rsp + 0x70]
xchg r8, rbp
cmp rcx, rax
mov dword [rsp - 0x28], 0x5ca154a0
jne 0x14004a54a
lea rdi, [rsp + 0x28]
xor eax, eax
mov dword [rsp - 0x1c], 0x2f42a3b8
mov ecx, 0x1f8f5b8
add ecx, 0x4007abed
sub ecx, 0x18e147b
sub ecx, 0x40728cfa
rep stosb byte [rdi], al
jmp 0x14004a54f
call fcn.14007fbb0
mov rdi, qword [rsp + 0x78]
mov dword [rsp - 0x20], esp
lea r11, [rsp + 0x60]
xchg r15, rbx
mov rax, r15
xchg rbx, r15
xchg rbx, r14
mov r14, qword [r11 + 0x20]
xchg rbx, r14
mov rsi, qword [r11 + 0x28]
xchg r11, rdx
mov rsp, rdx
xchg r11, rdx
pop r14
ret
Function at 0x14005f760
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg r15, rsi
xchg rdi, r11
mov qword [rsp + 0x20], r11
xchg r11, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
mov rbp, rsp
xchg rbx, rbx
nop
sub rsp, 0x76e1db9e
add rsp, 0x76e1db3e
movabs rbx, 0x313d6bef7e5bdbe0
sub rbx, 0x71b54c50
add rbx, 0x66e01040
sub rbx, 0x42e45079
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0x10], ebx
jne 0x14005f97a
xor esi, esi
mov dword [rbp - 0x40], 0x233f5ee3
add dword [rbp - 0x40], 0x5572c53d
add dword [rbp - 0x40], 0x431c316
xor dword [rbp - 0x40], 0x441ed691
sub dword [rbp - 0x40], 0x38ea3196
mov dword [rbp - 0x3c], 0x78993255
sub dword [rbp - 0x3c], 0x1112aee6
sub dword [rbp - 0x3c], 0x5a0d7673
xor dword [rbp - 0x3c], 0x2a38c79
xor dword [rbp - 0x3c], 0xf95802a
mov dword [rbp - 0x38], 0x4130b331
xor dword [rbp - 0x38], 0x332615f4
sub dword [rbp - 0x38], 0x378c3922
xor dword [rbp - 0x38], 0x3a946d83
mov dword [rbp - 0x34], 0x6b56e985
xor dword [rbp - 0x34], 0x6f2c0f56
add dword [rbp - 0x34], 0x29b48528
add dword [rbp - 0x34], 0x387cd6d7
sub dword [rbp - 0x34], 0x669041e8
mov dword [rbp - 0x30], 0x1c16da07
sub dword [rbp - 0x30], 0x1f1550b
add dword [rbp - 0x30], 0x1ac834eb
sub dword [rbp - 0x30], 0x34dab969
mov dword [rbp - 0x2c], 0x11bd7d37
add dword [rbp - 0x2c], 0x124aa6d0
xor dword [rbp - 0x2c], 0x32dd7c76
sub dword [rbp - 0x2c], 0x169357bc
mov qword [rbp + 0x10], rsi
mov dword [rsp - 0x2c], 0x380ce754
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x44], 0x4f0dbc35
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
mov dword [rsp - 0x1c], 0x35aa440b
mov eax, 0x2dcf4e73
xor eax, 0x194d04a7
sub eax, 0x30c9542a
add eax, 0x2b2080a6
shr eax, cl
xchg r9, r9
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
mov dword [rsp - 0x2c], ecx
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
xchg rdx, rdx
mov rax, qword [rbp + 0x10]
cmp rax, 0xc
jb 0x14005f8a4
xor edx, edx
mov dword [rsp - 0x14], ebp
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
call fcn.140075150
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, r14
mov r14, rax
xchg r14, r8
xor eax, eax
xchg rdx, rdx
xor rdx, rbx
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
xchg r9, r9
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14005f984
lea rdx, [0x1400d93d0]
xchg rbp, rbp
xchg rsp, rcx
mov rsp, r8
xchg rsp, rcx
call fcn.140063dfc
test al, al
mov rdx, rdx
setne al
jmp 0x14005f984
mov al, 0x7e
sub al, 0x52
xor al, 0x58
sub al, 0x17
sub al, 0x5c
lea r11, [rsp + 0x60]
mov dword [rsp - 0x28], ebx
xchg rbx, rdx
mov rdx, qword [r11 + 0x18]
xchg rbx, rdx
xchg rsi, r10
mov r10, qword [r11 + 0x20]
xchg rsi, r10
mov rdi, qword [r11 + 0x28]
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret