joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d590
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.1400bd750
sub rsp, rax
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x14003d7a8
mov r9d, 0x1000
lea rdx, [rsp + 0x60]
call fcn.140039f70
xor edx, edx
test al, al
jne 0x14003d691
mov dword [rsp + 0x20], 0x274d2704
mov r8d, 0x275f
mov dword [rsp + 0x24], 0x2742273c
mov dword [rsp + 0x28], 0x27052720
mov dword [rsp + 0x2c], 0x2741270b
mov dword [rsp + 0x30], 0x27482713
mov dword [rsp + 0x34], 0x270f271b
mov dword [rsp + 0x38], 0x2708270a
mov dword [rsp + 0x3c], 0x2703274d
mov dword [rsp + 0x40], 0x27142700
mov dword [rsp + 0x44], 0x271e2704
mov dword [rsp + 0x48], 0x27542716
mov dword [rsp + 0x4c], 0x2713271d
mov dword [rsp + 0x50], 0x271c2716
mov dword [rsp + 0x54], 0x2708271c
mov dword [rsp + 0x58], 0x2708
mov byte [rsp + 0x5c], 1
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x1d
jb 0x14003d670
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x20]
jmp 0x14003d78c
movsxd rax, dword [rbp - 0x64]
lea rcx, [rsp + 0x60]
add rcx, rax
mov r9d, edx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add r11, rax
test r10d, r10d
je 0x14003d6fb
nop word [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], 0x45474150
lea r8, [r11 + rcx*8]
jne 0x14003d6f3
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r8 + rax], dl
jne 0x14003d6e0
cmp rax, 4
je 0x14003d7c4
inc r9d
cmp r9d, r10d
jb 0x14003d6c0
mov dword [rsp + 0x20], 0x274d2704
mov r8d, 0x275f
mov dword [rsp + 0x24], 0x2742273c
mov dword [rsp + 0x28], 0x27052720
mov dword [rsp + 0x2c], 0x2741270b
mov dword [rsp + 0x30], 0x27482713
mov dword [rsp + 0x34], 0x2703270f
mov dword [rsp + 0x38], 0x27082705
mov dword [rsp + 0x3c], 0x271d274d
mov dword [rsp + 0x40], 0x2713270a
mov dword [rsp + 0x44], 0x271b2705
mov dword [rsp + 0x48], 0x271a271c
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rdx]
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x16
jb 0x14003d770
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.1400bc9e0
add rsp, 0x1070
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x14003d6fb
mov ecx, dword [r8 + 8]
lea r8, [rsp + 0x60]
add r8, rax
je 0x14003d6fb
test ecx, ecx
je 0x14003d6fb
test rdi, rdi
je 0x14003d7f1
mov dword [rdi], ecx
lea rax, [rsp + 0x60]
sub rbx, rax
lea rax, [r8 + rbx]
jmp 0x14003d7aa
Function at 0x14003fe40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x14003fe65
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x14003fe50
mov byte [rcx + 0x76], 0
ret

Function at 0x14003fe70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x14003fe95
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x14003fe80
mov byte [rcx + 0x6c], 0
ret

Function at 0x14003fea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x14003fec5
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x14003feb0
mov byte [rcx + 0x74], 0
ret

Function at 0x14003fed0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x14003fef5
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x14003fee0
mov byte [rcx + 0x6e], 0
ret

Function at 0x14003ff00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x14003ff25
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x14003ff10
mov byte [rcx + 0x48], 0
ret

Function at 0x14003ff30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x14003ff55
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x14003ff40
mov byte [rcx + 0x66], 0
ret

Function at 0x140040be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140040c05
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140040bf0
mov byte [rcx + 0x4a], 0
ret

Function at 0x140040c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140040c35
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140040c20
mov byte [rcx + 0x50], 0
ret

Function at 0x140040c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140040c65
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140040c50
mov byte [rcx + 0x3e], 0
ret

Function at 0x140040c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140040c95
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x140040c80
mov byte [rcx + 0x36], 0
ret

Function at 0x140040ca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140040cc5
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x140040cb0
mov byte [rcx + 0x4c], 0
ret

Function at 0x140040cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140040cf5
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x140040ce0
mov byte [rcx + 0x46], 0
ret
Function at 0x140040d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140040d25
xor eax, eax
mov r8d, 0x275f
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x140040d10
mov byte [rcx + 0x58], 0
ret
Function at 0x140048db0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140048ec3
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140048ec3
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x140048e28
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140048ed0
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x140048eb1
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x140048eb1
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x140048e8a
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x140048ea6
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400495a0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x140048e40
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140048ed0
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bc9e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004d1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x140109720]
movsxd rax, dword [0x1400faa98]
xor esi, esi
mov edx, esi
cmp eax, 0x7b
ja 0x14004d216
lea rdx, [0x1401081c0]
mov rdx, qword [rdx + rax*8]
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], sil
test rdx, rdx
jne 0x14004d282
mov dword [rbp - 0x40], 0xc8c0cef9
mov dword [rbp - 0x3c], 0xfa90dbcd
mov dword [rbp - 0x38], 0x100cad7
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x14004d250
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14004d272
lea rdx, [rbp - 0x40]
jmp 0x14004d29a
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14004d290
lea rcx, [rbp - 0x28]
call fcn.140037020
cmp edi, 1
jne 0x14004d309
movdqa xmm0, xmmword [0x1400e89b0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xde
mov byte [rbp - 0x2e], dil
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x14004d2d0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004d2f0
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.140037020
movss xmm0, dword [0x1400e7d80]
movss dword [rbp - 0x40], xmm0
movss xmm1, dword [0x1400e7d44]
movss dword [rbp - 0x3c], xmm1
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x40]
call fcn.140030920
test al, al
je 0x14004d360
test edi, edi
jne 0x14004d360
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14004d170]
xor edx, edx
xor ecx, ecx
call qword [0x1400c1160]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14004d39e
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d399
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d399
call qword [0x1400c1c00]
int3
call fcn.1400bd290
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bc9e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14004eea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14004eec3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x56]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14004eeb0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x1400503b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [0x1400c1188]
lea rcx, str.ntdll.dll
call qword [0x1400c1258]
movzx ecx, byte [0x1400e7840]
mov r9, rax
movups xmm0, xmmword [str.oAfMHBoDMK___v__4___M]
mov byte [rsp + 0x38], cl
xor ecx, ecx
cmp dword [0x1400fa090], 2
movsd xmm1, qword [0x1400e7838]
movups xmmword [rsp + 0x20], xmm0
movsd qword [rsp + 0x30], xmm1
jl 0x140050589
movdqa xmm0, xmmword [str.5555555555555555]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1400e8040]
mov eax, 4
movdqa xmm4, xmmword [0x1400e8770]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [str.1111]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400e8100]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400e8100]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x140050470
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x19
jge 0x1400505cd
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x19
jl 0x1400505a0
lea rdx, [rsp + 0x20]
mov rcx, r9
call qword [0x1400c1250]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call rax
test eax, eax
jne 0x1400505fd
cmp byte [rsp + 0x50], al
je 0x1400505fd
cmp byte [rsp + 0x51], al
je 0x140050612
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bc9e0
add rsp, 0x98
ret
lea rdx, str.SystemKernelDebuggerInformation
lea rcx, [rsp + 0x20]
call fcn.140036fe0
mov rcx, rax
call fcn.14004e0a0
int3
Function at 0x1400511b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400e89c0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xd8d0cbd7
mov dword [rsp + 0x34], 0xada1dc9e
mov dword [rsp + 0x38], 0xa0a6ae
mov byte [rsp + 0x3c], 1
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x56]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x1b
jb 0x1400511f0
mov rcx, qword [0x1400c1660]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x3c], 0
call fcn.140045a80
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
mov al, 1
add rsp, 0x48
ret
Function at 0x140056f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
call qword [fcn.14006ea90]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1400570b9
movdqa xmm0, xmmword [0x1400e89e0]
mov ecx, ebx
movdqa xmm1, xmmword [0x1400e8890]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x78], r14
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0xbda4bbe4
mov word [rbp - 0xc], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x56]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x24
jb 0x140056fc0
lea r8, [rbp - 0x30]
mov byte [rbp - 0xb], bl
mov edx, 0x2712
mov rcx, rdi
call qword [fcn.140071290]
mov edx, 0x34
mov rcx, rdi
lea r8d, [rdx - 0x33]
call qword [fcn.140071290]
lea r8, [0x140056ee0]
mov edx, 0x4e2b
mov rcx, rdi
call qword [fcn.140071290]
lea r8, [0x140108178]
mov edx, 0x2711
mov rcx, rdi
call qword [fcn.140071290]
mov rcx, rdi
call qword [fcn.14006eb50]
mov r14d, eax
test eax, eax
je 0x1400570a9
movdqa xmm0, xmmword [0x1400e88f0]
mov qword [rsp + 0x70], rsi
mov rsi, qword [0x1400c14a8]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xd8c9cadf
mov dword [rbp - 0x1c], 0xe1facbcd
mov word [rbp - 0x18], 0x100
nop
lea eax, [rbx - 0x56]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x18
jb 0x140057060
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x17], 0
mov rcx, rsi
call fcn.1400486f0
mov ecx, r14d
call qword [fcn.14006e180]
mov rdx, rax
mov rcx, rsi
call fcn.1400486f0
lea rdx, [0x1400488e0]
mov rcx, rax
call qword [0x1400c1468]
mov rsi, qword [rsp + 0x70]
mov rcx, rdi
call qword [0x1400e8cc0]
mov r14, qword [rsp + 0x78]
jmp 0x140057110
mov rdi, qword [0x1400c14a8]
mov dword [rbp - 0x40], 0xe1fefee9
mov dword [rbp - 0x3c], 0xc3c2ca8e
mov dword [rbp - 0x38], 0x100c1dd
nop word [rax + rax]
lea eax, [rbx - 0x56]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 0xa
jb 0x1400570e0
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x35], 0
mov rcx, rdi
call fcn.1400486f0
lea rdx, [0x1400488e0]
mov rcx, rdi
call qword [0x1400c1468]
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400598b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400598e4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x16]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400598d0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x140059911
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140059930
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14005993e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140037d90
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400599b5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400599b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400599b0
call qword [0x1400c1c00]
int3
call fcn.1400bd290
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400599d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x140059a14
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x16]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140059a00
mov byte [r8 + 0xc], r9b
lea rax, [r8 + 0xb]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], 0xf
cmp r8, rax
jne 0x140059a3b
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x140059a62
mov qword [rbp - 0x48], 0xb
movsd xmm0, qword [r8]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x50], ax
movzx eax, byte [r8 + 0xa]
mov byte [rbp - 0x4e], al
mov byte [rbp - 0x4d], r9b
cmp byte [rdx + 9], 0
je 0x140059a83
mov rcx, r9
nop dword [rax + rax]
lea eax, [rcx + 0x16]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x140059a70
mov byte [rdx + 9], 0
lea rax, [rdx + 8]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], 0xf
cmp rdx, rax
jne 0x140059aaa
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x140059abd
mov qword [rbp - 0x28], 8
mov rax, qword [rdx]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400590e0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140059b11
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059b0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059b0b
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140059b4f
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059b4a
call qword [0x1400c1c00]
int3
call fcn.1400bd290
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140059b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140059ba4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x16]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140059b90
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x140059bd1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140059be7
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140059bf5
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140037d90
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140059c6c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059c67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059c67
call qword [0x1400c1c00]
int3
call fcn.1400bd290
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140059c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140059cc4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x16]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140059cb0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], 0xf
cmp r8, rax
jne 0x140059ceb
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140059d05
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x140059d23
mov rcx, r9
nop
lea eax, [rcx + 0x16]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140059d10
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], 0xf
cmp rdx, rax
jne 0x140059d4a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140059d66
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.1400590e0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140059dba
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059db4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059db4
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140059df8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059df3
call qword [0x1400c1c00]
int3
call fcn.1400bd290
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret