joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401899e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
call fcn.140189e30
mov qword [rbp - 0x20], rdi
mov edx, edi
mov rax, qword [rsi + 0x168]
mov rcx, qword [rsi + 0x170]
sub rcx, rax
sar rcx, 1
cmp rcx, rdx
mov qword [rbp - 0x28], rdx
jbe 0x140189a3a
movzx r12d, word [rax + rdx*2]
test r12w, r12w
je 0x140189a3a
xor r14d, r14d
jmp 0x140189a40
mov r14b, 1
xor r12d, r12d
lea rax, [rsi + 0x168]
mov qword [rbp - 0x10], rax
lea rax, [0x140365fc4]
movsxd rdi, dword [0x140365fc4]
mov r15, rdi
xor r15, rax
and rdi, rax
add rdi, rdi
mov ebx, dword [0x140365fc0]
mov rcx, rsi
call fcn.140189f20
mov dword [rbp - 4], r12d
add r15, rdi
mov r12d, dword [0x14044bcd0]
lea r13d, [r12 + 1]
mov dword [0x14044bcd0], r13d
test r12d, r13d
je 0x140189a96
xor edi, edi
jmp 0x140189acc
xor eax, eax
mov edi, 0
test ebx, ebx
jle 0x140189acc
xor ecx, ecx
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov edi, edx
xor edi, edx
not edi
and edi, ecx
xor edi, edx
add eax, 2
mov ecx, edi
cmp eax, ebx
jl 0x140189ab0
test r14b, r14b
mov rbx, qword [rbp - 0x28]
je 0x140189be4
mov qword [rbp - 0x18], rsi
mov rcx, rsi
call fcn.140189cd0
mov rcx, qword [rsi + 0x168]
mov r14, qword [rsi + 0x170]
mov rax, r14
sub rax, rcx
sar rax, 1
cmp rax, rbx
seta dl
movzx r8d, byte [0x14049095b]
test r8b, dl
jne 0x140189b32
xor r8b, dl
jne 0x140189b32
mov word [rbp - 6], 0
mov rdx, qword [rbp - 0x20]
inc edx
cmp rax, rdx
jbe 0x140189b44
lea rax, [rcx + rdx*2]
mov qword [rsi + 0x170], rax
jmp 0x140189b8e
movzx eax, word [rcx + rbx*2]
mov dword [rbp - 4], eax
test ax, ax
jne 0x140189bdb
jmp 0x140189b8e
jae 0x140189b8e
cmp byte [0x140490b00], 0
jne 0x140189b81
mov r8, rdx
mov rdx, qword [rsi + 0x178]
sub rdx, rcx
sar rdx, 1
cmp rdx, r8
mov rdx, r8
jb 0x140189b81
sub rdx, rax
lea r8, [rdx + rdx]
mov rcx, r14
mov r15, rdx
xor edx, edx
call fcn.140341b50
lea rax, [r14 + r15*2]
jmp 0x140189b29
lea r8, [rbp - 6]
mov rcx, qword [rbp - 0x10]
call fcn.14018a020
and r12d, r13d
movzx eax, word [0x140365fcc]
xor ecx, ecx
cmp r12d, 1
sbb ecx, ecx
sub eax, edi
mov edx, eax
xor edx, ecx
not edx
test dx, ax
setne al
or al, byte [0x14049095b]
and al, 1
mov byte [0x14049095b], al
add rsi, 0xe8
mov rcx, rsi
call fcn.14018e050
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov dword [rbp - 4], ecx
mov word [rax + rbx*2], cx
lea rcx, [rbp - 0x18]
call fcn.140189910
mov eax, dword [rbp - 4]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401a0d00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x1401a0d83
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov r8, qword [case.0x1400eabdd.0]
mov qword [rbp - 0x10], 0
lea rdx, [rbp - 8]
call r8
mov r13, qword [rbp - 8]
test r13, r13
je 0x1401a0d86
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov qword [rbp - 0x18], r13
mov rcx, r13
call qword [case.0x1400eabdd.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
mov r13, qword [rbp - 0x18]
je 0x1401a0d86
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400eabdd.0]
jmp 0x1401a0d86
xor r13d, r13d
mov rax, qword [rdi + 0x18]
mov r15, qword [0x14044e378]
movsxd r12, dword [r15]
mov ebx, dword [0x140367bc4]
mov qword [rsi + 0x18], rax
mov eax, dword [0x14049116c]
add eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1401a0dd5
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov rdx, qword [case.0x1400eabdd.0]
mov qword [rbp - 0x10], r13
call rdx
mov qword [rsi + 8], r13
mov eax, dword [0x1404910c8]
lea esi, [rax + 1]
mov dword [0x1404910c8], esi
mov ecx, eax
not ecx
xor eax, esi
not esi
and esi, ecx
or esi, eax
xor edi, edi
xor esi, 0xffffffff
mov r14d, 0
jne 0x1401a0e67
mov rax, r12
xor rax, r15
and r12, r15
lea rax, [rax + r12*2]
xor ecx, ecx
mov edi, 0
mov r14d, 0
test ebx, ebx
jle 0x1401a0e67
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
movsxd rcx, ecx
mov r9, qword [rax + rcx]
mov r10, qword [rax + rcx + 8]
mov rdi, r9
xor rdi, r9
mov r14, r10
xor r14, r10
not r14
and r14, r8
xor r14, r10
not rdi
and rdi, rdx
xor rdi, r9
add ecx, 0x10
mov rdx, rdi
mov r8, r14
cmp ecx, ebx
jl 0x1401a0e30
test r13, r13
je 0x1401a0e95
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov rdx, qword [case.0x1400eabdd.0]
mov qword [rbp - 0x10], r13
mov rcx, r13
call rdx
mov rax, qword [r13]
mov rax, qword [rax + 0x20]
mov rcx, r13
call qword [case.0x1400eabdd.0]
mov rcx, qword [0x140367bd8]
xor edx, edx
test esi, esi
setne dl
xor r8d, r8d
add rdx, 0xffffffffffffffff
adc r8, 0xffffffffffffffff
mov rax, qword [0x140367bd0]
sub rax, rdi
sbb rcx, r14
and rcx, r8
and rax, rdx
or rax, rcx
mov rcx, rax
shr rcx, 0x20
or ecx, eax
add dword [0x14049116c], ecx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401a4b80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, qword [0x14044e9d8]
movsxd r14, dword [r12]
mov rdi, rdx
mov rbx, rcx
mov r15d, dword [0x140368a0c]
mov eax, 0xffff9d1a
add eax, dword [0x14044ea60]
cdqe
add rax, qword [0x14044ea88]
lea rdx, [rbp - 0x40]
mov rcx, r8
mov r8d, 0xafc2dd8b
call qword [case.0x1400eabdd.0]
test rdi, rdi
sete al
setne cl
test dil, 0xf
setne dl
sete r8b
xor r8b, cl
and dl, al
or dl, r8b
mov esi, 0xffffffff
cmp dl, 1
je 0x1401a4c44
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x40]
call fcn.140175e40
lea rcx, [rbp - 0x18]
mov rdx, rbx
mov r8, rdi
call fcn.1402476f0
mov qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov rcx, rbx
mov rdx, rdi
call fcn.140229ab0
mov ecx, dword [0x1404903d8]
add ecx, dword [rbp - 0x10]
xor esi, esi
neg eax
sbb esi, esi
or esi, ecx
mov rdi, qword [rbp - 0x38]
mov eax, dword [0x14044e9d0]
mov ecx, eax
xor ecx, 1
mov edx, eax
and edx, 1
lea edx, [rcx + rdx*2]
mov dword [0x14044e9d0], edx
xor ecx, ecx
test eax, edx
jne 0x1401a4c92
add r14, r12
test r15d, r15d
jle 0x1401a4c92
xor r8d, r8d
xor ecx, ecx
nop word cs:[rax + rax]
movsxd r9, r8d
add r9, r14
xor ecx, dword [r9]
add r8d, 4
cmp r8d, r15d
jl 0x1401a4c80
test rdi, rdi
je 0x1401a4d23
mov rbx, qword [rbp - 0x28]
and eax, edx
mov edx, dword [0x140368a18]
xor r8d, r8d
cmp eax, 1
sbb r8d, r8d
sub edx, ecx
and edx, r8d
mov eax, edx
add rax, qword [0x1404903d8]
mov qword [0x1404903d8], rax
sub rbx, rdi
mov rcx, rdi
xor edx, edx
mov r8, rbx
call fcn.140341b50
cmp rbx, 0xfff
jbe 0x1401a4cfd
mov rax, qword [0x140490898]
add rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x1401a4d34
add rbx, 0x27
mov rdi, rax
mov eax, 0xffff9d1a
add eax, dword [0x14044ea6c]
cdqe
add rax, qword [0x14044ea70]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0xebf6dc2e
call qword [case.0x1400eabdd.0]
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.1402f9bec
int3

Function at 0x1401b8910
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x140491348]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1401b893e
mov rcx, rsi
call fcn.140319880
cmp dword [0x140452194], 0xec926722
je 0x1401b8991
lea rax, [fcn.1401b8910]
lea edi, [rax + rax]
add edi, 0x8a0
nop
mov rcx, rsi
call fcn.140319880
mov eax, dword [0x140452194]
lea ecx, [rax + 0x136d98df]
xor ecx, edi
not ecx
and ecx, edi
mov edx, dword [0x140450a90]
add eax, edx
add eax, 0x136d094e
cdqe
add rax, qword [0x140450aa0]
mov edx, 0xf054dd93
call qword [case.0x1400eabdd.0]
test al, 1
je 0x1401b8950
jmp 0x1401b892a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401dc360
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
test ecx, ecx
je 0x1401dc399
test edx, edx
je 0x1401dc48b
movzx eax, byte [0x140455244]
cmp al, 0xa1
je 0x1401dc520
mov cl, 0x90
mov al, 0xf1
lock cmpxchg byte [0x140455244], cl
je 0x1401dc4e9
cmp al, 0xa1
jne 0x1401dc380
jmp 0x1401dc520
test edx, edx
je 0x1401dc4b9
movzx eax, byte [0x1404553b2]
nop dword [rax + rax]
cmp al, 0x7a
je 0x1401dc534
movzx ecx, byte [0x1404558dc]
lea eax, [rcx - 0x63]
add cl, 0x63
lock cmpxchg byte [0x1404553b2], cl
jne 0x1401dc3b0
xor edx, edx
mov r8d, 0xa1ba8c27
lea r9, [0x1404553a0]
lea r10, [0x14036a5f0]
lea rax, [fcn.1401dc360]
lea r11d, [rax + rax]
add r11d, 0x2520
mov esi, r11d
not esi
jmp 0x1401dc40b
inc edx
cmp edx, 0x12
jge 0x1401dc52c
mov eax, dword [0x140491514]
mov ecx, dword [0x1404558d8]
add ecx, r8d
movsxd rdi, edx
cmp eax, ecx
jge 0x1401dc460
nop word cs:[rax + rax]
movzx eax, byte [rdi + r10]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rdi + r9]
xor cl, al
mov byte [rdi + r9], cl
mov eax, dword [0x140491510]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
je 0x1401dc400
nop word cs:[rax + rax]
movzx eax, byte [rdi + r9]
movzx ecx, byte [rdi + r10]
shl al, cl
sub cl, al
mov ebx, eax
shl bl, cl
sub al, bl
mul bl
mov ecx, ebx
xor cl, bl
not cl
and cl, al
xor cl, bl
mov byte [rdi + r9], cl
test esi, r11d
jne 0x1401dc460
jmp 0x1401dc430
movzx eax, byte [0x14045537a]
cmp al, 0x3a
je 0x1401dc570
mov cl, 0x8b
nop dword [rax]
mov al, 0x7a
lock cmpxchg byte [0x14045537a], cl
je 0x1401dc540
cmp al, 0x3a
jne 0x1401dc4a0
jmp 0x1401dc570
movzx eax, byte [0x14045542d]
cmp al, 0xe6
je 0x1401dc5b0
mov cl, 0xbb
nop word [rax + rax]
mov al, 0x58
lock cmpxchg byte [0x14045542d], cl
je 0x1401dc579
cmp al, 0xe6
jne 0x1401dc4d0
jmp 0x1401dc5b0
xor eax, eax
lea rcx, [0x140455240]
lea rdx, [0x14036a4a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1401dc518
inc rax
jmp 0x1401dc500
mov al, 0xa1
xchg byte [0x140455244], al
lea rax, [0x140455240]
jmp 0x1401dc5f1
mov al, 0x7a
xchg byte [0x1404553b2], al
lea rax, [0x1404553a0]
jmp 0x1401dc5f1
xor eax, eax
lea rcx, [0x140455360]
lea rdx, [0x14036a5b0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x1401dc568
inc rax
jmp 0x1401dc550
mov al, 0x3a
xchg byte [0x14045537a], al
lea rax, [0x140455360]
jmp 0x1401dc5f1
xor eax, eax
lea rcx, [0x140455420]
lea rdx, [0x14036a670]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401dc5a8
inc rax
jmp 0x1401dc590
mov al, 0xe6
xchg byte [0x14045542d], al
xor eax, eax
test al, al
jne 0x1401dc5d0
mov eax, dword [0x140491514]
mov ecx, 0xa1ba8c18
add ecx, dword [0x1404558d8]
cmp eax, ecx
jl 0x1401dc5ea
nop dword [rax + rax]
mov eax, dword [0x140491510]
mov ecx, dword [0x1404558d8]
add ecx, eax
inc ecx
imul ecx, eax
test cl, 1
jne 0x1401dc5d0
jmp 0x1401dc5b6
lea rax, [0x140455420]
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401dfda0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [rcx + 8]
movsxd r13, dword [0x14036adc4]
mov r12d, dword [0x14036adc0]
mov r8, rbp
mov edx, 1
mov r9d, 0xd459d379
call fcn.1401e1170
mov r15d, eax
or byte [rsi + 0x10], 1
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.1401e0070
mov qword [rsi + 0x18], 0x7fffffff
mov qword [rsi + 0x38], 0
test r15d, r15d
je 0x1401dffbc
mov rcx, qword [rsi + 8]
mov rbx, qword [rcx + 8]
mov eax, dword [0x140456190]
lea r9d, [rax + 1]
mov dword [0x140456190], r9d
mov qword [rbp + 8], rax
test eax, r9d
jne 0x1401dfe42
test r12d, r12d
jg 0x1401dffd0
xor r14d, r14d
cmp byte [rcx + 0x18], 0
je 0x1401dfe59
cmp byte [0x140490429], 0
je 0x1401dfe7f
jmp 0x1401dffbc
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, r15d
mov r15d, r9d
call qword [case.0x1400eabdd.0]
mov r9d, r15d
mov r15d, eax
cmp byte [0x140490429], 0
jne 0x1401dffbc
mov eax, r15d
cmp dword [rbx + rax + 0xc], 0
je 0x1401dffbc
add rbx, rax
lea r15, [rbp - 0x58]
mov rax, qword [rbp + 8]
and eax, r9d
mov qword [rbp + 8], rax
jmp 0x1401dfebe
cmp dword [rbx + 0x20], 0
lea rbx, [rbx + 0x14]
je 0x1401dffbc
mov rdx, qword [rsi + 8]
mov rcx, r15
mov r8, rbx
mov r9d, 0x18633fad
call fcn.1401e1190
mov rdx, qword [rsi + 0x28]
cmp rdx, qword [rsi + 0x30]
je 0x1401dfef0
mov rcx, rdi
mov r8, r15
call fcn.1401e0aa0
add qword [rsi + 0x28], 0x58
jmp 0x1401dff27
movzx eax, byte [0x14036adcc]
cmp dword [rbp + 8], 1
mov ecx, 0
sbb ecx, ecx
sub al, r14b
not al
xor al, cl
test al, cl
setne al
or al, byte [0x140490429]
and al, 1
mov byte [0x140490429], al
mov rcx, rdi
mov r8, r15
call fcn.1401e08c0
lea rcx, [rbp - 0x18]
call fcn.1401e01e0
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x1401dff6f
mov rcx, qword [rbp - 0x48]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401dff6a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1401dfff5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140084550
mov r13, qword [rsi + 0x28]
add r13, 0xffffffffffffffa8
mov rcx, r13
mov edx, 0xe8ec0ad1
call fcn.1401e11a0
mov rcx, r13
mov edx, 0x9f27020
call fcn.1401e1160
mov r12d, eax
mov rcx, r13
mov edx, 0xde331f1
call fcn.1401e11b0
cmp r12d, dword [rsi + 0x18]
jae 0x1401dffab
mov dword [rsi + 0x18], r12d
cmp eax, dword [rsi + 0x1c]
jbe 0x1401dfeb0
mov dword [rsi + 0x1c], eax
jmp 0x1401dfeb0
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor eax, eax
lea rdx, [0x14036adc4]
xor r14d, r14d
nop dword [rax]
lea r8, [rax + r13]
xor r14b, byte [rdx + r8]
inc rax
cmp eax, r12d
jl 0x1401dffe0
jmp 0x1401dfe45
call fcn.1402f9bec
int3
Function at 0x1401ec520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov r13, qword [0x140457298]
mov rdi, rdx
mov rax, rcx
movsxd r15, dword [r13]
mov r12d, dword [0x14036bd60]
test rdx, rdx
je 0x1401ec59e
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 7
mov word [rbp - 0x20], 0
mov rcx, rdi
mov edx, 0xdc2f752e
call fcn.140084740
mov r14, rax
cmp rax, 7
jbe 0x1401ec5b2
mov rcx, rbx
mov rdx, r14
mov r9, rdi
call fcn.140077c70
jmp 0x1401ec5cf
cmp qword [rax + 0x20], 0x10
jb 0x1401ec6cb
mov rcx, qword [rax + 8]
jmp 0x1401ec6cf
mov qword [rbp - 0x10], r14
mov r8, r14
add r8, r14
mov rcx, rbx
mov rdx, rdi
call fcn.1403414a0
mov word [rbp + r14*2 - 0x20], 0
lea rax, [0x14035c690]
mov qword [rbp - 0x28], rax
mov edi, dword [0x140457288]
lea ebx, [rdi + 1]
mov dword [0x140457288], ebx
xor r14d, r14d
mov esi, 0
test edi, ebx
mov rcx, qword [rbp - 0x30]
jne 0x1401ec635
xor eax, eax
mov r14d, 0
mov esi, 0
test r12d, r12d
jle 0x1401ec635
add r15, r13
xor r14d, r14d
xor esi, esi
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
xor r14, qword [rdx]
xor rsi, qword [rdx + 8]
add eax, 0x10
cmp eax, r12d
jl 0x1401ec620
lea rdx, [rbp - 0x28]
call fcn.1401eb760
mov r11, qword [rbp - 8]
cmp r11, 8
jb 0x1401ec6f4
mov rdx, qword [rbp - 0x20]
mov rcx, qword [0x14036bd70]
mov r8, qword [0x14036bd68]
xor r9d, r9d
test edi, ebx
setne r9b
xor r10d, r10d
add r9, 0xffffffffffffffff
adc r10, 0xffffffffffffffff
sub r8, r14
sbb rcx, rsi
and r8, r9
and rcx, r10
or rcx, r8
add qword [0x140490db8], rcx
lea r8, [r11 + r11]
add r8, 2
cmp r8, 0x1000
jb 0x1401ec6dc
mov rcx, qword [0x140490db8]
add rcx, qword [rdx - 8]
sub rdx, rcx
add rdx, 0xfffffffffffffff8
cmp rdx, 0x20
jae 0x1401ec705
mov rsi, rax
add r11, r11
mov rdx, r11
xor rdx, 0x29
and r11d, 0x29
lea r8, [rdx + r11*2]
mov rdx, rcx
jmp 0x1401ec6df
lea rcx, [rax + 8]
mov qword [rax + 0x18], 0
mov byte [rcx], 0
jmp 0x1401ec6f4
mov rsi, rax
mov dword [rsp + 0x20], 0xfaf5f4c4
xor ecx, ecx
xor r9d, r9d
call fcn.1400ed740
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1402f9bec
int3
Function at 0x1401ef2e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
cmp qword [r8 + 0x20], 0x10
jb 0x1401ef314
mov rdx, qword [r8 + 8]
jmp 0x1401ef318
lea rdx, [r8 + 8]
lea r13, [rcx + 8]
mov rdi, qword [r8 + 0x18]
mov rax, qword [0x140457be8]
movsxd r14, dword [rax]
add r14, rax
mov r15d, dword [0x14036c624]
movabs rbx, 0x7fffffffffffffff
cmp rdi, 0x10
mov qword [rbp - 8], rcx
jae 0x1401ef358
movups xmm0, xmmword [rdx]
movups xmmword [r13], xmm0
mov r12d, 0xf
jmp 0x1401ef3c1
mov qword [rbp - 0x10], rdx
mov r12, rdi
or r12, 0xf
cmp r12, rbx
cmovae r12, rbx
cmp r12, 0xfff
jb 0x1401ef390
lea rcx, [r12 + 0x28]
mov edx, 0xc2b36bea
call fcn.140084ab0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1401ef3a2
lea rcx, [r12 + 1]
mov edx, 0xc2b36bea
call fcn.140084ab0
mov rcx, rax
mov qword [r13], rcx
mov rax, qword [0x1404917b8]
lea r8, [rdi + rax]
inc r8
mov rdx, qword [rbp - 0x10]
call fcn.1403414a0
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], r12
lea rdi, [0x14035c428]
mov qword [rcx], rdi
mov r11d, dword [0x140457be0]
lea edx, [r11 + 1]
mov dword [0x140457be0], edx
xor eax, eax
mov r8d, 0
test r11d, edx
jne 0x1401ef425
xor r9d, r9d
mov eax, 0
mov r8d, 0
test r15d, r15d
jle 0x1401ef425
xor eax, eax
xor r8d, r8d
nop dword [rax]
movsxd r9, r9d
xor r8, qword [r14 + r9 + 8]
xor rax, qword [r14 + r9]
add r9d, 0x10
cmp r9d, r15d
jl 0x1401ef410
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov r14, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0x10
jb 0x1401ef43d
mov rsi, qword [rsi + 8]
jmp 0x1401ef441
add rsi, 8
lea r15, [rcx + 0x30]
cmp r14, 0x10
jae 0x1401ef45c
movups xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov ebx, 0xf
jmp 0x1401ef4e5
mov r9, r14
or r9, 0xf
xor r10d, r10d
test r11d, edx
setne r10b
mov rdx, qword [0x14036c648]
mov rcx, qword [0x14036c640]
xor r11d, r11d
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
sub rcx, rax
sbb rdx, r8
and rcx, r10
and rdx, r11
or rcx, rdx
add qword [0x1404917b8], rcx
cmp r9, rbx
cmovb rbx, r9
cmp rbx, 0xffe
jbe 0x1401ef4c6
lea rcx, [rbx + 0x28]
call fcn.14031953c
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1401ef4d2
lea rcx, [rbx + 1]
call fcn.14031953c
mov rcx, rax
mov qword [r15], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call fcn.1403414a0
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x28], rdi
mov rax, rcx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401f37c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f37fc
test edx, edx
je 0x1401f382c
movzx eax, byte [0x1404581a7]
cmp al, 0x29
je 0x1401f37f4
mov cl, 0x8f
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x1404581a7], cl
je 0x1401f388c
cmp al, 0x29
jne 0x1401f37e0
lea rax, [0x140458190]
ret
test edx, edx
je 0x1401f385c
movzx eax, byte [0x140457e60]
cmp al, 0xb2
je 0x1401f3824
mov cl, 0x4c
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x140457e60], cl
je 0x1401f38c1
cmp al, 0xb2
jne 0x1401f3810
lea rax, [0x140457e50]
ret
movzx eax, byte [0x140457fa6]
cmp al, 0x3c
je 0x1401f3854
mov cl, 0x8e
nop dword [rax]
mov al, 0xdf
lock cmpxchg byte [0x140457fa6], cl
je 0x1401f3901
cmp al, 0x3c
jne 0x1401f3840
lea rax, [0x140457f90]
ret
movzx eax, byte [0x1404581bb]
cmp al, 0xdd
je 0x1401f3884
mov cl, 0x43
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x1404581bb], cl
je 0x1401f3941
cmp al, 0xdd
jne 0x1401f3870
lea rax, [0x1404581b0]
ret
xor eax, eax
lea rcx, [0x140458190]
lea rdx, [0x14036cbd0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x17
jl 0x1401f38a0
mov al, 0x29
xchg byte [0x1404581a7], al
lea rax, [0x140458190]
ret
xor eax, eax
lea rcx, [0x140457e50]
lea rdx, [0x14036c880]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x1401f38e0
mov al, 0xb2
xchg byte [0x140457e60], al
lea rax, [0x140457e50]
ret
xor eax, eax
lea rcx, [0x140457f90]
lea rdx, [0x14036c9d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x16
jl 0x1401f3920
mov al, 0x3c
xchg byte [0x140457fa6], al
lea rax, [0x140457f90]
ret
xor eax, eax
lea rcx, [0x1404581b0]
lea rdx, [0x14036cbf0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1401f3960
mov al, 0xdd
xchg byte [0x1404581bb], al
lea rax, [0x1404581b0]
ret
Function at 0x1401f3a20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f3a5c
test edx, edx
je 0x1401f3a8c
movzx eax, byte [0x14045812d]
cmp al, 0x5d
je 0x1401f3a54
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x14045812d], cl
je 0x1401f3aec
cmp al, 0x5d
jne 0x1401f3a40
lea rax, [0x140458120]
ret
test edx, edx
je 0x1401f3abc
movzx eax, byte [0x1404580fb]
cmp al, 0x39
je 0x1401f3a84
mov cl, 0xb5
nop dword [rax]
mov al, 0x3a
lock cmpxchg byte [0x1404580fb], cl
je 0x1401f3b21
cmp al, 0x39
jne 0x1401f3a70
lea rax, [0x1404580f0]
ret
movzx eax, byte [0x140457e48]
cmp al, 0xa5
je 0x1401f3ab4
mov cl, 0xee
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x140457e48], cl
je 0x1401f3b61
cmp al, 0xa5
jne 0x1401f3aa0
lea rax, [0x140457e40]
ret
movzx eax, byte [0x140457e10]
cmp al, 0x3e
je 0x1401f3ae4
mov cl, 0x52
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x140457e10], cl
je 0x1401f3ba1
cmp al, 0x3e
jne 0x1401f3ad0
lea rax, [0x140457e00]
ret
xor eax, eax
lea rcx, [0x140458120]
lea rdx, [0x14036cb60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x1401f3b00
mov al, 0x5d
xchg byte [0x14045812d], al
lea rax, [0x140458120]
ret
xor eax, eax
lea rcx, [0x1404580f0]
lea rdx, [0x14036cb30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1401f3b40
mov al, 0x39
xchg byte [0x1404580fb], al
lea rax, [0x1404580f0]
ret
xor eax, eax
lea rcx, [0x140457e40]
lea rdx, [0x14036c870]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x1401f3b80
mov al, 0xa5
xchg byte [0x140457e48], al
lea rax, [0x140457e40]
ret
xor eax, eax
lea rcx, [0x140457e00]
lea rdx, [0x14036c840]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x1401f3bc0
mov al, 0x3e
xchg byte [0x140457e10], al
lea rax, [0x140457e00]
ret