joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400910ac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x30
movaps xmmword [rax - 0x28], xmm6
mov r12, r9
mov rbp, r8
mov r15d, edx
mov r13, rcx
cmp edx, 1
ja 0x1400911c2
test bpl, 0xf
je 0x1400910ef
mov eax, 0xffffffde
jmp 0x140091146
test rbp, rbp
je 0x140091144
mov r14, qword [rsp + 0x70]
mov rsi, r12
mov rdi, qword [rsp + 0x78]
test r15d, r15d
jne 0x14009116a
sub rsi, rdi
movups xmm6, xmmword [r14]
mov r8, rdi
mov rdx, r14
mov rcx, r13
call fcn.140090a64
test eax, eax
jne 0x140091146
lea ecx, [rax + 0x10]
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x140091122
add r14, 0x10
sub rsi, 0x10
movdqu xmmword [r12], xmm6
sub rbp, 0x10
jne 0x140091109
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
sub rsi, r14
mov rdx, rdi
mov rcx, r14
sub rdx, r14
mov r8d, 0x10
mov al, byte [rsi + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
sub r8, 1
jne 0x14009117c
cmp r15d, 1
jne 0x1400911c2
mov r8, rdi
mov rdx, rdi
mov rcx, r13
call fcn.140090410
test eax, eax
jne 0x140091146
movups xmm0, xmmword [rdi]
add rdi, 0x10
add r14, 0x10
sub rsi, 0x10
movdqu xmmword [r12], xmm0
sub rbp, 0x10
je 0x140091144
jmp 0x14009116d
mov eax, 0xffffffdf
jmp 0x140091146

Function at 0x140091aa8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rdx]
mov rdi, r9
xor eax, dword [r8]
lea r9, [rbp + 0x38]
mov dword [rbp + 0x20], eax
mov rbx, rcx
mov eax, dword [rdx + 4]
lea rcx, [rbp + 0x20]
xor eax, dword [r8 + 4]
mov dword [rbp + 0x28], eax
mov eax, dword [rdx + 8]
xor eax, dword [r8 + 8]
mov dword [rbp + 0x30], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rbp + 0x28]
xor eax, dword [r8 + 0xc]
lea r8, [rbp + 0x30]
mov dword [rbp + 0x38], eax
lea rax, [0x1401d6e20]
mov qword [r11 - 0x20], rax
lea rax, [0x1401d6d20]
mov qword [r11 - 0x28], rax
lea rax, [0x1401d6c20]
mov qword [r11 - 0x30], rax
lea rax, str.cw
mov qword [r11 - 0x38], rax
call fcn.14009197c
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.140091800
mov eax, dword [rbp + 0x20]
xor eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rbp + 0x28]
xor eax, dword [rdi + 4]
mov dword [rbx + 4], eax
mov eax, dword [rbp + 0x30]
xor eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rbp + 0x38]
xor eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x140091b64
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rdx]
mov rdi, r9
xor eax, dword [r8]
lea r9, [rbp + 0x38]
mov dword [rbp + 0x20], eax
mov rbx, rcx
mov eax, dword [rdx + 4]
lea rcx, [rbp + 0x20]
xor eax, dword [r8 + 4]
mov dword [rbp + 0x28], eax
mov eax, dword [rdx + 8]
xor eax, dword [r8 + 8]
mov dword [rbp + 0x30], eax
mov eax, dword [rdx + 0xc]
lea rdx, [rbp + 0x28]
xor eax, dword [r8 + 0xc]
lea r8, [rbp + 0x30]
mov dword [rbp + 0x38], eax
lea rax, [0x1401d6c20]
mov qword [r11 - 0x20], rax
lea rax, str.cw
mov qword [r11 - 0x28], rax
lea rax, [0x1401d6e20]
mov qword [r11 - 0x30], rax
lea rax, [0x1401d6d20]
mov qword [r11 - 0x38], rax
call fcn.14009197c
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.140091800
mov eax, dword [rbp + 0x20]
xor eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rbp + 0x28]
xor eax, dword [rdi + 4]
mov dword [rbx + 4], eax
mov eax, dword [rbp + 0x30]
xor eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rbp + 0x38]
xor eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret

Function at 0x140091c20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
movzx r10d, r9b
mov rbx, r8
mov r11b, r10b
mov rdi, rdx
and r11b, 0x1f
shr r10d, 5
mov rsi, rcx
and r10d, 0x80000003
jge 0x140091c62
dec r10d
or r10d, 0xfffffffc
inc r10d
movzx ecx, r10b
mov r15d, 0xff00
movzx r14d, r11b
mov edx, dword [r8 + rcx*4]
mov r9d, edx
shl r9d, 0x10
mov eax, edx
and eax, r15d
shr edx, 8
xor r9d, eax
and edx, r15d
movzx eax, byte [r8 + rcx*4 + 3]
mov ecx, 0x20
shl r9d, 8
sub cl, r11b
xor r9d, eax
mov al, r11b
xor r9d, edx
mov r11d, 4
neg al
sbb al, al
and al, cl
movzx ebp, al
sub rdi, rsi
inc r10b
and r10b, 3
movzx edx, r10b
mov ecx, dword [rbx + rdx*4]
mov r8d, ecx
mov eax, ecx
shl r8d, 0x10
and eax, r15d
shr ecx, 8
xor r8d, eax
and ecx, r15d
movzx eax, byte [rbx + rdx*4 + 3]
shl r8d, 8
xor r8d, ecx
mov ecx, r14d
shl r9d, cl
xor r8d, eax
mov ecx, ebp
mov eax, r8d
shr eax, cl
or r9d, eax
mov ecx, r9d
mov eax, r9d
shr eax, 0x10
and ecx, 0xff0000
xor ecx, eax
mov eax, r9d
and eax, r15d
shl r9d, 0x10
xor eax, r9d
shr ecx, 8
shl eax, 8
mov r9d, r8d
xor ecx, eax
xor ecx, dword [rdi + rsi]
mov dword [rsi], ecx
lea rsi, [rsi + 4]
sub r11, 1
jne 0x140091cb6
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x14009717c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x90]
lea rax, [r11 - 0x38]
and qword [r11 - 0x38], 0
mov r15, rdx
lea rdx, [rcx + 0x10]
mov qword [r11 - 0x48], rax
mov rbx, r9
mov rsi, r8
mov rdi, rcx
lea r9, [r11 - 0x30]
xorps xmm0, xmm0
add rcx, 0x20
mov r8d, 0x10
movups xmmword [rsp + 0x38], xmm0
call fcn.140098964
mov ebp, eax
test eax, eax
je 0x1400971f2
or dword [rdi + 0xa4], 0x10
jmp 0x140097219
test rsi, rsi
je 0x140097217
sub r15, rbx
lea rcx, [rsp + 0x38]
add rcx, r15
sub r14, rbx
mov al, byte [rcx + rbx]
xor al, byte [rbx]
mov byte [r14 + rbx], al
inc rbx
sub rsi, 1
jne 0x140097205
xor ebp, ebp
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x38]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140140c70
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14009742c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov ecx, dword [rcx + 0xa4]
mov rsi, rdx
test cl, 0x10
jne 0x14009756b
test r8, r8
je 0x14009755e
test cl, 8
jne 0x14009756b
mov rdx, qword [rbx + 0x88]
test cl, 4
jne 0x140097496
cmp r8, rdx
ja 0x14009756b
mov al, byte [rbx + 0x89]
xor byte [rbx], al
mov al, byte [rbx + 0x88]
xor byte [rbx + 1], al
or ecx, 4
mov dword [rbx + 0xa4], ecx
jmp 0x1400974a9
mov rcx, qword [rbx + 0x98]
add rcx, r8
cmp rcx, rdx
ja 0x14009756b
mov r8, qword [rbx + 0x98]
mov eax, 0x10
add r8, 2
mov rdx, rdi
and r8d, 0xf
sub rax, r8
cmp rax, rdi
cmovbe rdx, rax
xor r9b, r9b
test rdx, rdx
je 0x1400974ea
xor eax, eax
lea rcx, [rax + r8]
inc r9b
mov al, byte [rax + rsi]
xor byte [rcx + rbx], al
movzx eax, r9b
cmp rax, rdx
jb 0x1400974d4
mov rcx, qword [rbx + 0x98]
lea rax, [rdx + r8]
add rcx, rdx
sub rdi, rdx
add rsi, rdx
mov qword [rbx + 0x98], rcx
cmp rax, 0x10
je 0x140097514
cmp rcx, qword [rbx + 0x88]
jne 0x140097537
lea rax, [rsp + 0x40]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.140098964
test eax, eax
jne 0x140097562
test rdi, rdi
jne 0x1400974a9
mov rax, qword [rbx + 0x88]
cmp qword [rbx + 0x98], rax
jne 0x14009755e
or dword [rbx + 0xa4], 8
and qword [rbx + 0x98], rdi
xor eax, eax
jmp 0x140097570
or dword [rbx + 0xa4], 0x10
jmp 0x140097570
mov eax, 0xfffffff3
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140097766
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test byte [rcx + 0xa4], 0x10
mov rsi, r8
mov r8, qword [rsp + 0xd8]
mov r13, rdx
mov qword [rsp + 0x30], r9
mov rbx, rcx
jne 0x1400977db
cmp qword [rcx + 0x90], 0
lea r14, [rcx + 0x98]
je 0x1400975e7
mov rcx, qword [r14]
add rcx, rsi
cmp rcx, qword [rbx + 0x80]
ja 0x1400977db
cmp qword [rsp + 0xd0], rsi
jb 0x1400977db
xor r15d, r15d
mov qword [r8], rsi
test rsi, rsi
je 0x1400977c2
mov rcx, qword [r14]
mov eax, 0x10
mov rbp, rcx
mov rdi, rsi
and ebp, 0xf
sub rax, rbp
cmp rax, rsi
cmovbe rdi, rax
lea rax, [rdi + rcx]
mov qword [r14], rax
mov al, byte [rbx + 0xa1]
dec al
test al, 0xfd
je 0x14009763b
lea r12, [rdi + rbp]
jmp 0x1400976bf
xor dl, dl
test rdi, rdi
je 0x140097659
xor eax, eax
lea rcx, [rax + rbx]
inc dl
mov al, byte [rax + r13]
xor byte [rcx + rbp], al
movzx eax, dl
cmp rax, rdi
jb 0x140097644
lea r12, [rdi + rbp]
cmp r12, 0x10
je 0x14009766f
mov rax, qword [rbx + 0x80]
cmp qword [r14], rax
jne 0x14009769e
lea rax, [rsp + 0x38]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.140098964
mov r15d, eax
test eax, eax
jne 0x1400977bb
mov r9, qword [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov r8, rdi
mov r9, r13
mov rdx, rbp
mov rcx, rbx
call fcn.14009717c
mov r15d, eax
test eax, eax
jne 0x1400977c2
test byte [rbx + 0xa1], 0xfd
jne 0x14009776e
lea rax, [rsp + 0x40]
mov r9, r13
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbx
call fcn.14009717c
mov r15d, eax
test eax, eax
jne 0x1400977c2
xor dl, dl
test rdi, rdi
je 0x140097710
xor eax, eax
lea rcx, [rax + rbx]
inc dl
mov al, byte [rsp + rax + 0x40]
xor byte [rcx + rbp], al
movzx eax, dl
cmp rax, rdi
jb 0x1400976fb
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.140142a0b
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
cmp r12, 0x10
je 0x140097748
mov rax, qword [rbx + 0x80]
cmp qword [r14], rax
jne 0x140097774
lea rax, [rsp + 0x38]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
mov rdx, rbx
call fcn.140098964
mov r15d, eax
test eax, eax
jne 0x1400977bb
cmp r12, 0x10
je 0x140097780
mov rax, qword [rbx + 0x80]
cmp qword [r14], rax
jne 0x1400977a3
xor dl, dl
cmp byte [rbx + 0xa0], dl
jbe 0x1400977a3
movzx eax, dl
mov rcx, rbx
sub rcx, rax
add byte [rcx + 0x1f], 1
jne 0x1400977a3
inc dl
cmp dl, byte [rbx + 0xa0]
jb 0x14009778a
mov r9, qword [rsp + 0x30]
add r13, rdi
add r9, rdi
mov qword [rsp + 0x30], r9
sub rsi, rdi
jmp 0x1400975fe
or dword [rbx + 0xa4], 0x10
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
mov eax, r15d
jmp 0x1400977e0
mov eax, 0xfffffff3
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009797c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0xc8]
mov rbx, r8
mov rax, qword [rsp + 0xd8]
lea r8, [r11 - 0x38]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x48], rdi
mov qword [r11 - 0x50], r8
mov r8, rbx
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r11 - 0x68], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], rax
call fcn.1400978cc
test eax, eax
jne 0x140097a4a
xor edx, edx
xor r9b, r9b
test rdi, rdi
je 0x140097a48
mov r8, qword [rsp + 0xe8]
xor eax, eax
movzx ecx, byte [rax + r8]
inc r9b
movzx eax, byte [rsp + rax + 0x60]
xor ecx, eax
movzx eax, r9b
or edx, ecx
cmp rax, rdi
jb 0x140097a0d
test edx, edx
je 0x140097a48
test rbx, rbx
je 0x140097a41
mov rax, qword [fcn.14014276a]
mov r8, rbx
xor edx, edx
mov rcx, rsi
call rax
mov eax, 0xfffffff1
jmp 0x140097a4a
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140097f7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140097fdb
mov rdx, r8
mov rcx, r9
sub rdx, r9
mov r8, qword [rbx + 0x80]
cmp r8, 0x40
jae 0x140097fdb
mov al, byte [rdx + rcx]
inc rsi
xor al, byte [r8 + rbx + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rbx + 0x80]
sub rdi, 1
jne 0x140097fb1
lea rbp, [rbx + 0x40]
cmp rdi, 0x40
jb 0x1400980c7
sub r14, r15
lea r12, [r9 + 1]
mov qword [rsp + 0x68], r14
mov r13, rdi
shr r13, 6
mov r14, rbx
imul rax, r13, 0xffffffffffffffc0
sub r14, rsi
add r12, rsi
add rdi, rax
sub r14, r15
mov rax, r13
add r14, 0x40
shl rax, 6
add rsi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.140097c7c
inc dword [rbx + 0x30]
mov edx, 8
mov rcx, qword [rsp + 0x68]
mov al, byte [r12 + rcx - 1]
xor al, byte [r12 + r14 - 1]
mov byte [r12 - 1], al
mov al, byte [r12 + r14]
xor al, byte [r12 + rcx]
mov byte [r12], al
mov al, byte [rcx + r12 + 1]
xor al, byte [r12 + r14 + 1]
mov byte [r12 + 1], al
mov al, byte [rcx + r12 + 2]
xor al, byte [r12 + r14 + 2]
mov byte [r12 + 2], al
mov al, byte [r12 + rcx + 3]
xor al, byte [r12 + r14 + 3]
mov byte [r12 + 3], al
mov al, byte [r12 + r14 + 4]
xor al, byte [r12 + rcx + 4]
mov byte [r12 + 4], al
mov al, byte [r12 + r14 + 5]
xor al, byte [r12 + rcx + 5]
mov byte [r12 + 5], al
mov al, byte [r12 + r14 + 6]
xor al, byte [r12 + rcx + 6]
mov byte [r12 + 6], al
add r12, 8
sub rdx, 1
jne 0x140098035
sub r14, 0x40
sub r13, 1
jne 0x14009801d
mov r14, qword [rsp + 0x70]
test rdi, rdi
je 0x140098104
mov rdx, rbp
mov rcx, rbx
call fcn.140097c7c
inc dword [rbx + 0x30]
mov rcx, rdi
sub rsi, rbx
lea rdx, [rsi + r14]
lea r8, [rsi + r15]
mov al, byte [rdx + rbp - 0x40]
xor al, byte [rbp]
mov byte [r8 + rbp - 0x40], al
inc rbp
sub rcx, 1
jne 0x1400980e8
mov qword [rbx + 0x80], rdi
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400985b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb0]
mov rbx, rdx
mov rdi, qword [rsp + 0xb8]
lea rdx, [r11 - 0x28]
mov qword [r11 - 0x38], rdx
mov edx, 1
mov qword [r11 - 0x40], rdi
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], r9
mov r9, r8
mov r8, rbx
call fcn.14009852c
test eax, eax
jne 0x1400986a2
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0x50]
xor edx, edx
xorps xmm3, xmm3
sub rcx, rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
add rax, rdx
add rdx, 4
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rdx, 0x10
jb 0x14009862b
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x1400986a0
test rbx, rbx
je 0x140098699
mov rax, qword [fcn.14014276a]
mov r8, rbx
xor edx, edx
mov rcx, rdi
call rax
mov eax, 0xffffffaa
jmp 0x1400986a2
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140140c70
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140099da4
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 8], 0
mov r9, rcx
test r8, r8
je 0x140099dcf
sub r9, rdx
mov al, byte [r9 + rdx]
mov cl, byte [rdx]
inc rdx
xor cl, al
mov al, byte [rsp + 8]
or cl, al
mov byte [rsp + 8], cl
sub r8, 1
jne 0x140099db4
movzx eax, byte [rsp + 8]
ret

Function at 0x14009a408
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rbp, qword [rcx + 8]
mov r14, r8
cmp rbp, qword [rdx + 8]
je 0x14009a43a
mov eax, 0xfffffffc
jmp 0x14009a4f1
mov edi, dword [rcx]
mov ebx, dword [rdx]
sar ebx, 1
sar edi, 1
and ebx, 1
and edi, 1
xor ebx, edi
mov esi, ebx
and esi, edi
mov dword [r8], esi
test rbp, rbp
je 0x14009a4ef
mov rax, qword [rdx + 0x10]
lea r13, [rbp - 1]
mov r15, qword [rcx + 0x10]
mov r12d, 1
sub r12d, edi
sub r15, rax
lea r13, [rax + r13*8]
mov r10, qword [r13]
mov edx, 1
mov r11, qword [r15 + r13]
sub edx, ebx
mov rax, r11
lea r13, [r13 - 8]
shr rax, 0x3f
mov r9, r10
xor r9, r11
mov rcx, r10
sub rcx, r11
mov r8, r9
sub r11, r10
shr r9, 0x3f
and eax, r9d
shr rcx, 0x3f
shr r11, 0x3f
not r8
shr r8, 0x3f
and ecx, r8d
shr r10, 0x3f
or ecx, eax
and r11d, r8d
or ebx, ecx
and r10d, r9d
or r11d, r10d
and edx, ecx
and edx, edi
mov eax, 1
sub eax, ebx
or ebx, r11d
and eax, r12d
and eax, r11d
or eax, edx
or eax, esi
mov esi, eax
sub rbp, 1
jne 0x14009a476
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x14009a510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r10, r9
xor esi, esi
mov r12, r9
mov rdi, rdx
xor dl, dl
mov r11, rcx
mov r15, r8
lea rbx, [rdi - 0xb]
movzx eax, byte [r11]
cmp r9, rbx
movzx r9d, byte [rcx + 1]
lea ecx, [rsi + 2]
cmova r10, rbx
xor r9d, ecx
or r9d, eax
jmp 0x14009a582
mov al, byte [rcx + r11]
neg al
or al, byte [rcx + r11]
not al
shr al, 7
or dl, al
mov al, dl
neg al
or al, dl
not al
movzx eax, al
shr rax, 7
add rsi, rax
inc rcx
cmp rcx, rdi
jb 0x14009a55c
movzx ecx, dl
lea rax, [rsi - 8]
neg ecx
shr rax, 0x3f
shr ecx, 0x1f
mov r14d, edi
dec ecx
sub r14d, esi
and ecx, 1
sub r14d, 3
or ecx, eax
or r9d, ecx
mov rcx, r10
mov r8d, r9d
neg r8d
shr r8d, 0x1f
neg r8d
mov edx, r8d
mov eax, r8d
not edx
and eax, r10d
and r14d, edx
and r8d, 0x4100
or r14d, eax
sub rcx, r14
shr rcx, 0x3f
mov esi, ecx
or ecx, r9d
neg ecx
neg esi
shr esi, 0x1f
shr ecx, 0x1f
mov ebp, esi
neg ebp
neg ecx
and ebp, edx
and ebp, 0x4400
or ebp, r8d
neg ebp
mov dword [rsp + 0x80], ebp
cmp rdi, 0xb
jbe 0x14009a61a
not cl
lea rax, [r11 + 0xb]
and byte [rax], cl
inc rax
sub rbx, 1
jne 0x14009a60f
neg esi
mov eax, r10d
mov ebx, esi
mov ecx, esi
not ebx
and rcx, rax
and rbx, r14
mov rdx, r11
sub rdx, r10
or rbx, rcx
add rdx, rdi
mov qword [rsp + 0x88], rdx
test r10, r10
je 0x14009a6da
xor esi, esi
test r10, r10
je 0x14009a6da
lea r13, [r10 - 1]
mov r12, rdx
mov r9, rsi
sub r9, rbx
shr r9, 0x3f
neg r9d
shr r9d, 0x1f
test r13, r13
je 0x14009a6a2
mov ebp, r9d
mov r14, r12
neg ebp
mov r15d, ebp
not r15d
mov cl, byte [r14]
mov dl, r15b
mov al, byte [r14 + 1]
and dl, al
mov al, bpl
and al, cl
or dl, al
mov byte [r14], dl
lea r14, [r14 + 1]
sub r13, 1
jne 0x14009a67e
lea r13, [r10 - 1]
movzx eax, byte [r11 + rdi - 1]
neg r9b
and r9b, al
inc rsi
mov byte [r11 + rdi - 1], r9b
cmp rsi, r10
jb 0x14009a65a
mov r12, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov ebp, dword [rsp + 0x80]
mov r15, qword [rsp + 0x90]
test r12, r12
je 0x14009a6ea
mov r8, r10
mov rcx, r15
call fcn.140142a0b
mov rcx, qword [rsp + 0xa0]
mov eax, ebp
mov qword [rcx], rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009a9f0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rbp, [r11 - 0x58]
movups xmmword [rsp + 0x20], xmm0
mov r14, rdx
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
movups xmmword [rsp + 0x40], xmm0
mov eax, 0x10
add byte [rdi + rax - 1], 1
jne 0x14009aa49
dec rax
test rax, rax
jg 0x14009aa3a
mov r8, rbp
lea rcx, [rdi + 0x28]
mov rdx, rdi
call fcn.140090410
mov ebx, eax
test eax, eax
jne 0x14009aabb
add rbp, 0x10
add esi, 0x10
cmp esi, 0x30
jl 0x14009aa35
xor edx, edx
lea rax, [rsp + 0x20]
sub r14, rax
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r14 + rax]
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rdx, 0x30
jl 0x14009aa74
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x28]
call fcn.14008fe90
mov ebx, eax
test eax, eax
jne 0x14009aabb
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x30]
call rax
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140140c70
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400a3200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x20], 0
lea rax, [rbp - 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
mov r8d, 0x10
lea rdx, [rbp - 0x18]
mov rbx, rcx
movups xmmword [rbp - 0x18], xmm0
call fcn.140098964
test eax, eax
jne 0x1400a33a7
movzx eax, byte [rbp - 0x17]
movzx r8d, byte [rbp - 0x18]
movzx r9d, byte [rbp - 0x10]
movzx ecx, byte [rbp - 0x14]
and qword [rbx + 0xe0], 0
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rbp - 0x16]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rbp - 0x15]
shl r8d, 8
or r8, rax
mov r10d, 4
movzx eax, byte [rbp - 0x13]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rbp - 0x12]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rbp - 0xc]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rbp - 0x11]
or r8, rax
movzx eax, byte [rbp - 0xf]
or r9d, eax
mov qword [rbx + 0x120], r8
movzx eax, byte [rbp - 0xe]
shl r9d, 8
or r9d, eax
movzx eax, byte [rbp - 0xd]
shl r9d, 8
or r9, rax
movzx eax, byte [rbp - 0xb]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rbp - 0xa]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rbp - 9]
or r9, rax
and qword [rbx + 0x60], 0
mov qword [rbx + 0xa0], r9
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov qword [rbx + r10*8 + 0x60], r9
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
mov qword [rbx + r10*8 + 0xe0], r8
shr r10d, 1
jne 0x1400a3309
mov r8d, 2
mov ecx, r8d
mov r10, qword [rbx + rcx*8 + 0xe0]
mov r11, qword [rbx + rcx*8 + 0x60]
cmp rcx, 1
jle 0x1400a3396
lea rdx, [rbx + 0x68]
lea r9, [rcx - 1]
mov rax, r10
xor rax, qword [rdx + 0x80]
mov qword [rdx + rcx*8 + 0x80], rax
mov rax, r11
xor rax, qword [rdx]
mov qword [rdx + rcx*8], rax
lea rdx, [rdx + 8]
sub r9, 1
jne 0x1400a3370
lea eax, [r8 + r8]
add rcx, rcx
mov r8d, eax
cmp eax, 8
jle 0x1400a3355
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140140c70
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret