joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000647c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 9
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, [0x140042940]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x1400064a8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 3
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, [0x140042940]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x1400065bc
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006618
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 2
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, [0x140042940]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x140006644
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140007000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, [0x140042af0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x140007058
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007204
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 0xc
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x140007230
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000728c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x1400072e2
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007399
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400073f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x140007453
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400074b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x140007507
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x1400075c4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007624
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x18]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x18]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x18
jb 0x14000767d
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400076dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 6]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 6]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov word [rax + 4], cx
add rax, 6
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 6
jb 0x140007731
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x11]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x11]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov byte [rax + 0x10], cl
add rax, 0x11
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x11
jb 0x1400077e8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007848
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x13]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x13]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov word [rax + 0x10], cx
mov byte [rax + 0x12], cl
add rax, 0x13
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x13
jb 0x1400078a4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007904
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xd]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xd]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov byte [rax + 0xc], cl
add rax, 0xd
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xd
jb 0x14000795c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400079bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xf]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xf]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
mov byte [rax + 0xe], cl
add rax, 0xf
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x301c82ac40260391
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub r8, rax
lea rax, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xf
jb 0x140007a18
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007a78
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 6
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 6
jb 0x140007aa4
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140007b00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 0xb
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x301c82ac40260391
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1af
lea rcx, str.HVNMXDBdfhNssdpCRwSeJaGYWIIqRlgdkkrJjhkNZym_EqgDifcE_UKAWmSuUkySEkvoQsVfjsLRjPn_zHBjQhuUMHSBRVFLHALuVjcRenxFiwnmiEhrhugNZtWqIlUmscYJGJjLfvowlWetembQcBmWpQHlclxcYFVVzCNzDShlH_reXgtRdCiAktRQuUKxmMCiWPFQnBJTRJHlYSKIVdQRvJXaZxcKQKHgNMnZzarkLpKEyxaj_ZPwoSOLprBGhoPUcRmkpCfYtNvqYSjqYJajdFKwfXueiWlYkVnDfBRlDfIqYAdLLtLH_tYWfiexsdgUGwHXjAlmLeMUdnLgGYnPGzREsitpGuPMPIXdOUoQyKDlcPRk_dFfilhJcWHsrqeJQuAWuGhGoIzgRoxZWHAXpNb_EzPZipxnSpfNYJSBvU
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xb
jb 0x140007b2c
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140009960
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000998e
xor eax, eax
jmp 0x140009a74
cmp qword [rcx + 0x68], 0
je 0x14000999f
call fcn.140003374
jmp 0x140009a74
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400099b6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400099b8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400099ea
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14000c2f0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140009a6e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140009a21
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140009a4a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140015e30
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140009a6e
cmp rsi, rbx
ja 0x140009a28
test rsi, rsi
je 0x140009a6e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140015e30
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000abd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ac1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ac1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ac1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ac1e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ac1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ac20
xor al, al
add rsp, 0x28
ret

Function at 0x14001a560
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a350