joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b00f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movsxd rbx, dword [0x140392f38]
mov edi, dword [0x140392ed0]
add rcx, 0x40
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x28], rcx
call fcn.14010d720
cmp byte [0x1404be238], 0
jne 0x1401b02d1
mov r14, qword [rsi]
mov r15, qword [r14]
cmp r15, r14
je 0x1401b02d1
lea rax, [0x140392f38]
add rbx, rax
mov eax, dword [0x1404be3b8]
mov ecx, eax
not ecx
mov edx, ecx
neg edx
mov dword [0x1404be3b8], edx
lea r12d, [rcx - 1]
xor eax, edx
and r12d, ecx
or r12d, eax
not r12d
mov r8d, edi
xor r13d, r13d
mov edi, 0
test r12d, r12d
jne 0x1401b01ca
xor eax, eax
mov r13d, 0
mov edi, 0
test r8d, r8d
jle 0x1401b01ca
xor r13d, r13d
xor edi, edi
nop dword [rax]
movsxd rcx, eax
mov rdx, qword [rbx + rcx]
mov rcx, qword [rbx + rcx + 8]
xor r13, rdx
xor rdi, rcx
add eax, 0x10
cmp eax, r8d
jl 0x1401b01b0
lea rbx, [rbp - 0x20]
jmp 0x1401b01ec
mov rax, r15
nop word cs:[rax + rax]
mov r15, rax
cmp rax, r14
je 0x1401b02d1
movups xmm0, xmmword [r15 + 0x20]
movaps xmmword [rbp - 0x40], xmm0
mov rcx, qword [rbp - 0x38]
call fcn.1401b1140
xor ecx, ecx
test r12d, r12d
setne cl
mov rdx, qword [0x140392ef8]
add rcx, 0xffffffffffffffff
mov r8d, 0
adc r8, 0xffffffffffffffff
mov r9, qword [0x140392ef0]
sub r9, r13
sbb rdx, rdi
mov r10, r9
not r10
mov r11, rdx
not r11
xor r9, rcx
not rcx
and rcx, r10
xor rdx, r8
not r8
and r8, r11
or r8, rdx
or rcx, r9
and rcx, r8
cmp rcx, 0xffffffffffffffff
setne cl
or cl, byte [0x1404be238]
and cl, 1
mov byte [0x1404be238], cl
test al, al
jne 0x1401b0290
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x1401b0281
mov rax, qword [rbp - 0x38]
mov qword [rdx], rax
add qword [rbp - 0x18], 8
jmp 0x1401b0290
mov rcx, rbx
lea r8, [rbp - 0x38]
call fcn.1401b0650
nop dword [rax]
mov rcx, qword [r15 + 0x10]
cmp byte [rcx + 0x19], 0
je 0x1401b02c0
nop word [rax + rax]
mov rax, qword [r15 + 8]
cmp byte [rax + 0x19], 0
jne 0x1401b01e0
mov rcx, r15
mov r15, rax
cmp rcx, qword [rax + 0x10]
je 0x1401b02a0
jmp 0x1401b01d0
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401b02c0
jmp 0x1401b01e0
mov rcx, qword [rbp - 0x28]
call fcn.14010d7c0
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
cmp rdi, rbx
je 0x1401b0315
nop word [rax + rax]
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x1401b0363
mov rdx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140116dad.0]
add rdi, 8
cmp rdi, rbx
jne 0x1401b02f0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1401b0351
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401b0346
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1401b0368
add rdx, 0x27
mov rcx, rax
mov r8d, 0x17f6bbd2
call fcn.14009e2b0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140348e34
call fcn.14032786c
int3
Function at 0x1401b1790
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
lea rsi, [rcx + 8]
mov rax, qword [0x140478ac8]
movsxd rbx, dword [rax]
add rbx, rax
neg rbx
mov rdi, rcx
mov r13d, dword [0x1403932c8]
mov rcx, rsi
call fcn.14010dc70
mov r15d, dword [0x140478ac0]
lea r14d, [r15 + 1]
mov dword [0x140478ac0], r14d
xor r14d, r15d
not r14d
test r14d, r15d
jne 0x1401b17f9
test r13d, r13d
jg 0x1401b1889
xor r12d, r12d
test al, al
je 0x1401b1862
mov byte [rdi + 0x2c], 0
lea rbx, [rdi + 0x20]
mov rcx, rbx
call fcn.14019e000
mov rcx, rsi
mov edx, 0x3e8
call fcn.14010e5b0
movzx ecx, byte [0x1403932c0]
and r14d, r15d
xor edx, edx
cmp r14d, 1
sbb edx, edx
sub cl, r12b
and cl, dl
setne cl
or cl, byte [0x1404bdcb1]
and cl, 1
mov byte [0x1404bdcb1], cl
test al, al
jne 0x1401b1852
mov rcx, rsi
call fcn.14010dc90
mov rcx, rsi
call fcn.14010dd80
mov rcx, rbx
call fcn.14019df50
add rdi, 0x20
mov rcx, rdi
call fcn.14019df50
lea rax, [0x14038bb50]
mov qword [rsi], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
neg rbx
xor ecx, ecx
xor r12d, r12d
nop word cs:[rax + rax]
xor r12b, byte [rbx + rcx]
inc rcx
cmp ecx, r13d
jl 0x1401b18a0
jmp 0x1401b17fc
Function at 0x1401b1c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r9
mov rdi, rcx
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x48], r8d
lea rdx, [rbp - 0x50]
mov r8d, 0xd9ab4414
call fcn.1401b20a0
movsxd r12, dword [0x1403935bc]
mov r13d, dword [0x1403935c4]
lea rax, [rdi + 0x38]
mov qword [rbp - 0x10], rax
lea rax, [0x140393548]
mov qword [rdi + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x60], xmm0
mov qword [rdi + 0x70], 0
mov qword [rbp - 8], rdi
lea rcx, [rdi + 0x78]
mov qword [rbp - 0x20], rcx
mov edx, 0x2710
call fcn.1401af970
mov rax, qword [rbp - 8]
lea rcx, [rax + 0x128]
mov qword [rbp - 0x18], rcx
call fcn.1401b3520
mov rcx, qword [rbp - 8]
call fcn.1401b20f0
mov rcx, qword [rbp - 8]
mov r15, qword [rbp + 0x70]
lea rax, [0x1403935bc]
add r12, rax
mov edi, dword [0x140478c50]
lea ebx, [rdi + 1]
mov dword [0x140478c50], ebx
xor r14d, r14d
test edi, ebx
jne 0x1401b1d5f
test r13d, r13d
jle 0x1401b1d5f
xor eax, eax
xor r14d, r14d
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r12
mov r8d, dword [rdx]
mov edx, r8d
xor edx, r8d
not edx
and r14d, edx
xor r14d, r8d
add eax, 4
cmp eax, r13d
jl 0x1401b1d40
mov r12, qword [0x1404be3c0]
add r12, qword [rcx + 0x20]
sub r12, qword [rcx + 0x18]
call fcn.1401b2450
mov r13d, dword [rax]
mov rcx, qword [rbp - 8]
call fcn.1401b2450
shr r12, 3
imul ecx, r12d, 0xba2e8ba3
movzx eax, word [rax + 4]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x24], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
call fcn.1401b4a20
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
call fcn.1401b2fc0
and edi, ebx
mov eax, dword [0x1403935c0]
xor ecx, ecx
cmp edi, 1
sbb ecx, ecx
sub eax, r14d
and eax, ecx
add qword [0x1404be3c0], rax
mov rax, qword [rbp - 8]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401b24e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [0x140478ca0]
movsxd rcx, dword [rax]
add rcx, rax
mov r8d, dword [0x1403935e8]
movabs rax, 0x2e8ba2e8ba2e8ba
cmp rdx, rax
ja 0x1401b26b9
mov r9, qword [rsi]
mov qword [rbp - 8], r9
mov rbx, qword [rsi + 8]
mov r13d, dword [0x140478c90]
lea r12d, [r13 - 0x26dcdb60]
add r12d, 0x26dcdb61
mov dword [0x140478c90], r12d
xor r12d, r13d
not r12d
test r12d, r13d
je 0x1401b255e
xor r14d, r14d
jmp 0x1401b2585
xor r9d, r9d
mov r14d, 0
test r8d, r8d
jle 0x1401b2585
xor r14d, r14d
nop
movsxd r10, r9d
add r10, rcx
movzx r10d, byte [r10]
xor r14b, r10b
inc r9d
cmp r9d, r8d
jl 0x1401b2570
imul r15, rdx, 0x58
mov rcx, qword [0x1404be150]
add rcx, r15
cmp rdx, 0x2e
jbe 0x1401b25cb
cmp rdx, rax
jae 0x1401b26b9
add rcx, 0x27
mov edx, 0xfc2693ae
call fcn.14009e350
lea rcx, [rax + 0x27]
mov edi, ecx
not edi
xor rcx, 0xffffffffffffffe0
and edi, 0x1f
or rdi, rcx
not rdi
mov qword [rdi - 8], rax
jmp 0x1401b25e1
test rdx, rdx
je 0x1401b25df
mov edx, 0xfc2693ae
call fcn.14009e350
mov rdi, rax
jmp 0x1401b25e1
xor edi, edi
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rcx, rax
je 0x1401b262e
mov rdx, rdi
mov r8, qword [rcx + 0x50]
mov qword [rdx + 0x50], r8
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm3
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add rdx, 0x58
add rcx, 0x58
cmp rcx, rax
jne 0x1401b25f0
mov rcx, qword [rsi]
test rcx, rcx
je 0x1401b2693
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401b2688
movzx eax, byte [0x1403935d4]
and r12d, r13d
xor r8d, r8d
cmp r12d, 1
sbb r8d, r8d
sub al, r14b
test al, r8b
setne al
or al, byte [0x1404be209]
and al, 1
mov byte [0x1404be209], al
mov rax, qword [rcx - 8]
jne 0x1401b2681
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1401b26be
add rdx, 0x27
mov rcx, rax
mov r8d, 0x75be7394
call fcn.14009e2b0
sub rbx, qword [rbp - 8]
add rbx, rdi
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
add r15, rdi
mov qword [rsi + 0x10], r15
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400894e0
call fcn.14032786c
int3
Function at 0x1401b3170
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov r12, qword [0x140478de8]
mov rsi, rcx
movsxd r14, dword [r12]
mov r15d, dword [0x14039373c]
mov rcx, qword [rax + 0x20]
sub rcx, qword [rax + 0x18]
shr rcx, 3
imul eax, ecx, 0xba2e8ba3
test eax, eax
je 0x1401b32fb
mov rdi, r8
mov rbx, rdx
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140116dad.0]
test al, al
je 0x1401b3306
add r14, r12
mov rax, qword [rsi + 0x10]
mov r12d, dword [0x140478de4]
lea r13d, [r12 + 1]
mov dword [0x140478de4], r13d
xor ebp, ebp
test r12d, r13d
jne 0x1401b320f
test r15d, r15d
jle 0x1401b320f
xor ecx, ecx
xor ebp, ebp
nop dword [rax]
movsxd rcx, ecx
xor ebp, dword [r14 + rcx]
add ecx, 4
cmp ecx, r15d
jl 0x1401b3200
lea rcx, [rsi + 0x78]
mov r8, qword [rax + 0x20]
sub r8, qword [rax + 0x18]
sar r8, 3
movabs rdx, 0x2e8ba2e8ba2e8ba3
imul rdx, r8
mov rax, qword [rsi + 0x78]
mov r14, qword [rsi + 0x80]
mov r8, r14
sub r8, rax
sar r8, 4
mov r15, rdx
sub r15, r8
jae 0x1401b325a
shl rdx, 4
add rax, rdx
mov qword [rsi + 0x80], rax
jmp 0x1401b3296
jbe 0x1401b3296
mov r8, qword [rsi + 0x88]
sub r8, rax
sar r8, 4
cmp r8, rdx
jae 0x1401b327b
lea r8, [rsp + 0x20]
call fcn.1401b3660
jmp 0x1401b3296
shl r15, 4
mov rcx, r14
xor edx, edx
mov r8, r15
call fcn.14036f7c0
add r15, r14
mov qword [rsi + 0x80], r15
mov rax, qword [rsi + 0x78]
mov rcx, qword [rsi + 0x80]
and r12d, r13d
mov edx, dword [0x140393734]
xor r8d, r8d
cmp r12d, 1
sbb r8d, r8d
sub edx, ebp
xor edx, r8d
not edx
and edx, r8d
add dword [0x1404bdb94], edx
cmp rax, rcx
je 0x1401b32dc
movups xmm0, xmmword [0x140393720]
movups xmmword [rax], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x1401b32d0
mov rax, qword [rsi + 0x78]
mov qword [rbx], rax
mov rcx, qword [rsi]
mov edx, 0x17142259
call fcn.1401b3830
test al, al
je 0x1401b3306
mov qword [0x1404be3c8], rdi
mov byte [rsi + 0x98], 1
mov al, 1
jmp 0x1401b3308
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401b4a50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rcx
lea rax, [0x140393548]
mov qword [rcx], rax
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx + 0x28]
cmp rsi, qword [rcx + 0x30]
je 0x1401b4acc
add rsi, 8
nop word cs:[rax + rax]
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x1401b4aaa
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140116dad.0]
cmp byte [0x1404bde9c], 0
jne 0x1401b4ac9
test byte [0x1404be161], 1
jne 0x1401b4ac9
lea rax, [rsi + 8]
cmp rsi, qword [rdi + 0x30]
mov rsi, rax
jne 0x1401b4a90
mov rsi, qword [rbx]
movsxd r8, dword [0x140393a00]
mov r9d, dword [0x1403939f0]
test rsi, rsi
je 0x1401b4ba4
lea rax, [0x140393a00]
add r8, rax
mov rdx, qword [rdi + 0x38]
mov eax, dword [0x140479010]
lea r10d, [rax + 1]
mov dword [0x140479010], r10d
xor ecx, ecx
test eax, r10d
jne 0x1401b4b3a
test r9d, r9d
jle 0x1401b4b3a
xor r11d, r11d
xor ecx, ecx
nop word cs:[rax + rax]
movsxd r11, r11d
xor ecx, dword [r8 + r11]
add r11d, 0x684fe3ab
add r11d, 0x97b01c59
cmp r11d, r9d
jl 0x1401b4b20
sub rdx, rsi
cmp rdx, 0xfff
jbe 0x1401b4b88
and eax, r10d
mov r8, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, r8
mov r9d, dword [0x1403939fc]
xor r10d, r10d
cmp eax, 1
sbb r10d, r10d
sub r9d, ecx
and r9d, r10d
setne al
or al, byte [0x1404bde9c]
and al, 1
mov byte [0x1404bde9c], al
cmp rsi, 0x20
jae 0x1401b4bad
add rdx, 0x27
mov rsi, r8
mov rcx, rsi
mov r8d, 0x1499f3b8
call fcn.14009e2b0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.14032786c
int3
Function at 0x1401b7250
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x10], rcx
call fcn.1401b7950
mov rsi, qword [rbp - 0x10]
lea rax, [rsi + 0x168]
mov qword [rbp - 0x18], rax
mov rcx, qword [rsi + 0x168]
mov rax, qword [rsi + 0x170]
mov qword [rbp - 0x30], rax
lea rax, [rsi + 0xe8]
mov qword [rbp - 0x20], rax
jmp 0x1401b72bc
mov rcx, qword [rbp - 0x28]
add rcx, 2
mov rsi, qword [rbp - 0x10]
cmp rcx, qword [rbp - 0x30]
je 0x1401b72e6
mov qword [rbp - 0x28], rcx
cmp byte [0x1404be3a8], 0
jne 0x1401b72b0
mov rax, qword [rbp - 0x28]
movzx edx, word [rax]
test dx, dx
je 0x1401b72b0
mov rcx, qword [rbp - 0x20]
call fcn.1401bc9b0
jmp 0x1401b72b0
lea rcx, [rbp - 0x38]
call fcn.1401b7590
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
movsxd r8, dword [0x140393ff0]
mov r10d, dword [0x140393fd8]
test rcx, rcx
je 0x1401b7430
mov rdx, qword [rsi + 0x178]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401b7413
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
mov r9d, dword [0x140479584]
lea esi, [r9 + 1]
mov dword [0x140479584], esi
xor r11d, r11d
mov edi, 0
test r9d, esi
jne 0x1401b73ad
xor ebx, ebx
mov r11d, 0
mov edi, 0
test r10d, r10d
jle 0x1401b73ad
lea r11, [0x140393ff0]
add r8, r11
xor r11d, r11d
xor edi, edi
nop dword [rax + rax]
movsxd r14, ebx
mov r15, qword [r8 + r14]
mov r14, qword [r8 + r14 + 8]
mov r12, r14
xor r12, r14
mov r13, r15
xor r13, r15
not r13
and r11, r13
xor r11, r15
not r12
and rdi, r12
xor rdi, r14
mov r14d, ebx
xor r14d, 0x10
and ebx, 0x10
lea ebx, [r14 + rbx*2]
cmp ebx, r10d
jl 0x1401b7370
sub rcx, rax
cmp rcx, 0x20
jae 0x1401b7468
add rdx, 0x27
mov r8, qword [0x140393fe8]
mov r10, qword [0x140393fe0]
xor ecx, ecx
test r9d, esi
setne cl
xor r9d, r9d
add rcx, 0xffffffffffffffff
adc r9, 0xffffffffffffffff
mov rsi, qword [rbp - 0x10]
sub r10, r11
sbb r8, rdi
not rcx
not r9
xor r9, r8
xor rcx, r10
and rcx, r10
and r9, r8
or r9, rcx
setne cl
or cl, byte [0x1404be3a8]
and cl, 1
mov byte [0x1404be3a8], cl
mov rcx, rax
mov r8d, 0x6fce26bd
call fcn.14009e2b0
xorps xmm0, xmm0
mov rax, qword [rbp - 0x18]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rcx, qword [rbp - 0x20]
call fcn.1401b7f70
lea rcx, [rsi + 0x98]
call fcn.14034ea38
lea rcx, [rsi + 0x50]
call fcn.14034ea38
mov rcx, rsi
call fcn.140348504
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14032786c
int3
Function at 0x14021cf60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
cmp qword [r8 + 0x20], 0x10
jb 0x14021cf94
mov rdx, qword [r8 + 8]
jmp 0x14021cf98
lea rdx, [r8 + 8]
lea r13, [rcx + 8]
mov rdi, qword [r8 + 0x18]
mov rax, qword [0x140485498]
movsxd r14, dword [rax]
add r14, rax
mov r15d, dword [0x14039a634]
movabs rbx, 0x7fffffffffffffff
cmp rdi, 0x10
mov qword [rbp - 8], rcx
jae 0x14021cfd8
movups xmm0, xmmword [rdx]
movups xmmword [r13], xmm0
mov r12d, 0xf
jmp 0x14021d041
mov qword [rbp - 0x10], rdx
mov r12, rdi
or r12, 0xf
cmp r12, rbx
cmovae r12, rbx
cmp r12, 0xfff
jb 0x14021d010
lea rcx, [r12 + 0x28]
mov edx, 0xc2b36bea
call fcn.14009e350
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14021d022
lea rcx, [r12 + 1]
mov edx, 0xc2b36bea
call fcn.14009e350
mov rcx, rax
mov qword [r13], rcx
mov rax, qword [0x1404bf060]
lea r8, [rdi + rax]
inc r8
mov rdx, qword [rbp - 0x10]
call fcn.14036f110
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], r12
lea rdi, [0x14038a448]
mov qword [rcx], rdi
mov r11d, dword [0x140485490]
lea edx, [r11 + 1]
mov dword [0x140485490], edx
xor eax, eax
mov r8d, 0
test r11d, edx
jne 0x14021d0a5
xor r9d, r9d
mov eax, 0
mov r8d, 0
test r15d, r15d
jle 0x14021d0a5
xor eax, eax
xor r8d, r8d
nop dword [rax]
movsxd r9, r9d
xor r8, qword [r14 + r9 + 8]
xor rax, qword [r14 + r9]
add r9d, 0x10
cmp r9d, r15d
jl 0x14021d090
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov r14, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0x10
jb 0x14021d0bd
mov rsi, qword [rsi + 8]
jmp 0x14021d0c1
add rsi, 8
lea r15, [rcx + 0x30]
cmp r14, 0x10
jae 0x14021d0dc
movups xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov ebx, 0xf
jmp 0x14021d165
mov r9, r14
or r9, 0xf
xor r10d, r10d
test r11d, edx
setne r10b
mov rdx, qword [0x14039a658]
mov rcx, qword [0x14039a650]
xor r11d, r11d
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
sub rcx, rax
sbb rdx, r8
and rcx, r10
and rdx, r11
or rcx, rdx
add qword [0x1404bf060], rcx
cmp r9, rbx
cmovb rbx, r9
cmp rbx, 0xffe
jbe 0x14021d146
lea rcx, [rbx + 0x28]
call fcn.1403471ac
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14021d152
lea rcx, [rbx + 1]
call fcn.1403471ac
mov rcx, rax
mov qword [r15], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call fcn.14036f110
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x28], rdi
mov rax, rcx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1402216a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402216dc
test edx, edx
je 0x14022170c
movzx eax, byte [0x1404859dd]
cmp al, 0x5d
je 0x1402216d4
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x1404859dd], cl
je 0x14022176c
cmp al, 0x5d
jne 0x1402216c0
lea rax, [0x1404859d0]
ret
test edx, edx
je 0x14022173c
movzx eax, byte [0x1404859ab]
cmp al, 0x39
je 0x140221704
mov cl, 0xb5
nop dword [rax]
mov al, 0x3a
lock cmpxchg byte [0x1404859ab], cl
je 0x1402217a1
cmp al, 0x39
jne 0x1402216f0
lea rax, [0x1404859a0]
ret
movzx eax, byte [0x1404856f8]
cmp al, 0xa5
je 0x140221734
mov cl, 0xee
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x1404856f8], cl
je 0x1402217e1
cmp al, 0xa5
jne 0x140221720
lea rax, [0x1404856f0]
ret
movzx eax, byte [0x1404856c0]
cmp al, 0x3e
je 0x140221764
mov cl, 0x52
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x1404856c0], cl
je 0x140221821
cmp al, 0x3e
jne 0x140221750
lea rax, [0x1404856b0]
ret
xor eax, eax
lea rcx, [0x1404859d0]
lea rdx, [0x14039ab70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x140221780
mov al, 0x5d
xchg byte [0x1404859dd], al
lea rax, [0x1404859d0]
ret
xor eax, eax
lea rcx, [0x1404859a0]
lea rdx, [0x14039ab40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1402217c0
mov al, 0x39
xchg byte [0x1404859ab], al
lea rax, [0x1404859a0]
ret
xor eax, eax
lea rcx, [0x1404856f0]
lea rdx, [0x14039a880]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x140221800
mov al, 0xa5
xchg byte [0x1404856f8], al
lea rax, [0x1404856f0]
ret
xor eax, eax
lea rcx, [0x1404856b0]
lea rdx, [0x14039a850]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x140221840
mov al, 0x3e
xchg byte [0x1404856c0], al
lea rax, [0x1404856b0]
ret
Function at 0x14022b510
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
test ecx, ecx
je 0x14022b54c
mov rcx, rsi
test edi, edi
je 0x14022b6f5
call fcn.1403473b8
jmp 0x14022b6fa
cmp byte [rsi + 0x19], 0
jne 0x14022b6fa
jmp 0x14022b57f
call fcn.14009e2b0
mov edx, 0x40
mov rcx, rsi
call fcn.14009e2b0
cmp byte [rbx + 0x19], 0
mov rsi, rbx
jne 0x14022b6fa
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
mov r8d, edi
xor r9d, r9d
call fcn.14022b510
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
test r14, r14
je 0x14022b565
mov rax, qword [0x140487148]
movsxd r15, dword [rax]
mov r12d, dword [0x14039b8f4]
mov r13, qword [rsi + 0x30]
cmp r14, r13
je 0x14022b6c0
add r15, rax
jmp 0x14022b633
mov r11, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r11
cmp rcx, 0x20
jae 0x14022b70c
add rax, 0x28
movzx ecx, word [0x14039b8f8]
and r8d, r9d
cmp r8d, 1
mov edx, 0
sbb edx, edx
sub ecx, r10d
test cx, dx
setne cl
or cl, byte [0x1404bdc70]
and cl, 1
mov byte [0x1404bdc70], cl
mov rdx, rax
mov rcx, r11
call fcn.14009e2b0
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r13
je 0x14022b6c0
mov rax, qword [r14 + 0x20]
mov r8d, dword [0x140487144]
lea r9d, [r8 - 0x2403c701]
add r9d, 0x2403c702
mov dword [0x140487144], r9d
test r8d, r9d
je 0x14022b660
xor r10d, r10d
jmp 0x14022b680
xor ecx, ecx
mov r10d, 0
test r12d, r12d
jle 0x14022b680
xor r10d, r10d
movsxd rcx, ecx
xor r10w, word [r15 + rcx]
add ecx, 2
cmp ecx, r12d
jl 0x14022b670
cmp rax, 0xf
jbe 0x14022b611
mov rcx, qword [r14 + 8]
cmp byte [0x1404bde74], 0
jne 0x14022b5c0
test byte [0x1404bdc70], 1
jne 0x14022b5c0
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14022b60c
jmp 0x14022b5c0
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14022b560
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14022b711
add rdx, 0x27
mov rcx, rax
jmp 0x14022b560
call fcn.140347358
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14032786c
call fcn.14032786c
int3