joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140750108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14075028f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140750139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075011f
add dl, dl
jne 0x140750146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407501a6
xor eax, eax
add dl, dl
jne 0x140750155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075025d
add dl, dl
jne 0x140750166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140750173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140750180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14075018d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14075019a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14075012e
mov eax, 1
add dl, dl
jne 0x1407501b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407501c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407501ab
sub eax, ebx
mov ebx, 1
jne 0x1407501fc
mov ecx, 1
add dl, dl
jne 0x1407501de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407501eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407501d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075012e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140750218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140750225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075020d
cmp eax, 0x7d00
jae 0x14075024b
cmp eax, 0x500
jb 0x140750246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075012e
cmp eax, 0x7f
ja 0x14075024e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075012e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140750282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14075012e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x121a0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1b8
mov rax, qword [0x00015208]
mov qword [rsp + 0x1a8], rax
call fcn.00011010
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x7c]
test eax, eax
je 0x121e1
mov eax, 1
jmp 0x122f7
mov eax, dword [0x0001529c]
shr eax, 0x10
mov ecx, dword [0x0001529c]
shl ecx, 0x10
or eax, ecx
mov r9d, eax
lea r8, str.RegistryMACHINESystemCurrentControlSetNEWHASPServicesEmulatorHASPDump
lea rdx, [0x00013300]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x48], 0x30
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x60], 0x40
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
lea r8, [rsp + 0x48]
mov edx, 0x20006
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jl 0x122d1
mov rdx, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x78], 0
jl 0x122e5
mov dword [rsp + 0x1a0], 0
jmp 0x122f0
mov dword [rsp + 0x1a0], 1
mov eax, dword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
call fcn.00012990
add rsp, 0x1b8
ret
Function at 0x14000124c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 5]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 5]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov byte [rax + 4], cl
add rax, 5
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 5
jb 0x1400012a0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.14000a044
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x7a]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000a044
mov qword [rdi], rax
lea r8d, [rsi + 0x7a]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x7a]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000cb00
lea rax, [rbx + 0x7a]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc esi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x7a
jb 0x140001363
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400013c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xb]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xb]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
mov byte [rax + 0xa], cl
add rax, 0xb
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xb
jb 0x140001421
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002b08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xc]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xc]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
add rax, 0xc
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x140042600]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xc
jb 0x140002b5d
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400040f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x1400427d0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 2
jb 0x14000414a
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000636c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 8
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, [0x1400429a0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x140006398
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400063f4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 5
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, [0x1400429a0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x140006420
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x14000647c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 9
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, [0x1400429a0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x1400064a8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 3
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, [0x1400429a0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x1400065bc
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006618
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 2
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, [0x1400429a0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x140006644
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140007000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, [0x140042b70]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x140007058
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007204
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 0xc
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x22a0122a0122a013
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x1c3
lea rcx, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x140007230
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000728c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x1400072e2
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007399
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400073f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x140007453
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400074b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x140007507
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x1400075c4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007624
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x18]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x18]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x18
jb 0x14000767d
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400076dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 6]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 6]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov word [rax + 4], cx
add rax, 6
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x22a0122a0122a013
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub r8, rax
lea rax, str.EYgTplCEaaNYVneaAMcqrJMaTtVNI_defFRJQuCgXnHfjBOrmZTLOPfTNf_wbfBTUXeenMvCUEfgPcLHTojVgbkUvcdKRBRQBBtmlRWzzNduElr_qzcMVojHxAQCbhfTZHXPDOMacLEdUrkiAgbMwPcqlTTxaHkmG_XCbwrgRLTuvLLwfcYESryqtEQSznFsgMIcDwSVppsaVahNqClLkJLFlaYvDyhRQYDRrPiJRgrlSWOKMWLiaWdYDWYaQmlenCLITUZjNrkvLVJZDMZRqHYjxDRatXpkSRxUt_NJXWXXnxHNOtgcfcMKivXshLMnYpMXNmNzPEeMMXrfyUWkARUBPVbgbpaE_KmbgSJSmefZEXklbOoBbasmKWlfSpf_HFMUwxmKUEXqtqWwuDmiYMTRDKiauLJgWpkLeesvtpckvcwIEWewzbXdj_hjYJiLkp
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 6
jb 0x140007731
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret