joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055da0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
mov qword [rsp + 0x10], rsi
nop
push 0x37b8239f
mov qword [rsp], rdi
nop
add rsp, 0x3a74153b
sub rsp, 0x3a74155b
xchg rsi, rbp
mov rbp, qword [rcx + 0x38]
xchg rbp, rsi
mov rbx, rdx
xchg r9, r9
mov r8, qword [rdx + 0x38]
xchg rcx, r15
mov rdi, r15
xchg r15, rcx
add r8, rsi
xchg r11, rdx
mov r11, rsi
xchg rdx, r11
mov qword [rcx + 0x38], r8
call fcn.140056a40
mov dword [rsp - 0x18], 0x28279a78
xchg r9, r12
mov r12, qword [rbx]
xchg r12, r9
mov ecx, esi
mov rsp, rsp
and ecx, 3
mov r8d, 0x58eb2ffb
xor r8d, 0x725284c6
xor r8d, 0x7bc34127
sub r8d, 0x1055b9d6
add r8d, 0x29842fcd
shl ecx, 2
shl ecx, 1
mov edx, r8d
mov dword [rsp - 0x1c], ebx
ror edx, cl
xchg r10, rax
mov rax, r10
xchg r10, rax
xor ecx, ecx
xchg r11, r11
cmp qword [rbx + 0x38], rcx
jbe 0x140055edb
lea rax, [rsi + rsi]
mov dword [rsp - 0x1c], 0x50202dc3
mov r11d, 0x6a2dbce0
xor r11d, 0x28fc90d8
xor r11d, 0x16b6a8ec
add r11d, 0x2a4ae8a0
sub r11d, 0x7eb26c75
sub rax, r9
mov r11, r11
add r10, rax
nop dword [rax]
movzx eax, dx
mov r10, r10
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 5
ror edx, 2
ror edx, 1
and ax, r11w
mov dword [rsp - 0x30], ebx
ror r8d, 6
ror r8d, 1
ror r8d, 1
xor ax, word [r9 - 2]
inc rcx
mov rdx, rdx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140055e94
mov dword [rsp - 0x44], esp
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
mov rax, rdi
xchg rsi, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x140055f00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rbx
mov qword [rsp + 0x10], rbx
xchg rsi, rbx
xchg rdi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rdi
push r14
mov dword [rsp - 0x2c], 0x6e622776
sub rsp, 0x20
mov r14, qword [rcx + 0x38]
mov rdi, rdx
xchg r9, rsi
mov r9, rcx
xchg r9, rsi
nop
movabs rbx, 0xffffffff325b0e96
sub rbx, 0x20cb9ca8
sub rbx, 0x1071ca53
add rbx, 0x7fffffff
add rbx, 0x7ee25865
inc rbx
cmp word [rdx + rbx*2], 0
mov r11, r11
jne 0x140055f60
lea r8, [r14 + rbx]
xchg rdx, r14
mov r14, rdx
xchg r14, rdx
mov qword [rcx + 0x38], r8
call fcn.140056a40
xchg r11, r11
mov ecx, r14d
mov edx, 0x2dc47bb7
add edx, 0x32226ffa
xor edx, 0x4cdd5ea6
xor edx, 0x7992d506
and ecx, 3
shl ecx, 1
shl ecx, 2
ror edx, cl
test rbx, rbx
mov dword [rsp - 0x40], 0x3df9bc96
je 0x140056024
lea r8, [r14 + r14]
mov ecx, 0x650a2c58
sub ecx, 0x54d34985
add ecx, 0x21febb17
sub ecx, 0x32359ceb
sub r8, rdi
mov dword [rsp - 0x10], 0x35dfdd46
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov dword [rsp - 0x3c], 0x304ab3a0
lea rdi, [rdi + 2]
and ax, cx
ror edx, 2
ror edx, 6
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
mov dword [rsp - 0x18], edx
sub rbx, 1
jne 0x140055ff4
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
xchg rdx, rsi
mov rax, rdx
xchg rdx, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
nop
add rsp, 0x1f2ecda3
sub rsp, 0x1f2ecd83
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400567a0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
xchg rbp, r14
mov qword [rsp + 0x18], r14
xchg r14, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
lea rsi, [rdx + 8]
xorps xmm0, xmm0
xchg r12, r12
xchg rsi, rcx
mov qword [rdx], rcx
xchg rsi, rcx
xor edi, edi
mov dword [rsp - 0x30], 0xf1959c5
xchg r10, rsi
movups xmmword [r10], xmm0
xchg rsi, r10
mov r14, r9
xchg r8, rbp
mov r8, rbp
xchg rbp, r8
xchg rsi, r11
movups xmmword [r11 + 0x10], xmm0
xchg r11, rsi
xchg rdi, rdx
mov rbx, rdi
xchg rdi, rdx
movups xmmword [rsi + 0x20], xmm0
mov qword [rdx + 0x38], rdi
mov dword [rsp - 0x2c], ebx
mov rax, qword [rcx + 0x38]
cmp r8, rax
jae 0x1400569c7
mov dword [rsp - 0x1c], 0x60bb9f0a
sub rax, r8
mov qword [rsp + 0x40], r15
cmp rax, r9
cmovb r14, rax
mov dword [rsp - 0x3c], 0x3dc0aedf
mov qword [rdx + 0x38], r14
xchg r8, rax
mov r8, qword [rcx]
xchg r8, rax
xchg r9, rcx
mov r9, qword [rdx]
xchg r9, rcx
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14005687d
xchg r13, r13
call fcn.140099eb0
cmp r14, 0x18
jbe 0x1400568b4
mov dword [rsp - 0x38], ebx
lea rcx, [r14 + r14]
call fcn.14009a150
mov qword [rbx], rax
xchg r12, r12
test rax, rax
jne 0x1400568bd
mov qword [rbx], rsi
xchg r9, rdi
mov rdi, r9
xchg rdi, r9
jmp 0x1400568db
mov qword [rbx], rsi
mov r9, r9
mov rax, rsi
xorps xmm0, xmm0
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rax
xchg r14, rax
movups xmmword [r14 + 0x20], xmm0
xchg r14, rax
mov r9, qword [rbx]
and ebp, 3
mov dword [rsp - 0x30], esp
mov r8d, 0x607aa559
sub r8d, 0x1fc5c15a
sub r8d, 0x38843a28
add r8d, 0x982d5d6
xor r8d, 0x7b1a1fbc
shl ebp, 3
mov dword [rsp - 0x24], 0x5658ff4f
mov edx, r8d
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
mov rbp, rbp
jbe 0x140056993
sub r15, r9
mov ecx, 0x27b5b2ec
add ecx, 0x45099134
sub ecx, 0x6bfecf4a
sub ecx, 0xc073d7
nop dword [rax]
nop word [rax + rax]
xchg r9, r9
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 4
ror edx, 2
ror edx, 2
and ax, cx
xchg r12, r12
ror r8d, 4
ror r8d, 3
ror r8d, 1
xor ax, word [r15 + r9 - 2]
xchg r8, r8
inc rdi
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
mov dword [rsp - 0x2c], ecx
jb 0x14005694f
mov r15, qword [rsp + 0x40]
mov rax, rbx
mov dword [rsp - 0x34], edx
mov rbx, qword [rsp + 0x48]
xchg rbp, r12
mov r12, qword [rsp + 0x50]
xchg rbp, r12
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
pop rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
xchg r15, rax
mov r15, rbx
xchg r15, rax
jmp 0x14005699f

Function at 0x140056d90
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ebf6
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140144f30]
mov dword [rsp - 0x2c], 0x4c57699b
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov dword [rsp - 0x3c], 0x1d2b7521
ret
Function at 0x140056db0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
mov dword [rsp - 0x18], edi
jmp 0x14008f27b
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144fc8]
cmp qword [0x140145018], 0
mov r8, r8
jne 0x14008e980
syscall
ret

Function at 0x140056dd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e9f5
xchg r10, r15
mov r15, rcx
xchg r10, r15
mov eax, dword [0x140144f00]
mov dword [rsp - 0x2c], ecx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056de0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008efc6
xchg r10, r8
mov r8, rcx
xchg r8, r10
mov eax, dword [0x140144f88]
cmp qword [0x140145018], 0
mov rcx, rcx
jne 0x14008e980
syscall
ret

Function at 0x140056df0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ee50
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x140144f68]
cmp qword [0x140145018], 0
mov dword [rsp - 0x10], edi
jne 0x14008e980
syscall
ret

Function at 0x140056e00
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ea51
xchg r10, rsp
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x140144f08]
cmp qword [0x140145018], 0
jne 0x14008e980
xchg r10, r10
syscall
ret

Function at 0x140056e10
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f0f7
xchg rdx, r10
mov rdx, rcx
xchg rdx, r10
mov eax, dword [0x140144fa4]
cmp qword [0x140145018], 0
mov dword [rsp - 0x1c], ecx
jne 0x14008e980
syscall
ret

Function at 0x140056e20
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f121
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144fa8]
mov dword [rsp - 0xc], edx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov rdx, rdx
ret

Function at 0x140056e30
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f04e
xchg r8, r10
mov r8, rcx
xchg r8, r10
mov eax, dword [0x140144f94]
cmp qword [0x140145018], 0
xchg rdi, rdi
jne 0x14008e980
syscall
ret

Function at 0x140056e40
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f077
xchg r9, r10
mov r9, rcx
xchg r9, r10
mov eax, dword [0x140144f98]
mov dword [rsp - 0x24], edx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056e50
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ec2c
mov r10, rcx
mov eax, dword [0x140144f34]
mov r10, r10
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
xchg r11, r11
ret

Function at 0x140056e60
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ef02
xchg r10, r8
mov r8, rcx
xchg r8, r10
mov eax, dword [0x140144f78]
cmp qword [0x140145018], 0
mov dword [rsp - 0x14], 0x3c4d9380
jne 0x14008e980
syscall
ret

Function at 0x140056e70
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ef66
xchg r9, rcx
mov r10, r9
xchg rcx, r9
mov eax, dword [0x140144f80]
cmp qword [0x140145018], 0
mov dword [rsp - 0x24], ebx
jne 0x14008e980
syscall
ret

Function at 0x140056e80
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ea23
xchg r9, r10
mov r9, rcx
xchg r9, r10
mov eax, dword [0x140144f04]
cmp qword [0x140145018], 0
mov dword [rsp - 0x34], ebx
jne 0x14008e980
syscall
ret
Function at 0x140056e90
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008efef
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x140144f8c]
mov dword [rsp - 0x10], 0x59ec6788
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
xchg rcx, rcx
ret

Function at 0x140056ea0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ee00
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x140144f60]
cmp qword [0x140145018], 0
jne 0x14008e980
mov dword [rsp - 0x1c], edi
syscall
ret

Function at 0x140056eb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ee2a
mov r10, rcx
mov eax, dword [0x140144f64]
mov rsi, rsi
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
xchg r13, r13
ret

Function at 0x140056ec0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eca9
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144f40]
mov r11, r11
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov rsi, rsi
ret

Function at 0x140056ed0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov r11, r11
mov byte [rsp + 0x48], al
jmp 0x14008f24a
xchg rcx, rbp
mov r10, rbp
xchg rcx, rbp
mov eax, dword [0x140144fc4]
mov dword [rsp - 0x40], 0xbe4ee80
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
xchg r8, r8
ret

Function at 0x140056ef0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eb1e
xchg r10, r12
mov r12, rcx
xchg r10, r12
mov eax, dword [0x140144f1c]
mov dword [rsp - 0x34], edx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov dword [rsp - 0x14], esp
ret

Function at 0x140056f00
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eb4c
xchg r10, r9
mov r9, rcx
xchg r10, r9
mov eax, dword [0x140144f20]
mov dword [rsp - 0xc], 0xa532a5d
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056f10
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eb7a
mov r10, rcx
mov eax, dword [0x140144f24]
mov dword [rsp - 0x28], 0x75e6aa0c
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
xchg rsi, rsi
ret

Function at 0x140056f20
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eba5
mov r10, rcx
mov dword [rsp - 0x34], edi
mov eax, dword [0x140144f28]
cmp qword [0x140145018], 0
jne 0x14008e980
mov dword [rsp - 0x18], edi
syscall
ret

Function at 0x140056f30
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eaf5
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144f18]
xchg rbx, rbx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f0a1
xchg rsp, r10
mov rsp, rcx
xchg r10, rsp
mov eax, dword [0x140144f9c]
mov dword [rsp - 0x30], esi
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov r8, r8
ret

Function at 0x140056f50
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ebcd
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144f2c]
cmp qword [0x140145018], 0
jne 0x14008e980
xchg rcx, rcx
syscall
ret

Function at 0x140056f60
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ea7a
mov r10, rcx
mov eax, dword [0x140144f0c]
xchg rdi, rdi
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret
Function at 0x140056f70
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ec52
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140144f38]
cmp qword [0x140145018], 0
jne 0x14008e980
xchg rdi, rdi
syscall
ret

Function at 0x140056f80
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eea2
xchg r10, rsi
mov rsi, rcx
xchg rsi, r10
mov eax, dword [0x140144f70]
mov dword [rsp - 0x1c], 0x4398c92f
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056f90
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ef30
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144f7c]
mov dword [rsp - 0x14], 0x4d270feb
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov dword [rsp - 0x28], 0x79e5ca40
ret

Function at 0x140056fb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008eac8
xchg r10, r15
mov r15, rcx
xchg r15, r10
mov eax, dword [0x140144f14]
mov dword [rsp - 0x30], ebx
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov rcx, rcx
ret

Function at 0x140056fc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f21e
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140144fc0]
xchg rsp, rsp
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov rsp, rsp
ret

Function at 0x140056fd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f0ce
xchg rdx, r10
mov rdx, rcx
xchg r10, rdx
mov eax, dword [0x140144fa0]
mov rbp, rbp
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
ret

Function at 0x140056fe0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f1c4
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144fb8]
cmp qword [0x140145018], 0
mov r8, r8
jne 0x14008e980
syscall
ret

Function at 0x140056ff0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ef90
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140144f84]
mov dword [rsp - 0x28], 0x77e5b481
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov dword [rsp - 0x34], 0x60309132
ret

Function at 0x140057000
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008f1ed
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140144fbc]
mov rbp, rbp
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov dword [rsp - 0x38], 0x3ba4778e
ret

Function at 0x140057010
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ea9d
mov r10, rcx
mov eax, dword [0x140144f10]
mov dword [rsp - 0x18], 0x740a7dd8
cmp qword [0x140145018], 0
jne 0x14008e980
syscall
mov rdi, rdi
ret

Function at 0x140057020
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ec7b
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140144f3c]
cmp qword [0x140145018], 0
mov dword [rsp - 0x24], 0x2359fdb5
jne 0x14008e980
syscall
ret
Function at 0x140069efc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x14], ebx
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rsp, rbp
mov rsp, rbp
xchg rbp, rsp
sub rsp, 0x60
mov dword [rsp - 0x40], esi
movabs rbx, 0x739865646f00184d
xor rbx, 0x75a2eeb4
add rbx, 0x512b7675
xor rbx, 0x2e92e52
sub rbx, 0x3715d96d
mov rdi, rcx
cmp qword [rcx + 0x30], rbx
mov r15, r15
jne 0x14006a10b
xor esi, esi
mov dword [rbp - 0x40], 0x481f50ed
sub dword [rbp - 0x40], 0x1e573f27
xor dword [rbp - 0x40], 0xd92cabd
add dword [rbp - 0x40], 0x3ed8a5f6
sub dword [rbp - 0x40], 0x632f8121
mov dword [rbp - 0x3c], 0x41ef2a93
add dword [rbp - 0x3c], 0x95a8ecd
sub dword [rbp - 0x3c], 0x46683810
xor dword [rbp - 0x3c], 0x4ea818f
mov dword [rbp - 0x38], 0x1de2287f
sub dword [rbp - 0x38], 0x92b4f94
xor dword [rbp - 0x38], 0x3ac5bb69
sub dword [rbp - 0x38], 0x1ca1530e
sub dword [rbp - 0x38], 0x11c91013
mov dword [rbp - 0x34], 0x63237173
sub dword [rbp - 0x34], 0x2ba8f417
add dword [rbp - 0x34], 0x1f75a725
sub dword [rbp - 0x34], 0x569823e7
mov dword [rbp - 0x30], 0x5e52cfc1
sub dword [rbp - 0x30], 0x4bf7705c
xor dword [rbp - 0x30], 0x171a353e
sub dword [rbp - 0x30], 0x53d6a1c
mov dword [rbp - 0x2c], 0x75c39116
xor dword [rbp - 0x2c], 0x5d514db4
add dword [rbp - 0x2c], 0x23018cba
sub dword [rbp - 0x2c], 0x4b8e6897
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x24], ebx
mov rcx, qword [rbp + 0x10]
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
and cl, 3
mov rsp, rsp
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x6dcad31d
xor eax, 0x1552e846
sub eax, 0x68e69619
add eax, 0x5af7bacf
shr eax, cl
mov dword [rsp - 0x28], ecx
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov dword [rsp - 0x14], 0x26e4c5a4
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
mov r12, r12
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
cmp rax, 0xc
jb 0x14006a023
xchg r9, r9
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
mov dword [rsp - 0x14], 0x193c6eea
call fcn.14008c3d0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
xchg rdx, r10
mov qword [rdi + 0x30], r10
xchg r10, rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov dword [rsp - 0xc], 0x74996e75
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006a113
mov dword [rsp - 0x20], esp
lea rdx, [0x1401442c0]
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
call fcn.14006e9f4
test al, al
setne al
xchg rbp, rbp
jmp 0x14006a113
mov al, 0x7a
sub al, 0x14
add al, 0xf
sub al, 0x74
lea r11, [rsp + 0x60]
mov rbp, rbp
xchg rbx, r9
mov r9, qword [r11 + 0x18]
xchg rbx, r9
xchg rcx, rsi
mov rcx, qword [r11 + 0x20]
xchg rcx, rsi
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x28], 0x10585b8a
xchg rbp, r11
mov rsp, rbp
xchg r11, rbp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14006a150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rdi, rbx
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
nop
push r15
mov qword [rsp], rbp
xchg r14, rbp
mov r14, rsp
xchg rbp, r14
nop
sub rsp, 0x4038f484
add rsp, 0x4038f434
movabs rbx, 0x739865647057463e
xor rbx, 0x5337e96d
sub rbx, 0x4eab56e
add rbx, 0x139b6fea
xchg rcx, rsp
mov rdi, rsp
xchg rsp, rcx
cmp qword [rcx + 0x28], rbx
mov rsi, rsi
jne 0x14006a346
mov eax, 0x57c349a5
sub eax, 0x2ab37908
add eax, 0x249b2ce1
sub eax, 0x324707b1
xor eax, 0x1f63f5b0
mov dword [rbp - 0x30], 0x657c43c6
xor dword [rbp - 0x30], 0x1d040050
xor dword [rbp - 0x30], 0x55e765e0
add dword [rbp - 0x30], 0x29251274
sub dword [rbp - 0x30], 0x56b8388c
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rsp - 0x40], 0x6ceed419
mov dword [rbp - 0x2c], 0x4a028fb
add dword [rbp - 0x2c], 0x310d970a
add dword [rbp - 0x2c], 0x1331ab5e
sub dword [rbp - 0x2c], 0x48866a97
mov dword [rbp - 0x28], 0x3f91b807
add dword [rbp - 0x28], 0x3687e9b1
sub dword [rbp - 0x28], 0x267d08dd
sub dword [rbp - 0x28], 0x4f4e98b8
mov dword [rbp - 0x24], 0x39e0178f
add dword [rbp - 0x24], 0x3dde0fcc
sub dword [rbp - 0x24], 0xeff5e45
sub dword [rbp - 0x24], 0x11ba3ca1
sub dword [rbp - 0x24], 0x56fe8ba8
mov qword [rbp + 0x10], rsi
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x5fd23dc5
xor eax, 0x4c18ea49
xor eax, 0x6b197606
sub eax, 0xe2a4179
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x44], ebx
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg rsi, rsi
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 9
jb 0x14006a26a
mov r9, r9
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
mov dword [rsp - 0x18], 0x26f1565f
call fcn.14008c3d0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov dword [rsp - 0x18], 0x2a1074be
xor rdx, rbx
xchg rdx, r11
mov qword [rdi + 0x28], r11
xchg rdx, r11
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
mov rsp, rsp
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006a350
xchg rcx, rcx
lea rdx, [0x140144810]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.140073148
mov dword [rsp - 0x2c], 0x4653c4ab
test al, al
setne al
jmp 0x14006a350
mov al, 0x70
sub al, 0x31
xor al, 0x41
sub al, 0x57
xor al, 0x26
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x24], 0x1e8fcc99
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffb0
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14006a378
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov rbp, rbp
mov qword [rsp + 0x18], rsi
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdx, rdi
push rbx
mov qword [rsp], rbp
mov rbp, rsp
mov dword [rsp - 0x28], edx
nop
add rsp, 0x272f9e3b
sub rsp, 0x272f9e8b
movabs rbx, 0x739865642a23b180
xor rbx, 0x3c1a3a8f
add rbx, 0x4c6f157d
sub rbx, 0x309736bd
mov rdi, rcx
mov r15, r15
cmp qword [rcx + 0x38], rbx
jne 0x14006a572
xor esi, esi
mov dword [rbp - 0x30], 0x6da8a9e2
xor dword [rbp - 0x30], 0x187418f3
xor dword [rbp - 0x30], 0x54298409
add dword [rbp - 0x30], 0x1d9ebdfd
sub dword [rbp - 0x30], 0x3f83f2d2
mov dword [rbp - 0x2c], 0x631c453b
sub dword [rbp - 0x2c], 0x1b2782c2
sub dword [rbp - 0x2c], 0x4302d993
sub dword [rbp - 0x2c], 0x4d9e81c
mov dword [rbp - 0x28], 0x2a300b1a
add dword [rbp - 0x28], 0x16c9b1ac
sub dword [rbp - 0x28], 0x1dd835f3
xor dword [rbp - 0x28], 0x237586b6
mov dword [rbp - 0x24], 0x690d1c22
sub dword [rbp - 0x24], 0x1a95eb2
xor dword [rbp - 0x24], 0x70381407
xor dword [rbp - 0x24], 0x67d32e2
sub dword [rbp - 0x24], 0x11189b0e
mov dword [rbp - 0x20], 0x1d86e276
sub dword [rbp - 0x20], 0x1072cd7
add dword [rbp - 0x20], 0x4d092769
xor dword [rbp - 0x20], 0x6984dd75
mov qword [rbp + 0x10], rsi
xchg r14, r14
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
xchg rcx, r11
mov r11, qword [rbp + 0x10]
xchg rcx, r11
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x28], 0xf493d0
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x1afdf6f
xor eax, 0x3b3ea8c8
xor eax, 0x12a93e39
xor eax, 0xd9a9038
add eax, 0x4506866b
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x20], edx
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov dword [rsp - 0x20], 0x6586df2
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
inc rax
xchg r14, rax
mov qword [rbp + 0x10], r14
xchg r14, rax
mov rax, qword [rbp + 0x10]
xchg r8, r8
cmp rax, 0xa
jb 0x14006a485
xor edx, edx
mov dword [rsp - 0x2c], ebx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008c3d0
xchg rdx, r13
mov r13, rax
xchg rdx, r13
mov r8, rax
xor eax, eax
xor rdx, rbx
mov dword [rsp - 0x28], 0x28abbd49
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov r11, r11
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006a57c
lea rdx, [0x140144830]
xchg rsi, rsi
xchg r8, r15
mov rcx, r15
xchg r8, r15
call fcn.140073558
test al, al
mov dword [rsp - 0x28], 0x18ad8e49
setne al
jmp 0x14006a57c
mov al, 0x4d
add al, 4
xor al, 0x5b
xor al, 0x76
sub al, 0x7b
mov rbx, qword [rsp + 0x68]
xchg rbx, rsi
mov rbx, qword [rsp + 0x70]
xchg rbx, rsi
mov rdi, qword [rsp + 0x78]
mov r11, r11
add rsp, 0x50
pop rbp
ret