joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012cd00
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbx, rcx
cmp rax, 0xffffffffffffffff
je 0x14012cd99
mov byte [rcx + 0xb4], 0
xor edx, edx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetCommMask]
mov rcx, qword [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0xa0]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14012cd5c
mov rcx, qword [rbx + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xd8]
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0x10], 0xffffffffffffffff
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResetEvent]
add rsp, 0x20
pop rbx
ret

Function at 0x14012cfb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x14018c010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x7f
mov eax, 0xffffff81
cmp ecx, ebx
jle 0x14012cfe3
mov ecx, ebx
jmp 0x14012cfe8
cmp ecx, eax
cmovl ecx, eax
cmp edx, ebx
jg 0x14012cff3
cmp edx, eax
mov ebx, edx
cmovl ebx, eax
test ecx, ecx
lea eax, [rcx + 0x100]
lea rdx, str._02X
cmovs ecx, eax
mov r8d, ecx
lea rcx, [rsp + 0x38]
call fcn.14001a100
lea eax, [rbx + 0x100]
test ebx, ebx
lea rdx, str._02X
cmovs ebx, eax
lea rcx, [rsp + 0x34]
mov r8d, ebx
call fcn.14001a100
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, str.57AB0200_s_s00
lea rcx, [rsp + 0x50]
call fcn.14001a100
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14012d060
mov rbp, rbx
shr rbp, 1
mov rcx, rbp
call fcn.140130670
xor edi, edi
mov rsi, rax
test rbx, rbx
je 0x14012d0b1
lea rcx, [rsp + 0x50]
add rcx, rdi
lea r8, [rsp + 0x3c]
lea rdx, [0x140161e28]
call fcn.140033240
movzx eax, byte [rsp + 0x3c]
mov rcx, rdi
shr rcx, 1
add rdi, 2
mov byte [rcx + rsi], al
cmp rdi, rbx
jb 0x14012d081
mov rax, qword [0x140198890]
cmp rax, 0xffffffffffffffff
je 0x14012d14c
mov rcx, qword [0x140198890]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x14012d0f4
cmp dword [rsp + 0x40], 0
jbe 0x14012d0f4
mov rcx, qword [0x140198890]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_PurgeComm]
mov rcx, qword [0x140198890]
lea rbx, [0x140198900]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov dword [rsp + 0x30], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14012d14c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14012d14c
mov rcx, qword [0x140198890]
lea r8, [rsp + 0x30]
mov r9d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rcx, rsi
call fcn.140036bd0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140130030
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012d420
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14018c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140195438], 0
ja 0x14012d454
mov eax, 0xffffdcd8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140130030
add rsp, 0x58
ret
inc dword [0x140195448]
mov qword [rsp + 0x50], rbx
mov dword [0x14019544c], 0xaa8855aa
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov rcx, qword [0x140195438]
lea rdx, [0x140195440]
xor r9d, r9d
mov dword [0x140195444], eax
lea rax, [0x140195c80]
mov dword [rsp + 0x28], recvfrom
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x10]
call qword [sym.imp.WSOCK32.dll_sendto]
mov rcx, qword [0x140195438]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140195860]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], recvfrom
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
call qword [sym.imp.WSOCK32.dll_recvfrom]
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSACleanup]
test ebx, ebx
mov qword [0x140195438], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
jns 0x14012d510
mov eax, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140130030
add rsp, 0x58
ret
mov eax, dword [0x14019544c]
cmp dword [0x14019586c], eax
je 0x14012d535
mov eax, 0xffffdcdc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140130030
add rsp, 0x58
ret
mov ecx, dword [0x140195448]
mov edx, 0xffffdcdd
cmp dword [0x140195868], ecx
mov eax, dword [0x140195864]
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140130030
add rsp, 0x58
ret
Function at 0x14012f810
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14012f894
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14014daf0]
cmp byte [rcx + rax], 0
je 0x14012f894
dec r8
sub rdx, 1
jne 0x14012f87a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140130ffc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140131046
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140131046
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140131046
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140131046
cmp dword [rcx + 0x84], 0xe
jbe 0x140131046
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140131048
xor al, al
add rsp, 0x28
ret
Function at 0x1400012fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 5]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 5]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov byte [rax + 4], cl
add rax, 5
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043440]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 5
jb 0x140001350
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400013b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x7a]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000a1b4
mov qword [rdi], rax
lea r8d, [rsi + 0x7a]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x7a]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000cc70
lea rax, [rbx + 0x7a]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc esi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043440]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x7a
jb 0x140001413
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001478
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 8]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 8]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
add rax, 8
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043440]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 8
jb 0x1400014ca
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043510]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 2
jb 0x140001da2
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x41]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000a1b4
mov qword [rdi], rax
lea r8d, [rsi + 0x41]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x41]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000cc70
lea rax, [rbx + 0x41]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc esi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043510]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x41
jb 0x140001e63
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140002d28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xc]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xc]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
add rax, 0xc
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x1400435e0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xc
jb 0x140002d7d
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400064dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 8
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, [0x140043780]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x140006508
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006564
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 5
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, [0x140043780]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x140006590
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400065ec
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 9
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, [0x140043780]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x140006618
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 3
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, [0x140043780]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x14000672c
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006788
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 2
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, [0x140043780]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x1400067b4
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140007170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, [0x140043920]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x1400071c8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007374
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a1b4
mov edx, 0xc
mov rcx, rax
call fcn.1400021b0
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4e5e0a72f0539783
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rax, rcx, 0xc4
lea rcx, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x1400073a0
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400073fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x140007452
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400074b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007509
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x1400075c3
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007624
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x140007677
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400076d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x140007734
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007794
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x18]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x18]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x18
jb 0x1400077ed
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000784c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a1b4
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 6]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a1b4
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 6]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov word [rax + 4], cx
add rax, 6
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4e5e0a72f0539783
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 7
imul rax, rax, 0xc4
sub r8, rax
lea rax, str.odUSmawgitSsfNwHqrEDMEWmJzHZsKKrmQCbpsnEUCPGnEGlQYbbiiEZGSFeEcVoMRxnzxwEcRUcvamBUlUQRXcYjzEcByfRaqWbBjIKMuIDXTkMvtSvORkYuWhPOxanhUnXeggQryglPjfuxYjVGsGReOGDhOwIACVGabHfKKSblQqzZEINLkqGFBQnZCvSwXA
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 6
jb 0x1400078a1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret