joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov esi, r8d
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x26]
call fcn.1400049b0
mov r9, rbx
mov r10, rdi
sub r9, rdi
neg r10
lea ecx, [rdi + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rdi + 0x13], r8b
mov al, byte [rdi]
xor al, r8b
mov byte [r9 + rdi], al
inc rdi
lea rax, [r10 + rdi]
cmp rax, 0x13
jb 0x140002117
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x22]
call fcn.1400049b0
mov r9, rdi
mov r10, rbx
sub r9, rbx
neg r10
lea ecx, [rbx + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rbx + 0x11], r8b
mov al, byte [rbx]
xor al, r8b
mov byte [r9 + rbx], al
inc rbx
lea rax, [r10 + rbx]
cmp rax, 0x11
jb 0x1400021af
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140002218
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x20]
call fcn.1400049b0
mov r9, rdi
mov r10, rbx
sub r9, rbx
neg r10
lea ecx, [rbx + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rbx + 0x10], r8b
mov al, byte [rbx]
xor al, r8b
mov byte [r9 + rbx], al
inc rbx
lea rax, [r10 + rbx]
cmp rax, 0x10
jb 0x140002247
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400022b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
call fcn.1400049b0
mov r9, rdi
mov r10, rbx
sub r9, rbx
neg r10
lea ecx, [rbx + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rbx + 0x14], r8b
mov al, byte [rbx]
xor al, r8b
mov byte [r9 + rbx], al
inc rbx
lea rax, [r10 + rbx]
cmp rax, 0x14
jb 0x1400022df
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002348
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x24]
call fcn.1400049b0
mov r9, rdi
mov r10, rbx
sub r9, rbx
neg r10
lea ecx, [rbx + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rbx + 0x12], r8b
mov al, byte [rbx]
xor al, r8b
mov byte [r9 + rbx], al
inc rbx
lea rax, [r10 + rbx]
cmp rax, 0x12
jb 0x140002377
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400023e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov rbx, rdx
mov qword [rcx + 8], rax
mov word [rcx + 0x10], ax
neg rbx
mov edi, r8d
mov r10, rdx
mov r9, rcx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 9], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 9
jb 0x14000240c
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140002474
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x2a]
call fcn.1400049b0
mov r9, rdi
mov r10, rbx
sub r9, rbx
neg r10
lea ecx, [rbx + r10]
or cl, sil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r9 + rbx + 0x15], r8b
mov al, byte [rbx]
xor al, r8b
mov byte [r9 + rbx], al
inc rbx
lea rax, [r10 + rbx]
cmp rax, 0x15
jb 0x1400024a3
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000250c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov qword [rcx + 8], rax
mov rbx, rdx
mov qword [rcx + 0x10], rax
mov edi, r8d
mov dword [rcx + 0x18], eax
mov r10, rdx
mov r9, rcx
neg rbx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 0xe], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 0xe
jb 0x14000253b
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400025a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov rbx, rdx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
neg rbx
mov edi, r8d
mov r10, rdx
mov r9, rcx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 0xc], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 0xc
jb 0x1400025cc
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140002634
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov qword [rcx + 8], rax
mov rbx, rdx
mov qword [rcx + 0x10], rax
mov edi, r8d
mov word [rcx + 0x18], ax
mov r10, rdx
mov r9, rcx
neg rbx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 0xd], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 0xd
jb 0x140002664
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1400026cc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x17]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x17
jb 0x1400026d2
mov rax, rcx
ret

Function at 0x1400026e8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x13]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x13
jb 0x1400026ee
mov rax, rcx
ret

Function at 0x140002704
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x11]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x11
jb 0x14000270a
mov rax, rcx
ret

Function at 0x140002720
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 6]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 6
jb 0x140002726
mov rax, rcx
ret

Function at 0x14000273c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x10]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x10
jb 0x140002742
mov rax, rcx
ret

Function at 0x140002758
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x14]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x14
jb 0x14000275e
mov rax, rcx
ret

Function at 0x140002774
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x12
jb 0x14000277a
mov rax, rcx
ret

Function at 0x140002790
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 9]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 9
jb 0x140002796
mov rax, rcx
ret
Function at 0x1400027ac
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x15]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x15
jb 0x1400027b2
mov rax, rcx
ret

Function at 0x1400027c8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x19]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x19
jb 0x1400027ce
mov rax, rcx
ret

Function at 0x1400027e4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xe]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xe
jb 0x1400027ea
mov rax, rcx
ret

Function at 0x140002800
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xb]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xb
jb 0x140002806
mov rax, rcx
ret

Function at 0x14000281c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xc]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xc
jb 0x140002822
mov rax, rcx
ret

Function at 0x140002838
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xd]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xd
jb 0x14000283e
mov rax, rcx
ret

Function at 0x140002854
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 9
jb 0x14000285a
mov rax, rcx
ret

Function at 0x140002878
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 2]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 2
jb 0x14000287e
mov rax, rcx
ret

Function at 0x140002894
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
lea rdi, str.CONIN_
mov qword [rcx], rax
xor r11d, r11d
mov r10, rcx
mov dword [rcx + 8], eax
mov word [rcx + 0xc], ax
mov ebx, r8d
mov r9, rcx
sub r10, rdi
mov cl, r11b
or cl, bl
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
lea rcx, [r11 + rdi]
and r8d, 0x37
xor r8d, eax
inc r11
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r10 + rcx + 7], r8b
mov al, byte [rcx]
xor al, r8b
mov byte [r10 + rcx], al
cmp r11, 7
jb 0x1400028c0
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140002924
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
lea rdi, str.CONOUT_
xor r11d, r11d
mov qword [rcx], rax
mov r10, rcx
mov qword [rcx + 8], rax
mov ebx, r8d
mov r9, rcx
sub r10, rdi
mov cl, r11b
or cl, bl
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
lea rcx, [r11 + rdi]
and r8d, 0x37
xor r8d, eax
inc r11
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r10 + rcx + 8], r8b
mov al, byte [rcx]
xor al, r8b
mov byte [r10 + rcx], al
cmp r11, 8
jb 0x14000294d
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400029b4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 7]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 7
jb 0x1400029ba
mov rax, rcx
ret

Function at 0x1400029d0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 8
jb 0x1400029d6
mov rax, rcx
ret
Function at 0x140004098
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ebp, r8d
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x46]
call fcn.1400049b0
xor edx, edx
lea rdi, [rbx + 0x46]
mov rcx, rdi
lea r8d, [rdx + 0x46]
call fcn.1400049b0
xor r9d, r9d
sub rsi, rbx
mov cl, r9b
inc r9
or cl, bpl
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov word [rdi], r8w
mov al, byte [rsi + rdi - 0x46]
lea rdi, [rdi + 2]
xor al, r8b
movsx eax, al
mov word [rdi - 0x48], ax
cmp r9, 0x23
jb 0x1400040d8
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000414c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
lea r10, [rcx + 0x18]
mov qword [rcx], rax
mov r11, rdx
mov qword [rcx + 8], rax
xor ebx, ebx
mov qword [rcx + 0x10], rax
mov edi, r8d
mov qword [r10], rax
mov r9, rcx
mov qword [r10 + 8], rax
sub r11, rcx
mov qword [r10 + 0x10], rax
mov cl, bl
inc rbx
or cl, dil
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov word [r10], r8w
mov al, byte [r11 + r10 - 0x18]
lea r10, [r10 + 2]
xor al, r8b
movsx eax, al
mov word [r10 - 0x1a], ax
cmp rbx, 0xc
jb 0x140004180
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1400041ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
lea r10, [rcx + 0x16]
mov qword [rcx], rax
mov r11, rdx
mov qword [rcx + 8], rax
xor ebx, ebx
mov dword [rcx + 0x10], eax
mov edi, r8d
mov word [rcx + 0x14], ax
mov r9, rcx
mov qword [r10], rax
sub r11, rcx
mov qword [r10 + 8], rax
mov dword [r10 + 0x10], eax
mov word [r10 + 0x14], ax
mov cl, bl
inc rbx
or cl, dil
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov word [r10], r8w
mov al, byte [r11 + r10 - 0x16]
lea r10, [r10 + 2]
xor al, r8b
movsx eax, al
mov word [r10 - 0x18], ax
cmp rbx, 0xb
jb 0x140004228
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140004294
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
lea r10, [rcx + 0x1a]
mov qword [rcx], rax
mov r11, rdx
mov qword [rcx + 8], rax
xor ebx, ebx
mov qword [rcx + 0x10], rax
mov edi, r8d
mov word [rcx + 0x18], ax
mov r9, rcx
mov qword [r10], rax
sub r11, rcx
mov qword [r10 + 8], rax
mov qword [r10 + 0x10], rax
mov word [r10 + 0x18], ax
mov cl, bl
inc rbx
or cl, dil
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov word [r10], r8w
mov al, byte [r11 + r10 - 0x1a]
lea r10, [r10 + 2]
xor al, r8b
movsx eax, al
mov word [r10 - 0x1c], ax
cmp rbx, 0xd
jb 0x1400042d1
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14000433c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x140004342
mov rax, rcx
ret

Function at 0x140004358
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x62]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x31
jb 0x14000435e
mov rax, rcx
ret

Function at 0x14000437c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x46]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x23
jb 0x140004382
mov rax, rcx
ret

Function at 0x1400043a0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x24]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x12
jb 0x1400043a6
mov rax, rcx
ret

Function at 0x1400043c4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x18]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0xc
jb 0x1400043ca
mov rax, rcx
ret

Function at 0x1400043e8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x16]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0xb
jb 0x1400043ee
mov rax, rcx
ret

Function at 0x14000440c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x1a]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0xd
jb 0x140004412
mov rax, rcx
ret

Function at 0x140004430
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 4
jb 0x140004436
mov rax, rcx
ret
Function at 0x140004f7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
movdqa xmm0, xmmword [0x140006720]
lea r9, [rbp + 0x38]
and qword [rbp + 0x38], 0
lea rdx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xa2f87c0f
mov dword [rsp + 0x44], 0x498a05bf
mov word [rsp + 0x48], 0x6c30
call fcn.1400036fc
and dword [rbp + 0x30], 0
mov ecx, 0x200
call fcn.140001104
mov rdi, rax
call fcn.140003b48
mov rbx, qword [rbp + 0x38]
mov r8d, eax
neg r8d
mov eax, 0x80808081
mul r8d
mov rax, qword [section..data]
shr edx, 7
imul ecx, edx, 0xff
sub r8d, ecx
mov ecx, r8d
or rbx, rcx
test rax, rax
jne 0x14000502f
mov ecx, 0x190
call fcn.140001034
test rax, rax
je 0x140005028
mov rcx, rax
call fcn.140001644
mov qword [section..data], rax
mov dword [rsp + 0x28], 0x100
or r9d, 0xffffffff
mov r8, rbx
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
call qword [rax + 0xc8]
and qword [rbp + 0x38], 0
lea rcx, [rsp + 0x5a]
xor edx, edx
mov r8d, 0xc4
call fcn.1400049b0
xor r9d, r9d
lea rbx, [0x140000000]
mov cl, r9b
or cl, 0x6d
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x56
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov al, byte [rbx + r9*2 + 0x6660]
xor al, r8b
mov word [rbp + r9*2 - 0x44], r8w
movsx eax, al
mov word [rsp + r9*2 + 0x5a], ax
inc r9
cmp r9, 0x31
jb 0x140005071
lea rcx, [rsp + 0x5a]
call fcn.140004358
lea r8, [rbp + 0x38]
mov rcx, rdi
lea rdx, [rsp + 0x5a]
lea r9, [rbp + 0x30]
call fcn.140002aec
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x140005197
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x30]
and qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
call fcn.140004b34
xor eax, eax
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov word [rsp + 0x58], ax
mov cl, r9b
or cl, 0xaa
mov r8b, cl
movsx eax, cl
not r8b
not cl
xor r8d, eax
movzx eax, cl
and r8d, 0x37
xor r8d, eax
mov eax, 0x80808081
mul r8d
shr edx, 7
imul eax, edx, 0xff
sub r8d, eax
mov al, byte [r9 + rbx + 0x66c4]
xor al, r8b
mov byte [rsp + r9 + 0x55], r8b
mov byte [rsp + r9 + 0x50], al
inc r9
cmp r9, 5
jb 0x140005126
lea rcx, [rsp + 0x50]
call fcn.14000433c
cmp qword [rsp + 0x40], 0
je 0x140005197
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400051ac
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400029f0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x1400039c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a12
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a14
xor al, al
add rsp, 0x28
ret

Function at 0x140007e80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140007d13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007d13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007d13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007d13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007d13
cmp dword [rcx + 0x84], 0xe
jbe 0x140007d13
cmp dword [rcx + 0xf8], 0
je 0x140007d13
mov ecx, ebx
call fcn.140007db4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140007ba4
cmp dword [rbp + 0x20], 0
je 0x140007d60
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007d68
int3
xor r8d, r8d
xor edx, edx
jmp 0x140007cac

Function at 0x140010820
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010848
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140010848
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x13308
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor ebx, ebx
mov rdi, rcx
cmp rsi, rbx
je 0x1337f
cmp dword [rdx + 8], 0x20
jb 0x1337f
cmp qword [0x0001aaa0], rbx
jne 0x13349
lea rcx, [0x0001aaa0]
mov edx, 0x640000
call fcn.00012a5c
cmp eax, ebx
jl 0x13367
cmp qword [0x0001a500], rbx
jne 0x133aa
lea rcx, [0x0001a500]
mov edx, 0x40000
call fcn.00012a5c
cmp eax, ebx
jge 0x133aa
lea rcx, [0x0001aaa0]
call fcn.00012bdc
lea rcx, [0x0001a500]
call fcn.00012bdc
mov eax, 0xc0000001
mov qword [rdi + 0x38], rbx
mov dword [rdi + 0x30], eax
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x0001aaa8]
mov qword [rsi], rax
mov rax, qword [0x0001aab8]
mov qword [rsi + 8], rax
mov rax, qword [0x0001a508]
mov qword [rsi + 0x10], rax
mov rax, qword [0x0001a518]
mov qword [rsi + 0x18], rax
call fcn.00011e38
mov dword [rdi + 0x30], ebx
mov qword [rdi + 0x38], 0x20
jmp 0x1338d