joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080a20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov r11, r11
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov rdx, rdx
mov r15d, edx
xor eax, 0x3db36469
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
cmp eax, 0x3db33e24
jne 0x140080be2
mov dword [rsp - 0x38], ebp
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x3db36469
mov r15, r15
cmp eax, 0x3db32139
jne 0x140080be2
mov edx, dword [rdx + rcx + 0x88]
call fcn.140080950
mov r10, r10
xchg r12, rcx
mov r12, rsi
xchg rcx, r12
xchg r11, rax
mov r14, r11
xchg r11, rax
mov edx, dword [rax + 0x20]
call fcn.140080950
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0x1c], 0x3b7fecc9
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
xchg rbx, rax
mov r12, rbx
xchg rbx, rax
call fcn.140080950
xchg r9, r9
mov edx, dword [r14 + 0x1c]
xchg rcx, r13
mov r13, rsi
xchg r13, rcx
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.140080950
mov dword [rsp - 0x10], edi
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140080be2
mov dword [rsp - 0xc], ebx
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140080950
xchg rdx, rdx
mov ecx, 0x325aa645
sub ecx, 0x25f2aa1e
add ecx, 0x52e3815c
xor ecx, 0xa0b4827c
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140080bc3
xchg r12, r12
nop dword [rax]
xchg r13, rbx
mov rdx, r13
xchg r13, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x13fac796
sub r8d, 0x12ebd769
add r8d, 0x1ccd2c20
xor r8d, 0x1ddc1c4c
inc rbx
call fcn.140089420
xchg r12, r12
cmp byte [rbx], 0
jne 0x140080b7a
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x28], 0x7e6a2998
not ecx
cmp ecx, r15d
je 0x140080c1e
mov dword [rsp - 0x38], 0x368d4dc2
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140080b34
xor eax, eax
mov dword [rsp - 0x20], ebx
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffe0
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
xchg r8, r8
pop rdi
pop rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x20], ebx
mov edx, dword [rax + rdx*4]
call fcn.140080950
jmp 0x140080be8
Function at 0x1400854a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x5d7cccb
add rsp, 0x5d7ca8b
xchg rbx, r13
mov r13, rdx
xchg r13, rbx
mov rdi, rcx
xor edx, edx
mov rdx, rdx
lea rcx, [rsp + 0x30]
mov r8d, 0x2b50bd5
xor r8d, 0x5da54fbd
sub r8d, 0x1cd8a83
sub r8d, 0x29a12034
xor r8d, 0x33a19bb9
call fcn.140092630
mov dword [rsp - 0x1c], edx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rsp, rax
mov rsp, qword [r8 + 0x10]
xchg rsp, rax
mov r8, qword [rax]
test r8, r8
je 0x14008570c
mov dword [rsp - 0xc], edi
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008570c
mov edx, 0x5dacb5a2
xor edx, 0x1019789e
sub edx, 0x42733fb0
add edx, 0x6fa4d790
sub edx, 0x7ae76418
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x30], 0x10c3cd84
lea r9d, [rdx - 1]
call fcn.140093050
mov edx, 0xe57725e
add edx, 0x4a2d4491
add edx, 0x25019052
xor edx, 0x24a4c5c3
sub edx, 0x59228226
lea rcx, [rsp + 0x30]
xchg rdi, rdi
call fcn.140093120
test rax, rax
je 0x1400856db
mov dword [rsp - 0x44], esp
xor ecx, ecx
xchg rdi, r14
mov rdx, r14
xchg r14, rdi
mov word [rax], cx
movabs rcx, 0x111b3c9544980a1f
sub rcx, 0x3f4d1435
sub rcx, 0x533d714
add rcx, 0x77bbfd6a
mov r8, qword [0x1400ef690]
movabs rax, 0x45628b53053ee861
add rax, 0x3d5a83f3
add rax, 0x2fb982e3
xor rax, 0x36b266d1
ror r8, 2
ror r8, 6
ror r8, 1
add r8, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdi
not r8
ror r8, 0xe
ror r8, 0xc
ror r8, 7
ror r8, 4
ror r8, 1
ror r8, 1
not r8
mov dword [rsp - 0x30], esi
ror r8, 7
ror r8, 4
ror r8, 1
ror r8, 1
xor r8, rax
call r8
mov rax, qword [0x1400ef680]
mov dword [rsp - 0x24], 0x2e0e3a70
lea r8, [rsp + 0x20]
movabs rcx, 0x2fd4b72866f5115f
sub rcx, 0x204a8df3
add rcx, 0x32b598f8
add rcx, 0x7fffffff
sub rcx, 0x2663ba3a
lea rdx, [rsp + 0x260]
xchg r13, r13
xor rax, rcx
xchg r15, r9
mov r15, rbx
xchg r15, r9
not rax
mov dword [rsp - 0x38], 0x1355ace2
lea rcx, [rsp + 0x30]
ror rax, 4
ror rax, 3
ror rax, 2
ror rax, 2
ror rax, 1
not rax
call rax
xchg r10, r10
xchg rbx, rcx
mov rcx, qword [rsp + 0x250]
xchg rcx, rbx
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x6eb856b5
sub eax, 0x2c07a545
add eax, 0xaf4c97c
xor eax, 0x8da57aed
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
mov rdi, rdi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbx, rbp
mov rbp, qword [rsp + 0x250]
xchg rbx, rbp
mov eax, 0x9daca19
add eax, 0x6d825770
xor eax, 0x70d10083
add eax, 0xb873e02b
add rsp, 0x240
mov dword [rsp - 0x20], esp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400887b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xfffffffffffffdd0
mov rbx, rbx
mov r8, qword [0x1400ef450]
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0x504e625f6422b988
sub rcx, 0x30ba5474
xor rcx, 0x79b51a1a
add rcx, 0x173a8620
movabs rax, 0x38f41a0739e7f999
sub rax, 0x3c0480d
sub rax, 0x22b7bcf9
add rax, 0x7fffffff
xor rax, 0x6b88354b
add r8, rcx
mov rcx, rcx
mov edx, 0x7411c244
sub edx, 0x1a5045e9
xor edx, 0x361d54c2
xor edx, 0x6fdc299d
not r8
lea rcx, [rsp + 0x20]
xchg r10, r10
sub r8, rax
rol r8, 0x13
rol r8, 9
rol r8, 1
rol r8, 1
rol r8, 1
rol r8, 1
rol r8, 1
rol r8, 1
not r8
xchg rbx, rbx
call r8
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x44], ebp
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff4dfc3131
xor rdx, 0x58602164
xor rdx, 0x1fe523c3
add rdx, 0x312d4b50
add rdx, 0x7fffffff
add rdx, 0x4459811a
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
lea rax, [rsp + 0x20]
mov dword [rsp - 0x38], esp
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400888af
mov dword [rsp - 0x38], 0x1391e1a4
mov rcx, rbx
mov qword [rbx + 0x38], rdx
call fcn.14001664c
xor r8d, r8d
mov rsi, rsi
mov edx, 0x1288e255
add edx, 0x1f2f510f
sub edx, 0x750f9aa
add edx, 0x4d6132ea
sub edx, 0x47865732
cmp qword [rbx + 0x38], r8
jbe 0x14008897a
mov dword [rsp - 0x34], 0x11f768c
lea r9, [rsp + 0x20]
mov r10d, 0x68f4deef
xor r10d, 0x33049fe5
xor r10d, 0x585f0e5
sub r10d, 0x24b2b4cb
sub r10d, 0x39c2fc25
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0x44], ecx
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
xchg r15, r15
ror edx, 3
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [r9 + rax - 2]
mov dword [rsp - 0x38], 0x4dc30ed6
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x30], ebp
jb 0x14008893d
xchg rcx, rbx
mov rax, rcx
xchg rbx, rcx
sub rsp, 0x173d28db
add rsp, 0x173d2b0b
pop rbx
ret
Function at 0x140089790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400effe4], 0
jne 0x14008988a
xor edx, edx
mov rsp, rsp
lea r8, [0x1400effe0]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov r9, r9
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x24], 0x3b3ffab8
neg ecx
and ecx, 0xedb88320
inc edx
xchg r11, r11
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x38], edx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r9, r9
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x10], ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x44], ecx
and eax, 1
neg eax
and eax, 0xedb88320
mov rdi, rdi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xchg r11, r11
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x2c], 0x69f518e6
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x3c], ecx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rcx, rcx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r15, r15
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov r14, r14
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov r11, r11
cmp edx, 0x100
jb 0x1400897b3
ret
Function at 0x1400909e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg r13, rbp
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg r13, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
push r15
nop
sub rsp, 0x62898b6c
add rsp, 0x62898b4c
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x2c], 0x545be02a
xchg r12, r8
mov r15, r12
xchg r8, r12
movzx ebx, byte [rdx]
mov r8, r8
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 7
shl ebx, 1
dec r8d
mov dword [rsp - 0x30], edx
or ebx, eax
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 2
shl ebx, 6
or ebx, eax
mov dword [rsp - 0x2c], ecx
movzx eax, byte [rdx + 3]
shl ebx, 7
shl ebx, 1
or ebx, eax
mov r13, r13
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
xchg r11, r11
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 7
shl edi, 1
or edi, eax
test r8d, r8d
mov rbp, rbp
jle 0x140090b2c
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov dword [rsp - 0x14], 0x7444a2dd
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
xchg r15, r15
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
mov dword [rsp - 0x38], edi
lea rbp, [rdx + rax*4]
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
xchg r12, r12
call fcn.140091274
xor ebx, eax
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
mov ecx, ebx
call fcn.140091274
xor edi, eax
mov dword [rsp - 0x28], 0x7adef2f6
nop
sub rsi, 0x35014215
add rsi, 0x350141fd
sub rbp, 0x18
sub r14, 1
jne 0x140090adc
mov dword [rsp - 0x40], ebp
lea rax, [r15 + 7]
mov ecx, 0x93a8502
xor ecx, 0x65a62fca
sub ecx, 0x2929d1f2
xor ecx, 0x3999b46a
sub ecx, 0x7aeb6cb8
mov byte [rax - 4], dil
xchg r11, r11
mov byte [rax], bl
dec rax
shr ebx, 5
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 2
shr edi, 4
shr edi, 2
sub rcx, 1
mov r9, r9
jne 0x140090b4d
mov rbx, qword [rsp + 0x40]
xchg r9, rbp
mov r9, qword [rsp + 0x48]
xchg rbp, r9
mov rsi, qword [rsp + 0x50]
mov dword [rsp - 0x28], 0x3af2183a
nop
sub rsp, 0x3a6d69e3
add rsp, 0x3a6d6a03
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140090bbc
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rsp
xchg r8, rax
xchg rbx, r15
mov qword [rax + 8], r15
xchg rbx, r15
xchg rbx, rbp
mov qword [rax + 0x10], rbx
xchg rbx, rbp
mov qword [rax + 0x18], rsi
mov rsp, rsp
xchg rbx, rdi
mov qword [rax + 0x20], rbx
xchg rbx, rdi
push r14
mov dword [rsp - 0x28], 0x21fa3e0f
sub rsp, 0x20
movzx eax, byte [rdx + 1]
xchg r8, r14
mov r8, r14
xchg r8, r14
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x30], edi
shl ebx, 8
or ebx, eax
shl edi, 5
shl edi, 2
shl edi, 1
movzx eax, byte [rdx + 2]
mov rdi, rdi
shl ebx, 3
shl ebx, 5
or ebx, eax
movzx eax, byte [rdx + 3]
mov dword [rsp - 0x24], ebx
shl ebx, 4
shl ebx, 1
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov rcx, rcx
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x24], ebp
movzx eax, byte [rdx + 7]
shl edi, 3
shl edi, 1
shl edi, 2
shl edi, 1
shl edi, 1
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x40], 0x5ee8dbe5
test eax, eax
jle 0x140090cce
xchg rsi, rdi
mov rdi, qword [rcx + 8]
xchg rsi, rdi
lea ebp, [rax - 1]
mov dword [rsp - 0xc], esp
shr ebp, 1
inc ebp
mov rdx, rsi
mov r12, r12
mov ecx, edi
call fcn.140091274
xor ebx, eax
lea rdx, [rsi + 0xc]
xchg rsi, rsi
mov ecx, ebx
call fcn.140091274
xor edi, eax
nop
add rsi, 0x4ecccbed
sub rsi, 0x4ecccbd5
sub rbp, 1
jne 0x140090c93
xchg r13, r13
lea rax, [r14 + 7]
mov ecx, 0x1862ac69
add ecx, 0x3da09535
xor ecx, 0x522d7574
sub ecx, 0x42e34e6
mov byte [rax - 4], dil
xchg r10, r10
mov byte [rax], bl
dec rax
shr ebx, 1
shr ebx, 2
shr ebx, 4
shr ebx, 1
shr edi, 2
shr edi, 3
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x140090ce9
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x2c], edx
xchg r8, rsi
mov r8, qword [rsp + 0x40]
xchg rsi, r8
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x20], 0x2ddd7e6
nop
add rsp, 0x7278c701
sub rsp, 0x7278c6e1
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140090f1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x2c], 0x67c2d483
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg r8, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
add rsp, 0x12c47f6
sub rsp, 0x12c4896
movdqa xmm0, xmmword [0x14000be30]
mov dword [rsp - 0x14], esi
xor edi, edi
movdqa xmm1, xmmword [0x14000bec0]
xchg rsp, rdx
mov rbx, rsp
xchg rdx, rsp
xchg rbp, r8
movdqu xmmword [r8 - 0x39], xmm0
xchg r8, rbp
xchg rcx, r8
mov rsi, r8
xchg rcx, r8
mov edx, edi
mov dword [rsp - 0x18], ebx
movdqa xmm0, xmmword [0x14000bea0]
mov r8d, edi
xchg rbx, rbp
movdqu xmmword [rbx - 0x29], xmm1
xchg rbx, rbp
movdqa xmm1, xmmword [0x14000beb0]
mov dword [rsp - 0x10], 0x4c3e8bfd
xchg rbp, r15
movdqu xmmword [r15 - 0x19], xmm0
xchg r15, rbp
xchg rbp, rcx
movdqu xmmword [rcx - 9], xmm1
xchg rcx, rbp
mov ecx, edx
lea r8, [r8 + 4]
xchg r10, r10
mov eax, 0x61596055
add eax, 0x17e4ff3f
sub eax, 0xd3a4059
add eax, 0x133e0a23
sub eax, 0x55971409
inc rdx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov r13, r13
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140090fd6
mov dword [rsp - 0x20], 0xc9a3d91
cmp dword [rsi + 4], 8
jne 0x140091089
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x10], 0x23239953
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
xchg r15, r15
shl cx, 3
shl cx, 4
shl cx, 1
or cx, ax
xchg rdi, rdi
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
mov dword [rsp - 0x20], edx
jl 0x140091032
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x14], ebp
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140090d5c
jmp 0x140091152
cmp dword [rsi], edi
mov r12, r12
jle 0x140091152
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x14e9100
add r8d, 0x7dac474c
sub r8d, 0x19dab1c1
sub r8d, 0x201f964e
xor r8d, 0x45009039
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov dword [rsp - 0xc], esp
add rbx, 2
shl ax, 4
shl ax, 2
shl ax, 1
shl ax, 1
or cx, ax
mov word [rdx], cx
mov r12, r12
lea rdx, [rdx - 2]
sub r8, 1
jne 0x1400910bd
xchg rsp, rsp
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg r15, r15
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
call fcn.140090d5c
mov dword [rsp - 0x2c], esi
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x14], ebx
sub r8d, 8
mov rcx, rsi
call fcn.140090d5c
inc edi
mov r14, r14
nop
add r14d, 0x6a93d483
sub r14d, 0x6a93d47b
cmp edi, dword [rsi]
mov rbp, rbp
jl 0x140091097
xor eax, eax
lea r11, [rsp + 0xa0]
mov rcx, rcx
xchg rbx, rsi
mov rsi, qword [r11 + 0x28]
xchg rbx, rsi
lea rdi, [rbp + 7]
mov dword [rsp - 0x28], 0x60637a31
xchg rsi, r15
mov r15, qword [r11 + 0x30]
xchg r15, rsi
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
mov rsp, r11
mov rcx, rcx
pop r14
pop rdi
pop rbp
ret
Function at 0x14009122c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov r11, r11
test edx, edx
je 0x14009126e
lea ecx, [r11 + r11]
mov r9d, r10d
mov dword [rsp - 0x14], edx
xor r9d, r11d
mov r11d, ecx
test dl, 1
mov r11, r11
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
xchg rdx, rdx
cmovb r11d, ecx
shr edx, 1
jne 0x140091239
mov rcx, rcx
mov eax, r10d
ret
Function at 0x140098c84
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0xf8]
xchg r13, rax
xor r8d, r8d
mov r13, r13
xchg r9, rdx
mov rdx, r9
xchg rdx, r9
test rax, rax
je 0x140098cf2
mov dword [rsp - 0x18], 0x1be7bcf7
mov ecx, r8d
mov edx, 0x4cffe2a8
add edx, 0x101baf63
sub edx, 0x4bad7fc7
xor edx, 0x38c50711
rol edx, cl
xor dl, byte [rax]
inc rax
mov rdi, rdi
mov byte [r8 + r9], dl
inc r8
cmp r8, 0x20
mov rdx, rdx
jb 0x140098caf
mov al, 0x6e
xor al, 0xf
sub al, 0x19
xor al, 0x1f
sub al, 0x56
ret
xchg r9, rax
mov r9, qword [rcx + 0x100]
xchg r9, rax
test rax, rax
mov dword [rsp - 0x28], 0x3ad11a06
je 0x140098d32
movups xmm0, xmmword [rax]
xchg rdx, r11
movups xmmword [r11], xmm0
xchg rdx, r11
xchg rbx, rax
movups xmm1, xmmword [rbx + 0x10]
xchg rbx, rax
xchg rdx, rdi
movups xmmword [rdi + 0x10], xmm1
xchg rdx, rdi
jmp 0x140098ce7
xorps xmm0, xmm0
mov dword [rsp - 0x34], 0x7c4a14a2
xor al, al
xchg r10, rdx
movups xmmword [r10], xmm0
xchg rdx, r10
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1400aa33c
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg r11, rsp
mov qword [r11 + 8], rbx
xchg rsi, rdi
mov qword [r11 + 0x18], rdi
xchg rdi, rsi
xchg rdi, rbp
mov qword [r11 + 0x20], rbp
xchg rdi, rbp
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
add rsp, 0x2a94cffd
sub rsp, 0x2a94d03d
mov rax, qword [0x1400ef4c8]
lea rdx, [r11 + 0x10]
mov dword [rsp - 0x18], 0x3ad3330c
rol rax, 0x17
rol rax, 0x13
rol rax, 3
rol rax, 1
mov rbx, rcx
movabs rcx, 0x30561dc451009238
add rcx, 0x1e93773f
xor rcx, 0x4368a5d0
xor rcx, 0x3af7e4a8
sub rcx, 0x8ae949d
mov dword [rsp + 0x58], 0x39a78715
add dword [rsp + 0x58], 0xce3c088
sub dword [rsp + 0x58], 0x33b8c232
xor dword [rsp + 0x58], 0x12d2857b
add rax, rcx
mov dword [rsp - 0x2c], 0x26fa9672
movabs rcx, 0x21678da25fb9ac18
sub rcx, 0x334767c1
add rcx, 0x46b100ab
xor rcx, 0x9f1944
add rcx, 0x7fffffff
sub rcx, 0x1cc4348a
rol rax, 0x23
rol rax, 1
add rax, rcx
xchg r9, r9
movabs rcx, 0x14fd80b5002ae382
xor rcx, 0x2668a96c
sub rcx, 0x1b487b26
xor rcx, 0x2844cb03
not rax
add rax, rcx
lea rcx, [r11 - 0x28]
mov dword [rsp - 0x14], ebp
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg rdi, r12
mov qword [rbx], r12
xchg rdi, r12
xor esi, esi
movups xmmword [rdi], xmm0
mov r15, r15
xchg r12, rdi
movups xmmword [r12 + 0x10], xmm0
xchg rdi, r12
xchg rdi, r14
movups xmmword [r14 + 0x20], xmm0
xchg rdi, r14
test eax, eax
jne 0x1400aa49d
mov dword [rsp - 0x3c], 0x3ea07212
mov qword [rbx + 0x38], rsi
jmp 0x1400aa5d4
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
inc r14
mov dword [rsp - 0x2c], 0x36b540a7
cmp word [rax + r14*2], si
jne 0x1400aa4a6
xchg r12, r14
mov qword [rbx + 0x38], r12
xchg r14, r12
cmp qword [rbx], rdi
je 0x1400aa4df
mov dword [rsp - 0x30], 0x4fe18d77
mov rcx, qword [rbx]
call fcn.1400920d0
cmp r14, 0x18
jbe 0x1400aa51d
mov r15, r15
lea rcx, [r14 + r14]
call fcn.140092370
mov qword [rbx], rax
mov dword [rsp - 0x38], 0x502dda2b
test rax, rax
jne 0x1400aa52b
mov qword [rbx], rdi
xchg rsi, rsi
xchg r8, rcx
mov r8, rsi
xchg rcx, r8
jmp 0x1400aa54b
mov qword [rbx], rdi
mov dword [rsp - 0x14], edi
xchg r8, rax
mov r8, rdi
xchg r8, rax
xorps xmm0, xmm0
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
movups xmmword [rax + 0x10], xmm0
xchg r13, rax
movups xmmword [r13 + 0x20], xmm0
xchg r13, rax
xchg rcx, r10
mov r10, qword [rbx]
xchg r10, rcx
mov edx, 0x6fceaf83
xor edx, 0x39b51b7c
xor edx, 0x46a50646
add edx, 0x1f6362b9
cmp qword [rbx + 0x38], rsi
jbe 0x1400aa5d4
lea r8, [rsp + 0x20]
mov dword [rsp - 0x28], ecx
sub r8, rcx
movzx eax, dx
mov r9d, 0x71018e57
sub r9d, 0x6a7c9b9b
xor r9d, 0x5b50e506
xor r9d, 0x6aefab52
sub r9d, 0x373bbbe9
and ax, r9w
mov dword [rsp - 0xc], 0x2499661d
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [r8 + rcx]
mov r15, r15
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x2c], 0x7c16aa19
jb 0x1400aa578
mov rsi, qword [rsp + 0x60]
xchg rbp, rbx
mov rax, rbp
xchg rbp, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
nop
add rsp, 0x7ea7972e
sub rsp, 0x7ea796ee
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400c1594
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x10], esi
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
xchg rsp, rsp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
add rsp, 0xffffffffffffffb0
mov rdx, rdx
xor esi, esi
mov dword [rbp - 0x30], 0x5dddca95
xor dword [rbp - 0x30], 0x4639f3b1
xor dword [rbp - 0x30], 0x5efc1ad0
xor dword [rbp - 0x30], 0x27e7b4db
sub dword [rbp - 0x30], 0x6299970a
mov dword [rbp - 0x2c], 0x130fcf3b
add dword [rbp - 0x2c], 0x32cf1ad8
sub dword [rbp - 0x2c], 0x3901f067
add dword [rbp - 0x2c], 0x16784900
sub dword [rbp - 0x2c], 0x22e6423c
mov rbx, rcx
mov r15, r15
mov dword [rbp - 0x28], 0x113bc53e
add dword [rbp - 0x28], 0x1d98da4e
add dword [rbp - 0x28], 0x38f69b9b
sub dword [rbp - 0x28], 0x67a43ae6
mov dword [rbp - 0x24], 0x7baadd94
sub dword [rbp - 0x24], 0x56cf53f
sub dword [rbp - 0x24], 0x2acca748
sub dword [rbp - 0x24], 0x182f6941
sub dword [rbp - 0x24], 0x32edd760
mov dword [rbp - 0x20], 0x5c107231
xor dword [rbp - 0x20], 0x3c955c53
add dword [rbp - 0x20], 0x4f0eb5f
add dword [rbp - 0x20], 0x84812eb
sub dword [rbp - 0x20], 0x6d452c8e
xchg rsi, r13
mov qword [rbp + 0x10], r13
xchg r13, rsi
mov rax, qword [rbp + 0x10]
xchg rcx, r11
mov r11, qword [rbp + 0x10]
xchg rcx, r11
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
and cl, 3
mov dword [rsp - 0x14], 0x7f1842c0
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x28], ebx
mov eax, 0x1bb2571a
add eax, 0x3c9cc425
sub eax, 0x2e7b4ae6
xor eax, 0x1991c52b
shr eax, cl
mov dword [rsp - 0x44], edi
movzx ecx, al
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov dword [rsp - 0x44], 0x5cada3b1
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
inc rax
mov r15, r15
xchg rbx, rax
mov qword [rbp + 0x10], rbx
xchg rbx, rax
mov rax, qword [rbp + 0x10]
mov r12, r12
cmp rax, 0xa
jb 0x1400c1679
xor edx, edx
mov dword [rsp - 0x24], 0x5c6817df
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.140085750
xchg r13, rax
mov r8, r13
xchg r13, rax
mov qword [rbx + 0x200], rax
xor eax, eax
mov dword [rsp - 0x14], 0x5ddb2e10
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x3c], esi
test r8, r8
je 0x1400c1797
lea rdx, [rbx + 0x208]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1400c1e48
test al, al
mov rbp, rbp
jne 0x1400c178d
mov rcx, qword [rbx + 0x200]
call fcn.140087ca0
mov dword [rsp - 0x1c], 0x6295d5e7
xor al, al
xchg rsi, rdi
mov qword [rbx + 0x200], rdi
xchg rsi, rdi
jmp 0x1400c1797
mov al, 0xe
xor al, 0x73
xor al, 0x4d
sub al, 5
xor al, 0x2a
mov rbx, qword [rsp + 0x68]
xchg r10, rsi
mov r10, qword [rsp + 0x70]
xchg r10, rsi
xchg rdi, rbp
mov rbp, qword [rsp + 0x78]
xchg rdi, rbp
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rbp
xchg rdi, rdi
ret