joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004720
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp byte [r8], 0
mov ebp, r9d
mov rsi, r8
mov rax, rdx
mov rdi, rcx
je 0x180004810
mov rdx, r8
mov qword [rsp + 0x50], rbx
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, eax
test eax, 0xfffffffd
je 0x18000480c
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800047ba
lea rdx, str.VBPS_LOGREL_NO_ASSERT_rc__ERROR_ACCESS_DENIED_
mov r8d, VarDecFix
mov qword [rsp + 0x38], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.long___cdecl_vbpsDeleteKeyRecursiveA_struct_VBPSREGSTATE__struct_HKEY____const_char__unsigned_int_
mov rcx, rax
mov qword [rsp + 0x30], rdx
lea rdx, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x3e2
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800047f2
mov dword [rsp + 0x30], ebx
lea r9, str._d:_delete_key__s_____u_n
mov qword [rsp + 0x28], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov dword [rsp + 0x20], ebp
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rdi + 0x64], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor eax, eax
jmp 0x1800047f7
mov rbp, qword [rsp + 0x58]
mov eax, 0x57
mov rsi, qword [rsp + 0x60]
mov dword [rcx + 0x64], 0x57
add rsp, 0x40
pop rdi
ret
Function at 0x180004830
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp word [r8], 0
mov ebp, r9d
mov rsi, r8
mov rax, rdx
mov rdi, rcx
je 0x180004921
mov rdx, r8
mov qword [rsp + 0x50], rbx
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ebx, eax
test eax, 0xfffffffd
je 0x18000491d
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800048cb
lea rdx, str.VBPS_LOGREL_NO_ASSERT_rc__ERROR_ACCESS_DENIED_
mov r8d, VarDecFix
mov qword [rsp + 0x38], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.long___cdecl_vbpsDeleteKeyRecursiveW_struct_VBPSREGSTATE__struct_HKEY____const_unsigned_short__unsigned_int_
mov rcx, rax
mov qword [rsp + 0x30], rdx
lea rdx, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x40a
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180004903
mov dword [rsp + 0x30], ebx
lea r9, str._d:_delete_key__ls_____u_n
mov qword [rsp + 0x28], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov dword [rsp + 0x20], ebp
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rdi + 0x64], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor eax, eax
jmp 0x180004908
mov rbp, qword [rsp + 0x58]
mov eax, 0x57
mov rsi, qword [rsp + 0x60]
mov dword [rcx + 0x64], 0x57
add rsp, 0x40
pop rdi
ret
Function at 0x180005e10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x180044668]
xor rax, rbp
mov qword [rbp + 8], rax
mov rdi, r9
mov r12, r8
mov r13, rdx
mov r15, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x180005e50
inc ebx
cmp byte [rcx + 0x78], 0
jne 0x180005eec
lea eax, [rbx + 0x80]
mov ecx, eax
mov dword [rbp], eax
add rax, 0xf
cmp rax, rcx
ja 0x180005e84
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800074a0
sub rsp, rax
lea r9, [rbp + 4]
lea rax, [rbp]
xor r8d, r8d
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x28], rax
lea r14, [rsp + 0x40]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180005eec
cmp dword [rbp + 4], 1
jne 0x180005eec
cmp dword [rbp], ebx
jne 0x180005eec
mov r8d, ebx
mov rdx, r14
mov rcx, rdi
mov esi, ebx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180005f10
mov r8d, esi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__memicmp]
test eax, eax
je 0x180005f10
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
jne 0x180005f17
xor eax, eax
jmp 0x180005fb4
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180005f6e
lea rdx, str.VBPS_LOGREL_NO_ASSERT_rc__ERROR_ACCESS_DENIED_
mov r8d, VarDecFix
mov qword [rsp + 0x38], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.long___cdecl_vbpsSetRegValueAA_struct_VBPSREGSTATE__struct_HKEY____const_char__const_char__unsigned_int_
mov rcx, rax
mov qword [rsp + 0x30], rdx
lea rdx, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x322
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180005fae
mov ecx, dword [rbp + 0x60]
lea r9, str._d:__s_s_____u_n
mov dword [rsp + 0x38], ebx
mov edx, 0x10
mov qword [rsp + 0x30], rdi
mov r8d, VarDecFix
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [r15 + 0x64], ebx
mov eax, ebx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.180007500
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180005fe0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
mov rax, qword [0x180044668]
xor rax, rbp
mov qword [rbp + 8], rax
mov rsi, rcx
mov rdi, r9
mov rcx, r9
mov r14, r8
mov r12, rdx
call qword [sym.imp.VBoxRT.dll_RTUtf16Len]
cmp byte [rsi + 0x78], 0
lea ebx, [rax*2 + 2]
jne 0x1800060a1
lea eax, [rbx + 0x80]
mov r10d, eax
mov dword [rbp], eax
add rax, 0xf
cmp rax, r10
ja 0x18000604e
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800074a0
sub rsp, rax
lea r9, [rbp + 4]
lea rax, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x28], rax
lea r15, [rsp + 0x40]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800060a1
cmp dword [rbp + 4], 1
jne 0x1800060a1
cmp dword [rbp], ebx
jne 0x1800060a1
mov r8d, ebx
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800060c5
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1800060cc
xor eax, eax
jmp 0x180006168
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006123
lea rdx, str.VBPS_LOGREL_NO_ASSERT_rc__ERROR_ACCESS_DENIED_
mov r8d, VarDecFix
mov qword [rsp + 0x38], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.long___cdecl_vbpsSetRegValueWW_struct_VBPSREGSTATE__struct_HKEY____const_unsigned_short__const_unsigned_short__unsigned_int_
mov rcx, rax
mov qword [rsp + 0x30], rdx
lea rdx, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x2df
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006163
mov ecx, dword [rbp + 0x50]
lea r9, str._d:__ls_ls_____u_n
mov dword [rsp + 0x38], ebx
mov edx, 0x10
mov qword [rsp + 0x30], rdi
mov r8d, VarDecFix
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rsi + 0x64], ebx
mov eax, ebx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.180007500
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop rbp
ret
Function at 0x140037e88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x3c], 0x51e84fc9
push rdi
sub rsp, 0x3df1acad
add rsp, 0x3df1abfd
xchg rsi, r15
mov r15, rcx
xchg r15, rsi
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x30], 0x6ef4add2
call fcn.140035bc0
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
mov r9, r9
cmp byte [rdi], 0
je 0x140037f33
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x366a7f0
xor r8d, 0x7fecf43
add r8d, 0x2d70c72d
add r8d, 0x20b3fcc3
xor r8d, 0x52bd2ca2
inc rdi
call fcn.14006f850
cmp byte [rdi], 0
mov dword [rsp - 0x38], ebx
jne 0x140037ee4
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rsi, rsi
not ebx
cmp rcx, rax
jne 0x140037f7e
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x20], 0x58f64c12
xor eax, eax
mov ecx, 0x71d95bdc
sub ecx, 0x689660d7
add ecx, 0x2bb52193
xor ecx, 0x4d1ab7ea
sub ecx, 0x79e2aaf2
rep stosb byte [rdi], al
jmp 0x140037f83
call fcn.140077cf0
mov eax, dword [rsi + 0x2f0]
mov rdx, rdx
lea r11, [rsp + 0xb0]
xor eax, 0x7083
shl eax, 7
shl eax, 9
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xchg rdx, rdx
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
xchg r11, rsi
mov rsp, rsi
xchg rsi, r11
pop rdi
ret

Function at 0x140038134
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x2c5adff0
xor r10d, 0x1f3b1ce0
add r10d, 0x2c249a14
xor r10d, 0x83c2da7
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
mov r8, r8
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov dword [rsp - 0x3c], 0x1c6ac342
mov eax, dword [rcx + 0x308]
xor eax, 0x44e3612
mov dword [rsp + 8], eax
mov dword [rsp - 0x44], ebx
xchg r10, rsp
movss xmm3, dword [r10 + 8]
xchg rsp, r10
mov al, byte [rdx]
mov r10, r10
cvtdq2ps xmm2, xmm2
test al, al
je 0x14003820a
mov dword [rsp - 0x18], ebp
xchg r10, r11
mov r11, qword [rcx + 0x300]
xchg r10, r11
movzx eax, al
inc rdx
xchg rbp, rbp
add rax, rax
xchg r10, r9
movups xmm0, xmmword [r9 + rax*8]
xchg r10, r9
xorps xmm0, xmmword [0x1400c9ff0]
xchg r10, r10
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mov dword [rsp - 0x1c], 0x1bc53d50
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
mov r15, r15
add r9d, ecx
test al, al
jne 0x1400381b7
mov eax, r9d
mov r14, r14
ret
Function at 0x1400383bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x67c8f7e9
sub r10d, 0x37dd872b
xor r10d, 0x45606137
sub r10d, 0x40ae3e0
sub r10d, 0xec5bd26
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
mov dword [rsp - 0x10], esi
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
mov dword [rsp - 0x30], 0x31508258
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x44e3612
mov dword [rsp - 0x3c], esi
mov dword [rsp + 8], eax
xchg rsp, r11
movss xmm3, dword [r11 + 8]
xchg r11, rsp
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
mov dword [rsp - 0x1c], esp
je 0x1400384ab
xchg rbx, r10
mov rbx, qword [rcx + 0x300]
xchg rbx, r10
movzx eax, ax
nop
add rdx, 0x4795549c
sub rdx, 0x4795549a
add rax, rax
xchg rcx, rcx
xchg rbp, r10
movups xmm0, xmmword [rbp + rax*8]
xchg rbp, r10
xorps xmm0, xmmword [0x1400c9ff0]
movzx eax, word [rdx]
movaps xmm1, xmm0
mov rcx, rcx
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
mov dword [rsp - 0x44], 0x70f90b74
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
mov dword [rsp - 0x14], ecx
test ax, ax
jne 0x140038449
mov eax, r9d
ret
Function at 0x1400384b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg rbx, rcx
mov qword [rax + 0x10], rcx
xchg rbx, rcx
xchg r9, rsi
mov qword [rax + 0x18], r9
xchg r9, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffff50
xor ebx, ebx
xchg r15, rdi
mov r15, rcx
xchg r15, rdi
xchg rbx, rdx
mov qword [rax + 8], rdx
xchg rdx, rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400385a5
mov edx, dword [rcx + 0x2ec]
xchg rbp, rbp
mov ecx, 0x4009505
add ecx, 0x3d76d58
add ecx, 0x37c32085
xor ecx, 0x53ac24d5
sub ecx, 0x147c95b4
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
mov dword [rsp - 0x28], 0x7436af51
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mov dword [rsp - 0x1c], 0x522f4870
mul rsi
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140077b60
mov dword [rsp - 0x24], 0x4f209701
test rsi, rsi
jle 0x1400385c9
xchg rcx, r12
mov r12, qword [rdi + 0x2f8]
xchg rcx, r12
mov edx, dword [rcx + rbx*4]
mov dword [rsp - 0x2c], 0x19471e34
xor edx, 0x7ee01212
mov dword [rax + rbx*4], edx
inc rbx
mov dword [rsp - 0x1c], 0x533d3bbd
cmp rbx, rsi
jl 0x14003856b
jmp 0x1400385c9
lea rdx, [rsp + 0xc0]
call fcn.1400387cc
xchg r13, r13
test al, al
je 0x140038665
xchg r10, rax
mov r10, qword [rsp + 0xc0]
xchg r10, rax
xchg rcx, r13
mov r13, qword [rdi + 0x318]
xchg r13, rcx
lea rdx, [rsp + 0x30]
mov dword [rsp - 0xc], 0x1313ec57
xchg r14, rax
mov qword [rsp + 0x28], r14
xchg r14, rax
lea rax, [0x140003d18]
mov dword [rsp - 0x40], 0x6330ee2a
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
xchg r14, rsp
movups xmm0, xmmword [r14 + 0x20]
xchg r14, rsp
mov qword [rsp + 0xa8], 0x7dc1d280
xor qword [rsp + 0xa8], 0xe2aff5e
sub qword [rsp + 0xa8], 0x49ef9ecb
add qword [rsp + 0xa8], 0x419e3ea4
sub qword [rsp + 0xa8], 0x6b99cd9f
xchg rdx, rax
mov qword [rsp + 0x30], rdx
xchg rdx, rax
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x44], esp
call fcn.140036f68
lea r11, [rsp + 0xb0]
xchg r15, rbx
mov r15, qword [r11 + 0x18]
xchg rbx, r15
mov rsi, qword [r11 + 0x20]
xchg rdi, rdi
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14004ba9b
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
nop
sub rsp, 0x7873b667
add rsp, 0x7873b647
mov rax, qword [rcx]
xchg rdi, rdi
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov dword [rsp - 0x18], 0x4f450794
xchg rbp, rax
mov rcx, rbp
xchg rbp, rax
xchg r15, rax
mov qword [rsp + 0x30], r15
xchg r15, rax
call fcn.14003d3d0
lea rcx, [rbx + 0x640]
mov r11, r11
lea rdx, [rsp + 0x30]
call fcn.14004b490
xchg rbx, r15
mov rcx, r15
xchg r15, rbx
nop
add rsp, 0x3a3ab876
sub rsp, 0x3a3ab856
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp 0x14004ba40
nop
mov qword [rsp - 8], rbx
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
cmp qword [rcx + 0x648], 0
xchg rsi, rsi
xchg rbp, rbx
mov rbp, rcx
xchg rbx, rbp
je 0x14004bc02
xchg r10, r10
lea rdx, [rsp + 0x30]
call fcn.14003ddf0
mov r8, qword [rsp + 0x30]
mov r11d, 0x77e7bf7b
sub r11d, 0x2f136c4b
xor r11d, 0x78ec98de
xor r11d, 0x3383f2b2
sub r11d, 0x3bb38bc
mov r9d, dword [rsp + 0x34]
mov dword [rsp - 0x44], 0x52acd5a9
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
xchg r9, r9
xchg rdx, rcx
mov rcx, qword [rbx + 0x648]
xchg rcx, rdx
cmp eax, r11d
cmovl r11d, eax
xchg rcx, rcx
xor r10d, r10d
test rdx, rdx
je 0x14004bb91
mov rbx, rbx
xchg r13, rax
mov r13, qword [rbx + 0x640]
xchg r13, rax
xchg r12, rdi
mov qword [rsp + 0x38], r12
xchg r12, rdi
lea rdi, [rax + rdx*8]
xchg r14, r14
cmp rax, rdi
je 0x14004bb86
mov r8d, r11d
xor r8d, 0x57ba7083
mov dword [rsp - 0x34], ecx
xor r9d, 0x57ba7083
nop word [rax + rax]
xchg r11, rdx
mov r11, qword [rax]
xchg rdx, r11
mov ecx, r10d
mov r12, r12
xor ecx, 0x57ba7083
add r10d, r11d
sub rax, 0xfffffffffffffff8
mov dword [rdx + 0x30], ecx
mov dword [rsp - 0x28], ebx
mov dword [rdx + 0x34], 0x13f8f48b
add dword [rdx + 0x34], 0x611a91d4
xor dword [rdx + 0x34], 0x769e59a8
add dword [rdx + 0x34], 0x542c908c
mov dword [rdx + 0x38], r8d
xchg r15, r15
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x14004bb26
mov r8, qword [rsp + 0x30]
xchg rdx, rdx
mov r9d, dword [rsp + 0x34]
xchg rdi, r15
mov r15, qword [rsp + 0x38]
xchg rdi, r15
mov rax, qword [rbx + 0x660]
test rax, rax
mov dword [rsp - 0x10], edi
je 0x14004bbec
sub r8d, r9d
mov dword [rax + 0x14], 0x591b45f7
sub dword [rax + 0x14], 0x51f1de5d
add dword [rax + 0x14], 0x13f46d46
xor dword [rax + 0x14], 0x60acff88
sub dword [rax + 0x14], 0x23f6bae5
xor r8d, 0x57ba7083
xor r9d, 0x57ba7083
xchg rbx, rbx
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov dword [rsp - 0x1c], edx
xchg rcx, rsi
mov rsi, rbx
xchg rsi, rcx
call fcn.14003c6a0
mov dword [rsp - 0x40], 0x3a02972a
nop
sub rsp, 0x36a231e3
add rsp, 0x36a23203
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1400587c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r12, rbx
mov r12, rdx
xchg r12, rbx
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
nop
movabs rdx, 0xffffffff2db4c79c
add rdx, 0x2a710481
xor rdx, 0x120c34bb
add rdx, 0x7fffffff
add rdx, 0x35d6075a
nop word [rax + rax]
mov rdx, rdx
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140058823
xchg rdx, rbp
mov qword [rcx + 0x38], rbp
xchg rbp, rdx
call fcn.14001653c
xchg rdx, rdx
xor r8d, r8d
mov edx, 0xb33e436
add edx, 0x4461eead
add edx, 0x75dfb48
sub edx, 0x408b8350
cmp qword [rdi + 0x38], r8
mov dword [rsp - 0xc], 0x411572d7
jbe 0x1400588cd
sub rbx, rax
mov r9d, 0x2f0ff3ce
add r9d, 0x87aaaba
xor r9d, 0x6f01921
sub r9d, 0x317a86aa
nop word [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
mov r15, r15
and cx, r9w
ror edx, 4
ror edx, 1
ror edx, 2
ror edx, 1
xor cx, word [rbx + rax - 2]
mov dword [rsp - 0x34], esi
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
mov dword [rsp - 0x18], 0x48bdc39a
jb 0x140058893
mov rbx, qword [rsp + 0x30]
xchg r14, rax
mov r14, rdi
xchg r14, rax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
mov dword [rsp - 0x10], 0x452eb5e9
ret
Function at 0x140059280
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
xchg rbx, rsi
mov qword [rsp + 0x10], rbx
xchg rbx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
xchg rbx, r13
mov r13, rdx
xchg r13, rbx
mov r8, qword [rdx + 0x38]
mov rbp, rbp
mov rdi, rcx
add r8, rsi
xchg r13, rdx
mov r13, rsi
xchg r13, rdx
xchg r8, rbp
mov qword [rcx + 0x38], rbp
xchg r8, rbp
call fcn.140059bc0
mov r9, qword [rbx]
mov dword [rsp - 0x18], edx
mov ecx, esi
and ecx, 3
mov r8d, 0x3c189354
add r8d, 0x1e5273c1
xor r8d, 0x27bd359
sub r8d, 0x41a88971
shl ecx, 3
mov dword [rsp - 0x40], 0x2768ec5a
mov edx, r8d
ror edx, cl
xchg r8, r10
mov r8, rax
xchg r8, r10
xor ecx, ecx
mov rsi, rsi
cmp qword [rbx + 0x38], rcx
jbe 0x140059393
lea rax, [rsi + rsi]
mov rdx, rdx
mov r11d, 0xb5327ee
xor r11d, 0x434f9bbd
sub r11d, 0x4472c648
sub r11d, 0x3a9f50c
sub rax, r9
mov dword [rsp - 0x10], esi
add r10, rax
nop dword [rax]
movzx eax, r8w
xchg rbp, rbp
lea r9, [r9 + 2]
xor ax, dx
ror r8d, 1
ror r8d, 7
and ax, r11w
ror edx, 5
ror edx, 1
ror edx, 1
ror edx, 1
xor ax, word [r9 - 2]
xchg rbp, rbp
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
xchg rdx, rdx
jb 0x140059353
mov rbx, qword [rsp + 0x30]
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x38], ebx
nop
add rsp, 0x53182f77
sub rsp, 0x53182f57
pop rdi
ret

Function at 0x1400593c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
xchg rsi, r8
mov qword [rsp + 0x10], r8
xchg r8, rsi
xchg rdi, r14
mov qword [rsp + 0x18], r14
xchg r14, rdi
push r14
sub rsp, 0x20
mov r11, r11
xchg r13, r14
mov r13, qword [rcx + 0x38]
xchg r13, r14
mov rdi, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
nop
movabs rbx, 0xffffffff76666617
sub rbx, 0x1d4a6780
add rbx, 0x223241a2
sub rbx, 0x6e0d821b
add rbx, 0x7fffffff
xor rbx, 0x72bf41e2
inc rbx
xchg rsp, rsp
cmp word [rdx + rbx*2], 0
jne 0x14005942e
lea r8, [r14 + rbx]
mov dword [rsp - 0x30], edi
xchg rdx, rdi
mov rdi, r14
xchg rdx, rdi
xchg rsp, r8
mov qword [rcx + 0x38], rsp
xchg r8, rsp
call fcn.140059bc0
mov ecx, r14d
mov dword [rsp - 0x24], edx
mov edx, 0x6b957a5d
xor edx, 0x8b9e43d
sub edx, 0x4f321eb1
add edx, 0x26dcb2c
and ecx, 3
shl ecx, 3
mov dword [rsp - 0xc], esp
ror edx, cl
test rbx, rbx
je 0x140059502
xchg rbx, rbx
lea r8, [r14 + r14]
mov ecx, 0x56b48ba9
sub ecx, 0xe30367d
sub ecx, 0x168b9bde
sub ecx, 0x31f8b84f
sub r8, rdi
add r8, rax
nop dword [rax]
mov dword [rsp - 0x1c], esp
nop dword [rax + rax]
movzx eax, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x2c], 0x3dfcec2c
and ax, cx
ror edx, 1
ror edx, 1
ror edx, 2
ror edx, 2
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
mov dword [rsp - 0x10], 0x5805a140
sub rbx, 1
jne 0x1400594c6
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x30], 0x24a8e12a
xchg rcx, rsi
mov rax, rcx
xchg rsi, rcx
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xchg r9, r9
add rsp, 0x20
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140059956
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r10, r10
xchg rbp, r12
mov qword [rsp + 0x18], r12
xchg rbp, r12
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x30], 0xcbc8527
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffe0
lea rsi, [rdx + 8]
xorps xmm0, xmm0
xchg rcx, rcx
xchg rsi, r9
mov qword [rdx], r9
xchg rsi, r9
xor edi, edi
mov rdi, rdi
xchg rsi, r9
movups xmmword [r9], xmm0
xchg r9, rsi
xchg rbp, r9
mov r14, rbp
xchg r9, rbp
xchg r14, rbp
mov r14, r8
xchg rbp, r14
movups xmmword [rsi + 0x10], xmm0
mov rbx, rdx
mov r13, r13
movups xmmword [rsi + 0x20], xmm0
mov qword [rdx + 0x38], rdi
xchg r12, rax
mov r12, qword [rcx + 0x38]
xchg r12, rax
cmp r8, rax
jae 0x140059b4d
mov r15, r15
sub rax, r8
xchg rbx, r15
mov qword [rsp + 0x40], rbx
xchg r15, rbx
cmp rax, r9
mov dword [rsp - 0xc], edi
cmovb r14, rax
xchg r14, r11
mov qword [rdx + 0x38], r11
xchg r11, r14
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
mov dword [rsp - 0x30], 0x12099ce2
cmp rcx, rsi
je 0x1400599ec
call fcn.140077cf0
mov dword [rsp - 0x1c], 0x4c53df4e
cmp r14, 0x18
jbe 0x140059a26
lea rcx, [r14 + r14]
mov rdx, rdx
call fcn.140077eb0
xchg rbp, rax
mov qword [rbx], rbp
xchg rbp, rax
test rax, rax
jne 0x140059a34
mov rsp, rsp
mov qword [rbx], rsi
xchg rdi, rsp
mov r8, rsp
xchg rdi, rsp
jmp 0x140059a5b
mov qword [rbx], rsi
mov dword [rsp - 0x34], ebp
xchg r13, rax
mov r13, rsi
xchg r13, rax
xorps xmm0, xmm0
mov r9, r9
xchg r14, rax
movups xmmword [r14], xmm0
xchg r14, rax
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
xchg r8, r13
mov r13, qword [rbx]
xchg r13, r8
and ebp, 3
mov rsi, rsi
mov r9d, 0x466be946
sub r9d, 0x2fff822c
sub r9d, 0x7ce686b
add r9d, 0x4c81b03a
xor r9d, 0x4d77e432
shl ebp, 3
mov edx, r9d
movzx ecx, bpl
mov dword [rsp - 0x44], 0x1269b13b
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x140059b16
sub r15, r8
mov dword [rsp - 0x34], 0x4ba16901
mov ecx, 0x1a26c5d6
add ecx, 0x1c195cb4
sub ecx, 0x2700e6e3
add ecx, 0x347acbdd
sub ecx, 0x43ba0685
nop dword [rax]
xchg r12, r12
nop word [rax + rax]
movzx eax, r9w
lea r8, [r8 + 2]
xor ax, dx
mov rcx, rcx
ror r9d, 5
ror r9d, 1
ror r9d, 2
and ax, cx
xchg r12, r12
ror edx, 8
xor ax, word [r15 + r8 - 2]
inc rdi
mov word [r8 - 2], ax
xchg r13, r13
cmp rdi, qword [rbx + 0x38]
jb 0x140059ad9
mov r15, qword [rsp + 0x40]
mov r9, r9
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov dword [rsp - 0x3c], ecx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
pop rdi
xchg r13, r13
nop
mov rsi, qword [rsp]
add rsp, 8
ret
mov rax, rbx
mov dword [rsp - 0x28], ecx
jmp 0x140059b25