joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cdd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg rcx, r8
lea rbx, [rdx + 0x2e]
xchg r10, rdx
mov r10, rbx
xchg rdx, r10
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x7e
xor byte [rbx + rax], 0x1c
xor byte [rbx + rax], 7
sub byte [rbx + rax], 0x31
add byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x79
inc rax
cmp rax, 0x5a
jb 0x14007cdfd
xchg r15, rdi
mov rax, r15
xchg rdi, r15
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x30]
xchg r13, rdx
mov r13, rbx
xchg r13, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x7e
xor byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x4f
sub byte [rbx + rax], 8
inc rax
cmp rax, 0x5c
jb 0x14007ce7c
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ced0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x30]
xchg rbx, r13
mov rdx, r13
xchg rbx, r13
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x11
add byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x54
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x5e
jb 0x14007cf03
mov rax, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf60
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x32]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 9
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x28
add byte [rbx + rax], 0x64
xor byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x26
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x5b
inc rax
cmp rax, 0x60
jb 0x14007cf93
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cfe0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x19
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x72
add byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x44
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x64
jb 0x14007d015
xchg r14, rdi
mov rax, r14
xchg rdi, r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rax
push rdx
push rbx
push rdx
xchg qword [rsp + 0x30], rdi
pop rdx
pop rbx
pop rdx
pop rax
pop rdx
pop rax
add rsp, 8
ret

Function at 0x14007d070
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r15
mov r15, rcx
xchg r15, rdi
lea rbx, [rdx + 0x38]
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x11
add byte [rbx + rax], 0x4a
sub byte [rbx + rax], 4
sub byte [rbx + rax], 0x4f
add byte [rbx + rax], 0x4a
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x6e
jb 0x14007d0ab
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdx
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x4e]
xchg rbx, rbp
mov rdx, rbp
xchg rbx, rbp
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x49
add byte [rbx + rax], 0x2d
xor byte [rbx + rax], 5
xor byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x4c
inc rax
cmp rax, 0x98
jb 0x14007d131
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d170
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x56]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x16
add byte [rbx + rax], 0x26
add byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x46
add byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x41
inc rax
cmp rax, 0xa8
jb 0x14007d1a9
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d200
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rcx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x46
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x27
inc rax
cmp rax, 0xb0
jb 0x14007d237
xchg rdi, r12
mov rax, r12
xchg r12, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x70]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
add byte [rbx + rax], 0x11
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x21
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x50
sub byte [rbx + rax], 0x72
inc rax
cmp rax, 0xdc
jb 0x14007d2b6
mov rax, rdi
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg rdx, r14
mov r14, rbx
xchg r14, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x68
sub byte [rbx + rax], 0x4c
xor byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x30
sub byte [rbx + rax], 1
sub byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x19
inc rax
cmp rax, 0xde
jb 0x14007d34b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x76]
xchg rdx, r10
mov r10, rbx
xchg r10, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x72
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x78
add byte [rbx + rax], 8
sub byte [rbx + rax], 9
inc rax
cmp rax, 0xea
jb 0x14007d3bd
xchg rbx, rdi
mov rax, rbx
xchg rdi, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
push r12
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x7c]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x13
sub byte [rbx + rax], 5
add byte [rbx + rax], 0x29
add byte [rbx + rax], 1
xor byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x34
inc rax
cmp rax, 0xf4
jb 0x14007d449
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg r8, rdx
push rdi
sub rsp, 0x20
xchg r12, rdi
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0x9a]
xchg rdx, r8
mov r8, rbx
xchg rdx, r8
call fcn.14007ab60
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x4b
add byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x31
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x71
inc rax
cmp rax, 0x130
jb 0x14007d4e8
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d540
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x65
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x47
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x14
jb 0x14007d56f
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5c0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r14, rcx
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0xe]
xchg rsi, rbx
mov rdx, rsi
xchg rbx, rsi
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x7e
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 0x18
jb 0x14007d602
xchg r8, rax
mov r8, rdi
xchg r8, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007d650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007ab60
nop
xor eax, eax
mov byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0x25
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x41
inc rax
cmp rax, 0x1a
jb 0x14007d686
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
push rbx
push rax
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400810a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, rdi
mov rdi, r8
xchg rbx, rdi
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
jne 0x14008116a
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdx, r11
mov r11, rsi
xchg rdx, r11
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.1400810a0
xchg r9, rdi
mov r9, rbx
xchg rdi, r9
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.1400916e0
mov edx, 0x44b57dcd
add edx, 0xef38e71
sub edx, 0x48dd1a49
add edx, 0x4863182d
sub edx, 0x2fb5a8d2
add edx, 0x6dc8ef8
xor edx, 0x2a55f0d0
xchg r11, rdi
mov rcx, r11
xchg r11, rdi
call fcn.1401fcdd8
cmp byte [rbx + 0x19], 0
je 0x1400810ee
xchg r12, rdi
mov r12, qword [rsp + 0x30]
xchg rdi, r12
mov rbx, qword [rsp + 0x38]
xchg rbp, rbx
mov rbx, qword [rsp + 0x40]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083ff0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x14008412f
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg r10, rdx
mov qword [r9 + r8 - 0x70], rdx
xchg r10, rdx
xchg r14, r10
mov qword [r9 + r8 - 0x68], r14
xchg r14, r10
movups xmm0, xmmword [r8 - 0x80]
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg r8, r15
movups xmm1, xmmword [r15 - 0x70]
xchg r15, r8
xorps xmm0, xmm0
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
xchg r10, r14
mov qword [r8 - 0x70], r14
xchg r14, r10
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0xcfdeb2e
xor qword [r8 - 0x68], 0x57918a68
sub qword [r8 - 0x68], 0x362eb48a
xor qword [r8 - 0x68], 0x33ec227e
sub qword [r8 - 0x68], 0xbf6bbeb
xor qword [r8 - 0x68], 0xadad2d0
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r10, r13
mov qword [r9 + r8 - 0x50], r13
xchg r13, r10
mov qword [r9 + r8 - 0x48], r10
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [r9 + r8 - 0x60], xmm0
movups xmm1, xmmword [r8 - 0x50]
xchg r9, r15
movups xmmword [r15 + r8 - 0x50], xmm1
xchg r9, r15
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x3ffbcefd
sub qword [r8 - 0x48], 0x1327d28a
sub qword [r8 - 0x48], 0x925abd9
add qword [r8 - 0x48], 0x441149a9
sub qword [r8 - 0x48], 0x241f5998
add qword [r8 - 0x48], 0x3151e8b2
sub qword [r8 - 0x48], 0x357280aa
sub qword [r8 - 0x48], 0x3f7fa8ac
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140084014
ret

Function at 0x140084230
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x1400842fb
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg r10, r15
mov qword [r9 + r8 - 0x28], r15
xchg r15, r10
lea rcx, [r8 - 0x18]
xchg rdi, r10
mov qword [r8 + r9 - 0x20], rdi
xchg rdi, r10
xchg r8, r12
movups xmm0, xmmword [r12 - 0x38]
xchg r12, r8
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg r8, r10
movups xmm1, xmmword [r10 - 0x28]
xchg r10, r8
movups xmmword [rax + 0x10], xmm1
xchg rbx, r10
mov qword [r8 - 0x28], rbx
xchg rbx, r10
nop
add rax, 0x6289e97b
sub rax, 0x6289e95b
mov qword [r8 - 0x20], 0x4522a700
xor qword [r8 - 0x20], 0x6360a3b4
xor qword [r8 - 0x20], 0x41ac9676
sub qword [r8 - 0x20], 0x606b6fee
add qword [r8 - 0x20], 0x31f67c13
sub qword [r8 - 0x20], 0x39799ee0
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140084258
ret

Function at 0x14008e830
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x25
add byte [rcx + rax + 0x14], 0x26
xor byte [rcx + rax + 0x14], 0x20
sub byte [rcx + rax + 0x14], 0x41
xor byte [rcx + rax + 0x14], 0x4d
sub byte [rcx + rax + 0x14], 0x50
sub byte [rcx + rax + 0x14], 0xd
add byte [rcx + rax + 0x14], 0x73
sub byte [rcx + rax + 0x14], 0x7d
inc rax
cmp rax, 0x24
jb 0x14008e832
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14015c190
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c385
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rbp
mov rbp, qword [rdx + 0x50]
xchg rcx, rbp
xchg rdx, rbx
mov rdi, rbx
xchg rbx, rdx
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c221
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c204
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c38e
xchg rcx, r11
mov r11, r8
xchg rcx, r11
call fcn.1401fcdd8
xchg rbx, r10
mov qword [rdi + 0x50], r10
xchg rbx, r10
xchg rbx, r10
mov qword [rdi + 0x58], r10
xchg rbx, r10
mov qword [rdi + 0x60], rbx
mov rcx, qword [rdi + 0x40]
xchg rbx, rax
mov rbx, qword [rcx + 8]
xchg rbx, rax
xchg rcx, rbx
mov qword [rax], rcx
xchg rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c284
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x66507aaf
sub edx, 0x41027673
xor edx, 0xae0953f
xor edx, 0x4ebe2184
xor edx, 0x527909ba
sub edx, 0x3369b925
call fcn.1401fcdd8
mov rcx, rbx
test rbx, rbx
jne 0x14015c24d
xchg rcx, rbp
mov rbp, qword [rdi + 0x40]
xchg rcx, rbp
mov edx, 0x13740983
xor edx, 0x259f0499
add edx, 0x1ff9d1a5
sub edx, 0x3fd4591d
add edx, 0x2dee7033
sub edx, 0x26a2d0cf
sub edx, 0x1e5c24ee
call fcn.1401fcdd8
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015c33b
xchg rsi, r12
mov qword [rsp + 0x38], r12
xchg r12, rsi
mov esi, 0x60c7d9a5
xor esi, 0x7f1f09
sub esi, 0x32c90a6
xor esi, 0x68bac0d2
sub esi, 0x77898ea
add esi, 0xd241a215
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c330
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c330
xchg rdx, rax
mov rdx, qword [rbx]
xchg rdx, rax
xchg r12, rbx
mov rcx, r12
xchg r12, rbx
call qword [rax + 8]
xchg rdi, rsi
mov rdi, qword [rsp + 0x38]
xchg rsi, rdi
mov edx, 0xca80868
xor edx, 0x39647490
add edx, 0x24ba714d
xor edx, 0x1c1b76c4
xor edx, 0x604a0c7a
add edx, 0x16d37021
sub edx, 0x3dab0374
xchg rdi, rdx
mov rcx, rdx
xchg rdi, rdx
call fcn.1401fcdd8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
call 0x140ca33ab
test esp, ecx
int3
Function at 0x140193d30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r10
mov rdx, r10
xchg rdx, r10
xchg r15, r11
mov r15, rcx
xchg r11, r15
mov word [rsp + 0x30], 0xade
add word [rsp + 0x30], 0x59ca
sub word [rsp + 0x30], 0x13d7
add word [rsp + 0x30], 0x2a6b
sub word [rsp + 0x30], 0x501e
add word [rsp + 0x30], 0xcbd8
mov dword [rsp + 0x34], 0x749199a7
sub dword [rsp + 0x34], 0x400dc0ae
add dword [rsp + 0x34], 0x18d170c5
xor dword [rsp + 0x34], 0x1200cb8
add dword [rsp + 0x34], 0x335a2e73
sub dword [rsp + 0x34], 0x7ed3b3cc
add dword [rsp + 0x34], 0x10ad4d2e
xor dword [rsp + 0x34], 0xeee6f38a
mov byte [rsp + 0x32], 1
xor byte [rsp + 0x32], 0x60
sub byte [rsp + 0x32], 0x57
add byte [rsp + 0x32], 2
add byte [rsp + 0x32], 0x1d
add byte [rsp + 0x32], 0x35
add byte [rsp + 0x32], 0x98
mov dword [rsp + 0x38], 0x7b39f746
sub dword [rsp + 0x38], 0x3e632e1a
xor dword [rsp + 0x38], 0x6dd6869f
sub dword [rsp + 0x38], 0x3b348f8
xor dword [rsp + 0x38], 0x400bcb53
add dword [rsp + 0x38], 0x5f85c3a9
xor dword [rsp + 0x38], 0x71b8f418
xor dword [rsp + 0x38], 0x460d2ba3
xor dword [rsp + 0x38], 0x5b79b174
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x140193e25
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg rdx, r10
mov r10, rdx
xchg rdx, r10
xchg rcx, r8
mov r8, r11
xchg r8, rcx
call fcn.140194220
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x19
xor byte [rsp + rbx + 0x34], 0x30
add byte [rsp + rbx + 0x34], 0x50
sub byte [rsp + rbx + 0x34], 0x3c
xor byte [rsp + rbx + 0x34], 0x3f
sub byte [rsp + rbx + 0x34], 2
inc rbx
cmp rbx, 6
jb 0x140193e75
add rsp, 0x40
push rax
push rax
push rdx
push rdx
push rax
push rcx
push rdx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
ret
Function at 0x1401aaf00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdx, rbx
mov r11, rbx
xchg rbx, rdx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test rdx, rdx
je 0x1401aaf84
xchg rbp, rbx
mov qword [rsp], rbp
xchg rbp, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aaf77
movzx eax, byte [r10]
test bl, bl
je 0x1401aaf59
lea rcx, [r9 - 1]
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aaf48
jmp 0x1401aaf77
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aaf68
inc r10
sub r11, 1
jne 0x1401aaf2a
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x3ccd872b
add r9d, 0x3ff6f0fd
sub r9d, 0x396215d1
add r9d, 0x2dec92e6
sub r9d, 0x4d5b0f38
sub r9d, 0x12d4d1e5
add r9d, 0x167f72b4
xor r9d, 0x2d03d482
sub r9d, 0xa9d4fe6
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b03c1
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b037c
mov ecx, dword [r10]
jmp 0x1401b0512
cmp ecx, 0x4e0
jb 0x1401b0512
lea r11, [r10 + 0x9c4]
xchg rsi, rbx
mov qword [rsp], rsi
xchg rbx, rsi
mov eax, dword [r11]
mov ebx, 0xf417f60
add ebx, 0x1a2f30f8
xor ebx, 0x5768fb92
sub ebx, 0x72c67375
xor ebx, 0x4d746019
add ebx, 0x21c2d478
xor ebx, 0x352b3cfb
sub ebx, 0x3dfc9c5f
sub ebx, 0x14c712fd
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0416
lea r11, [r10 + 0xd50]
mov ebx, 0x580a41e8
sub ebx, 0x2338f163
sub ebx, 0xaf92380
xor ebx, 0x578528f8
sub ebx, 0x363a4e26
sub ebx, 0x940343f
xor ebx, 0x3ee28214
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b048e
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rsi, rbx
mov rsi, qword [rsp]
xchg rbx, rsi
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 8
shr ecx, 1
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 1
shl eax, 8
shl eax, 1
shl eax, 1
shl eax, 2
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 2
shr eax, 0xb
shr eax, 1
shr eax, 3
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]