joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400938c0
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r9
mov rax, r9
xchg rsp, r9
mov qword [rax + 8], rbx
xchg rcx, rbp
mov qword [rax + 0x10], rcx
xchg rcx, rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rdi
push r14
nop
sub rsp, 0x1a03291b
add rsp, 0x1a0328fb
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x3c], 0x731b2ee8
xchg r8, r10
mov r14, r10
xchg r8, r10
movzx ebx, byte [rdx]
mov dword [rsp - 0x40], esi
movzx edi, byte [rdx + 4]
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x30], edi
shl edi, 2
shl edi, 1
shl edi, 5
movzx eax, byte [rdx + 2]
xchg r11, r11
shl ebx, 1
shl ebx, 7
or ebx, eax
movzx eax, byte [rdx + 3]
mov rbx, rbx
shl ebx, 1
shl ebx, 1
shl ebx, 4
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
xchg rdi, rdi
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x34], esp
movzx eax, byte [rdx + 7]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
mov r14, r14
mov eax, dword [rcx + 4]
test eax, eax
jle 0x1400939e0
mov dword [rsp - 0x30], 0x27826f4a
xchg rsi, r14
mov r14, qword [rcx + 8]
xchg r14, rsi
lea ebp, [rax - 1]
mov dword [rsp - 0x44], edx
shr ebp, 1
inc ebp
xchg rdx, r14
mov r14, rsi
xchg rdx, r14
mov ecx, edi
mov dword [rsp - 0x28], ecx
call fcn.140093f70
xor ebx, eax
lea rdx, [rsi + 0xc]
mov r9, r9
mov ecx, ebx
call fcn.140093f70
xor edi, eax
nop
sub rsi, 0x3219a168
add rsi, 0x3219a180
sub rbp, 1
mov dword [rsp - 0x24], esp
jne 0x14009399d
lea rax, [r14 + 7]
mov ecx, 0x47fe2c84
xor ecx, 0x79b55829
add ecx, 0x19fa6b86
xor ecx, 0x224a5c47
sub ecx, 0x7a0fbc70
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x38], esi
dec rax
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 8
sub rcx, 1
jne 0x140093a01
mov dword [rsp - 0x38], 0x17350ea1
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x14], ebp
add rsp, 0x20
pop r14
ret
Function at 0x140093c14
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg r8, rsi
push rbx
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r10
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
mov r8, r8
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001e20]
xchg rbx, rbx
xor edi, edi
movdqa xmm1, xmmword [0x140001da0]
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg r10, rbp
movdqu xmmword [r10 - 0x39], xmm0
xchg r10, rbp
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001db0]
mov dword [rsp - 0x14], ebp
mov r8d, edi
xchg rbp, r8
movdqu xmmword [r8 - 0x29], xmm1
xchg r8, rbp
movdqa xmm1, xmmword [0x140001dc0]
mov dword [rsp - 0x14], 0x67ad35b6
xchg rbp, rdi
movdqu xmmword [rdi - 0x19], xmm0
xchg rdi, rbp
xchg rsp, rbp
movdqu xmmword [rsp - 9], xmm1
xchg rbp, rsp
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x38], edx
mov eax, 0x6bd5810
add eax, 0x36e51aee
xor eax, 0x1dd4f7a5
add eax, 0x59afec56
inc rdx
mov r12, r12
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
mov rsi, rsi
cmp rdx, 0x10
jb 0x140093cca
cmp dword [rsi + 4], 8
mov r13, r13
jne 0x140093d72
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
xchg r11, r11
inc rdi
shl cx, 5
shl cx, 1
shl cx, 1
shl cx, 1
or cx, ax
mov r10, r10
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140093d18
xchg r14, r14
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg r15, r15
xchg rcx, r13
mov r13, rsi
xchg r13, rcx
call fcn.140093a50
xchg r9, r9
jmp 0x140093e46
cmp dword [rsi], edi
jle 0x140093e46
mov dword [rsp - 0x3c], esp
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x2f118473
add r8d, 0x68e8bbb
add r8d, 0x10398638
add r8d, 0x238a795d
sub r8d, 0x69640fbf
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov r15, r15
add rbx, 2
shl ax, 5
shl ax, 1
shl ax, 1
shl ax, 1
or cx, ax
mov dword [rsp - 0x1c], ecx
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140093da7
mov dword [rsp - 0x2c], ebx
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
mov dword [rsp - 0x20], 0xba7dd22
call fcn.140093a50
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
mov dword [rsp - 0x1c], ebx
sub r8d, r14d
lea rdx, [rbp + 0x67]
sub r8d, 8
mov dword [rsp - 0x3c], 0x6cb74bc4
xchg rcx, r14
mov r14, rsi
xchg rcx, r14
call fcn.140093a50
mov dword [rsp - 0x2c], esi
inc edi
nop
add r14d, 0x39dcc785
sub r14d, 0x39dcc77d
cmp edi, dword [rsi]
jl 0x140093d81
mov r15, r15
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbx, rsp
mov rsp, qword [r11 + 0x28]
xchg rsp, rbx
lea rdi, [rbp + 7]
mov dword [rsp - 0xc], ebx
xchg rsi, rbx
mov rbx, qword [r11 + 0x30]
xchg rbx, rsi
lea ecx, [rax + 0x40]
mov rsp, rsp
rep stosb byte [rdi], al
mov rsp, r11
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140093f24
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rbp, rbp
mov r11d, ecx
test edx, edx
je 0x140093f6a
mov dword [rsp - 0x34], edi
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
xchg r11, r11
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov r11, r11
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
xchg r14, r14
cmovb r11d, ecx
shr edx, 1
jne 0x140093f35
mov dword [rsp - 0x40], esp
mov eax, r10d
ret
Function at 0x140099dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
xchg r10, r15
mov qword [rsp], r15
xchg r15, r10
xchg r11, rdx
mov qword [rsp + 8], rdx
xchg r11, rdx
xor r11, r11
lea r10, [rsp + 0x18]
mov dword [rsp - 0x20], edi
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
mov rdx, rdx
bnd jae 0x140099e2b
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov r11, r11
mov byte [r11], 0x71
sub byte [r11], 0x24
xor byte [r11], 0x59
xor byte [r11], 0x25
xor byte [r11], 0x31
cmp r10, r11
xchg rdx, rdx
bnd jne 0x140099e04
xchg r10, rsi
mov rsi, qword [rsp]
xchg rsi, r10
xchg rsi, r11
mov rsi, qword [rsp + 8]
xchg r11, rsi
nop
add rsp, 0xa05a6e5
sub rsp, 0xa05a6d5
bnd ret

Function at 0x14009f238
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
mov r9, rdx
mov dword [rsp - 0x34], 0x54e8c89e
test rax, rax
je 0x14009f29f
mov ecx, r8d
xchg r14, r14
mov edx, 0x59ea042a
sub edx, 0x2dc71fba
xor edx, 0x473e53c7
add edx, 0xf09b9fa
rol edx, cl
xor dl, byte [rax]
xchg r10, r10
inc rax
mov byte [r8 + r9], dl
inc r8
mov dword [rsp - 0x10], 0x6cfd0812
cmp r8, 0x20
jb 0x14009f256
mov al, 0x2d
sub al, 0x20
xor al, 0x5e
sub al, 0x52
ret
xchg r15, rax
mov r15, qword [rcx + 0x100]
xchg r15, rax
test rax, rax
je 0x14009f2e1
xchg r10, rax
movups xmm0, xmmword [r10]
xchg r10, rax
xchg r10, rdx
movups xmmword [r10], xmm0
xchg rdx, r10
movups xmm1, xmmword [rax + 0x10]
mov dword [rsp - 0x28], 0x45cc763e
xchg r14, rdx
movups xmmword [r14 + 0x10], xmm1
xchg r14, rdx
jmp 0x14009f296
xorps xmm0, xmm0
mov r13, r13
xor al, al
movups xmmword [rdx], xmm0
xchg rbp, rdx
movups xmmword [rbp + 0x10], xmm0
xchg rdx, rbp
ret
Function at 0x1400b5b04
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg rsp, r11
mov qword [r11 + 8], rbx
xchg rbp, rsi
mov qword [r11 + 0x18], rbp
xchg rsi, rbp
mov qword [r11 + 0x20], rdi
xchg rcx, rcx
nop
push 0x4be112c3
mov qword [rsp], r14
nop
sub rsp, 0x29d8ee60
add rsp, 0x29d8ee20
mov rax, qword [0x1401414c8]
mov dword [rsp - 0x18], esp
lea rdx, [r11 + 0x10]
rol rax, 6
rol rax, 0xe
rol rax, 3
rol rax, 1
rol rax, 1
rol rax, 1
mov rbx, rcx
movabs rcx, 0xe6fc3e141f8421f
add rcx, 0x27aa062a
xor rcx, 0x7f5137c
add rcx, 0xe09fc91
mov dword [rsp + 0x58], 0x2f3bb1d8
sub dword [rsp + 0x58], 0x1ae72753
xor dword [rsp + 0x58], 0x18ec6d44
sub dword [rsp + 0x58], 0xcb8e7b1
sub rax, rcx
movabs rcx, 0x3f48e22b359bbeca
sub rcx, 0x13ee023
add rcx, 0x408caafd
add rcx, 0x7fffffff
sub rcx, 0xb0e48bf
rol rax, 0x1e
rol rax, 7
rol rax, 1
rol rax, 1
xor rax, rcx
movabs rcx, 0x6798626c3802422f
sub rcx, 0x3659521e
add rcx, 0x72ddbb3c
add rcx, 0x574ce699
not rax
xchg rdi, rdi
add rax, rcx
lea rcx, [r11 - 0x28]
rol rax, 2
rol rax, 0xc
rol rax, 1
rol rax, 2
rol rax, 1
call rax
mov dword [rsp - 0x18], ecx
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg r9, rdi
mov qword [rbx], r9
xchg r9, rdi
xor esi, esi
xchg rdi, rbx
movups xmmword [rbx], xmm0
xchg rdi, rbx
xchg rbx, rdi
movups xmmword [rbx + 0x10], xmm0
xchg rdi, rbx
movups xmmword [rdi + 0x20], xmm0
mov dword [rsp - 0x14], 0x2256dfc7
test eax, eax
jne 0x1400b5c67
xchg r14, rsi
mov qword [rbx + 0x38], r14
xchg r14, rsi
jmp 0x1400b5d8f
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
mov dword [rsp - 0x40], edx
inc r14
cmp word [rax + r14*2], si
jne 0x1400b5c74
mov qword [rbx + 0x38], r14
mov r9, r9
cmp qword [rbx], rdi
je 0x1400b5c9d
mov rcx, qword [rbx]
call fcn.140098930
xchg r14, r14
cmp r14, 0x18
jbe 0x1400b5cd5
lea rcx, [r14 + r14]
call fcn.140098be0
mov dword [rsp - 0x40], ecx
mov qword [rbx], rax
test rax, rax
jne 0x1400b5ce5
mov dword [rsp - 0x40], esi
xchg rsp, rdi
mov qword [rbx], rsp
xchg rdi, rsp
mov rcx, rsi
jmp 0x1400b5d0b
xchg r8, rdi
mov qword [rbx], r8
xchg rdi, r8
mov rax, rdi
mov dword [rsp - 0x34], edi
xorps xmm0, xmm0
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg r9, rax
movups xmmword [r9 + 0x10], xmm0
xchg r9, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
xchg r11, rcx
mov r11, qword [rbx]
xchg rcx, r11
mov edx, 0x6fae384f
sub edx, 0x5cc51c02
xor edx, 0x66b2afc7
xor edx, 0x149e8033
cmp qword [rbx + 0x38], rsi
mov dword [rsp - 0x18], ecx
jbe 0x1400b5d8f
lea r8, [rsp + 0x20]
sub r8, rcx
mov dword [rsp - 0xc], esi
movzx eax, dx
mov r9d, 0x412e88b4
sub r9d, 0x1e12f39a
add r9d, 0x5b084560
sub r9d, 0x49bf41b1
xor r9d, 0x34649836
and ax, r9w
xchg r12, r12
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor ax, word [r8 + rcx]
inc rsi
mov word [rcx], ax
mov dword [rsp - 0x30], esp
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400b5d3c
xchg rdi, rsi
mov rdi, qword [rsp + 0x60]
xchg rdi, rsi
xchg rbx, rcx
mov rax, rcx
xchg rbx, rcx
xchg r8, rbx
mov r8, qword [rsp + 0x50]
xchg r8, rbx
xchg rbp, rdi
mov rbp, qword [rsp + 0x68]
xchg rbp, rdi
nop
add rsp, 0x4bd00504
sub rsp, 0x4bd004c4
pop r14
mov dword [rsp - 0x28], 0x2465fc80
ret
Function at 0x1400d62d8
Capabilities:
Execute syscall

Disassembly:
push rbx
nop
sub rsp, 0x7c4060b1
add rsp, 0x7c406091
mov rbx, rcx
mov r12, r12
mov rcx, qword [rcx + 0x1a8]
cmp rcx, 0xffffffffffffffff
je 0x1400d6376
mov r11, r11
mov rax, qword [rbx + 0x258]
movabs rdx, 0x17c94cef0c0f137f
add rdx, 0x6c8c5c2
xor rdx, 0x73c35217
add rdx, 0x7fffffff
xor rdx, 0xb200648
add rax, rdx
movabs rdx, 0xc16eb310092c8b5b
add rdx, 0x6d9d70ec
add rdx, 0x75fc0cc
sub rdx, 0xc8d9587
add rdx, 0x7221a48f
ror rax, 0xb
ror rax, 2
ror rax, 0x12
ror rax, 1
ror rax, 1
add rax, rdx
mov r10, r10
not rax
call rax
mov rcx, qword [rbx + 0x198]
mov dword [rsp - 0x10], ecx
test rcx, rcx
je 0x1400d63b4
cmp qword [rbx + 0x1a0], 0
jne 0x1400d63b4
xchg r15, r15
mov rcx, qword [rcx + 0x20]
call fcn.140098930
mov rcx, qword [rbx + 0x198]
mov dword [rsp - 0x28], ecx
call fcn.140098930
mov rcx, qword [rbx + 0x1a0]
test rcx, rcx
je 0x1400d643b
mov rsi, rsi
mov rax, qword [rbx + 0x248]
movabs rdx, 0xf6e2cfa74c3cb057
xor rdx, 0x35bcfa91
sub rdx, 0x2cc6066f
xor rdx, 0x59639a19
add rdx, 0x2cda80eb
rol rax, 0x14
rol rax, 1
rol rax, 4
rol rax, 1
rol rax, 3
rol rax, 6
xor rax, rdx
movabs rdx, 0x1ce723c1d051396
sub rdx, 0x9e8967e
add rdx, 0x6851cc6d
add rdx, 0x6409d009
rol rax, 0x2e
rol rax, 1
xor rax, rdx
mov rsp, rsp
call rax
cmp qword [rbx + 0x200], 0
je 0x1400d64e7
mov rax, qword [rbx + 0x210]
xchg r9, r9
movabs rcx, 0x3e62148b072a1a58
add rcx, 0x12e35c10
xor rcx, 0x72cd2a0
add rcx, 0x83dd26d
add rcx, 0x457d1d5b
rol rax, 0xd
mov dword [rsp - 0xc], 0x41ba3674
sub rax, rcx
movabs rcx, 0x9f0a29d869d6ab5b
sub rcx, 0x400286a1
xor rcx, 0x3118747c
add rcx, 0x7fffffff
add rcx, 0x60a426f6
ror rax, 0x2e
ror rax, 7
ror rax, 4
ror rax, 1
ror rax, 1
add rax, rcx
mov dword [rsp - 0x14], 0x1402f66f
not rax
call rax
mov rcx, qword [rbx + 0x200]
mov rdi, rdi
call fcn.14008d320
and qword [rbx + 0x200], 0
xchg r8, rcx
mov r8, qword [rbx + 0x1f0]
xchg rcx, r8
add rsp, 0x20
xchg r9, r9
pop rbx
jmp fcn.140056140
Function at 0x1400d8ae4
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg rsi, r13
push rbp
mov dword [rsp - 0x40], edi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
xchg rbp, r12
mov r12, rsp
xchg rbp, r12
add rsp, 0xffffffffffffffb0
mov r9, r9
xor esi, esi
mov dword [rbp - 0x30], 0x566a41c6
add dword [rbp - 0x30], 0x20ddd238
sub dword [rbp - 0x30], 0x934bea
sub dword [rbp - 0x30], 0x22a3718d
xor dword [rbp - 0x30], 0x54515669
mov dword [rbp - 0x2c], 0x6b7ba751
sub dword [rbp - 0x2c], 0x5f2d7ae1
xor dword [rbp - 0x2c], 0x79bc9238
sub dword [rbp - 0x2c], 0x146c0036
sub dword [rbp - 0x2c], 0x6147bd1b
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov dword [rbp - 0x28], 0x60f09064
sub dword [rbp - 0x28], 0x2e2ef6af
xor dword [rbp - 0x28], 0x6c61cf6
add dword [rbp - 0x28], 0x3c43dbe8
xor dword [rbp - 0x28], 0x704a61a1
mov r14d, 0x599c704c
sub r14d, 0x48996c6
xor r14d, 0x45278679
add r14d, 0xcdbe43b
sub r14d, 0x1d114439
mov dword [rbp - 0x24], 0x4dc6076
add dword [rbp - 0x24], 0xb952a8
add dword [rbp - 0x24], 0x3addd4c4
sub dword [rbp - 0x24], 0x406f86f7
mov dword [rbp - 0x20], 0x7f8d4d8c
sub dword [rbp - 0x20], 0x101c3335
add dword [rbp - 0x20], 0x91eceed
xor dword [rbp - 0x20], 0x78d0e991
xchg rsi, r15
mov qword [rbp + 0x20], r15
xchg r15, rsi
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
mov rcx, qword [rbp + 0x20]
xchg r13, r13
mov rax, qword [rbp + 0x20]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x2c], 0x1e2b6e0e
mov eax, 0x47b2e49d
sub eax, 0x8ba0238
sub eax, 0x214ff291
sub eax, 0xe982873
xor eax, 0x6fd5f4d8
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x44], 0x7d1b6bc4
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0xc], 0x74350f68
add rax, r14
mov qword [rbp + 0x20], rax
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
cmp rax, 0xa
jb 0x1400d8c01
xor edx, edx
mov dword [rsp - 0x10], esi
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008ad70
xchg r11, rax
mov r8, r11
xchg r11, rax
xchg r12, rax
mov qword [rbx + 0x200], r12
xchg r12, rax
xor eax, eax
xchg r15, r15
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov r15, r15
test r8, r8
je 0x1400d8cfc
lea rdx, [rbx + 0x208]
xchg r15, r8
mov rcx, r15
xchg r15, r8
call fcn.1400d93ac
mov dword [rsp - 0x1c], 0x1ee7c1ed
test al, al
jne 0x1400d8cf9
mov rcx, qword [rbx + 0x200]
mov r14, r14
call fcn.14008d320
xor al, al
mov qword [rbx + 0x200], rsi
jmp 0x1400d8cfc
mov al, r14b
lea r11, [rsp + 0x50]
mov r13, r13
mov rbx, qword [r11 + 0x28]
xchg rcx, rsi
mov rcx, qword [r11 + 0x30]
xchg rcx, rsi
xchg rsp, r8
mov r8, r11
xchg r8, rsp
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400d9188
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffec0
xchg r8, rdi
mov r8, rdi
xchg rdi, r8
xchg rcx, r15
mov rbx, r15
xchg r15, rcx
mov r8d, 0x59645d65
add r8d, 0x20fcdbd0
add r8d, 0x295d861
xor r8d, 0x7cf71096
lea rcx, [rsp + 0x40]
xchg r14, r14
xor edx, edx
call fcn.140098f00
xchg r11, rax
mov r11, qword [rbx + 0x238]
xchg r11, rax
lea r8, [rsp + 0x40]
mov edx, dword [rdi + 0x10]
mov r12, r12
movabs rcx, 0x61da798441d81b11
xor rcx, 0x6b5b2cec
sub rcx, 0x243f649d
add rcx, 0x5ab6e2d0
add rcx, 0x5c776d29
rol rax, 1
rol rax, 1
mov r9d, 0x2a968185
add r9d, 0x3c3c14b8
sub r9d, 0x114af142
xor r9d, 0x5587a5fb
xor rax, rcx
mov dword [rsp + 0x30], 0x8801fa2
add dword [rsp + 0x30], 0x6466be03
sub dword [rsp + 0x30], 0x3f38f594
add dword [rsp + 0x30], 0x1816bdef
sub dword [rsp + 0x30], 0x45c4a5fe
and dword [rsp + 0x28], 0
movabs rcx, 0x542ec19304e034df
xor rcx, 0x217920c1
sub rcx, 0x24a156fd
add rcx, 0x7fffffff
add rcx, 0x446a98ae
and qword [rsp + 0x20], 0
add rax, rcx
ror rax, 0x1a
ror rax, 8
ror rax, 3
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
movabs rcx, 0x4dd7fb6216d54461
xor rcx, 0x2b53862d
add rcx, 0x6a16c59
sub rcx, 0x20008245
sub rcx, 0x1947409d
xor rax, rcx
mov rcx, qword [rdi + 0x20]
xchg r14, r14
call rax
test eax, eax
jne 0x1400d938b
mov dword [rsp - 0x18], 0x5e480db8
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
cmp byte [rsp + 0x40], 0
mov dword [rsp + 0x150], eax
mov dword [rsp - 0x3c], ecx
je 0x1400d9360
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x150]
mov r8d, 0x1cd97724
xor r8d, 0xca2a3fc
add r8d, 0x321c4978
sub r8d, 0x42981e4f
inc rbx
mov dword [rsp - 0x20], 0x13c63365
call fcn.14008df40
cmp byte [rbx], 0
jne 0x1400d9311
mov eax, dword [rsp + 0x150]
mov rdx, rdx
not eax
cmp eax, 0xa2ca6717
je 0x1400d937e
cmp eax, 0xd7b7e7a8
mov dword [rsp - 0x18], edx
sete al
jmp 0x1400d938d
mov al, 0x36
sub al, 0x29
add al, 0x38
sub al, 0x44
jmp 0x1400d938d
xor al, al
mov rbx, qword [rsp + 0x158]
mov r8, r8
add rsp, 0x48b07fc4
sub rsp, 0x48b07e84
pop rdi
mov dword [rsp - 0x3c], esp
ret

Function at 0x1400dd960
Capabilities:
Encrypt data using curve25519

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffff40
xchg rdi, rax
mov rdi, r8
xchg rdi, rax
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rdx, r12
mov r8, r12
xchg r12, rdx
xchg r12, rcx
mov rdi, r12
xchg r12, rcx
mov edx, 0x3e918831
xor edx, 0x3431149c
add edx, 0x5648839f
sub edx, 0x2dd8bd50
sub edx, 0x331062dc
xchg r10, rax
mov rcx, r10
xchg r10, rax
call fcn.1400de1b0
movzx eax, byte [rbx + 0x1f]
mov rdi, rdi
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
and al, 0x3f
or al, 0x40
xchg rbx, rbx
xchg r10, rdx
mov r10, rbx
xchg r10, rdx
mov byte [rbx + 0x1f], al
call fcn.1400e1840
lea rdx, [rsp + 0x20]
mov dword [rsp - 0x10], ebx
xchg r8, rcx
mov r8, rdi
xchg r8, rcx
call fcn.1400e1770
mov rbx, qword [rsp + 0xd0]
neg rsp
add rsp, 0xffffffffffffff40
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400f0550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov dword [rcx + 8], 0x6fcab391
sub dword [rcx + 8], 0x248747c0
xor dword [rcx + 8], 0x3f7e2eb2
sub dword [rcx + 8], 0x743d4562
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x14000ba68]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.14001791c
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x1400f05f3
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x1400f05d9
mov ecx, dword [rsi + 0x40]
mov edx, 0x5c4490e
add edx, 0x7633502f
xor edx, 0x1d05d854
xor edx, 0x367c70c4
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x6747c230
sub r15d, 0x4416a68b
xor r15d, 0x5bf5b2e8
sub r15d, 0xd8b8476
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x4d20705d
sub edx, 0x15fa464b
sub edx, 0x37262a02
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
sub r14, 0x45c2dbd1
add r14, 0x45c3dbd0
mov rcx, r14
shl rcx, 4
call fcn.140098850
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x140146580]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x1400f06dc
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x140146580]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x1400f06fe
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.1400ea020
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffd0
pop r15
pop r14
pop rdi
ret
Function at 0x1400f2078
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140073f40
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x1400f20f8
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x8586a33
xor r8d, 0x3206a4fc
sub r8d, 0x2a44cd52
sub r8d, 0x101a017c
inc rdi
call fcn.14008df40
cmp byte [rdi], 0
jne 0x1400f20ba
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400f212c
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x679267cb
sub ecx, 0x18cf6bca
xor ecx, 0x4ec2fc81
rep stosb byte [rdi], al
jmp 0x1400f2131
call fcn.140098930
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x31ad
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x1400f2250
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x48cb55e1
add r10d, 0x2d5da1ff
sub r10d, 0xd18fcb7
sub r10d, 0x1881c97c
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x6b3924d7
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x1400f22ed
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140146580]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x1400f22b1
mov eax, r9d
ret

Function at 0x1400f23f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x115b33dc
add r10d, 0x55e1f11c
sub r10d, 0x16aef34b
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x6b3924d7
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400f248e
mov r10, qword [rcx + 0x300]
movzx eax, ax
add rdx, 2
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140146580]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x1400f244f
mov eax, r9d
ret