joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
add rsp, 0xffffffffffffffd0
mov dword [rcx + 8], 0x7a086c9
xor dword [rcx + 8], 0x221faf02
sub dword [rcx + 8], 0xa0d5e7
sub dword [rcx + 8], 0x251e53e3
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ed40
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140031cb3
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140031c99
mov ecx, dword [rbx + 0x40]
mov esi, 0x522f66f8
xor esi, 0x3b21b524
xor esi, 0x70413146
xor esi, 0x194f1d65
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x288446d2
xor edx, 0x6145dc5b
sub edx, 0x49c19a79
mov eax, dword [rbx + 0x54]
xor eax, 0x7e4c2a49
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x7e4c2a49
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x7e4c2a49
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x7e4c2a49
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x3af910e5
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x7e4c2a49
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x3c173b3a
sub eax, 0x3bd8fa5d
add eax, 0x47ed62b1
sub eax, 0x482ba28f
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.140096540
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a1540]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140031d8e
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rax + rdx - 0x10]
xor ecx, 0x3af910e5
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rax + rdx - 0xc]
xor ecx, 0x3af910e5
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rax + rdx - 8]
xor ecx, 0x3af910e5
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rax + rdx - 4]
xor ecx, 0x3af910e5
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a1540]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140031db2
lea rcx, [r14 + 0xa0]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.140011e60
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140033d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0x44662ef5
sub rsp, 0x44662fa5
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.1400197f0
mov ebx, 0x2f836cb4
add ebx, 0x478a95a2
add ebx, 0x88f1fda9
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x140033dce
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x70ee9c92
sub r8d, 0x2e06e1d0
xor r8d, 0x42e7bac3
inc rdi
call fcn.140081bf0
cmp byte [rdi], 0
jne 0x140033d97
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x140033e08
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x65352b7e
xor ecx, 0x4a64795
sub ecx, 0x21329f1d
sub ecx, 0x4060cd4e
rep stosb byte [rdi], al
jmp 0x140033e0d
call fcn.1400966a0
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x2a49
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x140033e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
add rsp, 0xffffffffffffffc0
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x7e4c2a49
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x7e4c2a49
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x3af910e5
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.1400536d0
test ax, ax
je 0x140033f1e
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404a1540]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.1400536d0
test ax, ax
jne 0x140033ed4
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
sub rsp, 0xffffffffffffffc0
pop r14
pop rdi
pop rsi
ret

Function at 0x140033f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x7e4c2a49
xor r9d, 0x7e4c2a49
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x3af910e5
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x140033fcd
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a1540]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x140033f94
mov eax, r8d
ret
Function at 0x140033fe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x7e4c2a49
xor r9d, 0x7e4c2a49
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x3af910e5
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x14003407b
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a1540]
movzx eax, ax
nop
add rdx, 0x4bebba83
sub rdx, 0x4bebba81
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x140034035
mov eax, r8d
ret
Function at 0x140034080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
cmp qword [rcx + 0x2f8], 0
mov rdi, rcx
pushf
mov qword [rsp + 0xb2], 0x1cbb56c0
add qword [rsp + 0xb2], 0x486a0b23
sub qword [rsp + 0xb2], 0x2420e43c
xor qword [rsp + 0xb2], 0x41047da7
popf
pushf
movabs rsi, 0xffffffff65472d4f
sub rsi, 0x67409ae
sub rsi, 0x3cd67c9d
add rsi, 0x7fffffff
add rsi, 0x5e0358fc
popf
je 0x140034230
mov edx, dword [rcx + 0x2ec]
mov eax, dword [rcx + 0x2e8]
xor edx, 0x7e4c2a49
xor eax, 0x7e4c2a49
imul edx, eax
mov eax, 0x472db0b5
xor eax, 0x31bd112e
xor eax, 0x7690a19f
movsxd rbx, edx
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400964d0
mov qword [rsp + 0xb0], rax
test rbx, rbx
jle 0x140034176
xor edx, edx
mov rax, qword [rdi + 0x2f8]
mov ecx, dword [rax + rdx*4]
mov rax, qword [rsp + 0xb0]
xor ecx, 0xa0b4447
mov dword [rax + rdx*4], ecx
inc rdx
cmp rdx, rbx
jl 0x14003414f
mov rbx, qword [rdi + 0x318]
lea rax, [0x140001bb8]
mov qword [rsp + 0x20], rax
movabs rdx, 0x41c44f304b6e7275
sub rdx, 0x436bcbf6
xor rdx, 0x5ec50eed
add rdx, 0x733d16c
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x98], 0x1472135b
add qword [rsp + 0x98], 0x1e8f3999
sub qword [rsp + 0x98], 0x33014cdc
mov qword [rsp + 0x28], rdi
mov rcx, qword gs:[0x30]
mov rax, qword [rbx + 0x98]
xor rax, rdx
cmp rax, qword [rcx + 0x48]
jne 0x14003424a
lea rcx, [rsp + 0x20]
call fcn.140032da0
movzx edi, al
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
ja 0x140034337
test rax, rax
je 0x14003437d
mov rax, qword [rsp + 0x20]
mov r8, qword [rax]
jmp 0x140034363
lea rdx, [rsp + 0xb0]
call fcn.1400343a0
test al, al
jne 0x140034176
jmp 0x140034381
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x48]
lock inc dword [rbx + 0xf0]
je 0x140034282
cmp rdi, qword [rbx + 0xe0]
je 0x140034313
mov rcx, qword [rbx + 0xe8]
xor r8d, r8d
xor edx, edx
call fcn.140053f60
mov qword [rbx + 0xe0], rdi
mov dword [rbx + 0xf4], 0x66f264fd
xor dword [rbx + 0xf4], 0x4f5db97b
sub dword [rbx + 0xf4], 0x29afdd85
lea rcx, [rbx + 0xc0]
lea rdx, [rsp + 0x20]
call fcn.140031840
test rax, rax
setne dil
sub dword [rbx + 0xf4], 1
jne 0x14003431e
mov qword [rbx + 0xe0], 0x2e303866
add qword [rbx + 0xe0], 0x575678b
sub qword [rbx + 0xe0], 0x33a59ff1
lock xadd dword [rbx + 0xf0], esi
dec esi
cmp esi, 0xffffffff
je 0x140034325
mov rcx, qword [rbx + 0xe8]
xor edx, edx
call fcn.140053f20
jmp 0x140034325
inc dword [rbx + 0xf4]
jmp 0x1400342a7
lock dec dword [rbx + 0xf0]
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
jbe 0x140034352
mov rcx, qword [rsp + 0x20]
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rsp + 0x20]
call fcn.1400966a0
jmp 0x14003437d
test rax, rax
je 0x14003437d
mov rcx, qword [rsp + 0x20]
mov r8, qword [rcx]
lea rax, [0x140032e00]
cmp r8, rax
je 0x14003437d
xor edx, edx
lea rcx, [rsp + 0x20]
call r8
movzx eax, dil
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003649a
Capabilities:
Packed with generic packer

Disassembly:
push rbx
nop
add rsp, 0x5beec272
sub rsp, 0x5beec292
mov rax, qword gs:[0x30]
mov rbx, rcx
mov qword [rsp + 0x38], rdi
mov rdi, qword [rax + 0x48]
lock inc dword [rcx + 0x228]
je 0x140036421
cmp rdi, qword [rcx + 0x218]
je 0x14003650c
mov rcx, qword [rcx + 0x220]
xor r8d, r8d
xor edx, edx
call fcn.140053f60
mov qword [rbx + 0x218], rdi
mov dword [rbx + 0x22c], 0x427dd3e1
add dword [rbx + 0x22c], 0x3fcb81f
add dword [rbx + 0x22c], 0x1ad90d4a
sub dword [rbx + 0x22c], 0x61539949
mov rcx, qword [rbx + 0x200]
test rcx, rcx
je 0x140036499
mov rdi, qword [rbx + 0x1f8]
mov qword [rsp + 0x30], rsi
lea rsi, [rdi + rcx*8]
cmp rdi, rsi
je 0x140036494
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax]
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
cmp rdi, rsi
jne 0x140036479
mov rsi, qword [rsp + 0x30]
sub dword [rbx + 0x22c], 1
mov rdi, qword [rsp + 0x38]
jne 0x140036517
mov qword [rbx + 0x218], 0x1b618e74
sub qword [rbx + 0x218], 0x181c8460
sub qword [rbx + 0x218], 0x3450a14
mov eax, 0x55b7d822
xor eax, 0x4621dec
add eax, 0xae2a3a31
lock xadd dword [rbx + 0x228], eax
dec eax
cmp eax, 0xffffffff
je 0x14003651e
mov rcx, qword [rbx + 0x220]
xor edx, edx
nop
sub rsp, 0x1d4eb890
add rsp, 0x1d4eb8b0
pop rbx
jmp fcn.140053f20
inc dword [rcx + 0x22c]
jmp 0x140036450
lock dec dword [rbx + 0x228]
nop
sub rsp, 0x71311d8
add rsp, 0x71311f8
pop rbx
ret

Function at 0x1400364a2
Capabilities:
Packed with generic packer

Disassembly:
push rbx
nop
add rsp, 0x5beec272
sub rsp, 0x5beec292
mov rax, qword gs:[0x30]
mov rbx, rcx
mov qword [rsp + 0x38], rdi
mov rdi, qword [rax + 0x48]
lock inc dword [rcx + 0x228]
je 0x140036421
cmp rdi, qword [rcx + 0x218]
je 0x14003650c
mov rcx, qword [rcx + 0x220]
xor r8d, r8d
xor edx, edx
call fcn.140053f60
mov qword [rbx + 0x218], rdi
mov dword [rbx + 0x22c], 0x427dd3e1
add dword [rbx + 0x22c], 0x3fcb81f
add dword [rbx + 0x22c], 0x1ad90d4a
sub dword [rbx + 0x22c], 0x61539949
mov rcx, qword [rbx + 0x200]
test rcx, rcx
je 0x140036499
mov rdi, qword [rbx + 0x1f8]
mov qword [rsp + 0x30], rsi
lea rsi, [rdi + rcx*8]
cmp rdi, rsi
je 0x140036494
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax]
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
cmp rdi, rsi
jne 0x140036479
mov rsi, qword [rsp + 0x30]
sub dword [rbx + 0x22c], 1
mov rdi, qword [rsp + 0x38]
jne 0x140036517
mov qword [rbx + 0x218], 0x1b618e74
sub qword [rbx + 0x218], 0x181c8460
sub qword [rbx + 0x218], 0x3450a14
mov eax, 0x55b7d822
xor eax, 0x4621dec
add eax, 0xae2a3a31
lock xadd dword [rbx + 0x228], eax
dec eax
cmp eax, 0xffffffff
je 0x14003651e
mov rcx, qword [rbx + 0x220]
xor edx, edx
nop
sub rsp, 0x1d4eb890
add rsp, 0x1d4eb8b0
pop rbx
jmp fcn.140053f20
inc dword [rcx + 0x22c]
jmp 0x140036450
lock dec dword [rbx + 0x228]
nop
sub rsp, 0x71311d8
add rsp, 0x71311f8
pop rbx
ret
Function at 0x14003f620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14000ed40
mov edi, 0x2e1c3faa
xor edi, 0xb663624
xor edi, 0x54c256e3
mov r9, rax
mov ecx, edi
mov r15d, 0x6d99f8bf
xor r15d, 0x23ea0753
sub r15d, 0x4e73feed
test rbp, rbp
je 0x14003f6df
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14003f6be
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x14003f72a
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x14003f72a
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x14003f70a
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff43f3cbf3
xor rdx, 0x7f336c08
add rdx, 0x7fffffff
add rdx, 0x433f5805
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14003f767
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14000ed40
cmp qword [r14 + 0x38], rbx
jbe 0x14003f7b3
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x14003f78f
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14003f7eb
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x6d69a237
xor ecx, 0x63256bd2
xor ecx, 0x64570388
sub ecx, 0x6a1bca3d
rep stosb byte [rdi], al
jmp 0x14003f7f0
call fcn.1400966a0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140047ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
add rsp, 0x27ca8d80
sub rsp, 0x27ca8da0
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14004802b
mov rdi, qword [rcx + 0x640]
jmp 0x140048032
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14004804b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14004804e
mov rcx, rsi
cmp rdi, rcx
je 0x14004828c
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x14004806d
add rdi, 8
jmp 0x140048032
test r8, r8
je 0x14004813f
cmp rdi, qword [rbx + 0x640]
jb 0x14004813f
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14004813f
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1400480c4
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1400480c7
mov rax, rsi
nop
add rax, 0xffffffff9c30c571
sub rax, 0xffffffff9c30c579
cmp rdx, rax
jae 0x1400480f8
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x15d11301
sub rdx, 0x15d112f9
jmp 0x1400480a4
test rcx, rcx
je 0x14004813f
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14004813f
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140048131
call fcn.1400966a0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140048167
mov rax, qword [rcx]
mov edx, 0x252d1495
add edx, 0x17c924e5
xor edx, 0x6aed2d3a
xor edx, 0x561b1441
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14004828c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140038c30
mov rcx, qword [rsp + 0x30]
mov r10d, 0x6a5ab4d7
sub r10d, 0x5bf68b08
xor r10d, 0x18af68c7
sub r10d, 0x16cb4068
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140048244
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140048244
mov r9d, r10d
xor r9d, 0x7e4c2a49
xor r8d, 0x7e4c2a49
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x7e4c2a49
add esi, r10d
nop
add rdx, 0x2e5de651
sub rdx, 0x2e5de649
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x1a5f3fbb
add dword [rcx + 0x34], 0x1b07817
xor dword [rcx + 0x34], 0x62439d9b
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x1400481f5
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140048284
sub ecx, r8d
mov dword [rax + 0x14], 0x2868134b
xor dword [rax + 0x14], 0x5aa33
add dword [rax + 0x14], 0x55de70d1
xor ecx, 0x7e4c2a49
xor r8d, 0x7e4c2a49
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.140037c40
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret
Function at 0x1400482b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
nop
add rsp, 0x41b82ee6
sub rsp, 0x41b82f06
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140038510
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140047ea0
mov rcx, rbx
nop
add rsp, 0x3fe6bfa3
sub rsp, 0x3fe6bf83
pop rbx
jmp 0x1400482b0
push rbx
nop
sub rsp, 0x9b4e731
add rsp, 0x9b4e711
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1400483ec
lea rdx, [rsp + 0x30]
call fcn.140038c30
mov r8, qword [rsp + 0x30]
mov r11d, 0x101efcef
sub r11d, 0x94401ab
sub r11d, 0x6dafaa4
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1400483a2
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x14004839d
mov r8d, r11d
xor r8d, 0x7e4c2a49
xor r9d, 0x7e4c2a49
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x7e4c2a49
add r10d, r11d
neg rax
add rax, 0xfffffffffffffff8
neg rax
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x42e37e7e
sub dword [rdx + 0x34], 0x2d8e55a9
add dword [rdx + 0x34], 0x68f70174
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140048351
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1400483e4
sub r8d, r9d
mov dword [rax + 0x14], 0x3881bf4a
add dword [rax + 0x14], 0x21e1022f
add dword [rax + 0x14], 0x23e968d0
xor r8d, 0x7e4c2a49
xor r9d, 0x7e4c2a49
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.140037c40
sub rsp, 0xffffffffffffffe0
pop rbx
ret

Function at 0x140051ff0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x7dbcfcec
add rsp, 0x7dbcfccc
xchg rcx, rbx
mov rcx, rdx
xchg rbx, rcx
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
nop
movabs rdx, 0xffffffff3074a071
xor rdx, 0x50651709
sub rdx, 0x459ffe4a
sub rdx, 0x4273db8
add rdx, 0x7fffffff
add rdx, 0x69b5848a
nop word [rax + rax]
xchg r15, r15
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140052060
mov qword [rcx + 0x38], rdx
xchg rdi, rdi
call fcn.14000ed40
xor r8d, r8d
mov edx, 0x1c52ba00
add edx, 0x3de71c17
sub edx, 0xab3dd8e
xor edx, 0x305864ef
xor edx, 0xe65c30b
cmp qword [rdi + 0x38], r8
jbe 0x1400520fd
mov dword [rsp - 0x10], 0x2142f988
sub rbx, rax
mov r9d, 0x7cab829b
sub r9d, 0x12f8c1b4
sub r9d, 0x5977ffc7
sub r9d, 0x103ac021
nop word [rax + rax]
xchg r13, r13
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
ror edx, 8
mov rbx, rbx
xor cx, word [rbx + rax - 2]
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
mov rbp, rbp
jb 0x1400520d3
mov rbx, qword [rsp + 0x30]
xchg rsp, rax
mov rsp, rdi
xchg rsp, rax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140052a80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffe0
mov rdi, rdi
mov rsi, qword [rcx + 0x38]
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
xchg rbx, r8
mov rbx, qword [rdx + 0x38]
xchg rbx, r8
xchg rsp, rdi
mov rsp, rcx
xchg rsp, rdi
add r8, rsi
mov dword [rsp - 0x1c], ebp
xchg rbp, rsi
mov rdx, rbp
xchg rsi, rbp
mov qword [rcx + 0x38], r8
mov dword [rsp - 0x38], 0xf060757
call fcn.140053730
mov r9, qword [rbx]
mov ecx, esi
mov dword [rsp - 0x34], ebx
and ecx, 3
mov r8d, 0x50dcb44d
xor r8d, 0x2548f679
xor r8d, 0x19a4f9f0
add r8d, 0x587a3a9
shl ecx, 3
mov edx, r8d
xchg r13, r13
ror edx, cl
mov r10, rax
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov r13, r13
jbe 0x140052b98
lea rax, [rsi + rsi]
mov r11d, 0x57d7336c
add r11d, 0x139446f1
sub r11d, 0x4cf5889b
add r11d, 0x10991a4a
sub r11d, 0x2f0f0b0d
sub rax, r9
add r10, rax
xchg rsi, rsi
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
xchg r8, r8
xor ax, r8w
ror edx, 3
ror edx, 2
ror edx, 2
ror edx, 1
and ax, r11w
xchg rcx, rcx
ror r8d, 8
xor ax, word [r9 - 2]
inc rcx
mov dword [rsp - 0x44], esi
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140052b58
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
mov rax, rdi
mov dword [rsp - 0x24], ebx
xchg rbp, rsi
mov rbp, qword [rsp + 0x38]
xchg rbp, rsi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140052bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp - 0x34], ecx
nop
mov qword [rsp - 8], r14
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r14, qword [rcx + 0x38]
xchg r13, r13
mov rdi, rdx
xchg rsi, r12
mov r12, rcx
xchg rsi, r12
nop
movabs rbx, 0xffffffff1e6cc956
xor rbx, 0x1bedacae
add rbx, 0x3a09a98f
xor rbx, 0x11172fde
add rbx, 0x7fffffff
xor rbx, 0x5163dfa7
inc rbx
cmp word [rdx + rbx*2], 0
mov dword [rsp - 0x40], 0x772c6e7
jne 0x140052c38
lea r8, [r14 + rbx]
xchg rdx, r14
mov r14, rdx
xchg r14, rdx
xchg r8, rsp
mov qword [rcx + 0x38], rsp
xchg r8, rsp
call fcn.140053730
mov dword [rsp - 0x34], ebp
mov ecx, r14d
mov edx, 0x5d1f132d
add edx, 0x952b28f
sub edx, 0x1628e3f9
xor edx, 0x21f0beae
and ecx, 3
mov dword [rsp - 0x18], ebx
shl ecx, 1
shl ecx, 2
ror edx, cl
test rbx, rbx
xchg r9, r9
je 0x140052d04
lea r8, [r14 + r14]
mov ecx, 0xa25cf30
sub ecx, 0x4d94cde
add ecx, 0x4a3ce866
xor ecx, 0x232fe413
sub ecx, 0x6ca68dac
sub r8, rdi
mov rdx, rdx
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov dword [rsp - 0x1c], esp
lea rdi, [rdi + 2]
and ax, cx
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
xchg r9, r9
sub rbx, 1
jne 0x140052cd8
mov rbx, qword [rsp + 0x30]
xchg rdx, rax
mov rdx, rsi
xchg rdx, rax
xchg rsi, rdi
mov rdi, qword [rsp + 0x38]
xchg rdi, rsi
xchg rdi, rcx
mov rcx, qword [rsp + 0x40]
xchg rcx, rdi
add rsp, 0x20
mov dword [rsp - 0x20], 0x1b2d627
pop r14
ret