joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016610
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400166b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001666a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140023140
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400030d0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140095948]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400166bf
mov rcx, rbx
call fcn.1400030d0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140016b00
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140016b52
lea r11, [0x140047e00]
cmp r9b, 0x23
jne 0x140016b35
cmp byte [r8], r9b
jne 0x140016b35
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016b22
mov r11, qword [0x140095950]
xor r9d, r9d
mov r10, qword [r11 + 0x3228]
test r10, r10
lea rcx, [r10 + 4]
cmovne r9, rcx
test r9, r9
je 0x140016b9e
not eax
cmp dword [r9], eax
je 0x140016ba7
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140016b75
mov rcx, rbx
pop rbx
jmp fcn.140016a10
mov rax, r9
pop rbx
ret
Function at 0x14001a040
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001a27e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140095040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140047e00]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001a246
mov rcx, rbp
call fcn.140019720
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001a111
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001a101
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001a0f9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001a0fc
mov rdx, rcx
test rdx, rdx
jne 0x14001a0d0
cmp r8, r10
je 0x14001a111
cmp dword [r8], r9d
jne 0x14001a111
mov rcx, qword [r8 + 8]
jmp 0x14001a113
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001a1a7
cmp qword [rcx + 0x18], 0
jne 0x14001a19c
mov qword [rcx + 0x18], rbx
jmp 0x14001a1a7
cmp qword [rcx + 0x20], 0
jne 0x14001a1a7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001a1dc
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001a1d0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.1400027b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001a238
cmp r9b, 0x23
jne 0x14001a21b
cmp byte [r8], r9b
jne 0x14001a21b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001a208
not ecx
call fcn.14000a9f0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001a090
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140044bd0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140045840
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004588a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004588a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004588a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004588a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004588a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004588c
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140009008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140009008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x14001960e
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, r10
mov qword [rsp + 0x18], r10
xchg rsi, r10
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
xchg rdi, rdi
lea rax, [rcx + 8]
xchg r13, rbx
mov qword [rsp + 0x70], r13
xchg r13, rbx
mov qword [rcx], rax
xchg r8, r8
xorps xmm0, xmm0
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg rdi, rcx
mov rsi, rdi
xchg rcx, rdi
xchg rbp, rdi
mov qword [rsp + 0x78], rdi
xchg rdi, rbp
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x28], 0x31a8b3cd
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
movups xmmword [rax + 0x30], xmm0
xchg r13, rax
movups xmmword [r13 + 0x40], xmm0
xchg r13, rax
movups xmmword [rax + 0x50], xmm0
mov dword [rsp - 0x30], 0xc961d05
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
xchg rbp, r15
mov r15, qword [rdx + 0x38]
xchg rbp, r15
lea rax, [rsp + 0x28]
mov r11, r11
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
xchg r11, rsp
movups xmmword [r11 + 0x28], xmm0
xchg r11, rsp
lea rdx, [rbp + 1]
mov dword [rsp - 0x40], ecx
xchg rsp, r13
movups xmmword [r13 + 0x38], xmm0
xchg rsp, r13
xchg rsp, rdi
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.14000ed90
xchg rbp, rbp
mov edx, 0x4915a51
xor edx, 0x466761eb
add edx, 0x33ef2e87
xor edx, 0x642676ce
test rbp, rbp
je 0x140019771
xchg rsp, rsp
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
sub rbx, rax
xchg rbp, r12
mov r9, r12
xchg rbp, r12
mov r8d, 0x1650a342
add r8d, 0x6082d016
xor r8d, 0x5698d476
add r8d, 0x2911154d
sub r8d, 0x495cbb7c
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg r14, r14
and cx, r8w
ror edx, 2
ror edx, 1
ror edx, 2
ror edx, 2
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov dword [rsp - 0x10], 0x379b4bc0
mov word [rdi - 2], cx
sub r9, 1
jne 0x14001973b
xor ecx, ecx
xchg rsp, rsp
xchg rbp, r8
mov rbp, r8
xchg rbp, r8
mov word [rax + rbp*2], cx
mov r8, r8
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
mov rdx, qword [rsp + 0x20]
mov rsp, rsp
call fcn.1400729c0
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
xchg r12, r12
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x140019808
xor eax, eax
mov dword [rsp - 0x18], 0x62da76b7
lea rdi, [rsp + 0x28]
mov ecx, 0x6f58bd6d
xor ecx, 0x754e9101
add ecx, 0x2eda8817
sub ecx, 0x48f0b453
rep stosb byte [rdi], al
xchg r15, rax
mov r15, rsi
xchg r15, rax
xchg rcx, rsi
mov rcx, qword [rsp + 0x80]
xchg rsi, rcx
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098620
mov rax, rsi
mov dword [rsp - 0x14], esi
xchg r14, rsi
mov r14, qword [rsp + 0x80]
xchg r14, rsi
nop
add rsp, 0x4765ac7c
sub rsp, 0x4765ac1c
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140032220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
add rsp, 0x3cece1bf
sub rsp, 0x3cece1ef
mov dword [rcx + 8], 0x5b39fc84
sub dword [rcx + 8], 0x34791c0a
xor dword [rcx + 8], 0x444236dc
xor dword [rcx + 8], 0x6282d6a7
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ed90
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x1400322ce
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x1400322b4
mov ecx, dword [rbx + 0x40]
mov esi, 0x16fcd162
xor esi, 0x17a9953
xor esi, 0x392e03a4
xor esi, 0x2ea8b46a
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x43a88288
sub edx, 0x16aedcf2
xor edx, 0x74e5e21c
xor edx, 0x581c479a
mov eax, dword [rbx + 0x54]
xor eax, 0x35cb7a53
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x35cb7a53
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x35cb7a53
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x35cb7a53
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x760f0615
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x35cb7a53
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x19e762df
add eax, 0x2c5fe8a3
sub eax, 0x2c1a8d78
xor eax, 0x1a2cbef5
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.140098550
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a3550]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x1400323af
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rdx + rax - 0x10]
xor ecx, 0x760f0615
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rdx + rax - 0xc]
xor ecx, 0x760f0615
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rdx + rax - 8]
xor ecx, 0x760f0615
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rdx + rax - 4]
xor ecx, 0x760f0615
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a3550]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x1400323d3
lea rcx, [r14 + 0xa8]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.140011fa0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140034440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
add rsp, 0x4074edc4
sub rsp, 0x4074ee04
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x35cb7a53
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x35cb7a53
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x760f0615
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.140054190
test ax, ax
je 0x140034509
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404a3550]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.140054190
test ax, ax
jne 0x1400344bf
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140034530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x35cb7a53
xor r9d, 0x35cb7a53
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x760f0615
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x1400345bd
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a3550]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x140034584
mov eax, r8d
ret

Function at 0x1400345d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x35cb7a53
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x35cb7a53
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x760f0615
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.140054190
test ax, ax
je 0x14003468e
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404a3550]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.140054190
test ax, ax
jne 0x140034644
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400346b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x35cb7a53
xor r9d, 0x35cb7a53
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x760f0615
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x140034746
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a3550]
movzx eax, ax
neg rdx
add rdx, 0xfffffffffffffffe
neg rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x140034705
mov eax, r8d
ret

Function at 0x1400347eb
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x140034893
mov edx, dword [rcx + 0x2ec]
mov qword [rax + 0x10], rsi
xor edx, 0x35cb7a53
mov eax, dword [rcx + 0x2e8]
nop
movabs rcx, 0xffffffff30049faa
xor rcx, 0x1363cc34
add rcx, 0x7fffffff
add rcx, 0x5c98ac62
xor eax, 0x35cb7a53
imul edx, eax
mov eax, 0x79253f67
sub eax, 0x47b22acc
xor eax, 0x3173149f
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400984e0
mov qword [rsp + 0xb0], rax
test rsi, rsi
jle 0x140034814
nop
mov rax, qword [rdi + 0x2f8]
mov ecx, dword [rax + rbx*4]
mov rax, qword [rsp + 0xb0]
xor ecx, 0x56362ae
mov dword [rax + rbx*4], ecx
inc rbx
cmp rbx, rsi
jl 0x1400347ed
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rdi + 0x318]
lea rax, [0x140001bb0]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x98], 0x1a06d3ae
add qword [rsp + 0x98], 0x417e545
xor qword [rsp + 0x98], 0x6b3379a1
sub qword [rsp + 0x98], 0x752dc13a
mov qword [rsp + 0x28], rdi
call fcn.140033720
mov rbx, qword [rsp + 0xc0]
add rsp, 0x5bbfe77c
sub rsp, 0x5bbfe6dc
pop rdi
ret
lea rdx, [rsp + 0xb0]
call fcn.1400348c0
test al, al
jne 0x14003481c
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
Function at 0x14003fd40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf8]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xac0]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14000ed90
mov edi, 0x18806416
xor edi, 0x7f906605
xor edi, 0xd3bbdfb
xor edi, 0x78e8a367
mov r9, rax
mov ecx, edi
mov r15d, 0x65db3b3d
xor r15d, 0x341f6169
sub r15d, 0x43a7931a
xor r15d, 0xe1cc7c5
test rbp, rbp
je 0x14003fe0c
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rdx + rbx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14003fdeb
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb48], bx
je 0x14003fe57
mov edx, ebx
cmp qword [rsi + 0xaf8], rbx
jbe 0x14003fe57
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb48]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf8]
jb 0x14003fe37
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff584abd2a
add rdx, 0x20f29546
sub rdx, 0x4f12ae50
add rdx, 0x7fffffff
add rdx, 0x55d55be0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14003fe9b
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14000ed90
cmp qword [r14 + 0x38], rbx
jbe 0x14003fee7
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rax + rsi - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x14003fec3
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14003ff19
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x684b7e2
xor ecx, 0x3ac25ebd
sub ecx, 0x3c46e92f
rep stosb byte [rdi], al
jmp 0x14003ff1e
call fcn.140098620
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140048b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffffe0
mov r8, qword [rcx + 0x650]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140048b60
mov rdi, qword [rcx + 0x648]
jmp 0x140048b67
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140048b80
mov rax, qword [rbx + 0x648]
lea rcx, [rax + r8*8]
jmp 0x140048b83
mov rcx, rsi
cmp rdi, rcx
je 0x140048db2
mov rax, qword [rdi]
cmp qword [rax + 0x30], rdx
je 0x140048ba2
sub rdi, 0xfffffffffffffff8
jmp 0x140048b67
test r8, r8
je 0x140048c69
cmp rdi, qword [rbx + 0x648]
jb 0x140048c69
mov rax, qword [rbx + 0x648]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140048c69
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x650]
test rcx, rcx
je 0x140048bf9
mov rax, qword [rbx + 0x648]
lea rax, [rax + rcx*8]
jmp 0x140048bfc
mov rax, rsi
nop
sub rax, 0xffffffff86a106cf
add rax, 0xffffffff86a106c7
cmp rdx, rax
jae 0x140048c22
mov rax, qword [rdx + 8]
mov qword [rdx], rax
add rdx, 8
jmp 0x140048bd9
test rcx, rcx
je 0x140048c69
lea rax, [rcx - 1]
mov qword [rbx + 0x650], rax
test rax, rax
jne 0x140048c69
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140048c5b
call fcn.140098620
mov qword [rbx + 0x648], rsi
mov qword [rbx + 0x658], rsi
mov qword [rbx + 0x650], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140048c91
mov rax, qword [rcx]
mov edx, 0xb1b863
xor edx, 0x5e96f820
sub edx, 0x143aa06f
sub edx, 0x49ec9fd3
call qword [rax]
cmp qword [rbx + 0x650], rsi
je 0x140048db2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140039290
mov rcx, qword [rsp + 0x30]
mov r10d, 0x77997448
sub r10d, 0x31bfbd34
add r10d, 0x2d097b23
sub r10d, 0x72e33197
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x650]
sub eax, r8d
cdq
idiv dword [rbx + 0x650]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140048d6a
mov rdx, qword [rbx + 0x648]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140048d6a
mov r9d, r10d
xor r9d, 0x35cb7a53
xor r8d, 0x35cb7a53
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x35cb7a53
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x38], eax
mov dword [rcx + 0x3c], 0x545ae751
add dword [rcx + 0x3c], 0x111fba6d
xor dword [rcx + 0x3c], 0xc54ce2
xor dword [rcx + 0x3c], 0x5074970f
mov dword [rcx + 0x40], r9d
mov dword [rcx + 0x44], r8d
cmp rdx, r11
jne 0x140048d1f
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x668]
test rax, rax
je 0x140048daa
sub ecx, r8d
mov dword [rax + 0x1c], 0x769d3a95
xor dword [rax + 0x1c], 0x586b6c00
add dword [rax + 0x1c], 0x6d523be
xor ecx, 0x35cb7a53
xor r8d, 0x35cb7a53
mov dword [rax + 0x18], ecx
mov dword [rax + 0x20], r8d
mov dword [rax + 0x24], r8d
mov rcx, rbx
call fcn.140038340
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret