joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c3a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x14018fc30]
mov rcx, rbx
test rdi, rdi
je 0x14002c3f5
cmp qword [0x14018fc30], 0
je 0x14002c3f5
mov rsi, qword [rdi + 8]
cmp qword [rcx + 8], rsi
jne 0x14002c3e8
mov rdx, qword [rdi + 0x10]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14014d595
test eax, eax
je 0x14002c407
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002c3cf
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x14002c3f7

Function at 0x14002d51c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
xor eax, eax
xorps xmm0, xmm0
lea r8, [r11 - 0x28]
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov rdi, r9
call fcn.140019008
test eax, eax
je 0x14002d558
add eax, 0xffffc580
jmp 0x14002d59d
cmp qword [0x14018fea0], 0
lea rbx, [0x14018fea0]
mov rcx, rbx
je 0x14002d598
mov rsi, qword [rsp + 0x28]
cmp qword [rcx + 8], rsi
jne 0x14002d58b
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14014d595
test eax, eax
je 0x14002d5b3
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002d571
mov eax, 0xffffc380
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rbx, rbx
je 0x14002d598
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
cmp eax, 1
jne 0x14002d5e4
cmp dword [rdi], 5
je 0x14002d5d4
cmp dword [rdi], 0
je 0x14002d5d4
mov eax, 0xffffc580
jmp 0x14002d59d
mov rax, qword [rdi + 8]
neg rax
sbb eax, eax
and eax, 0xffffc580
jmp 0x14002d59d
xor eax, eax
jmp 0x14002d59d
Function at 0x140031880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x470], rax
cmp dword [rcx + 0x148], 1
mov rsi, rcx
mov r12, qword [rsp + 0x4e8]
mov r9, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4f8]
jne 0x140031a8a
mov rbx, qword [rcx + 8]
lea rax, [rbx - 0x10]
cmp rax, 0x3f0
ja 0x140031a8a
lea rax, [0x14018ede0]
mov ecx, 1
cmp ecx, dword [rsi + 0x14c]
je 0x140031904
mov ecx, dword [rax + 0x10]
add rax, 0xc
test ecx, ecx
jne 0x1400318f1
movzx edi, byte [rax + 8]
test edi, edi
je 0x140031a8a
lea r14d, [rdi + rdi]
lea ecx, [r14 + 2]
cmp rcx, rbx
ja 0x140031a8a
lea rax, [rsp + 0x70]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140030d04
mov edx, eax
test eax, eax
jne 0x140031a6e
mov eax, dword [rsi + 0x14c]
lea rcx, [rsp + 0x71]
mov ebp, edi
mov dword [rsp + 0x20], eax
mov r15, rbx
mov edx, ebp
sub r15, rdi
lea rdi, [rsp + 0x71]
add rdi, rbp
mov r8, rdi
lea r9, [r15 - 1]
call fcn.14003137c
mov edx, eax
test eax, eax
jne 0x140031a6e
mov eax, dword [rsi + 0x14c]
lea r8, [rsp + 0x71]
mov r9d, ebp
mov dword [rsp + 0x20], eax
lea rdx, [r15 - 1]
mov rcx, rdi
call fcn.14003137c
mov edx, eax
test eax, eax
jne 0x140031a6e
mov ecx, dword [rsi + 0x14c]
call fcn.14002a7a4
test rax, rax
jne 0x1400319b6
mov edx, 0xffffbf80
jmp 0x140031a6e
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14002acdc
mov edx, eax
test eax, eax
jne 0x140031a6e
mov dl, byte [rsp + 0x70]
xor ecx, ecx
test rbp, rbp
je 0x1400319f0
mov al, byte [rsp + rcx + 0x30]
inc rcx
xor al, byte [rdi]
inc rdi
or dl, al
cmp rcx, rbp
jb 0x1400319dd
mov eax, r14d
mov r10, rbx
sub r10, rax
xor r9d, r9d
xor r8b, r8b
xor ecx, ecx
add r10, 0xfffffffffffffffe
je 0x140031a27
or r8b, byte [rcx + rdi]
inc rcx
mov al, r8b
neg al
or al, r8b
not al
movzx eax, al
shr rax, 7
add r9, rax
cmp rcx, r10
jb 0x140031a07
add rdi, r9
mov al, byte [rdi]
inc rdi
xor al, 1
or dl, al
je 0x140031a3c
mov edx, 0xffffbf00
jmp 0x140031a6e
sub rbx, rdi
lea r8, [rsp + 0x70]
add r8, rbx
cmp r8, qword [rsp + 0x500]
jbe 0x140031a58
mov edx, 0xffffbc00
jmp 0x140031a6e
mov qword [r12], r8
test r8, r8
je 0x140031a6c
mov rdx, rdi
mov rcx, r13
call fcn.14014d59b
xor edx, edx
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x400
rep stosb byte [rdi], al
lea ecx, [rax + 0x40]
lea rdi, [rsp + 0x30]
rep stosb byte [rdi], al
mov eax, edx
jmp 0x140031a8f
mov eax, 0xffffbf80
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140034a94
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov esi, edx
mov r14, rcx
cmp edx, 1
jbe 0x140034abb
mov eax, 0xffffff8c
jmp 0x140034b84
and dword [rcx], 0
mov eax, esi
and dword [rcx + 4], 0
neg eax
mov eax, esi
sbb edi, edi
and edi, 0x7b152682
add edi, 0xbb67ae85
neg eax
mov eax, esi
sbb ebx, ebx
and ebx, 0xf401e9a5
add ebx, 0x3c6ef372
neg eax
mov eax, esi
sbb r11d, r11d
and r11d, 0x51be63ff
add r11d, 0xa54ff53a
neg eax
mov eax, esi
sbb r10d, r10d
and r10d, 0xaeb1b8b2
add r10d, 0x510e527f
neg eax
mov eax, esi
sbb r9d, r9d
and r9d, 0x4575b5fc
add r9d, 0x1f83d9ab
neg eax
mov eax, esi
sbb r8d, r8d
and r8d, 0xcd52ac85
add r8d, 0x9b05688c
neg eax
mov eax, esi
sbb edx, edx
and edx, 0x6319828b
add edx, 0x5be0cd19
neg eax
sbb ecx, ecx
and ecx, 0x56fbb871
add ecx, 0x6a09e667
mov dword [r14 + 8], ecx
xor eax, eax
mov dword [r14 + 0xc], edi
mov dword [r14 + 0x10], ebx
mov dword [r14 + 0x14], r11d
mov dword [r14 + 0x18], r10d
mov dword [r14 + 0x1c], r8d
mov dword [r14 + 0x20], r9d
mov dword [r14 + 0x24], edx
mov dword [r14 + 0x68], esi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret

Function at 0x140035a70
Capabilities:
Hash data using sha512

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov esi, edx
mov rbp, rcx
cmp edx, 1
jbe 0x140035a97
mov eax, 0xffffff8b
jmp 0x140035bcd
mov eax, esi
xorps xmm0, xmm0
neg eax
movups xmmword [rcx], xmm0
sbb rdi, rdi
movabs rax, 0xa7327aa4b1b22dcc
and rdi, rax
movabs rax, 0xbb67ae8584caa73b
add rdi, rax
mov eax, esi
neg eax
movabs rax, 0x54ea0de731dbe4ec
sbb rbx, rbx
and rbx, rax
movabs rax, 0x3c6ef372fe94f82b
add rbx, rax
mov eax, esi
neg eax
movabs rax, 0x6fdff79e97f12248
sbb r11, r11
and r11, rax
movabs rax, 0xa54ff53a5f1d36f1
add r11, rax
mov eax, esi
neg eax
movabs rax, 0x1624d3e851d98860
sbb r10, r10
and r10, rax
movabs rax, 0x510e527fade682d1
add r10, rax
mov eax, esi
neg eax
movabs rax, 0xebd47b04ab7c2e2b
sbb r9, r9
and r9, rax
movabs rax, 0x5be0cd19137e2179
add r9, rax
mov eax, esi
neg eax
movabs rax, 0xbb88546169b7d23c
sbb r8, r8
and r8, rax
movabs rax, 0x1f83d9abfb41bd6b
add r8, rax
mov eax, esi
neg eax
movabs rax, 0xf3aee1fb3d19a8f2
sbb rdx, rdx
and rdx, rax
movabs rax, 0x9b05688c2b3e6c1f
add rdx, rax
mov eax, esi
neg eax
movabs rax, 0x61b1b6f5cd48d5d0
sbb rcx, rcx
and rcx, rax
movabs rax, 0x6a09e667f3bcc908
add rcx, rax
mov qword [rbp + 0x10], rcx
xor eax, eax
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], r11
mov qword [rbp + 0x30], r10
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], r9
mov dword [rbp + 0xd0], esi
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400553c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movdqa xmm0, xmmword [0x1402343f0]
mov rbx, rdx
movdqa xmm1, xmmword [0x140234780]
xor edx, edx
mov ecx, edx
mov word [rsp + 0x50], 0x100
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
lea eax, [rcx - 0x4c]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x20
jb 0x14005541d
xorps xmm0, xmm0
mov byte [rsp + 0x51], dl
xorps xmm1, xmm1
lea rax, [rsp + 0x30]
movups xmmword [rbp + 0x80], xmm0
or r8, 0xffffffffffffffff
movdqu xmmword [rbp + 0x90], xmm1
inc r8
cmp byte [rax + r8], dl
jne 0x14005544f
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x80]
call fcn.1400129ec
mov rdx, qword [rbp + 0x98]
lea rax, [rbp + 0x80]
mov rcx, qword [rbp + 0x80]
cmp rdx, 0x10
cmovae rax, rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm1
jb 0x1400554cd
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400554c8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400554c8
call fcn.140a43e09
int3
call fcn.14014b8b4
mov rax, qword [0x14026f948]
lea rdx, [rbp + 0xa0]
mov r8d, 0x100
lea rcx, [rsp + 0x60]
movups xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x80], xmm0
call fcn.1400161d8
mov edi, dword [rbx + 0x54]
lea r9, [rbp + 0x80]
mov rdx, qword [rbx + 0x70]
mov rcx, qword [0x14026f948]
add rdx, 0xfffffffffffffff0
mov r8d, dword [rbx + 0x58]
add rdx, rdi
add rcx, rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
sub r8d, edi
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140017040
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x120
movabs rdx, 0x7ff000000
xor qword [rbx + 0x70], rdx
rep stosb byte [rdi], al
mov rcx, qword [0x14026f948]
cmp rcx, qword [0x14026f950]
je 0x140055565
mov qword [0x14026f950], rcx
mov al, 1
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14014b850
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140056078
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov r8d, 6
cmp byte [r9 + 7], 0
je 0x1400560b8
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [r9 + rcx], al
inc rcx
cmp rcx, r8
jb 0x1400560a4
mov byte [r9 + 7], 0
lea rax, [r9 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
cmp r9, rax
jne 0x1400560e7
movdqa xmm0, xmmword [0x140233e70]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
jmp 0x1400560f5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14005e350
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140056103
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14005b600
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140056180
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005617b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005617b
call 0x14081a8e4
int3
call fcn.14014b8b4
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140056320
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 3], r8b
je 0x140056350
mov ecx, r8d
lea eax, [rcx - 0x4c]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 2
jb 0x14005633d
mov byte [rdx + 3], r8b
xorps xmm0, xmm0
lea rax, [rdx + 2]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x140056378
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x140056386
mov r8d, 2
mov rcx, rbx
call fcn.14005e350
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140056390
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 4], r8b
je 0x1400563c0
mov ecx, r8d
lea eax, [rcx - 0x4c]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 3
jb 0x1400563ad
mov byte [rdx + 4], r8b
xorps xmm0, xmm0
lea rax, [rdx + 3]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400563e8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x1400563f6
mov r8d, 3
mov rcx, rbx
call fcn.14005e350
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140056400
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 6], r8b
je 0x140056430
mov ecx, r8d
lea eax, [rcx - 0x4c]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 5
jb 0x14005641d
mov byte [rdx + 6], r8b
xorps xmm0, xmm0
lea rax, [rdx + 5]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x140056458
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x140056466
mov r8d, 5
mov rcx, rbx
call fcn.14005e350
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140056470
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 5], r8b
je 0x1400564a0
mov ecx, r8d
lea eax, [rcx - 0x4c]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x14005648d
mov byte [rdx + 5], r8b
xorps xmm0, xmm0
lea rax, [rdx + 4]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400564c8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x1400564d6
mov r8d, 4
mov rcx, rbx
call fcn.14005e350
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140058cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0x11
cmp byte [rdi + 0x12], 0
je 0x140058d3a
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x140058d28
mov byte [rdi + 0x12], 0
lea rax, [rdi + 0x11]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x140058d60
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140058d6c
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140059150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xe
cmp byte [rdi + 0xf], 0
je 0x1400591da
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x1400591c8
mov byte [rdi + 0xf], 0
lea rax, [rdi + 0xe]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x140059200
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14005920c
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140059230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0x10
cmp byte [rdi + 0x11], 0
je 0x1400592ba
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x1400592a8
mov byte [rdi + 0x11], 0
lea rax, [rdi + 0x10]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x1400592e0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x1400592ec
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140073764
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
test rdx, rdx
jne 0x14007378c
xor eax, eax
jmp 0x1400737d1
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov edi, dword [rbp + rdx + 0x20]
mov esi, dword [rbp + rdx + 0x24]
add rdi, rbx
add rsi, rbx
jmp 0x1400737af
lea rdi, [rdi + 4]
add rsi, 2
mov ecx, dword [rdi]
mov rdx, r14
add rcx, rbx
push rcx
call 0x1403dcbb9
test eax, eax
jne 0x1400737a7
mov ecx, dword [rbp + rbx + 0x1c]
movzx edx, word [rsi]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400779d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140077a0f
mov edx, esi
mov eax, 0x10c3
add eax, edx
xor word [r8 + rdx*2], ax
inc rdx
cmp rdx, 4
jb 0x1400779f6
mov byte [r8 + 0xa], sil
add r8, 8
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14007f3e4
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140077a2f
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14006b518
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0x28]
call fcn.1400109fc
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14007e7f4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 7], r8b
je 0x14007e824
mov ecx, r8d
lea eax, [rcx - 0x4c]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x14007e811
mov byte [rdx + 7], r8b
xorps xmm0, xmm0
lea rax, [rdx + 6]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x14007e84c
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14007e85a
mov r8d, 6
mov rcx, rbx
call fcn.14005e350
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14007f104
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xc
cmp byte [rdi + 0xd], 0
je 0x14007f18e
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x14007f17c
mov byte [rdi + 0xd], 0
lea rax, [rdi + 0xc]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x14007f1b4
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14007f1c0
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x14007f1e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xd
cmp byte [rdi + 0xe], 0
je 0x14007f26e
xor ecx, ecx
lea eax, [rcx - 0x4c]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x14007f25c
mov byte [rdi + 0xe], 0
lea rax, [rdi + 0xd]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x14007f294
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14007f2a0
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14007f2c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140058420
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.14014b870
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 9
cmp byte [rdi + 0xa], 0
je 0x14007f34e
xor ecx, ecx
lea eax, [rcx - 0x3d]
xor byte [rcx + rdi], al
inc rcx
cmp rcx, r8
jb 0x14007f33c
mov byte [rdi + 0xa], 0
lea rax, [rdi + 9]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x14007f374
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14007f380
mov rdx, rdi
mov rcx, rbx
call fcn.14005e350
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret