joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e6820
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
call fcn.1401e6c70
mov qword [rbp - 0x20], rdi
mov edx, edi
mov rax, qword [rsi + 0x168]
mov rcx, qword [rsi + 0x170]
sub rcx, rax
sar rcx, 1
cmp rcx, rdx
mov qword [rbp - 0x28], rdx
jbe 0x1401e687a
movzx r12d, word [rax + rdx*2]
test r12w, r12w
je 0x1401e687a
xor r14d, r14d
jmp 0x1401e6880
mov r14b, 1
xor r12d, r12d
lea rax, [rsi + 0x168]
mov qword [rbp - 0x10], rax
lea rax, [0x1403c2fd4]
movsxd rdi, dword [0x1403c2fd4]
mov r15, rdi
xor r15, rax
and rdi, rax
add rdi, rdi
mov ebx, dword [0x1403c2fd0]
mov rcx, rsi
call fcn.1401e6d60
mov dword [rbp - 4], r12d
add r15, rdi
mov r12d, dword [0x1404aa010]
lea r13d, [r12 + 1]
mov dword [0x1404aa010], r13d
test r12d, r13d
je 0x1401e68d6
xor edi, edi
jmp 0x1401e690c
xor eax, eax
mov edi, 0
test ebx, ebx
jle 0x1401e690c
xor ecx, ecx
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov edi, edx
xor edi, edx
not edi
and edi, ecx
xor edi, edx
add eax, 2
mov ecx, edi
cmp eax, ebx
jl 0x1401e68f0
test r14b, r14b
mov rbx, qword [rbp - 0x28]
je 0x1401e6a24
mov qword [rbp - 0x18], rsi
mov rcx, rsi
call fcn.1401e6b10
mov rcx, qword [rsi + 0x168]
mov r14, qword [rsi + 0x170]
mov rax, r14
sub rax, rcx
sar rax, 1
cmp rax, rbx
seta dl
movzx r8d, byte [0x1404eec72]
test r8b, dl
jne 0x1401e6972
xor r8b, dl
jne 0x1401e6972
mov word [rbp - 6], 0
mov rdx, qword [rbp - 0x20]
inc edx
cmp rax, rdx
jbe 0x1401e6984
lea rax, [rcx + rdx*2]
mov qword [rsi + 0x170], rax
jmp 0x1401e69ce
movzx eax, word [rcx + rbx*2]
mov dword [rbp - 4], eax
test ax, ax
jne 0x1401e6a1b
jmp 0x1401e69ce
jae 0x1401e69ce
cmp byte [0x1404ee448], 0
jne 0x1401e69c1
mov r8, rdx
mov rdx, qword [rsi + 0x178]
sub rdx, rcx
sar rdx, 1
cmp rdx, r8
mov rdx, r8
jb 0x1401e69c1
sub rdx, rax
lea r8, [rdx + rdx]
mov rcx, r14
mov r15, rdx
xor edx, edx
call fcn.14039e9a0
lea rax, [r14 + r15*2]
jmp 0x1401e6969
lea r8, [rbp - 6]
mov rcx, qword [rbp - 0x10]
call fcn.1401e6e60
and r12d, r13d
movzx eax, word [0x1403c2fdc]
xor ecx, ecx
cmp r12d, 1
sbb ecx, ecx
sub eax, edi
mov edx, eax
xor edx, ecx
not edx
test dx, ax
setne al
or al, byte [0x1404eec72]
and al, 1
mov byte [0x1404eec72], al
add rsi, 0xe8
mov rcx, rsi
call fcn.1401eae90
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov dword [rbp - 4], ecx
mov word [rax + rbx*2], cx
lea rcx, [rbp - 0x18]
call fcn.1401e6750
mov eax, dword [rbp - 4]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401fdb40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x1401fdbc3
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov r8, qword [case.0x14014757d.0]
mov qword [rbp - 0x10], 0
lea rdx, [rbp - 8]
call r8
mov r13, qword [rbp - 8]
test r13, r13
je 0x1401fdbc6
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov qword [rbp - 0x18], r13
mov rcx, r13
call qword [case.0x14014757d.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
mov r13, qword [rbp - 0x18]
je 0x1401fdbc6
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14014757d.0]
jmp 0x1401fdbc6
xor r13d, r13d
mov rax, qword [rdi + 0x18]
mov r15, qword [0x1404ac6b8]
movsxd r12, dword [r15]
mov ebx, dword [0x1403c4bd4]
mov qword [rsi + 0x18], rax
mov eax, dword [0x1404ef47c]
add eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1401fdc15
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov rdx, qword [case.0x14014757d.0]
mov qword [rbp - 0x10], r13
call rdx
mov qword [rsi + 8], r13
mov eax, dword [0x1404ef3d8]
lea esi, [rax + 1]
mov dword [0x1404ef3d8], esi
mov ecx, eax
not ecx
xor eax, esi
not esi
and esi, ecx
or esi, eax
xor edi, edi
xor esi, 0xffffffff
mov r14d, 0
jne 0x1401fdca7
mov rax, r12
xor rax, r15
and r12, r15
lea rax, [rax + r12*2]
xor ecx, ecx
mov edi, 0
mov r14d, 0
test ebx, ebx
jle 0x1401fdca7
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
movsxd rcx, ecx
mov r9, qword [rax + rcx]
mov r10, qword [rax + rcx + 8]
mov rdi, r9
xor rdi, r9
mov r14, r10
xor r14, r10
not r14
and r14, r8
xor r14, r10
not rdi
and rdi, rdx
xor rdi, r9
add ecx, 0x10
mov rdx, rdi
mov r8, r14
cmp ecx, ebx
jl 0x1401fdc70
test r13, r13
je 0x1401fdcd5
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov rdx, qword [case.0x14014757d.0]
mov qword [rbp - 0x10], r13
mov rcx, r13
call rdx
mov rax, qword [r13]
mov rax, qword [rax + 0x20]
mov rcx, r13
call qword [case.0x14014757d.0]
mov rcx, qword [0x1403c4be8]
xor edx, edx
test esi, esi
setne dl
xor r8d, r8d
add rdx, 0xffffffffffffffff
adc r8, 0xffffffffffffffff
mov rax, qword [0x1403c4be0]
sub rax, rdi
sbb rcx, r14
and rcx, r8
and rax, rdx
or rax, rcx
mov rcx, rax
shr rcx, 0x20
or ecx, eax
add dword [0x1404ef47c], ecx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1402019c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, qword [0x1404acd18]
movsxd r14, dword [r12]
mov rdi, rdx
mov rbx, rcx
mov r15d, dword [0x1403c5a1c]
mov eax, 0xffff9d1a
add eax, dword [0x1404acda0]
cdqe
add rax, qword [0x1404acdc8]
lea rdx, [rbp - 0x40]
mov rcx, r8
mov r8d, 0xafc2dd8b
call qword [case.0x14014757d.0]
test rdi, rdi
sete al
setne cl
test dil, 0xf
setne dl
sete r8b
xor r8b, cl
and dl, al
or dl, r8b
mov esi, 0xffffffff
cmp dl, 1
je 0x140201a84
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x40]
call fcn.1401d2c80
lea rcx, [rbp - 0x18]
mov rdx, rbx
mov r8, rdi
call fcn.1402a4530
mov qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov rcx, rbx
mov rdx, rdi
call fcn.1402868f0
mov ecx, dword [0x1404ee6f8]
add ecx, dword [rbp - 0x10]
xor esi, esi
neg eax
sbb esi, esi
or esi, ecx
mov rdi, qword [rbp - 0x38]
mov eax, dword [0x1404acd10]
mov ecx, eax
xor ecx, 1
mov edx, eax
and edx, 1
lea edx, [rcx + rdx*2]
mov dword [0x1404acd10], edx
xor ecx, ecx
test eax, edx
jne 0x140201ad2
add r14, r12
test r15d, r15d
jle 0x140201ad2
xor r8d, r8d
xor ecx, ecx
nop word cs:[rax + rax]
movsxd r9, r8d
add r9, r14
xor ecx, dword [r9]
add r8d, 4
cmp r8d, r15d
jl 0x140201ac0
test rdi, rdi
je 0x140201b63
mov rbx, qword [rbp - 0x28]
and eax, edx
mov edx, dword [0x1403c5a28]
xor r8d, r8d
cmp eax, 1
sbb r8d, r8d
sub edx, ecx
and edx, r8d
mov eax, edx
add rax, qword [0x1404ee6f8]
mov qword [0x1404ee6f8], rax
sub rbx, rdi
mov rcx, rdi
xor edx, edx
mov r8, rbx
call fcn.14039e9a0
cmp rbx, 0xfff
jbe 0x140201b3d
mov rax, qword [0x1404eebb0]
add rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140201b74
add rbx, 0x27
mov rdi, rax
mov eax, 0xffff9d1a
add eax, dword [0x1404acdac]
cdqe
add rax, qword [0x1404acdb0]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0xebf6dc2e
call qword [case.0x14014757d.0]
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140356a3c
int3

Function at 0x140215750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x1404ef658]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x14021577e
mov rcx, rsi
call fcn.1403769c0
cmp dword [0x1404b04d4], 0xec926722
je 0x1402157d1
lea rax, [fcn.140215750]
lea edi, [rax + rax]
add edi, 0x8a0
nop
mov rcx, rsi
call fcn.1403769c0
mov eax, dword [0x1404b04d4]
lea ecx, [rax + 0x136d98df]
xor ecx, edi
not ecx
and ecx, edi
mov edx, dword [0x1404aedd0]
add eax, edx
add eax, 0x136d094e
cdqe
add rax, qword [0x1404aede0]
mov edx, 0xf054dd93
call qword [case.0x14014757d.0]
test al, 1
je 0x140215790
jmp 0x14021576a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1402391a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
test ecx, ecx
je 0x1402391d9
test edx, edx
je 0x1402392cb
movzx eax, byte [0x1404b3584]
cmp al, 0xa1
je 0x140239360
mov cl, 0x90
mov al, 0xf1
lock cmpxchg byte [0x1404b3584], cl
je 0x140239329
cmp al, 0xa1
jne 0x1402391c0
jmp 0x140239360
test edx, edx
je 0x1402392f9
movzx eax, byte [0x1404b36f2]
nop dword [rax + rax]
cmp al, 0x7a
je 0x140239374
movzx ecx, byte [0x1404b3c1c]
lea eax, [rcx - 0x63]
add cl, 0x63
lock cmpxchg byte [0x1404b36f2], cl
jne 0x1402391f0
xor edx, edx
mov r8d, 0xa1ba8c27
lea r9, [0x1404b36e0]
lea r10, [0x1403c7600]
lea rax, [fcn.1402391a0]
lea r11d, [rax + rax]
add r11d, 0x2520
mov esi, r11d
not esi
jmp 0x14023924b
inc edx
cmp edx, 0x12
jge 0x14023936c
mov eax, dword [0x1404ef824]
mov ecx, dword [0x1404b3c18]
add ecx, r8d
movsxd rdi, edx
cmp eax, ecx
jge 0x1402392a0
nop word cs:[rax + rax]
movzx eax, byte [rdi + r10]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rdi + r9]
xor cl, al
mov byte [rdi + r9], cl
mov eax, dword [0x1404ef820]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
je 0x140239240
nop word cs:[rax + rax]
movzx eax, byte [rdi + r9]
movzx ecx, byte [rdi + r10]
shl al, cl
sub cl, al
mov ebx, eax
shl bl, cl
sub al, bl
mul bl
mov ecx, ebx
xor cl, bl
not cl
and cl, al
xor cl, bl
mov byte [rdi + r9], cl
test esi, r11d
jne 0x1402392a0
jmp 0x140239270
movzx eax, byte [0x1404b36ba]
cmp al, 0x3a
je 0x1402393b0
mov cl, 0x8b
nop dword [rax]
mov al, 0x7a
lock cmpxchg byte [0x1404b36ba], cl
je 0x140239380
cmp al, 0x3a
jne 0x1402392e0
jmp 0x1402393b0
movzx eax, byte [0x1404b376d]
cmp al, 0xe6
je 0x1402393f0
mov cl, 0xbb
nop word [rax + rax]
mov al, 0x58
lock cmpxchg byte [0x1404b376d], cl
je 0x1402393b9
cmp al, 0xe6
jne 0x140239310
jmp 0x1402393f0
xor eax, eax
lea rcx, [0x1404b3580]
lea rdx, [0x1403c74b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140239358
inc rax
jmp 0x140239340
mov al, 0xa1
xchg byte [0x1404b3584], al
lea rax, [0x1404b3580]
jmp 0x140239431
mov al, 0x7a
xchg byte [0x1404b36f2], al
lea rax, [0x1404b36e0]
jmp 0x140239431
xor eax, eax
lea rcx, [0x1404b36a0]
lea rdx, [0x1403c75c0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x1402393a8
inc rax
jmp 0x140239390
mov al, 0x3a
xchg byte [0x1404b36ba], al
lea rax, [0x1404b36a0]
jmp 0x140239431
xor eax, eax
lea rcx, [0x1404b3760]
lea rdx, [0x1403c7680]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402393e8
inc rax
jmp 0x1402393d0
mov al, 0xe6
xchg byte [0x1404b376d], al
xor eax, eax
test al, al
jne 0x140239410
mov eax, dword [0x1404ef824]
mov ecx, 0xa1ba8c18
add ecx, dword [0x1404b3c18]
cmp eax, ecx
jl 0x14023942a
nop dword [rax + rax]
mov eax, dword [0x1404ef820]
mov ecx, dword [0x1404b3c18]
add ecx, eax
inc ecx
imul ecx, eax
test cl, 1
jne 0x140239410
jmp 0x1402393f6
lea rax, [0x1404b3760]
pop rbx
pop rdi
pop rsi
ret
Function at 0x14023cbe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [rcx + 8]
movsxd r13, dword [0x1403c7dd4]
mov r12d, dword [0x1403c7dd0]
mov r8, rbp
mov edx, 1
mov r9d, 0xd459d379
call fcn.14023dfb0
mov r15d, eax
or byte [rsi + 0x10], 1
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.14023ceb0
mov qword [rsi + 0x18], 0x7fffffff
mov qword [rsi + 0x38], 0
test r15d, r15d
je 0x14023cdfc
mov rcx, qword [rsi + 8]
mov rbx, qword [rcx + 8]
mov eax, dword [0x1404b44d0]
lea r9d, [rax + 1]
mov dword [0x1404b44d0], r9d
mov qword [rbp + 8], rax
test eax, r9d
jne 0x14023cc82
test r12d, r12d
jg 0x14023ce10
xor r14d, r14d
cmp byte [rcx + 0x18], 0
je 0x14023cc99
cmp byte [0x1404ee749], 0
je 0x14023ccbf
jmp 0x14023cdfc
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, r15d
mov r15d, r9d
call qword [case.0x14014757d.0]
mov r9d, r15d
mov r15d, eax
cmp byte [0x1404ee749], 0
jne 0x14023cdfc
mov eax, r15d
cmp dword [rbx + rax + 0xc], 0
je 0x14023cdfc
add rbx, rax
lea r15, [rbp - 0x58]
mov rax, qword [rbp + 8]
and eax, r9d
mov qword [rbp + 8], rax
jmp 0x14023ccfe
cmp dword [rbx + 0x20], 0
lea rbx, [rbx + 0x14]
je 0x14023cdfc
mov rdx, qword [rsi + 8]
mov rcx, r15
mov r8, rbx
mov r9d, 0x18633fad
call fcn.14023dfd0
mov rdx, qword [rsi + 0x28]
cmp rdx, qword [rsi + 0x30]
je 0x14023cd30
mov rcx, rdi
mov r8, r15
call fcn.14023d8e0
add qword [rsi + 0x28], 0x58
jmp 0x14023cd67
movzx eax, byte [0x1403c7ddc]
cmp dword [rbp + 8], 1
mov ecx, 0
sbb ecx, ecx
sub al, r14b
not al
xor al, cl
test al, cl
setne al
or al, byte [0x1404ee749]
and al, 1
mov byte [0x1404ee749], al
mov rcx, rdi
mov r8, r15
call fcn.14023d700
lea rcx, [rbp - 0x18]
call fcn.14023d020
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x14023cdaf
mov rcx, qword [rbp - 0x48]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14023cdaa
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14023ce35
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140084c10
mov r13, qword [rsi + 0x28]
add r13, 0xffffffffffffffa8
mov rcx, r13
mov edx, 0xe8ec0ad1
call fcn.14023dfe0
mov rcx, r13
mov edx, 0x9f27020
call fcn.14023dfa0
mov r12d, eax
mov rcx, r13
mov edx, 0xde331f1
call fcn.14023dff0
cmp r12d, dword [rsi + 0x18]
jae 0x14023cdeb
mov dword [rsi + 0x18], r12d
cmp eax, dword [rsi + 0x1c]
jbe 0x14023ccf0
mov dword [rsi + 0x1c], eax
jmp 0x14023ccf0
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor eax, eax
lea rdx, [0x1403c7dd4]
xor r14d, r14d
nop dword [rax]
lea r8, [rax + r13]
xor r14b, byte [rdx + r8]
inc rax
cmp eax, r12d
jl 0x14023ce20
jmp 0x14023cc85
call fcn.140356a3c
int3
Function at 0x140249360
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov r13, qword [0x1404b55d8]
mov rdi, rdx
mov rax, rcx
movsxd r15, dword [r13]
mov r12d, dword [0x1403c8d70]
test rdx, rdx
je 0x1402493de
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 7
mov word [rbp - 0x20], 0
mov rcx, rdi
mov edx, 0xdc2f752e
call fcn.140085540
mov r14, rax
cmp rax, 7
jbe 0x1402493f2
mov rcx, rbx
mov rdx, r14
mov r9, rdi
call fcn.140076ad0
jmp 0x14024940f
cmp qword [rax + 0x20], 0x10
jb 0x14024950b
mov rcx, qword [rax + 8]
jmp 0x14024950f
mov qword [rbp - 0x10], r14
mov r8, r14
add r8, r14
mov rcx, rbx
mov rdx, rdi
call fcn.14039e2f0
mov word [rbp + r14*2 - 0x20], 0
lea rax, [0x1403b96b0]
mov qword [rbp - 0x28], rax
mov edi, dword [0x1404b55c8]
lea ebx, [rdi + 1]
mov dword [0x1404b55c8], ebx
xor r14d, r14d
mov esi, 0
test edi, ebx
mov rcx, qword [rbp - 0x30]
jne 0x140249475
xor eax, eax
mov r14d, 0
mov esi, 0
test r12d, r12d
jle 0x140249475
add r15, r13
xor r14d, r14d
xor esi, esi
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
xor r14, qword [rdx]
xor rsi, qword [rdx + 8]
add eax, 0x10
cmp eax, r12d
jl 0x140249460
lea rdx, [rbp - 0x28]
call fcn.1402485a0
mov r11, qword [rbp - 8]
cmp r11, 8
jb 0x140249534
mov rdx, qword [rbp - 0x20]
mov rcx, qword [0x1403c8d80]
mov r8, qword [0x1403c8d78]
xor r9d, r9d
test edi, ebx
setne r9b
xor r10d, r10d
add r9, 0xffffffffffffffff
adc r10, 0xffffffffffffffff
sub r8, r14
sbb rcx, rsi
and r8, r9
and rcx, r10
or rcx, r8
add qword [0x1404ef0d0], rcx
lea r8, [r11 + r11]
add r8, 2
cmp r8, 0x1000
jb 0x14024951c
mov rcx, qword [0x1404ef0d0]
add rcx, qword [rdx - 8]
sub rdx, rcx
add rdx, 0xfffffffffffffff8
cmp rdx, 0x20
jae 0x140249545
mov rsi, rax
add r11, r11
mov rdx, r11
xor rdx, 0x29
and r11d, 0x29
lea r8, [rdx + r11*2]
mov rdx, rcx
jmp 0x14024951f
lea rcx, [rax + 8]
mov qword [rax + 0x18], 0
mov byte [rcx], 0
jmp 0x140249534
mov rsi, rax
mov dword [rsp + 0x20], 0xfaf5f4c4
xor ecx, ecx
xor r9d, r9d
call fcn.14014a0e0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140356a3c
int3
Function at 0x14024c120
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
cmp qword [r8 + 0x20], 0x10
jb 0x14024c154
mov rdx, qword [r8 + 8]
jmp 0x14024c158
lea rdx, [r8 + 8]
lea r13, [rcx + 8]
mov rdi, qword [r8 + 0x18]
mov rax, qword [0x1404b5f28]
movsxd r14, dword [rax]
add r14, rax
mov r15d, dword [0x1403c9634]
movabs rbx, 0x7fffffffffffffff
cmp rdi, 0x10
mov qword [rbp - 8], rcx
jae 0x14024c198
movups xmm0, xmmword [rdx]
movups xmmword [r13], xmm0
mov r12d, 0xf
jmp 0x14024c201
mov qword [rbp - 0x10], rdx
mov r12, rdi
or r12, 0xf
cmp r12, rbx
cmovae r12, rbx
cmp r12, 0xfff
jb 0x14024c1d0
lea rcx, [r12 + 0x28]
mov edx, 0xc2b36bea
call fcn.140084df0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14024c1e2
lea rcx, [r12 + 1]
mov edx, 0xc2b36bea
call fcn.140084df0
mov rcx, rax
mov qword [r13], rcx
mov rax, qword [0x1404efad0]
lea r8, [rdi + rax]
inc r8
mov rdx, qword [rbp - 0x10]
call fcn.14039e2f0
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], r12
lea rdi, [0x1403b9448]
mov qword [rcx], rdi
mov r11d, dword [0x1404b5f20]
lea edx, [r11 + 1]
mov dword [0x1404b5f20], edx
xor eax, eax
mov r8d, 0
test r11d, edx
jne 0x14024c265
xor r9d, r9d
mov eax, 0
mov r8d, 0
test r15d, r15d
jle 0x14024c265
xor eax, eax
xor r8d, r8d
nop dword [rax]
movsxd r9, r9d
xor r8, qword [r14 + r9 + 8]
xor rax, qword [r14 + r9]
add r9d, 0x10
cmp r9d, r15d
jl 0x14024c250
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov r14, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0x10
jb 0x14024c27d
mov rsi, qword [rsi + 8]
jmp 0x14024c281
add rsi, 8
lea r15, [rcx + 0x30]
cmp r14, 0x10
jae 0x14024c29c
movups xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov ebx, 0xf
jmp 0x14024c325
mov r9, r14
or r9, 0xf
xor r10d, r10d
test r11d, edx
setne r10b
mov rdx, qword [0x1403c9658]
mov rcx, qword [0x1403c9650]
xor r11d, r11d
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
sub rcx, rax
sbb rdx, r8
and rcx, r10
and rdx, r11
or rcx, rdx
add qword [0x1404efad0], rcx
cmp r9, rbx
cmovb rbx, r9
cmp rbx, 0xffe
jbe 0x14024c306
lea rcx, [rbx + 0x28]
call fcn.14037638c
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14024c312
lea rcx, [rbx + 1]
call fcn.14037638c
mov rcx, rax
mov qword [r15], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call fcn.14039e2f0
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x28], rdi
mov rax, rcx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140250600
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14025063c
test edx, edx
je 0x14025066c
movzx eax, byte [0x1404b64e7]
cmp al, 0x29
je 0x140250634
mov cl, 0x8f
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x1404b64e7], cl
je 0x1402506cc
cmp al, 0x29
jne 0x140250620
lea rax, [0x1404b64d0]
ret
test edx, edx
je 0x14025069c
movzx eax, byte [0x1404b61a0]
cmp al, 0xb2
je 0x140250664
mov cl, 0x4c
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x1404b61a0], cl
je 0x140250701
cmp al, 0xb2
jne 0x140250650
lea rax, [0x1404b6190]
ret
movzx eax, byte [0x1404b62e6]
cmp al, 0x3c
je 0x140250694
mov cl, 0x8e
nop dword [rax]
mov al, 0xdf
lock cmpxchg byte [0x1404b62e6], cl
je 0x140250741
cmp al, 0x3c
jne 0x140250680
lea rax, [0x1404b62d0]
ret
movzx eax, byte [0x1404b64fb]
cmp al, 0xdd
je 0x1402506c4
mov cl, 0x43
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x1404b64fb], cl
je 0x140250781
cmp al, 0xdd
jne 0x1402506b0
lea rax, [0x1404b64f0]
ret
xor eax, eax
lea rcx, [0x1404b64d0]
lea rdx, [0x1403c9be0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x17
jl 0x1402506e0
mov al, 0x29
xchg byte [0x1404b64e7], al
lea rax, [0x1404b64d0]
ret
xor eax, eax
lea rcx, [0x1404b6190]
lea rdx, [0x1403c9890]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x140250720
mov al, 0xb2
xchg byte [0x1404b61a0], al
lea rax, [0x1404b6190]
ret
xor eax, eax
lea rcx, [0x1404b62d0]
lea rdx, [0x1403c99e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x16
jl 0x140250760
mov al, 0x3c
xchg byte [0x1404b62e6], al
lea rax, [0x1404b62d0]
ret
xor eax, eax
lea rcx, [0x1404b64f0]
lea rdx, [0x1403c9c00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1402507a0
mov al, 0xdd
xchg byte [0x1404b64fb], al
lea rax, [0x1404b64f0]
ret
Function at 0x140250860
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14025089c
test edx, edx
je 0x1402508cc
movzx eax, byte [0x1404b646d]
cmp al, 0x5d
je 0x140250894
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x1404b646d], cl
je 0x14025092c
cmp al, 0x5d
jne 0x140250880
lea rax, [0x1404b6460]
ret
test edx, edx
je 0x1402508fc
movzx eax, byte [0x1404b643b]
cmp al, 0x39
je 0x1402508c4
mov cl, 0xb5
nop dword [rax]
mov al, 0x3a
lock cmpxchg byte [0x1404b643b], cl
je 0x140250961
cmp al, 0x39
jne 0x1402508b0
lea rax, [0x1404b6430]
ret
movzx eax, byte [0x1404b6188]
cmp al, 0xa5
je 0x1402508f4
mov cl, 0xee
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x1404b6188], cl
je 0x1402509a1
cmp al, 0xa5
jne 0x1402508e0
lea rax, [0x1404b6180]
ret
movzx eax, byte [0x1404b6150]
cmp al, 0x3e
je 0x140250924
mov cl, 0x52
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x1404b6150], cl
je 0x1402509e1
cmp al, 0x3e
jne 0x140250910
lea rax, [0x1404b6140]
ret
xor eax, eax
lea rcx, [0x1404b6460]
lea rdx, [0x1403c9b70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x140250940
mov al, 0x5d
xchg byte [0x1404b646d], al
lea rax, [0x1404b6460]
ret
xor eax, eax
lea rcx, [0x1404b6430]
lea rdx, [0x1403c9b40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x140250980
mov al, 0x39
xchg byte [0x1404b643b], al
lea rax, [0x1404b6430]
ret
xor eax, eax
lea rcx, [0x1404b6180]
lea rdx, [0x1403c9880]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x1402509c0
mov al, 0xa5
xchg byte [0x1404b6188], al
lea rax, [0x1404b6180]
ret
xor eax, eax
lea rcx, [0x1404b6140]
lea rdx, [0x1403c9850]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x140250a00
mov al, 0x3e
xchg byte [0x1404b6150], al
lea rax, [0x1404b6140]
ret