joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov dword [rcx + 8], 0x580766c1
sub dword [rcx + 8], 0x3bce61ed
add dword [rcx + 8], 0x1664a42d
sub dword [rcx + 8], 0x329da900
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140002a08]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.1400189f0
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140033b53
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140033b39
mov ecx, dword [rbx + 0x40]
mov esi, 0xefd5d85
add esi, 0x266c7e0
add esi, 0x11321637
xor esi, 0x2296c463
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x3601cf61
sub edx, 0xb219f42
sub edx, 0x6b17a07
xor edx, 0x242eb608
mov eax, dword [rbx + 0x54]
xor eax, 0x33f12d3
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x33f12d3
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x33f12d3
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x33f12d3
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x406421b5
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x33f12d3
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x2a54390c
add eax, 0xf73ccd9
sub eax, 0x39c804e6
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.1400bbb40
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404e0530]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140033c2f
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rax + rdx - 0x10]
xor ecx, 0x406421b5
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rax + rdx - 0xc]
xor ecx, 0x406421b5
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rax + rdx - 8]
xor ecx, 0x406421b5
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rax + rdx - 4]
xor ecx, 0x406421b5
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404e0530]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140033c53
lea rcx, [r14 + 0xa0]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.14002af60
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
sub rsp, 0xffffffffffffffd0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400341de
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 0x41528baa
add rsp, 0x41528b4a
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov qword [rsp + 0x78], rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400189f0
mov edx, 0x25b1c4ff
add edx, 0x182ff00a
add edx, 0x3cb6a7ae
test rbp, rbp
je 0x1400342b1
mov rdi, rax
sub rbx, rax
mov r9, rbp
mov r8d, 0x4b22a16b
sub r8d, 0x150fe1ef
add r8d, 0x49b370eb
xor r8d, 0x7fc63098
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x140034290
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
call fcn.1400a10e0
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x140034315
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x6146d4f7
sub ecx, 0x2346c0d3
sub ecx, 0x2c6ff3d0
xor ecx, 0x11902064
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
sub rsp, 0xffffffffffffffa0
pop rdi
ret
call fcn.1400bbca0
mov rax, rsi
mov rsi, qword [rsp + 0x80]
nop
add rsp, 0x45fab3dd
sub rsp, 0x45fab37d
pop rdi
ret
Function at 0x140036100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffff50
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.1400341d0
mov ebx, 0x6ea5ff69
sub ebx, 0x2f9281f3
add ebx, 0xc0ec8289
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x14003618e
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0xb08a445
xor r8d, 0x62c4fa7f
xor r8d, 0x31843e2e
sub r8d, 0x58486013
inc rdi
call fcn.1400a03c0
cmp byte [rdi], 0
jne 0x140036150
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400361c2
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x5f0c5a2c
sub ecx, 0x101c65f0
sub ecx, 0x4eeff3bc
rep stosb byte [rdi], al
jmp 0x1400361c7
call fcn.1400bbca0
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x12d3
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x140036220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
nop
sub rsp, 0x37785a5f
add rsp, 0x37785a1f
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x33f12d3
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x33f12d3
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x406421b5
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.14006d860
test ax, ax
je 0x1400362e9
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404e0530]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.14006d860
test ax, ax
jne 0x14003629f
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
sub rsp, 0xffffffffffffffc0
pop r14
pop rdi
pop rsi
ret

Function at 0x140036310
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x33f12d3
xor r9d, 0x33f12d3
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x406421b5
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x14003639d
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404e0530]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x140036364
mov eax, r8d
ret
Function at 0x1400363b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x33f12d3
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x33f12d3
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x406421b5
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.14006d860
test ax, ax
je 0x140036474
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404e0530]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.14006d860
test ax, ax
jne 0x14003642a
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
nop
sub rsp, 0x5d976b67
add rsp, 0x5d976ba7
pop r14
pop rdi
pop rsi
ret

Function at 0x1400364a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x33f12d3
xor r9d, 0x33f12d3
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x406421b5
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x140036530
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404e0530]
movzx eax, ax
sub rdx, 0xfffffffffffffffe
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x1400364f5
mov eax, r8d
ret
Function at 0x1400365c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
cmp qword [rcx + 0x2f8], 0
mov rdi, rcx
pushf
mov qword [rsp + 0xb2], 0x39c3ed49
sub qword [rsp + 0xb2], 0x2aea164c
xor qword [rsp + 0xb2], 0xed9d6fd
popf
pushf
movabs rsi, 0xffffffff0291d278
xor rsi, 0x7eb1c7dd
sub rsi, 0x2319c55b
add rsi, 0x7fffffff
add rsi, 0x26f9afb6
popf
je 0x1400366af
mov edx, dword [rcx + 0x2ec]
mov eax, dword [rcx + 0x2e8]
xor edx, 0x33f12d3
xor eax, 0x33f12d3
imul edx, eax
mov eax, 0x3ef5fba3
sub eax, 0x1f9545e1
add eax, 0x38dc934c
xor eax, 0x583d490a
movsxd rbx, edx
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bbad0
mov qword [rsp + 0xb0], rax
test rbx, rbx
jle 0x1400366cc
xor r8d, r8d
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + r8*4]
xor edx, 0x5d8d086a
mov dword [rax + r8*4], edx
inc r8
cmp r8, rbx
jl 0x140036689
jmp 0x1400366cc
lea rdx, [rsp + 0xb0]
call fcn.140036950
test al, al
je 0x1400368ca
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rdi + 0x318]
lea rcx, [0x140002ba0]
mov qword [rsp + 0x30], rax
movabs rdx, 0x4280750837623568
xor rdx, 0x316756a
add rdx, 0x3abbf55a
mov qword [rsp + 0x98], 0x1737c173
sub qword [rsp + 0x98], 0xd830e43
add qword [rsp + 0x98], 0x5286bf63
sub qword [rsp + 0x98], 0x5c3b727b
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rcx, qword gs:[0x30]
mov rax, qword [rbx + 0x98]
xor rax, rdx
mov qword [rsp + 0xb8], rbp
cmp rax, qword [rcx + 0x48]
jne 0x14003678b
lea rcx, [rsp + 0x20]
call fcn.140034b70
movzx ebp, al
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
ja 0x140036878
test rax, rax
je 0x1400368be
mov rax, qword [rsp + 0x20]
mov r8, qword [rax]
jmp 0x1400368a4
mov rax, qword gs:[0x30]
mov rbp, qword [rax + 0x48]
lock inc dword [rbx + 0xf8]
je 0x1400367c3
cmp rbp, qword [rbx + 0xe8]
je 0x140036854
mov rcx, qword [rbx + 0xf0]
xor r8d, r8d
xor edx, edx
call fcn.140094c40
mov qword [rbx + 0xe8], rbp
mov dword [rbx + 0xfc], 0x37f37fa8
add dword [rbx + 0xfc], 0x399ecd40
sub dword [rbx + 0xfc], 0x71924ce7
lea rcx, [rbx + 0xc8]
lea rdx, [rsp + 0x20]
call fcn.1400336b0
test rax, rax
setne bpl
sub dword [rbx + 0xfc], 1
jne 0x14003685f
mov qword [rbx + 0xe8], 0x65e326e1
xor qword [rbx + 0xe8], 0x55aceac8
sub qword [rbx + 0xe8], 0x304fcc29
lock xadd dword [rbx + 0xf8], esi
dec esi
cmp esi, 0xffffffff
je 0x140036866
mov rcx, qword [rbx + 0xf0]
xor edx, edx
call fcn.140094be0
jmp 0x140036866
inc dword [rbx + 0xfc]
jmp 0x1400367e8
lock dec dword [rbx + 0xf8]
mov rax, qword [rsp + 0x98]
cmp rax, 0x78
jbe 0x140036893
mov rcx, qword [rsp + 0x20]
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rsp + 0x20]
call fcn.1400bbca0
jmp 0x1400368be
test rax, rax
je 0x1400368be
mov rcx, qword [rsp + 0x20]
mov r8, qword [rcx]
lea rax, [0x140034b80]
cmp r8, rax
je 0x1400368be
xor edx, edx
lea rcx, [rsp + 0x20]
call r8
movzx eax, bpl
mov rbp, qword [rsp + 0xb8]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140044790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400189f0
mov edi, 0x5b6cadab
sub edi, 0x4c64088a
xor edi, 0x7590f996
mov r9, rax
mov ecx, edi
mov r15d, 0x248b6e64
add r15d, 0x26f5a355
add r15d, 0x53858b5
sub r15d, 0x50b9696f
test rbp, rbp
je 0x140044856
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x140044835
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400448a1
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400448a1
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x140044881
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff67c5a6b8
xor rdx, 0x2547569
add rdx, 0x7fffffff
xor rdx, 0x1a6e2c2f
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400448de
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.1400189f0
cmp qword [r14 + 0x38], rbx
jbe 0x14004492a
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x140044906
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140044962
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x7dcf6981
sub ecx, 0x29e4174a
xor ecx, 0xb0beaa9
sub ecx, 0x58e0b86e
rep stosb byte [rdi], al
jmp 0x140044967
call fcn.1400bbca0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140048300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffffe0
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140048330
mov rdi, qword [rcx + 0x640]
jmp 0x140048337
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140048350
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140048353
mov rcx, rsi
cmp rdi, rcx
je 0x14004857e
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140048378
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
jmp 0x140048337
test r8, r8
je 0x14004843c
cmp rdi, qword [rbx + 0x640]
jb 0x14004843c
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14004843c
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1400483cf
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1400483d2
mov rax, rsi
neg rax
add rax, 8
neg rax
cmp rdx, rax
jae 0x1400483f5
mov rax, qword [rdx + 8]
mov qword [rdx], rax
sub rdx, 0xfffffffffffffff8
jmp 0x1400483af
test rcx, rcx
je 0x14004843c
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14004843c
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x14004842e
call fcn.1400bbca0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004845e
mov rax, qword [rcx]
mov edx, 0x1acdeb15
add edx, 0x4d1ca78f
sub edx, 0x67ea92a3
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14004857e
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140047ee0
mov rcx, qword [rsp + 0x30]
mov r10d, 0x1bc023bc
add r10d, 0x1fb42989
sub r10d, 0x1a80ca10
xor r10d, 0x20f38395
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140048536
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140048536
mov r9d, r10d
xor r9d, 0x33f12d3
xor r8d, 0x33f12d3
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x33f12d3
add esi, r10d
neg rdx
add rdx, 0xfffffffffffffff8
neg rdx
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x640f836d
xor dword [rcx + 0x34], 0x35ee23f2
sub dword [rcx + 0x34], 0x4ea28dcc
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x1400484ec
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140048576
sub ecx, r8d
mov dword [rax + 0x14], 0x69913845
sub dword [rax + 0x14], 0x3313a99b
sub dword [rax + 0x14], 0x333e7bd7
xor ecx, 0x33f12d3
xor r8d, 0x33f12d3
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.140043100
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
nop
add rsp, 0x569ed905
sub rsp, 0x569ed8e5
pop rdi
ret
Function at 0x1400485a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140029d50
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1400481c0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400485a0
push rbx
add rsp, 0xffffffffffffffe0
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1400486e0
lea rdx, [rsp + 0x30]
call fcn.140047ee0
mov r8, qword [rsp + 0x30]
mov r11d, 0x2e0b0540
sub r11d, 0xc6606c4
add r11d, 0x5391d477
xor r11d, 0x7536d253
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x14004868f
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x14004868a
mov r8d, r11d
xor r8d, 0x33f12d3
xor r9d, 0x33f12d3
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x33f12d3
add r10d, r11d
add rax, 8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x350d2f95
add dword [rdx + 0x34], 0x436df8a6
xor dword [rdx + 0x34], 0x27211d02
sub dword [rdx + 0x34], 0x5c1b2266
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x14004863d
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1400486d8
sub r8d, r9d
mov dword [rax + 0x14], 0x54c38dcc
xor dword [rax + 0x14], 0x2bbc3603
sub dword [rax + 0x14], 0x38ca8765
sub dword [rax + 0x14], 0x43762197
xor r8d, 0x33f12d3
xor r9d, 0x33f12d3
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.140043100
add rsp, 0x20
pop rbx
ret
Function at 0x140052b70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rax
mov rbx, rsp
xchg rbx, rax
xchg rbx, r11
mov qword [rax + 0x10], r11
xchg rbx, r11
push rdi
add rsp, 0xffffffffffffffa0
movabs rbx, 0x4280750858d97473
xor rbx, 0xf0efec8
sub rbx, 0x3c3dc124
add rbx, 0x53966bc5
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x30], rbx
jne 0x140052d9d
xchg r8, r8
mov dword [rax - 0x48], 0x228d2ec0
add dword [rax - 0x48], 0x3ea22310
sub dword [rax - 0x48], 0x517ef1a6
sub dword [rax - 0x48], 0xf785f34
xor r8d, r8d
mov dword [rsp - 0x24], esp
mov dword [rax - 0x44], 0x548b35f9
xor dword [rax - 0x44], 0x702ced54
xor dword [rax - 0x44], 0xc7a8ac8
xor dword [rax - 0x44], 0x28c6528b
mov dword [rax - 0x40], 0x51f864ad
sub dword [rax - 0x40], 0x28b620dd
add dword [rax - 0x40], 0x52827909
xor dword [rax - 0x40], 0x7bf1bc1e
mov dword [rax - 0x3c], 0x17114dff
add dword [rax - 0x3c], 0x141873d5
add dword [rax - 0x3c], 0x7096cce
sub dword [rax - 0x3c], 0x31eb2df7
mov dword [rax - 0x38], 0x30b72fce
add dword [rax - 0x38], 0x2a1d3f8d
sub dword [rax - 0x38], 0xa141097
sub dword [rax - 0x38], 0x50885e2b
mov dword [rax - 0x34], 0x4d141688
xor dword [rax - 0x34], 0x690079b7
add dword [rax - 0x34], 0x2e622e60
sub dword [rax - 0x34], 0x171f6620
xor dword [rax - 0x34], 0x3b41378b
xchg r8, r12
mov qword [rsp + 0x70], r12
xchg r8, r12
mov rax, qword [rsp + 0x70]
nop word [rax + rax]
mov r8, r8
xchg rbx, rcx
mov rbx, qword [rsp + 0x70]
xchg rbx, rcx
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
and cl, 3
mov dword [rsp - 0x2c], edx
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x49d36951
xor eax, 0x6ec24caf
add eax, 0x42ff91d9
add eax, 0x1087a4e0
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x34], 0x71a0765c
mov rax, qword [rsp + 0x70]
xor cx, dx
mov word [rsp + rax*2 + 0x38], cx
xchg r14, r14
xchg r13, rax
mov r13, qword [rsp + 0x70]
xchg r13, rax
inc rax
mov r8, r8
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
cmp rax, 0xc
mov dword [rsp - 0x20], edi
jb 0x140052c8a
xor edx, edx
mov word [rsp + 0x50], r8w
lea rcx, [rsp + 0x38]
xchg r10, r10
call fcn.14009cac0
mov rdx, rax
xchg r9, r8
mov r9, rax
xchg r8, r9
xor rdx, rbx
xor eax, eax
mov dword [rsp - 0x20], edx
xchg rcx, rdx
mov qword [rdi + 0x30], rcx
xchg rdx, rcx
lea rdi, [rsp + 0x38]
mov rsi, rsi
mov ecx, 0x19166111
add ecx, 0xf081c85
xor ecx, 0x7fc153fb
xor ecx, 0x57df2e61
rep stosb byte [rdi], al
mov rcx, rcx
cmp rdx, rbx
je 0x140052da7
lea rdx, [0x1404df2e0]
xchg rcx, r14
mov r14, r8
xchg r14, rcx
call fcn.14005a960
mov rcx, rcx
test al, al
setne al
xchg rdx, rbx
mov rdx, qword [rsp + 0x78]
xchg rdx, rbx
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x16
add al, 0x1a
add al, 0x4e
xor al, 0x15
sub al, 0x6a
mov rbx, qword [rsp + 0x78]
mov r8, r8
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x40], 0x5c66f493
ret