joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg r15, rbx
nop
push 0x10e2f5c9
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0x5e14f89a
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
xchg r11, r11
mov r15d, edx
xor eax, 0x7a8c338e
xchg rbx, rsi
mov rbx, rcx
xchg rsi, rbx
cmp eax, 0x7a8c69c3
jne 0x140084011
mov dword [rsp - 0x28], 0x1a29a948
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x7a8c338e
cmp eax, 0x7a8c76de
mov dword [rsp - 0x30], edx
jne 0x140084011
mov edx, dword [rdx + rcx + 0x88]
call fcn.140083da0
xchg rbx, rcx
mov rbx, rsi
xchg rcx, rbx
xchg r10, rax
mov r14, r10
xchg r10, rax
mov edx, dword [rax + 0x20]
mov dword [rsp - 0x1c], ebx
call fcn.140083da0
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg rsp, r12
mov rsp, rax
xchg rsp, r12
call fcn.140083da0
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x3c], edi
xchg r12, rsi
mov rcx, r12
xchg rsi, r12
xchg r13, rbp
mov rbp, rax
xchg r13, rbp
call fcn.140083da0
xor edi, edi
xchg r9, rax
mov qword [rsp + 0x70], r9
xchg r9, rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x14], esp
jbe 0x140084011
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x24], edi
mov rcx, rsi
call fcn.140083da0
mov ecx, 0x4f0185d6
sub ecx, 0x31d6238a
add ecx, 0x18ce20fd
add ecx, 0xca067cb6
mov rbx, rax
mov dword [rsp + 0x60], ecx
xchg rbp, rbp
cmp byte [rax], 0
je 0x140083ff7
nop dword [rax]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x55de0e38
add r8d, 0x10f336fe
sub r8d, 0x6817429
sub r8d, 0x604fd10c
inc rbx
mov dword [rsp - 0x3c], 0x3e41ac70
call fcn.14008d0c0
cmp byte [rbx], 0
jne 0x140083fa9
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0xc], 0x55c71b54
not ecx
cmp ecx, r15d
je 0x140084059
inc edi
xchg rdi, rdi
cmp edi, dword [r14 + 0x18]
jb 0x140083f6c
xor eax, eax
xchg rbx, rbp
mov rbp, qword [rsp + 0x68]
xchg rbx, rbp
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov r14, r14
pop r14
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg rcx, rax
mov rcx, qword [rsp + 0x70]
xchg rcx, rax
mov edx, dword [rax + rdx*4]
mov r9, r9
call fcn.140083da0
jmp 0x140084013
Function at 0x140084090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov dword [rsp - 0x34], esp
nop
add rsp, 0x52348732
sub rsp, 0x52348752
movzx eax, word [rcx]
xchg r14, r14
mov edi, edx
xor eax, 0x7a8c338e
mov rbx, rcx
mov dword [rsp - 0x24], ebp
cmp eax, 0x7a8c69c3
jne 0x14008414c
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x40], 0xbe0a55
xor eax, 0x7a8c338e
cmp eax, 0x7a8c76de
jne 0x14008414c
mov edx, dword [rdx + rcx + 0x88]
mov r9, r9
call fcn.140083da0
sub edi, dword [rax + 0x10]
cmp edi, dword [rax + 0x14]
xchg r10, r10
jae 0x14008414c
mov edx, dword [rax + 0x1c]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.140083da0
mov dword [rsp - 0x34], 0x4bfdb92b
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
mov edx, dword [rax + rdi*4]
mov dword [rsp - 0x30], 0x78548782
mov rbx, qword [rsp + 0x30]
nop
sub rsp, 0x28a5d23b
add rsp, 0x28a5d25b
pop rdi
jmp fcn.140083da0
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg r11, rbx
xor eax, eax
nop
add rsp, 0x4a9d1977
sub rsp, 0x4a9d1957
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140088475
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x34], esi
push rdi
nop
add rsp, 0x31db894c
sub rsp, 0x31db89ac
xchg rbx, r11
mov r11, qword [rcx]
xchg rbx, r11
lea rax, [rsp + 0x28]
mov dword [rsp - 0x38], 0x242e0c2
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg rbx, rbx
mov qword [rsp + 0x20], rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg rsp, r12
lea rdx, [rsi + 1]
xchg rsp, r9
movups xmmword [r9 + 0x38], xmm0
xchg rsp, r9
xchg rdi, rsp
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017b44
mov rsi, rsi
mov edx, 0x15722b2
xor edx, 0x260e2cc4
add edx, 0x18cc3908
sub edx, 0x6ae046d
xor edx, 0x13601a6a
test rsi, rsi
je 0x140088562
mov r11, r11
mov rdi, rax
sub rbx, rax
xchg r12, rsi
mov r8, r12
xchg r12, rsi
mov r9d, 0x4bca84ec
sub r9d, 0x22013e61
add r9d, 0x53cc8929
sub r9d, 0x5d44f261
sub r9d, 0x2050dc54
nop dword [rax]
movzx ecx, dx
xchg rbx, rbx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r13, r13
mov word [rdi - 2], cx
sub r8, 1
jne 0x140088536
mov rsi, rsi
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg r12, rcx
mov r12, qword [rsp + 0x20]
xchg r12, rcx
call fcn.140088610
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg rsi, rsi
xchg rsi, r10
mov r10, qword [rsp + 0x70]
xchg rsi, r10
lea rax, [rsp + 0x28]
mov r13, r13
cmp rcx, rax
jne 0x1400885da
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x2c], esi
mov ecx, 0x1f3794f7
xor ecx, 0x297e8e97
xor ecx, 0x2054d9ad
xor ecx, 0x161dc3fd
rep stosb byte [rdi], al
mov eax, ebx
mov rsp, rsp
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140097780
mov eax, ebx
xchg rsi, rbx
mov rsi, qword [rsp + 0x78]
xchg rsi, rbx
nop
sub rsp, 0x163f7404
add rsp, 0x163f7464
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140089ad6
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg r11, rsp
mov qword [r11 + 0x20], rbx
mov rbp, rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x650a3d31
add rsp, 0x650a3cd1
xchg r8, rbx
mov r8, qword [rcx]
xchg r8, rbx
lea rax, [r11 - 0x40]
xchg rbp, rcx
mov qword [r11 + 8], rcx
xchg rbp, rcx
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov dword [rsp - 0xc], edi
mov ebp, r8d
xchg r13, rsi
mov qword [r11 + 0x10], r13
xchg r13, rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov dword [rsp - 0x38], ebx
mov qword [r11 + 0x18], r14
mov r14, rdx
xchg rsp, r11
movups xmmword [r11 + 0x28], xmm0
xchg r11, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x20], 0x2c4e94b
xchg r13, rsp
movups xmmword [r13 + 0x38], xmm0
xchg rsp, r13
xchg rsp, r14
movups xmmword [r14 + 0x48], xmm0
xchg rsp, r14
call fcn.140017b44
mov edx, 0x7ff2273e
xor edx, 0x32ec329f
add edx, 0x215bbece
sub edx, 0x44627af4
test rsi, rsi
mov dword [rsp - 0x24], edx
je 0x140089b41
mov rdi, rax
sub rbx, rax
xchg r15, r15
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x3422de0c
xor r9d, 0x316dccfc
add r9d, 0x46e12d18
xor r9d, 0x533235be
xor r9d, 0x1f027549
nop word [rax + rax]
mov dword [rsp - 0xc], edx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x28], edi
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x20], edi
mov word [rdi - 2], cx
sub r8, 1
jne 0x140089b13
mov rsi, rsi
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov r8, r8
xchg r13, r14
mov rdx, r13
xchg r13, r14
xchg r12, rcx
mov r12, qword [rsp + 0x20]
xchg rcx, r12
call fcn.140089c20
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x1c], 0x197c0693
mov ebx, eax
xchg rbx, r14
mov rbx, qword [rsp + 0x80]
xchg rbx, r14
lea rax, [rsp + 0x28]
xchg rsi, r10
mov r10, qword [rsp + 0x78]
xchg r10, rsi
xchg rbp, rbx
mov rbx, qword [rsp + 0x70]
xchg rbp, rbx
cmp rcx, rax
jne 0x140089bec
mov dword [rsp - 0x14], 0x55e0c4ad
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x25ed3936
add ecx, 0x588a652e
xor ecx, 0x72491f5f
xor ecx, 0x59f1b825
sub ecx, 0x55cf38ee
rep stosb byte [rdi], al
mov eax, ebx
mov dword [rsp - 0xc], ebp
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
pop rdi
xchg r14, r14
ret
call fcn.140097780
mov dword [rsp - 0x24], 0x77ea2f14
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
sub rsp, 0x6993b161
add rsp, 0x6993b1c1
pop rdi
ret
Function at 0x140089c20
Capabilities:
Access peb ldr_data

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
mov dword [rsp + 0x18], r8d
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x414366d
add rsp, 0x414342d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x77fc4eaa
sub r8d, 0x58295c27
xor r8d, 0x3e1d2a38
sub r8d, 0x21cfd6b3
call fcn.140097d40
xchg r10, r10
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rbp, rax
mov rbp, qword [r8 + 0x10]
xchg rbp, rax
xchg r8, rbx
mov rbx, qword [rax]
xchg rbx, r8
test r8, r8
je 0x140089eaa
mov dword [rsp - 0x10], edi
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x140089eaa
mov dword [rsp - 0x34], 0x52c9a8b2
mov edx, 0x7eb85be0
sub edx, 0x7975152f
sub edx, 0x683413
sub edx, 0x4db119a
lea rcx, [rsp + 0x30]
mov rbx, rbx
lea r9d, [rdx - 1]
call fcn.1400988c0
mov edx, 0x2cd462bf
xor edx, 0x4447258a
sub edx, 0x108a587e
sub edx, 0x5808ee5b
lea rcx, [rsp + 0x30]
mov rbx, rbx
call fcn.1400989d0
test rax, rax
je 0x140089e74
xor ecx, ecx
mov dword [rsp - 0x34], 0x60d25b15
mov rdx, rdi
mov word [rax], cx
movabs rcx, 0xc7b08095353bce05
xor rcx, 0x21f5eef2
sub rcx, 0x7a0d844
xor rcx, 0x15e6c0c6
add rcx, 0x3199e4c6
mov rax, qword [0x140140690]
ror rax, 0x15
ror rax, 3
ror rax, 8
ror rax, 2
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
mov dword [rsp - 0x3c], ebp
movabs rcx, 0x22a04fca1a8fabd2
add rcx, 0x33cda707
sub rcx, 0x3835e6ae
xor rcx, 0x19882189
xor rcx, 0x632dca17
add rax, rcx
xchg r14, r14
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140140680]
lea r8, [rsp + 0x20]
xchg r15, r15
movabs rcx, 0x5896292705364df8
add rcx, 0x749f361d
sub rcx, 0x1c59e615
add rcx, 0x42ce1517
lea rdx, [rsp + 0x260]
xchg rsi, rsi
xor rax, rcx
xchg r13, r9
mov r13, rbx
xchg r13, r9
movabs rcx, 0x2bbca41f53cf61fa
xor rcx, 0x68288895
xor rcx, 0x5944ebb4
sub rcx, 0x4cee492f
add rcx, 0x76a56375
add rax, rcx
mov r12, r12
movabs rcx, 0x27ca5d63351fd9ab
add rcx, 0x290c3af2
sub rcx, 0x4e518e9a
add rcx, 0x7fffffff
xor rcx, 0x4e162a45
not rax
mov dword [rsp - 0x18], 0x22e1c72
sub rax, rcx
lea rcx, [rsp + 0x30]
call rax
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg r13, rbx
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
mov rdi, rdi
ret
mov eax, 0x4be9df00
sub eax, 0x2581342e
xor eax, 0x758a7994
add eax, 0x104d46d6
xor eax, 0xa4301a1d
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
xchg rcx, rcx
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rdx, rbx
mov rdx, qword [rsp + 0x250]
xchg rdx, rbx
mov eax, 0x5b0d1e7
add eax, 0x8127631
add eax, 0x2e1a957e
add eax, 0x8422239f
sub rsp, 0xb9dcfd4
add rsp, 0xb9dd214
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008d420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140140c24], 0
mov dword [rsp - 0x38], ecx
jne 0x14008d521
xor edx, edx
lea r8, [0x140140c20]
mov rsi, rsi
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov r10, r10
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0x34], edx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov rbp, rbp
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], edx
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x38], 0x1503745
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x14], ecx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x20], 0x5a8b4617
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x14], edx
shr eax, 1
and ecx, 1
neg ecx
mov r12, r12
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg rbx, rbx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x24], ebp
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rsp, rsp
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r10, r10
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x10], edx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x28], esi
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008d447
ret
Function at 0x140092660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg r8, rsi
nop
push 0x59c10e10
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x1c], 0x5d74a1ea
mov r15, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
mov rbx, rbx
shl ebx, 3
shl ebx, 4
shl ebx, 1
dec r8d
xchg r13, r13
or ebx, eax
shl edi, 1
shl edi, 3
shl edi, 3
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x1c], ebp
shl ebx, 7
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
xchg r15, r15
shl ebx, 6
shl ebx, 2
or ebx, eax
mov dword [rsp - 0x24], ebp
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 6
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x18], ebp
shl edi, 1
shl edi, 5
shl edi, 1
shl edi, 1
or edi, eax
test r8d, r8d
jle 0x1400927b0
mov dword [rsp - 0x44], ebx
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
mov dword [rsp - 0x2c], ecx
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
mov dword [rsp - 0x1c], 0x6a899bcc
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rdx, rbp
mov rbp, rsi
xchg rbp, rdx
mov ecx, edi
mov rbp, rbp
call fcn.140092e90
xor ebx, eax
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
mov ecx, ebx
mov dword [rsp - 0xc], edx
call fcn.140092e90
xor edi, eax
nop
add rsi, 0x6dd44ab3
sub rsi, 0x6dd44acb
nop
sub rbp, 0x1f48b1ae
add rbp, 0x1f48b196
sub r14, 1
mov dword [rsp - 0x10], 0x6e5c3182
jne 0x140092755
lea rax, [r15 + 7]
mov ecx, 0x111ab366
add ecx, 0x6b9e6d6e
sub ecx, 0x14db6893
xor ecx, 0x67ddb845
mov byte [rax - 4], dil
mov byte [rax], bl
xchg rbp, rbp
dec rax
shr ebx, 3
shr ebx, 3
shr ebx, 1
shr ebx, 1
shr edi, 2
shr edi, 5
shr edi, 1
sub rcx, 1
jne 0x1400927cb
mov rcx, rcx
xchg rbx, r12
mov r12, qword [rsp + 0x40]
xchg r12, rbx
xchg rbp, rcx
mov rcx, qword [rsp + 0x48]
xchg rbp, rcx
xchg r14, rsi
mov r14, qword [rsp + 0x50]
xchg rsi, r14
nop
add rsp, 0x77017b5e
sub rsp, 0x77017b3e
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009283c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg rbp, rbp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xchg r10, rsi
mov qword [rax + 0x18], r10
xchg r10, rsi
xchg rdi, r9
mov qword [rax + 0x20], r9
xchg rdi, r9
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
xchg r14, r15
mov r15, r8
xchg r15, r14
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov rsi, rsi
shl ebx, 5
shl ebx, 3
or ebx, eax
mov r10, r10
shl edi, 2
shl edi, 4
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x10], esi
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 3
shl ebx, 1
shl ebx, 3
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
xchg rsi, rsi
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 1
shl edi, 2
shl edi, 4
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x38], 0x35fb583b
shl edi, 8
or edi, eax
mov eax, dword [rcx + 4]
test eax, eax
mov rbx, rbx
jle 0x140092937
xchg rsi, rsp
mov rsp, qword [rcx + 8]
xchg rsp, rsi
lea ebp, [rax - 1]
mov dword [rsp - 0x1c], ecx
shr ebp, 1
inc ebp
mov rdx, rsi
xchg r9, r9
mov ecx, edi
call fcn.140092e90
xor ebx, eax
lea rdx, [rsi + 0xc]
mov r15, r15
mov ecx, ebx
call fcn.140092e90
xor edi, eax
sub rsi, 0xffffffffffffffe8
mov r11, r11
sub rbp, 1
jne 0x140092907
lea rax, [r14 + 7]
mov ecx, 0x40b186cb
add ecx, 0x1af75f03
sub ecx, 0x4d6b3be0
sub ecx, 0xe3da9ea
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x1c], ebx
dec rax
shr ebx, 4
shr ebx, 3
shr ebx, 1
shr edi, 2
shr edi, 4
shr edi, 1
shr edi, 1
sub rcx, 1
mov r15, r15
jne 0x140092952
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
mov rbp, qword [rsp + 0x38]
xchg r12, rsi
mov r12, qword [rsp + 0x40]
xchg r12, rsi
mov rdi, qword [rsp + 0x48]
xchg r14, r14
sub rsp, 0xffffffffffffffe0
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140092b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r13, r13
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push rbx
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140001db0]
xchg rcx, rcx
xor edi, edi
movdqa xmm1, xmmword [0x140001e50]
mov rbx, rdx
movdqu xmmword [rbp - 0x39], xmm0
xchg rbx, rbx
mov rsi, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001e40]
mov rdi, rdi
mov r8d, edi
xchg rbp, r15
movdqu xmmword [r15 - 0x29], xmm1
xchg rbp, r15
movdqa xmm1, xmmword [0x140001da0]
mov dword [rsp - 0x18], ecx
xchg rbp, r15
movdqu xmmword [r15 - 0x19], xmm0
xchg rbp, r15
movdqu xmmword [rbp - 9], xmm1
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x28], 0x43fe2795
mov eax, 0x1998c5f0
xor eax, 0x238eb12f
add eax, 0x215cb593
xor eax, 0x65260a93
sub eax, 0x16acbfde
inc rdx
mov rdi, rdi
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov dword [rsp - 0x20], ebp
jb 0x140092bfd
cmp dword [rsi + 4], 8
jne 0x140092cb8
xchg r15, r15
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
mov dword [rsp - 0x30], 0x5bc25f33
inc rdi
shl cx, 3
shl cx, 1
shl cx, 1
shl cx, 2
shl cx, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov dword [rsp - 0x14], esp
cmp rdi, 4
jl 0x140092c55
lea r9, [rbp + 7]
xor r8d, r8d
mov dword [rsp - 0x24], 0x5193e949
lea rdx, [rbp + 0x67]
xchg rbp, rsi
mov rcx, rbp
xchg rsi, rbp
call fcn.1400929b0
jmp 0x140092d7e
cmp dword [rsi], edi
mov r12, r12
jle 0x140092d7e
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov rcx, rcx
mov r8d, 0x7c62ec47
sub r8d, 0x6699a456
xor r8d, 0x233876d1
sub r8d, 0x152c7e07
xor r8d, 0x21c4b31d
movzx eax, byte [rbx]
mov dword [rsp - 0x2c], ecx
movzx ecx, byte [rbx + 1]
sub rbx, 0xfffffffffffffffe
shl ax, 8
or cx, ax
mov dword [rsp - 0x40], 0x7769ec53
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140092cef
mov dword [rsp - 0x2c], edx
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg rsi, rsi
xchg r9, rsi
mov rcx, r9
xchg r9, rsi
call fcn.1400929b0
mov dword [rsp - 0x1c], ebx
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
xchg r10, r10
sub r8d, 8
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.1400929b0
inc edi
neg r14d
add r14d, 0xfffffff8
neg r14d
cmp edi, dword [rsi]
mov dword [rsp - 0x14], edx
jl 0x140092cc6
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rcx, rcx
xchg r8, rbx
mov r8, qword [r11 + 0x28]
xchg r8, rbx
lea rdi, [rbp + 7]
xchg rbp, rbp
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
mov rbp, rbp
mov rsp, r11
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
mov r13, r13
pop rbp
ret

Function at 0x140092e44
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov dword [rsp - 0x24], 0x4cb54b72
mov r11d, ecx
test edx, edx
je 0x140092e8b
lea ecx, [r11 + r11]
xchg r14, r14
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov rsp, rsp
test dl, 1
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov dword [rsp - 0x3c], ebp
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
mov r15, r15
jne 0x140092e56
mov eax, r10d
ret
Function at 0x14009de5c
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
mov dword [rsp - 0x2c], ebp
xor r8d, r8d
xchg rsi, r9
mov rsi, rdx
xchg r9, rsi
test rax, rax
je 0x14009dec7
mov dword [rsp - 0x24], ecx
mov ecx, r8d
mov edx, 0x11f60f15
add edx, 0x2d0ac821
sub edx, 0x37a5cca3
add edx, 0x3ebff2d9
sub edx, 0x1e729c69
rol edx, cl
xchg r15, r15
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
mov r8, r8
inc r8
cmp r8, 0x20
jb 0x14009de80
mov al, 0x13
add al, 0x29
sub al, 0x14
sub al, 0x27
ret
xchg rbp, rax
mov rbp, qword [rcx + 0x100]
xchg rbp, rax
test rax, rax
je 0x14009df05
movups xmm0, xmmword [rax]
mov rbx, rbx
xchg r12, rdx
movups xmmword [r12], xmm0
xchg r12, rdx
xchg r10, rax
movups xmm1, xmmword [r10 + 0x10]
xchg r10, rax
xchg r13, rdx
movups xmmword [r13 + 0x10], xmm1
xchg rdx, r13
jmp 0x14009debe
xorps xmm0, xmm0
mov r14, r14
xor al, al
xchg r9, rdx
movups xmmword [r9], xmm0
xchg rdx, r9
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1400d7860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg rsi, r9
mov qword [rsp + 0x20], rdi
xchg rdi, rdi
push rbp
xchg rsp, rbp
mov rsp, rbp
xchg rsp, rbp
sub rsp, 0x50
xor esi, esi
mov dword [rbp - 0x30], 0x4a5dc48f
add dword [rbp - 0x30], 0xdca8743
sub dword [rbp - 0x30], 0x2a3c512e
add dword [rbp - 0x30], 0xfd28fb1
xor dword [rbp - 0x30], 0x3d948a79
mov dword [rbp - 0x2c], 0x72e2be39
xor dword [rbp - 0x2c], 0x22e74f06
xor dword [rbp - 0x2c], 0x326c03b7
xor dword [rbp - 0x2c], 0x2e5d9171
sub dword [rbp - 0x2c], 0x4bbf63d4
xchg rcx, r11
mov rbx, r11
xchg r11, rcx
mov dword [rbp - 0x28], 0x5d266b66
xor dword [rbp - 0x28], 0x44b63733
sub dword [rbp - 0x28], 0x3eb82ed
add dword [rbp - 0x28], 0x319740e8
sub dword [rbp - 0x28], 0x46d11a08
mov dword [rbp - 0x24], 0x5a719e8
add dword [rbp - 0x24], 0x79a10049
sub dword [rbp - 0x24], 0x7b86e395
add dword [rbp - 0x24], 0x271fd442
sub dword [rbp - 0x24], 0x2a930aa5
mov dword [rbp - 0x20], 0x4416dd53
add dword [rbp - 0x20], 0x4c02ab1
xor dword [rbp - 0x20], 0x1ccfbd19
add dword [rbp - 0x20], 0x1927bcba
sub dword [rbp - 0x20], 0x6d0b71c0
xchg rsi, rcx
mov qword [rbp + 0x10], rcx
xchg rsi, rcx
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xchg rcx, r11
mov r11, qword [rbp + 0x10]
xchg r11, rcx
mov rax, qword [rbp + 0x10]
and cl, 3
mov dword [rsp - 0x1c], ecx
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov r14, r14
mov eax, 0x131080b7
xor eax, 0x78ac3b2d
xor eax, 0xd46bf87
xor eax, 0x4ced5d66
shr eax, cl
xchg rsi, rsi
movzx ecx, al
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov rsi, rsi
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
mov rdx, rdx
mov qword [rbp + 0x10], rax
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
cmp rax, 0xa
mov dword [rsp - 0x40], ebx
jb 0x1400d7952
xor edx, edx
mov word [rbp - 8], si
mov dword [rsp - 0x20], 0x49c60825
lea rcx, [rbp - 0x1c]
call fcn.140089ef0
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x200], rax
xor eax, eax
xchg r8, r8
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
xchg r12, r12
test r8, r8
je 0x1400d7a5f
lea rdx, [rbx + 0x208]
xchg rsp, rsp
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.1400d80f0
test al, al
jne 0x1400d7a55
mov dword [rsp - 0x38], ebp
xchg rcx, rbp
mov rbp, qword [rbx + 0x200]
xchg rbp, rcx
call fcn.14008c430
mov dword [rsp - 0x10], edi
xor al, al
xchg rbp, rsi
mov qword [rbx + 0x200], rbp
xchg rbp, rsi
jmp 0x1400d7a5f
mov al, 0x56
add al, 2
add al, 1
xor al, 0x75
sub al, 0x2b
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg r13, rbx
mov rsi, qword [rsp + 0x70]
xchg r14, rdi
mov r14, qword [rsp + 0x78]
xchg r14, rdi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret