joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073688
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x1400738c9
mov r11, rsp
push r12
push r13
sub rsp, 0xf8
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov qword [r11 + 8], rbx
xor r9d, r9d
mov qword [r11 + 0x10], rbp
mov r8, rcx
mov qword [r11 + 0x18], rsi
mov r12d, r9d
mov rsi, qword [0x140132f80]
mov qword [r11 - 0x18], rdi
mov edi, dword [0x14012a128]
mov qword [r11 - 0x20], r14
movsxd r13, edx
mov edx, dword [0x140132f8c]
mov qword [r11 - 0x28], r15
mov qword [rsp + 0x20], rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r12 + r8]
cmp edx, 0x140
cmove edx, r9d
movsxd rcx, edx
mov dword [0x140132f8c], edx
add byte [rcx + rsi], al
mov eax, edx
and eax, 0x80000007
jge 0x14007371b
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x14007386a
cmp edi, 1
jne 0x14007386a
mov r14, r9
lea rbp, [rsp + 0x90]
mov rbx, r9
lea r15d, [rax + 0x10]
nop
cmp edi, 1
jne 0x140073788
lea rcx, [rsp + 0x30]
call fcn.140078ca0
mov rdx, qword [0x140132f80]
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.14007a900
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.140078b20
mov rsi, qword [0x140132f80]
xor r9d, r9d
mov edi, dword [0x14012a128]
lea rdx, [rsi + 0x13]
mov rcx, r9
add rdx, rbx
lea rax, [rbx + rsi]
lea r8, [rsp + 0xa3]
cmp rax, r8
ja 0x1400737b0
lea r8, [rsp + 0x90]
cmp rdx, r8
jae 0x1400737c6
movdqu xmm0, xmmword [rax]
mov ecx, 0x10
pxor xmm0, xmmword [rsp + 0x90]
movdqu xmmword [rax], xmm0
lea rax, [r14 + rcx]
mov r8, rbp
add rax, rsi
sub r8, rsi
mov edx, shutdown
sub rdx, rcx
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400737e0
add rbx, 0x14
add r14, 0x14
sub rbp, 0x14
sub r15, 1
jne 0x140073740
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
cmp edi, 1
jne 0x14007385f
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400b5f30
xor r9d, r9d
mov r8, qword [rsp + 0x20]
mov edx, dword [0x140132f8c]
inc edx
inc r12
mov dword [0x140132f8c], edx
cmp r12, r13
jl 0x1400736f0
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0xf8
pop r13
pop r12
ret
Function at 0x1400738d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, dword [0x14012a128]
cmp r9d, 1
je 0x140073910
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0xd8
ret
mov r10, qword [0x140132f80]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
lea rsi, [rsp + 0x80]
mov qword [rsp + 0xd0], rdi
xor edi, edi
xor ebx, ebx
lea ebp, [rdi + 0x10]
cmp r9d, 1
jne 0x14007398d
lea rcx, [rsp + 0x20]
call fcn.140078ca0
mov rdx, qword [0x140132f80]
lea rcx, [rsp + 0x20]
mov r8d, 0x140
call fcn.14007a900
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140078b20
mov r9d, dword [0x14012a128]
mov r10, qword [0x140132f80]
lea rdx, [r10 + 0x13]
xor ecx, ecx
add rdx, rbx
lea rax, [rbx + r10]
lea r8, [rsp + 0x93]
cmp rax, r8
ja 0x1400739b4
lea r8, [rsp + 0x80]
cmp rdx, r8
jae 0x1400739ca
movdqu xmm0, xmmword [rax]
mov ecx, 0x10
pxor xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rax], xmm0
lea rax, [rdi + rcx]
mov r8, rsi
add rax, r10
sub r8, r10
mov edx, shutdown
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400739e0
add rbx, 0x14
add rdi, 0x14
sub rsi, 0x14
sub rbp, 1
jne 0x140073946
mov rdi, qword [rsp + 0xd0]
lea eax, [rdx + 1]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0xd8
ret
Function at 0x1400750c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
or eax, 0xffffffff
mov r10d, edx
mov r11, rcx
test edx, edx
je 0x140075106
mov qword [rsp], rbx
lea rbx, [0x14012a130]
nop dword [rax]
movzx r9d, byte [r11]
lea r11, [r11 + 1]
mov r8d, eax
mov ecx, eax
xor r9, r8
shr ecx, 8
movzx edx, r9b
mov eax, dword [rbx + rdx*4]
xor eax, ecx
sub r10d, 1
jne 0x1400750e0
mov rbx, qword [rsp]
not eax
add rsp, 8
ret
Function at 0x140078ca0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rcx + 0x18], 0
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
ret
Function at 0x14007aa80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rsi, qword [rbp + 0xc8]
mov rbx, r8
mov r8d, dword [rbp + 0xd0]
mov r15, rcx
mov eax, 0x66666667
mov dword [rsp + 0x48], r9d
mov r12d, edx
mov qword [rsp + 0x58], rbx
imul r8d
mov edi, edx
sar edi, 3
mov eax, edi
shr eax, 0x1f
add edi, eax
lea ecx, [rdi + rdi*4]
shl ecx, 2
cmp r8d, ecx
je 0x14007aae9
inc edi
mov r13d, dword [rbp + 0xc0]
lea eax, [rdi + rdi*4]
shl eax, 2
mov r14d, 1
sub r8d, eax
add r8d, 0x14
mov dword [rbp + 0xd0], r8d
cmp edi, r14d
jle 0x14007ac33
movsxd rax, r9d
lea rcx, [rbp - 0x50]
add rcx, rax
movaps xmmword [rsp + 0x140], xmm6
mov qword [rsp + 0x50], rcx
lea ecx, [r9 + 4]
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x60], rax
nop word [rax + rax]
xor ecx, ecx
mov r8, rax
mov dword [rsp + 0x40], ecx
mov rdx, rbx
lea rcx, [rbp - 0x50]
mov byte [rsp + 0x43], r14b
call fcn.1400b4ef0
mov rcx, qword [rsp + 0x50]
lea r8, [rbp - 0x50]
mov eax, dword [rsp + 0x40]
mov edx, r12d
mov r9d, dword [rsp + 0x44]
mov dword [rcx], eax
lea rax, [rbp - 0x80]
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14007bf90
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x78], eax
movups xmm6, xmmword [rbp - 0x80]
movups xmmword [rsp + 0x68], xmm6
cmp r13d, 1
jle 0x14007ac0b
lea ebx, [r13 - 1]
nop dword [rax]
lea rax, [rbp - 0x68]
mov r9d, shutdown
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r15
call fcn.14007bf90
movdqu xmm0, xmmword [rbp - 0x68]
xor eax, eax
pxor xmm6, xmm0
movdqu xmmword [rsp + 0x68], xmm6
lea edx, [rax + 4]
movdqu xmmword [rbp - 0x80], xmm0
nop word [rax + rax]
movzx ecx, byte [rbp + rax - 0x58]
xor byte [rsp + rax + 0x78], cl
mov byte [rbp + rax - 0x70], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14007abe0
movups xmm6, xmmword [rsp + 0x68]
sub rbx, 1
jne 0x14007aba0
mov eax, dword [rsp + 0x78]
mov rbx, qword [rsp + 0x58]
movups xmmword [rsi], xmm6
mov dword [rsi + 0x10], eax
inc r14d
mov rax, qword [rsp + 0x60]
add rsi, 0x14
cmp r14d, edi
jl 0x14007ab40
mov r9d, dword [rsp + 0x48]
movaps xmm6, xmmword [rsp + 0x140]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
mov r8, rbx
mov edx, r12d
mov dword [rsp + 0x20], r13d
mov rcx, r15
call fcn.14007b120
movsxd r8, dword [rbp + 0xd0]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1400b4ef0
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14007b900
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rsi, qword [rbp + 0xb8]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r10, r8
movzx eax, byte [rbp + 0xc0]
mov r15d, edx
movsxd rdi, r9d
mov r14, rcx
mov r8, rdi
mov byte [rsp + 0x33], al
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.1400b4ef0
mov eax, dword [rsp + 0x30]
lea r9d, [rdi + 4]
mov dword [rbp + rdi - 0x40], eax
lea r8, [rbp - 0x40]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x40
mov edx, r15d
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.14007c490
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
mov eax, dword [rbp + 0xb0]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
cmp eax, 1
jle 0x14007ba8c
lea rdi, [rsi + 0x3f]
lea ebx, [rax - 1]
nop dword [rax]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 0x40
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov edx, r15d
mov rcx, r14
call fcn.14007c490
xor eax, eax
lea rcx, [rsp + 0x40]
cmp rcx, rdi
ja 0x14007b9fd
lea rcx, [rsp + 0x7f]
cmp rcx, rsi
jae 0x14007ba0f
lea rcx, [rbp - 0x41]
cmp rsi, rcx
ja 0x14007ba3d
lea rcx, [rbp - 0x80]
cmp rdi, rcx
jb 0x14007ba3d
lea rcx, [rbp - 0x80]
mov r8, rsi
sub r8, rcx
nop dword [rax]
lea rcx, [rbp - 0x80]
add rcx, rax
movzx edx, byte [rcx]
xor byte [r8 + rcx], dl
mov byte [rsp + rax + 0x40], dl
inc rax
cmp rax, 0x40
jl 0x14007ba20
jmp 0x14007ba82
lea rdx, [rsp + 0x40]
mov rax, rsi
sub rdx, rsi
lea r8, [rbp - 0x80]
sub r8, rsi
mov ecx, 4
nop dword [rax]
nop dword [rax + rax]
movdqu xmm1, xmmword [r8 + rax]
movdqu xmm0, xmmword [rax]
movdqu xmmword [rdx + rax], xmm1
lea rax, [rax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x14007ba60
sub rbx, 1
jne 0x14007b9c0
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0x158
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14007bf90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov rsi, qword [rbp + 0x100]
mov r15d, r9d
mov r14, r8
mov ebx, edx
mov rdi, rcx
cmp edx, 0x40
jle 0x14007c004
lea rcx, [rbp - 0x80]
call fcn.140078ca0
mov r8d, ebx
lea rcx, [rbp - 0x80]
mov rdx, rdi
call fcn.14007a900
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x80]
call fcn.140078b20
lea rdi, [rbp + 0x80]
mov ebx, shutdown
movabs rax, 0x3636363636363636
xor ecx, ecx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov byte [rbp + 0x20], al
movabs rax, 0x5c5c5c5c5c5c5c5c
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x70], al
test ebx, ebx
jle 0x14007c0e0
cmp ebx, 0x10
jb 0x14007c0e0
lea eax, [rbx - 1]
movsxd rdx, eax
lea r8, [rbp + 0x30]
add r8, rdx
lea r9, [rbp + 0x30]
lea rax, [rdx + rdi]
cmp r9, rax
ja 0x14007c088
cmp r8, rdi
jae 0x14007c0e0
lea r8, [rbp - 0x20]
add r8, rdx
lea rdx, [rbp - 0x20]
cmp rdx, rax
ja 0x14007c09d
cmp r8, rdi
jae 0x14007c0e0
mov eax, ebx
and eax, 0x8000000f
jge 0x14007c0ad
dec eax
or eax, 0xfffffff0
inc eax
mov edx, ebx
sub edx, eax
movsxd rax, ecx
add ecx, 0x10
movdqu xmm1, xmmword [rax + rdi]
movdqu xmm0, xmmword [rbp + rax - 0x20]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 0x20], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x30]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax + 0x30], xmm0
cmp ecx, edx
jl 0x14007c0b1
movsxd rax, ecx
movsxd r9, ebx
cmp rax, r9
jge 0x14007c115
lea r10, [rbp - 0x20]
lea r11, [rbp + 0x30]
sub r10, rdi
sub r11, rdi
lea rcx, [rax + rdi]
sub r9, rax
movzx eax, byte [rcx]
xor byte [r10 + rcx], al
xor byte [r11 + rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x14007c100
lea rcx, [rsp + 0x20]
call fcn.140078ca0
mov r8d, 0x40
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x20]
call fcn.14007a900
mov r8d, r15d
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.14007a900
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140078b20
lea rcx, [rsp + 0x20]
call fcn.140078ca0
mov r8d, 0x40
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14007a900
mov r8d, shutdown
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.14007a900
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140078b20
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0x1a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140081c00
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, r8
lea rax, [0x14012aa10]
mov rdi, rcx
mov r9, rcx
mov r8d, edx
mov ecx, 0x20
nop word [rax + rax]
lea r9, [r9 + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [r9 - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [r9 - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [r9 - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [r9 - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [r9 - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [r9 - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [r9 - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [r9 - 0x10], xmm1
sub rcx, 1
jne 0x140081c30
movups xmm0, xmmword [rax]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x30], xmm1
mov rcx, qword [rax + 0x40]
mov eax, 0x48
cmp edx, eax
mov qword [r9 + 0x40], rcx
mov rdx, r10
cmovg r8d, eax
movsxd r8, r8d
add r8, r10
xor ebx, ebx
mov r9d, ebx
nop
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x140081cd0
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14008efa0
mov eax, dword [rsp + 0x30]
mov dword [rdi + rsi*4], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 + 4], eax
add rsi, 2
cmp rsi, 0x12
jl 0x140081d30
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14008efa0
mov eax, dword [rsp + 0x30]
mov dword [rdi + rbx*4 + 0x48], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x4c], eax
add rbx, 2
cmp rbx, 0x400
jl 0x140081d60
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140088250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r11, [0x1401360a0]
mov ebx, 0x100
lea r10, [0x1401358a0]
lea rdi, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r11 + 0x100]
lea r10, [r10 + 4]
mov ecx, r9d
lea r11, [r11 + 1]
and ecx, 3
mov edx, r9d
shr edx, 1
mov eax, r9d
xor edx, r9d
shr eax, 2
shr edx, 1
movzx r8d, byte [rcx + rdi + 0x12db50]
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x12db54]
xor edx, eax
xor r8d, r9d
xor edx, r9d
imul eax, edx, 0x10100
add eax, r8d
shl eax, 8
add eax, r9d
shl r9d, 0x10
mov dword [r10 - 0x804], eax
imul eax, edx, 0x1000100
add eax, r8d
add r9d, eax
mov dword [r10 - 4], r9d
movzx r9d, byte [r11 - 1]
mov ecx, r9d
mov edx, r9d
shr edx, 1
and ecx, 3
xor edx, r9d
mov eax, r9d
shr edx, 1
shr eax, 2
movzx r8d, byte [rcx + rdi + 0x12db50]
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x12db54]
xor edx, eax
xor r8d, r9d
xor edx, r9d
mov ecx, r9d
imul eax, edx, 0x101
shl ecx, 8
shl edx, 8
add ecx, r8d
add edx, r9d
shl ecx, 0x10
shl edx, 8
add ecx, eax
imul eax, r8d, 0x1000001
mov dword [r10 - 0x404], ecx
add edx, eax
mov dword [r10 + 0x3fc], edx
sub rbx, 1
jne 0x140088280
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140088370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor ebx, ebx
lea rdi, [0x1401361a0]
lea rsi, [0x140000000]
nop
movzx r11d, bl
lea rdi, [rdi + 1]
shr r11b, 4
movzx r10d, bl
and r10b, 0xf
movzx ecx, r11b
mov eax, ecx
movzx edx, r10b
xor rax, rdx
inc ebx
movzx ecx, byte [rcx + rsi + 0x12db68]
movzx r8d, byte [rax + rsi + 0x12db78]
movzx eax, byte [rdx + rsi + 0x12db58]
mov r9d, r8d
xor rcx, rax
movzx edx, byte [rcx + rsi + 0x12db98]
movzx ecx, byte [r8 + rsi + 0x12db68]
xor r9, rdx
movzx eax, byte [rdx + rsi + 0x12db58]
xor rcx, rax
movzx edx, r10b
movzx eax, byte [rcx + rsi + 0x12dbd8]
shl al, 4
or al, byte [r9 + rsi + 0x12dbb8]
mov byte [rdi - 0x101], al
movzx ecx, r11b
mov eax, ecx
xor rax, rdx
movzx ecx, byte [rcx + rsi + 0x12db68]
movzx r8d, byte [rax + rsi + 0x12db88]
movzx eax, byte [rdx + rsi + 0x12db58]
mov r9d, r8d
xor rcx, rax
movzx edx, byte [rcx + rsi + 0x12dba8]
movzx ecx, byte [r8 + rsi + 0x12db68]
xor r9, rdx
movzx eax, byte [rdx + rsi + 0x12db58]
xor rcx, rax
movzx eax, byte [rcx + rsi + 0x12dbe8]
shl al, 4
or al, byte [r9 + rsi + 0x12dbc8]
mov byte [rdi - 1], al
cmp ebx, 0x100
jb 0x140088390
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14008aa60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
mov r13, rcx
mov rcx, rdi
xor edx, edx
mov r8d, 0x1000
call fcn.1400b5f30
xor ebp, ebp
lea r11, [0x1400e7a70]
mov r15d, ebp
nop
test ebp, ebp
jne 0x14008ab36
mov rax, qword [r13]
mov ebx, 4
mov qword [rdi + 0x180], rax
nop dword [rax + rax]
lea eax, [rbx + rbx]
movsxd rcx, ebx
cdqe
add rcx, 0x10
add rax, 0x10
shl rcx, 4
add rax, rax
add rcx, rdi
mov rax, qword [rdi + rax*8]
mov qword [rcx], rax
call fcn.14008af70
sar ebx, 1
test ebx, ebx
jg 0x14008aac0
mov rax, qword [rdi + 0x110]
lea rcx, [rdi + 0x80]
mov qword [rcx], rax
call fcn.14008af70
mov ebx, 4
nop word [rax + rax]
lea eax, [rbx + rbx]
movsxd rcx, ebx
cdqe
add rax, rax
shl rcx, 4
add rcx, rdi
mov rax, qword [rdi + rax*8]
mov qword [rcx], rax
call fcn.14008af70
sar ebx, 1
test ebx, ebx
jg 0x14008ab10
jmp 0x14008ab8f
cmp ebp, 1
jle 0x14008ab8f
mov r10d, 8
movsxd rcx, r10d
sar r10d, 1
lea rax, [rcx - 0x20]
add rax, r15
lea r9, [r15 + rcx]
add rax, rax
shl r9, 4
add r9, rdi
mov rax, qword [rdi + rax*8]
mov qword [r9], rax
mov r8d, eax
mov ecx, dword [r9 + 4]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
shr eax, 0x18
or eax, ecx
shl r8d, 8
mov dword [r9 + 4], eax
movzx ecx, word [r11 + rdx*2]
xor ecx, r8d
mov dword [r9], ecx
test r10d, r10d
jg 0x14008ab41
mov r9d, 2
movsxd r12, ebp
mov r11d, r9d
shl r12, 8
nop
lea rax, [r15 + r11]
shl rax, 4
lea r10, [rdi + 0x10]
add rax, rdi
add r10, r12
cmp r9d, 1
jle 0x14008ac1b
lea ecx, [r9 + 1]
movsxd rdx, ecx
lea r8, [rdi + 8]
shl rdx, 4
add r8, r12
add r8, rdx
neg rdx
lea rbx, [rdx + 0xc]
lea rsi, [rdx + 0x10]
lea r14, [rdx + 0x14]
lea edx, [r9 - 1]
mov ecx, dword [r10]
lea r8, [r8 + 0x10]
xor ecx, dword [rax]
lea r10, [r10 + 0x10]
mov dword [r8 - 0x18], ecx
mov ecx, dword [rbx + r8 - 0x10]
xor ecx, dword [rax + 4]
mov dword [r8 - 0x14], ecx
mov ecx, dword [rsi + r8 - 0x10]
xor ecx, dword [rax + 8]
mov dword [r8 - 0x10], ecx
mov ecx, dword [r14 + r8 - 0x10]
xor ecx, dword [rax + 0xc]
mov dword [r8 - 0xc], ecx
sub rdx, 1
jne 0x14008abe0
add r9d, r9d
add r11, r11
cmp r9d, 0x10
jl 0x14008aba0
inc ebp
lea r11, [0x1400e7a70]
add r15, 0x10
cmp ebp, 0x10
jl 0x14008aaa0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008ac60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r13, rcx
mov rcx, rbx
xor edx, edx
mov r8d, 0x2000
call fcn.1400b5f30
xor ebp, ebp
lea r11, [0x1400e7870]
mov r15d, ebp
nop
test ebp, ebp
jne 0x14008ad3a
movups xmm0, xmmword [r13]
mov edi, 4
movups xmmword [rbx + 0x180], xmm0
nop dword [rax]
lea eax, [rdi + rdi]
movsxd rcx, edi
add rcx, 0x10
movsxd rdx, eax
add rdx, 0x10
shl rcx, 4
add rdx, rdx
add rcx, rbx
movups xmm0, xmmword [rbx + rdx*8]
movups xmmword [rcx], xmm0
call fcn.14008aea0
sar edi, 1
test edi, edi
jg 0x14008acc0
movups xmm0, xmmword [rbx + 0x110]
lea rcx, [rbx + 0x80]
movups xmmword [rcx], xmm0
call fcn.14008aea0
mov edi, 4
nop dword [rax + rax]
lea eax, [rdi + rdi]
movsxd rcx, edi
movsxd rdx, eax
add rdx, rdx
shl rcx, 4
add rcx, rbx
movups xmm0, xmmword [rbx + rdx*8]
movups xmmword [rcx], xmm0
call fcn.14008aea0
sar edi, 1
test edi, edi
jg 0x14008ad10
jmp 0x14008adc5
cmp ebp, 1
jle 0x14008adc5
mov r10d, 8
nop dword [rax]
movsxd rcx, r10d
sar r10d, 1
lea rax, [rcx - 0x20]
add rax, r15
lea r9, [r15 + rcx]
add rax, rax
shl r9, 4
add r9, rbx
movups xmm0, xmmword [rbx + rax*8]
movups xmmword [r9], xmm0
mov edx, dword [r9 + 8]
mov eax, edx
mov ecx, dword [r9 + 0xc]
mov r8d, ecx
shr eax, 0x18
shl ecx, 8
or eax, ecx
shl edx, 8
mov ecx, dword [r9 + 4]
mov dword [r9 + 0xc], eax
mov eax, ecx
shr eax, 0x18
or eax, edx
shl ecx, 8
mov edx, dword [r9]
mov dword [r9 + 8], eax
mov eax, edx
shr r8d, 0x18
shr eax, 0x18
or eax, ecx
shl edx, 8
mov dword [r9 + 4], eax
movzx ecx, word [r11 + r8*2]
xor ecx, edx
mov dword [r9], ecx
test r10d, r10d
jg 0x14008ad50
mov r9d, 2
movsxd r12, ebp
mov r14d, r9d
shl r12, 8
nop word [rax + rax]
lea rdx, [r15 + r14]
shl rdx, 4
lea r8, [rbx + 0x10]
add rdx, rbx
add r8, r12
cmp r9d, 1
jle 0x14008ae55
lea eax, [r9 + 1]
movsxd rcx, eax
lea r10d, [r9 - 1]
shl rcx, 4
lea rax, [rbx + 8]
add rax, r12
add rax, rcx
neg rcx
lea r11, [rcx + 0xc]
lea rdi, [rcx + 0x10]
lea rsi, [rcx + 0x14]
mov ecx, dword [r8]
lea rax, [rax + 0x10]
xor ecx, dword [rdx]
lea r8, [r8 + 0x10]
mov dword [rax - 0x18], ecx
mov ecx, dword [r11 + rax - 0x10]
xor ecx, dword [rdx + 4]
mov dword [rax - 0x14], ecx
mov ecx, dword [rdi + rax - 0x10]
xor ecx, dword [rdx + 8]
mov dword [rax - 0x10], ecx
mov ecx, dword [rsi + rax - 0x10]
xor ecx, dword [rdx + 0xc]
mov dword [rax - 0xc], ecx
sub r10, 1
jne 0x14008ae20
add r9d, r9d
add r14, r14
cmp r9d, 0x10
jl 0x14008ade0
inc ebp
lea r11, [0x1400e7870]
add r15, 0x10
cmp ebp, 0x20
jl 0x14008aca0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret