joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ac16
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r14
mov r14, rsp
xchg r14, r11
mov qword [r11 + 0x20], rbx
mov r11, r11
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
mov dword [rsp - 0x20], 0x3d00b90
xchg r10, rbx
mov r10, qword [rcx]
xchg rbx, r10
lea rax, [r11 - 0x40]
xchg rbx, rbp
mov qword [r11 + 8], rbx
xchg rbx, rbp
xorps xmm0, xmm0
xchg r14, r14
xchg rbx, rax
mov qword [r11 - 0x48], rbx
xchg rbx, rax
mov ebp, r8d
mov r9, r9
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov r8, r8
mov r14, rdx
xchg rsp, rdi
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rsi + 1]
xchg rsp, r12
movups xmmword [r12 + 0x38], xmm0
xchg r12, rsp
xchg rsp, rbp
movups xmmword [rbp + 0x48], xmm0
xchg rbp, rsp
call fcn.14001795c
mov edx, 0x9c55ca4
sub edx, 0x28efd4f
add edx, 0x4db6b19f
xor edx, 0x61349682
sub edx, 0x8844367
test rsi, rsi
xchg r9, r9
je 0x14008ac7d
xchg r12, rax
mov rdi, r12
xchg r12, rax
sub rbx, rax
mov r8, r8
xchg r11, r8
mov r11, rsi
xchg r8, r11
mov r9d, 0x21c5d8d5
add r9d, 0x502ed225
sub r9d, 0x3e2402e1
add r9d, 0x1d76da24
sub r9d, 0x5147813e
nop word [rax + rax]
movzx ecx, dx
xchg rdx, rdx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 2
ror edx, 1
ror edx, 4
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rsi, rsi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008ac4c
xchg r10, r10
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg r14, r14
xchg r14, r9
mov rdx, r9
xchg r14, r9
mov rcx, qword [rsp + 0x20]
call fcn.14008ad50
mov rcx, qword [rsp + 0x20]
xchg rbp, rbp
mov ebx, eax
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rdx, rdx
mov rsi, qword [rsp + 0x78]
xchg rbp, r9
mov r9, qword [rsp + 0x70]
xchg r9, rbp
cmp rcx, rax
mov r15, r15
jne 0x14008ad19
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x17e3074c
xor ecx, 0x6512ed61
xor ecx, 0x3056b9f1
sub ecx, 0x42a753ac
rep stosb byte [rdi], al
mov r14, r14
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x5c8e1638
sub rsp, 0x5c8e15d8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098ac0
mov rdi, rdi
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
sub rsp, 0x21da682f
add rsp, 0x21da688f
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008ad50
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
nop
push r15
mov qword [rsp], rdi
sub rsp, 0x240
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
mov rdi, rcx
xor edx, edx
mov dword [rsp - 0x1c], esi
lea rcx, [rsp + 0x30]
mov r8d, 0x495787fe
add r8d, 0x29886435
xor r8d, 0x45086c99
xor r8d, 0x37d782a2
call fcn.1400990e0
mov dword [rsp - 0x34], ebx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg r12, rax
mov r12, qword [r8 + 0x10]
xchg r12, rax
mov r8, qword [rax]
mov rbp, rbp
test r8, r8
je 0x14008b022
mov r8, qword [r8 + 0x50]
test r8, r8
xchg rdx, rdx
je 0x14008b022
mov edx, 0xc50f7ab
xor edx, 0x51ddaba
add edx, 0x5c24109e
sub edx, 0x65713cab
lea rcx, [rsp + 0x30]
mov rsi, rsi
lea r9d, [rdx - 1]
call fcn.140099c60
mov edx, 0x486edc2e
sub edx, 0x42e565b7
add edx, 0x269c5b87
xor edx, 0x6c1f8c00
sub edx, 0x403a5da2
lea rcx, [rsp + 0x30]
call fcn.140099d90
mov dword [rsp - 0x2c], 0x746992d9
test rax, rax
je 0x14008afe7
xor ecx, ecx
mov rdx, rdi
xchg r11, r11
mov word [rax], cx
movabs rcx, 0x810fb74a635669f8
add rcx, 0xeb02af6
xor rcx, 0x4b30541a
xor rcx, 0x1490e848
mov r8, qword [0x140142690]
movabs rax, 0x7903d6854fb9f21a
sub rax, 0x320acd7f
add rax, 0x20aedcd0
add rax, 0x7fffffff
xor rax, 0x58c70baf
add r8, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdi
xor r8, rax
movabs rax, 0x5558b335723fa183
xor rax, 0x34f476f9
xor rax, 0x1be9712d
xor rax, 0x175255e1
sub r8, rax
mov dword [rsp - 0x40], edi
movabs rax, 0xac34ac5e1834fe22
add rax, 0x347aedb1
sub rax, 0x2a855b3f
add rax, 0x863b519
add rax, 0x7fffffff
sub rax, 0x7278fe1
xor r8, rax
movabs rax, 0x13916da977e5af81
sub rax, 0x4d641282
xor rax, 0x7a97f0e3
xor rax, 0x6e5ab8e1
sub r8, rax
call r8
mov dword [rsp - 0x1c], 0x58ded137
mov r10, qword [0x140142680]
lea r8, [rsp + 0x20]
movabs rcx, 0xd23308c143132981
sub rcx, 0x1c9a0afa
xor rcx, 0x79c5a24b
add rcx, 0xb6fd509
sub rcx, 0x177a1f97
lea rdx, [rsp + 0x260]
add r10, rcx
mov r12, r12
movabs rax, 0x3ac97cf67d770536
sub rax, 0x640f5512
sub rax, 0xd2678b9
add rax, 0x19f5e951
add rax, 0x68aae5a2
ror r10, 0x2d
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x24], 0x349077c7
add r10, rax
mov r9, rbx
rol r10, 1
rol r10, 5
movabs rax, 0x2f6209ec5c7e11f9
sub rax, 0x2acc5620
xor rax, 0x57dbd07f
xor rax, 0xcace3e2
add rax, 0x14b44044
sub r10, rax
ror r10, 0x2e
ror r10, 4
ror r10, 5
ror r10, 1
ror r10, 1
call r10
mov rbx, qword [rsp + 0x250]
mov rcx, rcx
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
xchg r8, r8
ret
mov eax, 0x45a1d911
add eax, 0x33e64964
xor eax, 0x4e519469
sub eax, 0x171785ed
xor eax, 0xe0c2302e
mov rbx, qword [rsp + 0x250]
xchg r11, r11
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xchg rbx, rcx
mov rcx, qword [rsp + 0x250]
xchg rbx, rcx
mov eax, 0x6741858b
sub eax, 0x4ab77aeb
add eax, 0xe447d43
add eax, 0x95317952
sub rsp, 0xfffffffffffffdc0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008e530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142c24], 0
mov r11, r11
jne 0x14008e647
xor edx, edx
lea r8, [0x140142c20]
mov rdi, rdi
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
xchg r10, r10
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x38], 0x15fa7b8d
neg ecx
and ecx, 0xedb88320
inc edx
mov dword [rsp - 0x38], ebx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x28], 0x6a9251a3
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r13, r13
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x24], ebp
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x18], 0xeb634da
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0xc], 0x6e498cc
xor eax, ecx
mov ecx, eax
shr eax, 1
mov r12, r12
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r14, r14
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x10], 0x3dae1225
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x1c], 0x7af4a315
mov ecx, eax
shr eax, 1
and ecx, 1
mov r10, r10
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov r15, r15
shr ecx, 1
and eax, 1
neg eax
mov r9, r9
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov dword [rsp - 0x20], 0xe3fec52
jb 0x14008e556
ret
Function at 0x14009394c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x24], 0x4dcac602
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
xchg r8, r13
mov r15, r13
xchg r8, r13
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0xc], esi
mov r8d, dword [rcx + 4]
shl ebx, 8
dec r8d
or ebx, eax
mov dword [rsp - 0x1c], 0x2e25acaa
shl edi, 3
shl edi, 3
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x34], ebp
movzx eax, byte [rdx + 3]
shl ebx, 8
or ebx, eax
mov dword [rsp - 0x3c], ebp
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 2
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x40], ebp
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x2c], ebp
test r8d, r8d
jle 0x140093a8d
xchg rdx, r13
mov r13, qword [rcx + 8]
xchg rdx, r13
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
xchg rsi, rsi
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
xchg r9, r9
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov rdx, rsi
mov dword [rsp - 0x2c], edi
mov ecx, edi
call fcn.140094164
xor ebx, eax
xchg rcx, rdx
mov rcx, rbp
xchg rdx, rcx
mov ecx, ebx
xchg r13, r13
call fcn.140094164
xor edi, eax
nop
sub rsi, 0x36ef26de
add rsi, 0x36ef26c6
neg rbp
sub rbp, 0xffffffffffffffe8
neg rbp
sub r14, 1
jne 0x140093a42
xchg r10, r10
lea rax, [r15 + 7]
mov ecx, 0x78c20d9e
add ecx, 0x389f7b7
sub ecx, 0x10fb9e3d
sub ecx, 0x5784bceb
xor ecx, 0x13cbaa29
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x18], ebx
dec rax
shr ebx, 3
shr ebx, 3
shr ebx, 2
shr edi, 5
shr edi, 2
shr edi, 1
sub rcx, 1
jne 0x140093aae
mov dword [rsp - 0x1c], 0x2ba45379
xchg rdx, rbx
mov rdx, qword [rsp + 0x40]
xchg rdx, rbx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
nop
add rsp, 0x7e45fc7d
sub rsp, 0x7e45fc5d
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x24], 0x2550b5c1
pop rdi
ret
Function at 0x140093b18
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg rbx, r14
mov qword [rax + 8], r14
xchg r14, rbx
xchg rbp, r13
mov qword [rax + 0x10], r13
xchg r13, rbp
xchg r15, rsi
mov qword [rax + 0x18], r15
xchg r15, rsi
mov qword [rax + 0x20], rdi
push r14
xchg r9, r9
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
xchg rcx, r14
mov rcx, r8
xchg r14, rcx
movzx ebx, byte [rdx]
mov r9, r9
movzx edi, byte [rdx + 4]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 5
shl edi, 2
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 4
shl ebx, 2
shl ebx, 2
or ebx, eax
xchg r14, r14
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 3
shl edi, 2
shl edi, 2
shl edi, 1
or edi, eax
xchg r14, r14
movzx eax, byte [rdx + 7]
shl edi, 7
shl edi, 1
or edi, eax
mov dword [rsp - 0x28], 0x66005516
mov eax, dword [rcx + 4]
test eax, eax
jle 0x140093c15
mov rsi, qword [rcx + 8]
mov dword [rsp - 0x24], esi
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
xchg rbx, rsi
mov rdx, rbx
xchg rsi, rbx
mov ecx, edi
xchg rdx, rdx
call fcn.140094164
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov dword [rsp - 0x28], ecx
call fcn.140094164
xor edi, eax
neg rsi
add rsi, 0xffffffffffffffe8
neg rsi
sub rbp, 1
xchg r11, r11
jne 0x140093bd8
lea rax, [r14 + 7]
mov ecx, 0x50a0add4
sub ecx, 0x20bee3d3
xor ecx, 0x5fc6ce43
sub ecx, 0x1f7bf776
xor ecx, 0x50ab0cc8
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov r10, r10
shr ebx, 7
shr ebx, 1
shr edi, 7
shr edi, 1
sub rcx, 1
jne 0x140093c36
mov dword [rsp - 0x34], 0x470521d3
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x10], esi
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
nop
add rsp, 0x8d7039b
sub rsp, 0x8d7037b
pop r14
ret
Function at 0x140093e5c
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg rbx, r10
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg r15, rsi
push rbp
xchg rdi, rdi
push rdx
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
xchg rcx, rcx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140001e30]
xor edi, edi
mov r14, r14
movdqa xmm1, xmmword [0x140001da0]
xchg rbx, r11
mov r11, rdx
xchg r11, rbx
xchg r14, rbp
movdqu xmmword [r14 - 0x39], xmm0
xchg r14, rbp
mov rsi, rcx
mov dword [rsp - 0x20], edx
mov edx, edi
movdqa xmm0, xmmword [0x140001db0]
mov r8d, edi
mov dword [rsp - 0x38], ebp
xchg r12, rbp
movdqu xmmword [r12 - 0x29], xmm1
xchg rbp, r12
movdqa xmm1, xmmword [0x140001dc0]
xchg rsp, rsp
xchg rbp, rsi
movdqu xmmword [rsi - 0x19], xmm0
xchg rbp, rsi
movdqu xmmword [rbp - 9], xmm1
mov r10, r10
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0x25f14c8d
sub eax, 0x365eb46
add eax, 0x49cbb56d
sub eax, 0x5255b4fa
inc rdx
rol eax, cl
mov r9, r9
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140093f00
xchg rbx, rbx
cmp dword [rsi + 4], 8
jne 0x140093f95
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
mov rcx, rcx
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 8
xchg rdi, rdi
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
xchg r11, r11
cmp rdi, 4
jl 0x140093f47
lea r9, [rbp + 7]
xor r8d, r8d
xchg rcx, rcx
lea rdx, [rbp + 0x67]
xchg rsi, r12
mov rcx, r12
xchg r12, rsi
call fcn.140093c90
jmp 0x14009405b
cmp dword [rsi], edi
jle 0x14009405b
mov r10, r10
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x39311002
sub r8d, 0x2b52e91b
add r8d, 0x47b80b57
xor r8d, 0x5596323a
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
sub rbx, 0xfffffffffffffffe
xchg rdx, rdx
shl ax, 6
shl ax, 2
or cx, ax
mov dword [rsp - 0x24], esp
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140093fc2
mov rbp, rbp
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x14], edi
xchg r10, rsi
mov rcx, r10
xchg rsi, r10
call fcn.140093c90
mov dword [rsp - 0x40], 0x2f8b4f7a
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
xchg r8, r8
lea rdx, [rbp + 0x67]
add r8d, 0xfffffff8
xchg r9, rsi
mov rcx, r9
xchg r9, rsi
call fcn.140093c90
inc edi
mov r8, r8
nop
add r14d, 0x2063325c
sub r14d, 0x20633254
cmp edi, dword [rsi]
xchg r14, r14
jl 0x140093fa3
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, rsi
lea rdi, [rbp + 7]
xchg r9, rsi
mov r9, qword [r11 + 0x30]
xchg rsi, r9
lea ecx, [rax + 0x40]
xchg rbx, rbx
rep stosb byte [rdi], al
xchg r11, r15
mov rsp, r15
xchg r15, r11
pop r14
mov r12, r12
pop rdi
nop
mov rbp, qword [rsp]
add rsp, 8
ret

Function at 0x140094118
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov dword [rsp - 0x20], edi
je 0x14009415d
lea ecx, [r11 + r11]
mov r9d, r10d
mov rbx, rbx
xor r9d, r11d
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov dword [rsp - 0x20], 0xeb02482
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
cmovb r11d, ecx
mov dword [rsp - 0x1c], ebx
shr edx, 1
jne 0x140094126
mov eax, r10d
mov rdx, rdx
ret
Function at 0x140099fd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xchg r10, r14
mov qword [rsp], r14
xchg r10, r14
mov qword [rsp + 8], r11
xor r11, r11
xchg rsp, rsp
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
xchg r8, r8
cmp r10, r11
bnd jae 0x14009a03a
and r10w, 0xf000
mov r8, r8
lea r11, [r11 - 0x1000]
mov byte [r11], 0x68
sub byte [r11], 0x29
xor byte [r11], 0x3b
add byte [r11], 0x69
xor byte [r11], 0x6d
cmp r10, r11
xchg rsi, rsi
bnd jne 0x14009a016
xchg r10, r13
mov r13, qword [rsp]
xchg r13, r10
xchg r11, r9
mov r9, qword [rsp + 8]
xchg r9, r11
add rsp, 0x10
mov rdx, rdx
bnd ret
Function at 0x14009a060
Capabilities:
Authenticate hmac

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
mov esi, r9d
mov dword [rsp - 0x34], edx
xchg rdi, r8
mov rbx, rdi
xchg r8, rdi
xchg r9, rdx
mov rdi, r9
xchg rdx, r9
mov r10d, ecx
cmp r9d, 0xa
mov r9, r9
jne 0x14009a0b8
test ecx, ecx
jns 0x14009a0b8
mov al, 0
xor al, 0x6b
sub al, 0x34
sub al, 0x36
jmp 0x14009a0bd
xor al, al
mov r14, r14
test rdi, rdi
je 0x14009a280
cmp rbx, 1
mov dword [rsp - 0x38], 0x23364c02
jbe 0x14009a280
cmp esi, 0x24
ja 0x14009a280
mov rsi, rsi
xor r8d, r8d
xchg r10, rbp
mov qword [rsp + 0x10], r10
xchg r10, rbp
xchg r15, rdi
mov rcx, r15
xchg rdi, r15
test al, al
xchg r12, r12
je 0x14009a137
mov byte [rdx], 0x51
add byte [rdx], 5
sub byte [rdx], 0x21
xor byte [rdx], 0x18
lea rcx, [rdx + 1]
mov r8d, 0x744cb593
xor r8d, 0xee9dfb2
sub r8d, 0x78011ee8
sub r8d, 0x2a44b38
neg r10d
mov r13, r13
xchg r9, r14
mov r14, rcx
xchg r14, r9
mov ebp, 0x7981130d
xor ebp, 0x6602d50d
sub ebp, 0x9b9232c
xor ebp, 0x1a84832
sub ebp, 0x1462eab6
nop word [rax + rax]
xor edx, edx
mov eax, r10d
mov dword [rsp - 0xc], esi
div esi
mov r10d, eax
cmp edx, 9
pushf
mov eax, 0x43e7cc3b
add eax, 0x247cf6c0
add eax, 0xfa0192e
xor eax, 0x7804dc7e
popf
cmovbe eax, ebp
inc r8
mov rdi, rdi
add al, dl
mov byte [rcx], al
test r10d, r10d
jle 0x14009a1b6
xchg r11, r11
inc rcx
cmp r8, rbx
jb 0x14009a163
jmp 0x14009a1c2
cmp r8, rbx
mov r11, r11
jb 0x14009a20e
xchg r8, rbp
mov r8, qword [rsp + 0x10]
xchg r8, rbp
mov eax, 0x4fd74694
add eax, 0x1106eef5
xor eax, 0x1f184a09
sub eax, 0x7fc67f5e
mov byte [rdi], 0x5c
xor byte [rdi], 0x54
xor byte [rdi], 0x50
xor byte [rdi], 0x58
xchg rbx, rcx
mov rcx, qword [rsp + 0x18]
xchg rbx, rcx
xchg rsi, rdi
mov rdi, qword [rsp + 0x20]
xchg rdi, rsi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov byte [rcx + 1], 0x11
xor byte [rcx + 1], 0x41
xor byte [rcx + 1], 0x7d
sub byte [rcx + 1], 0xa
sub byte [rcx + 1], 0x23
nop dword [rax]
movzx edx, byte [r9]
mov dword [rsp - 0x18], 0x74491f13
movzx r8d, byte [rcx]
mov byte [rcx], dl
dec rcx
mov byte [r9], r8b
mov dword [rsp - 0x18], 0x2bd1819c
inc r9
cmp r9, rcx
jb 0x14009a225
mov dword [rsp - 0x40], 0x3aac5bb9
mov rbp, qword [rsp + 0x10]
xor eax, eax
xchg rbx, r14
mov r14, qword [rsp + 0x18]
xchg r14, rbx
xchg rsi, rdi
mov rdi, qword [rsp + 0x20]
xchg rdi, rsi
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x18]
mov eax, 0x3d32d26e
xor eax, 0x64bf577e
add eax, 0x17e95d7
sub eax, 0x5b0c1ad1
xchg r13, rsi
mov r13, qword [rsp + 0x20]
xchg rsi, r13
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14009f4e8
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0xf8]
xchg r9, rax
xor r8d, r8d
mov r9, rdx
mov dword [rsp - 0x44], ebp
test rax, rax
je 0x14009f54e
mov ecx, r8d
mov edx, 0x31bb11cb
add edx, 0x2b3bab9f
sub edx, 0x46df0479
add edx, 0x70178a4
sub edx, 0x317cfdb
rol edx, cl
xchg r8, r8
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
inc r8
mov dword [rsp - 0x28], ebx
cmp r8, 0x20
jb 0x14009f506
mov al, 0x63
xor al, 0x58
sub al, 1
xor al, 0x3b
ret
xchg r8, rax
mov r8, qword [rcx + 0x100]
xchg r8, rax
test rax, rax
je 0x14009f58c
xchg r14, r14
xchg rsi, rax
movups xmm0, xmmword [rsi]
xchg rsi, rax
movups xmmword [rdx], xmm0
xchg r10, r10
xchg r14, rax
movups xmm1, xmmword [r14 + 0x10]
xchg r14, rax
xchg r12, rdx
movups xmmword [r12 + 0x10], xmm1
xchg rdx, r12
jmp 0x14009f545
xorps xmm0, xmm0
mov r10, r10
xor al, al
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1400b5ee4
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg rsp, r11
mov qword [r11 + 8], rbx
xchg rsi, r8
mov qword [r11 + 0x18], r8
xchg r8, rsi
mov qword [r11 + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffc0
mov r8, qword [0x1401424c8]
lea rdx, [r11 + 0x10]
xchg r10, r10
ror r8, 5
ror r8, 2
ror r8, 1
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
movabs rcx, 0x625b8d9b41da653e
xor rcx, 0x5104b88d
add rcx, 0x56a6c8a6
xor rcx, 0x658e8627
add rcx, 0x97dd441
mov dword [rsp + 0x58], 0x24ad1062
xor dword [rsp + 0x58], 0x486b294d
xor dword [rsp + 0x58], 0x5099b21d
xor dword [rsp + 0x58], 0x4d2ed12
sub dword [rsp + 0x58], 0x388d6610
add r8, rcx
movabs rax, 0x443fe0b22fe2df41
add rax, 0x180cb1aa
add rax, 0x1b9f09ce
sub rax, 0x1f151570
add rax, 0x3818c2c9
not r8
mov r11, r11
lea rcx, [r11 - 0x28]
sub r8, rax
movabs rax, 0x61972f77267e1c9a
xor rax, 0x440802b9
xor rax, 0x54c29de
xor rax, 0x1ee4e373
sub rax, 0x73955802
xor r8, rax
rol r8, 0x35
rol r8, 1
call r8
lea rdi, [rbx + 8]
xchg r11, r11
xorps xmm0, xmm0
mov qword [rbx], rdi
xor esi, esi
xchg rsi, rdi
movups xmmword [rsi], xmm0
xchg rsi, rdi
xchg r15, rdi
movups xmmword [r15 + 0x10], xmm0
xchg rdi, r15
movups xmmword [rdi + 0x20], xmm0
mov dword [rsp - 0x34], 0x24b9cde5
test eax, eax
jne 0x1400b6024
xchg rsi, rsp
mov qword [rbx + 0x38], rsp
xchg rsp, rsi
jmp 0x1400b6154
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
inc r14
mov dword [rsp - 0x38], 0x5c2a3f31
cmp word [rax + r14*2], si
jne 0x1400b602d
xchg r14, rsi
mov qword [rbx + 0x38], rsi
xchg rsi, r14
cmp qword [rbx], rdi
je 0x1400b6064
xchg r8, rcx
mov r8, qword [rbx]
xchg rcx, r8
call fcn.140098ac0
cmp r14, 0x18
mov dword [rsp - 0x20], ebx
jbe 0x1400b60aa
lea rcx, [r14 + r14]
call fcn.140098d80
mov dword [rsp - 0x40], 0x13e43ea9
xchg r8, rax
mov qword [rbx], r8
xchg r8, rax
test rax, rax
jne 0x1400b60ba
xchg rdi, r13
mov qword [rbx], r13
xchg rdi, r13
xchg r13, rsi
mov rcx, r13
xchg r13, rsi
jmp 0x1400b60d3
xchg r13, rdi
mov qword [rbx], r13
xchg r13, rdi
xchg r15, rax
mov r15, rdi
xchg r15, rax
xorps xmm0, xmm0
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rbx]
mov edx, 0x171a480f
sub edx, 0x15ad5093
add edx, 0x25db087f
xor edx, 0x1c9804e7
sub edx, 0xe8ab80d
cmp qword [rbx + 0x38], rsi
jbe 0x1400b6154
lea r8, [rsp + 0x20]
xchg r14, r14
sub r8, rcx
movzx eax, dx
mov r9d, 0x2a5fa7b5
add r9d, 0x4a7f3561
sub r9d, 0x3f648441
sub r9d, 0xfe2fcfb
xor r9d, 0x25975b25
and ax, r9w
ror edx, 1
ror edx, 6
ror edx, 1
xor ax, word [r8 + rcx]
mov rdi, rdi
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
mov r13, r13
cmp rsi, qword [rbx + 0x38]
jb 0x1400b6105
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov dword [rsp - 0x28], ebp
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
xchg r10, r10
ret
Function at 0x1400d95ec
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg rsi, r14
xchg rdi, rbx
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
push rbp
mov dword [rsp - 0x10], ecx
mov rbp, rsp
add rsp, 0xffffffffffffffb0
xor esi, esi
mov dword [rsp - 0x40], ebp
mov dword [rbp - 0x30], 0x44c73374
sub dword [rbp - 0x30], 0x17f79fbd
sub dword [rbp - 0x30], 0x15cc978
sub dword [rbp - 0x30], 0x2b42c9e7
mov dword [rbp - 0x2c], 0xe3460a4
add dword [rbp - 0x2c], 0x2077fb49
sub dword [rbp - 0x2c], 0x1dc79942
add dword [rbp - 0x2c], 0x7b2da27
xor dword [rbp - 0x2c], 0x18e59cb5
xchg r8, rbx
mov r8, rcx
xchg r8, rbx
mov dword [rbp - 0x28], 0x1a2ca691
xor dword [rbp - 0x28], 0x53d432a1
xor dword [rbp - 0x28], 0x17fbbe6b
sub dword [rbp - 0x28], 0x5d922a1f
mov dword [rbp - 0x24], 0x6f8c200a
sub dword [rbp - 0x24], 0x2506882
xor dword [rbp - 0x24], 0x7ad8663e
xor dword [rbp - 0x24], 0x6ccfb085
xor dword [rbp - 0x24], 0x7b656148
mov dword [rbp - 0x20], 0x4729351e
sub dword [rbp - 0x20], 0x463c169
sub dword [rbp - 0x20], 0x21c0b16e
xor dword [rbp - 0x20], 0x212bc224
xchg r14, rsi
mov qword [rbp + 0x10], r14
xchg rsi, r14
mov rax, qword [rbp + 0x10]
xchg rcx, rdi
mov rdi, qword [rbp + 0x10]
xchg rdi, rcx
mov rax, qword [rbp + 0x10]
xchg r11, r11
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
xchg rdx, rdx
mov eax, 0x1b6aa1b
add eax, 0x1cf1967e
xor eax, 0x4adb3eb1
sub eax, 0x271e3b19
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x28], 0x59014603
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
mov rdi, rdi
inc rax
mov qword [rbp + 0x10], rax
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
cmp rax, 0xa
jb 0x1400d96d0
mov dword [rsp - 0x3c], 0x41ffc32d
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
mov dword [rsp - 0x30], ecx
call fcn.14008b060
xchg rdx, rax
mov r8, rdx
xchg rdx, rax
xchg rsp, rax
mov qword [rbx + 0x200], rsp
xchg rsp, rax
xor eax, eax
xchg rsi, rsi
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x28], 0x3449f41b
test r8, r8
je 0x1400d97dc
lea rdx, [rbx + 0x208]
mov rcx, r8
mov r11, r11
call fcn.1400d9ecc
test al, al
jne 0x1400d97d2
xchg rbp, rcx
mov rbp, qword [rbx + 0x200]
xchg rcx, rbp
call fcn.14008d570
xor al, al
mov dword [rsp - 0x10], 0x3d1217be
xchg r9, rsi
mov qword [rbx + 0x200], r9
xchg rsi, r9
jmp 0x1400d97dc
mov al, 0x5e
xor al, 0x52
xor al, 0x28
xor al, 0x4a
sub al, 0x6d
xchg rbx, r12
mov r12, qword [rsp + 0x68]
xchg r12, rbx
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rbp, rsi
xchg r13, rdi
mov r13, qword [rsp + 0x78]
xchg rdi, r13
sub rsp, 0xffffffffffffffb0
mov dword [rsp - 0x30], 0x10368f5f
pop rbp
ret