joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d570
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3460], 1
je 0x14000d5d3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2f
mov rdx, rsi
jne 0x14000d590
mov dword [0x1400d3460], 1
mov eax, 0x5759509e
pop rsi
ret

Function at 0x14000d5e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d346c], 1
je 0x14000d650
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x22
mov rax, rsi
jne 0x14000d610
mov dword [0x1400d346c], 1
mov eax, 0x4d60c032
pop rsi
ret

Function at 0x14000d660
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3f04], 1
je 0x14000d6c7
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffeb
movzx edx, byte [r8 + r9 + 0x15]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x16
jne 0x14000d680
mov dword [0x1400d3f04], 1
mov eax, 0x99c5667a
ret

Function at 0x14000d6d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3428], 1
je 0x14000d740
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x20
mov rax, rsi
jne 0x14000d700
mov dword [0x1400d3428], 1
mov eax, 0x30e4e209
pop rsi
ret

Function at 0x14000d750
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3434], 1
je 0x14000d7b3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x20
mov rdx, rsi
jne 0x14000d770
mov dword [0x1400d3434], 1
mov eax, 0x32d4fd9f
pop rsi
ret
Function at 0x14000d850
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3448], 1
je 0x14000d8b3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x28
mov rdx, rsi
jne 0x14000d870
mov dword [0x1400d3448], 1
mov eax, 0x7faf7cdf
pop rsi
ret

Function at 0x14000da70
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3f10], 1
je 0x14000dad9
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, 0x18
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x20
mov rdx, rsi
jne 0x14000da90
mov dword [0x1400d3f10], 1
mov eax, 0xc970c2a7
pop rsi
ret

Function at 0x14000dd80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
je 0x14000de30
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14000de30
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000de28
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x14000de2c
cmp eax, 1
je 0x14000ddf8
test eax, eax
jne 0x14000de28
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14000de1f
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000de28
cmp byte [rsi + 0x71], 0
sete al
jmp 0x14000de32
xor eax, eax
jmp 0x14000de32
mov byte [rsi + 0x71], 0
mov al, 1
mov ebx, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ebc0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000dec0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rsp + 0x88], rax
cmp edx, 0xffffffff
je 0x14000dffc
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14000df1e
mov rax, qword [rcx + 0x58]
mov r8d, dword [rax]
test r8d, r8d
jle 0x14000df1e
mov r9d, edx
dec r8d
mov dword [rax], r8d
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
lea r8, [rcx + 1]
mov qword [rax], r8
mov byte [rcx], dl
mov ecx, edx
jmp 0x14000e047
cmp qword [rcx + 0x80], 0
je 0x14000e000
mov rax, qword [rcx + 0x18]
lea r8, [rcx + 0x70]
cmp qword [rax], r8
jne 0x14000df5e
mov r8d, dword [rcx + 0x90]
mov r9, qword [rcx + 0x88]
mov qword [rax], r9
mov rax, qword [rcx + 0x38]
mov qword [rax], r9
mov eax, r9d
sub r8d, r9d
mov rax, qword [rcx + 0x50]
mov dword [rax], r8d
mov rax, qword [rcx + 0x68]
test rax, rax
je 0x14000e007
mov ebp, edx
mov byte [rsp + 0x5f], dl
lea r8, [rsp + 0x80]
lea r9, [rsp + 0x60]
mov r14, rcx
lea rdx, [rcx + 0x74]
mov r10, qword [rax]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rsi, [rsp + 0x5f]
mov rcx, rax
mov r8, rsi
call qword [r10 + 0x38]
cmp eax, 2
jae 0x14000e023
mov rbx, qword [rsp + 0x48]
sub rbx, rdi
je 0x14000dfeb
mov r9, qword [r14 + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 0xffffffff
cmp rbx, rax
jne 0x14000e047
mov byte [r14 + 0x71], 1
cmp qword [rsp + 0x50], rsi
mov eax, 0xffffffff
jmp 0x14000e042
xor ecx, ecx
jmp 0x14000e047
mov ecx, 0xffffffff
jmp 0x14000e047
mov rax, qword [rcx + 0x80]
movsx ecx, dl
mov esi, edx
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, esi
jmp 0x14000e044
mov ecx, 0xffffffff
cmp eax, 3
jne 0x14000e047
mov rdx, qword [r14 + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
mov ecx, ebp
cmove ecx, eax
mov esi, ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002ebc0
mov eax, esi
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14000e4d0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14000e505
mov rsi, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x14000e4fe
mov rcx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor eax, eax
jmp 0x14000e627
mov rax, qword [rdi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x14000e569
mov rcx, qword [rdi + 0x50]
movsxd rbx, dword [rcx]
test rbx, rbx
je 0x14000e569
cmp rbx, rsi
cmovae rbx, rsi
mov rcx, rdx
mov r14, rdx
mov rdx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
add rax, rbx
mov ecx, ebx
mov rdx, qword [rdi + 0x50]
sub dword [rdx], ebx
mov rdx, qword [rdi + 0x38]
movsxd rcx, ebx
add qword [rdx], rcx
mov rcx, rsi
sub rcx, rbx
cmp qword [rdi + 0x80], 0
jne 0x14000e57d
jmp 0x14000e621
mov rcx, rsi
mov rax, rdx
cmp qword [rdi + 0x80], 0
je 0x14000e621
mov rdx, qword [rdi + 0x18]
lea r8, [rdi + 0x70]
cmp qword [rdx], r8
jne 0x14000e5af
mov r8d, dword [rdi + 0x90]
mov r9, qword [rdi + 0x88]
mov qword [rdx], r9
mov rdx, qword [rdi + 0x38]
mov qword [rdx], r9
mov edx, r9d
sub r8d, r9d
mov rdx, qword [rdi + 0x50]
mov dword [rdx], r8d
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
nop dword [rax]
mov rbx, rcx
cmp rcx, 0x1000
jb 0x14000e5fa
mov r9, qword [rdi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call r15
add r14, rax
sub rbx, rax
mov rcx, rbx
cmp rax, 0xfff
je 0x14000e5c0
sub rsi, rbx
jmp 0x14000e624
test rbx, rbx
je 0x14000e61f
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rcx, rbx
jmp 0x14000e621
xor ecx, ecx
sub rsi, rcx
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
pop rcx
test al, al
jne 0x14006f25e
mov eax, dword [rbp + 0xc]
push 0x10
pop rcx
add eax, 0xc
lock or dword [rax], ecx
or eax, 0xffffffff
jmp 0x14006f261
movzx eax, bl
pop rbx
pop rdi
pop rbp
ret
Function at 0x14000e640
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x68], 0
je case.default.0x14000e659
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov rax, qword [rax]
test rax, rax
je 0x14000e6c7
test r8, r8
jle 0x14000e6c7
mov r9, qword [rcx + 0x58]
mov r9d, dword [r9]
test r9d, r9d
jle 0x14000e6c7
mov esi, r9d
cmp rsi, r8
cmovae rsi, r8
mov rbx, rcx
mov rcx, rax
mov rdi, rdx
mov r14, r8
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
mov r8, r14
add rdi, rsi
mov edx, esi
mov r9, qword [rbx + 0x58]
sub dword [r9], esi
mov rdx, qword [rbx + 0x40]
add qword [rdx], rsi
mov rdx, r14
sub rdx, rsi
mov rax, rdi
mov rsi, rdx
test rsi, rsi
jg 0x14000e6d2
jmp 0x14000e6f8
mov rax, rdx
mov rsi, r8
test rsi, rsi
jle 0x14000e6f8
mov r9, qword [rcx + 0x80]
test r9, r9
je 0x14000e6f8
mov edx, 1
mov rcx, rax
mov rdi, r8
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r8, rdi
sub rsi, rax
mov rax, r8
sub rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, 0xffff
jmp 0x14006f377
pop rdi
pop rbp
ret

Function at 0x14000ece0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d46e8], 1
je 0x14000ed59
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x26
mov r9, rax
jne 0x14000ed10
mov dword [0x1400d46e8], 1
mov eax, 0x13dfe23e
pop rsi
ret

Function at 0x14000f1d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d33fc], 1
je 0x14000f233
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x26
mov rdx, rsi
jne 0x14000f1f0
mov dword [0x1400d33fc], 1
mov eax, 0x4b900370
pop rsi
ret

Function at 0x14000f760
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3558], 1
je 0x14000f7c3
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x14000f780
mov dword [0x1400d3558], 1
mov eax, 0x9fce6990
pop rsi
ret
Function at 0x14000f8e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3548], 1
je 0x14000f94a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x19
mov rdx, rsi
jne 0x14000f900
mov dword [0x1400d3548], 1
mov eax, 0x5b19bc8c
pop rsi
ret

Function at 0x14000fa50
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d357c], 1
je 0x14000fab7
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffeb
movzx edx, byte [r8 + r9 + 0x15]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x14000fa70
mov dword [0x1400d357c], 1
mov eax, 0xd0542d36
ret

Function at 0x140010410
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3834], 1
je 0x14001046d
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe5
movzx edx, byte [r8 + r9 + 0x1b]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x2b
jne 0x140010430
mov dword [0x1400d3834], 1
mov eax, 0xdc96e0a9
ret

Function at 0x140010480
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400d3854], 1
je 0x1400104e0
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
add eax, edx
lea eax, [rax + rax*8]
movzx edx, byte [r8 + r9 + 0x12]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x19
jne 0x1400104a0
mov dword [0x1400d3854], 1
mov eax, 0xdbd7d45e
ret

Function at 0x140010560
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3868], 1
je 0x1400105c3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x28
mov rdx, rsi
jne 0x140010580
mov dword [0x1400d3868], 1
mov eax, 0xaf289ce
pop rsi
ret
Function at 0x140010880
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3874], 1
je 0x1400108f4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x18
jne 0x1400108b0
mov dword [0x1400d3874], 1
mov eax, 0xf8a56e47
pop rsi
ret

Function at 0x140010b00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d38b4], 1
je 0x140010b6c
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov edx, eax
shl eax, 5
sub edx, eax
movzx eax, byte [r8 + r9 + 0x1f]
mov r11d, r9d
add edx, r9d
movsxd rdx, edx
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x3a
jne 0x140010b20
mov dword [0x1400d38b4], 1
mov eax, 0x44f171de
ret

Function at 0x140011a60
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d470c], 1
je 0x140011ac1
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x140011a80
mov dword [0x1400d470c], 1
mov eax, 0xf6a2b42d
ret

Function at 0x1400121c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d471c], 1
je 0x140012239
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x1400121f0
mov dword [0x1400d471c], 1
mov eax, 0x90412739
pop rsi
ret

Function at 0x1400127b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d473c], 1
je 0x140012813
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x1400127d0
mov dword [0x1400d473c], 1
mov eax, 0x70ce7c20
pop rsi
ret
Function at 0x140012820
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4724], 1
je 0x14001288a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x15
mov rdx, rsi
jne 0x140012840
mov dword [0x1400d4724], 1
mov eax, 0x63428178
pop rsi
ret

Function at 0x140012b60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4748], 1
je 0x140012bd9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1e
mov r9, rax
jne 0x140012b90
mov dword [0x1400d4748], 1
mov eax, 0x4b5838a6
pop rsi
ret

Function at 0x140012be0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4754], 1
je 0x140012c59
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x140012c10
mov dword [0x1400d4754], 1
mov eax, 0x7beeb9dd
pop rsi
ret

Function at 0x140012c60
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4760], 1
je 0x140012cdf
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x25
mov r9, rax
jne 0x140012c90
mov dword [0x1400d4760], 1
mov eax, 0x51f545ed
pop rsi
ret

Function at 0x140012cf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d476c], 1
je 0x140012d53
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1a
mov rdx, rsi
jne 0x140012d10
mov dword [0x1400d476c], 1
mov eax, 0x2b7bd7b0
pop rsi
ret
Function at 0x140012d60
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4778], 1
je 0x140012ddf
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x27
mov r9, rax
jne 0x140012d90
mov dword [0x1400d4778], 1
mov eax, 0xb243f564
pop rsi
ret

Function at 0x140012df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4784], 1
je 0x140012e69
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1c
mov r9, rax
jne 0x140012e20
mov dword [0x1400d4784], 1
mov eax, 0xbf8ae7da
pop rsi
ret

Function at 0x140012eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d47a0], 1
je 0x140012f24
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x18
jne 0x140012ee0
mov dword [0x1400d47a0], 1
mov eax, 0xb609f77
pop rsi
ret

Function at 0x140013360
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d57e0], 1
je 0x1400133c7
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe3
movzx edx, byte [r8 + r9 + 0x1d]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x33
jne 0x140013380
mov dword [0x1400d57e0], 1
mov eax, 0x479c499d
ret

Function at 0x140013bc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d55d8], 1
je 0x140013c2a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, 0x14
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x140013be0
mov dword [0x1400d55d8], 1
mov eax, 0x7609be91
pop rsi
ret