joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5987e0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x598887
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59892a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x598887
cmp r9, 0
je 0x5989e3
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x598940
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5e6d80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5e6e55
movdqa xmm0, xmmword [0x0072c3d0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5e6dc1
movdqa xmm0, xmmword [0x0072c3e0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5e6ed7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5e6eab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0072c058]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0072c3f0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5f3cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f3e5b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f3ce1
inc rcx
cmp rbx, rcx
jle 0x5f3e51
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f3cde
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008bebb8]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5f3e45
test rdx, rdx
je 0x5f3e3a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00952fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f3e09
xor eax, eax
lea rbx, [0x006b1a5d]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b1a96]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x5f3e30
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0072a9d8]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x6350c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6351c2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x635113
mov rbx, qword [0x008cbd40]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0066a6c0]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00952fe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x635195
xor eax, eax
lea rbx, [0x006b1a5d]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b1a96]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x6351bc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0072a9d8]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x140031fcc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
add rsp, 0x6e3a1aff
sub rsp, 0x6e3a1baf
mov r14, rdx
movabs rdx, 0x5def002058d87a3c
xor rdx, 0x48446d1f
xor rdx, 0x2ab26a61
cmp qword [rcx + 0x538], rdx
jne 0x14003229a
xorps xmm0, xmm0
mov rax, r14
xor rax, rdx
mov qword [rcx + 0x538], rax
lea rax, [rbp - 0x41]
mov rsi, qword [rcx + 0x578]
mov rbx, qword [rcx + 0x540]
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x49], rax
movups xmmword [rbp - 0x41], xmm0
lea rdx, [rsi + 1]
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
call fcn.1400166e8
xor r15d, r15d
mov edx, 0x3bcb1f18
xor edx, 0x13d650c
add edx, 0xf32d4c8
test rsi, rsi
je 0x1400320b2
mov rdi, rax
sub rbx, rax
mov r8, rsi
movzx ecx, dx
mov r9d, 0x52d6dc9b
xor r9d, 0x19a01e9f
sub r9d, 0x4b76c105
and cx, r9w
ror edx, 8
xor cx, word [rbx + rdi]
mov word [rdi], cx
lea rdi, [rdi + 2]
sub r8, 1
jne 0x14003207f
mov word [rax + rsi*2], r15w
movabs rcx, 0x55b3632c07b30b80
add rcx, 0x31c17819
xor rcx, 0xf9f5c44
add rcx, 0x6f631467
lea rax, [0x1400322d0]
mov qword [rbp + 7], r15
mov qword [rbp - 1], rax
mov edx, 0x1779fb10
sub edx, 0x12872ba4
sub edx, 0x4f2506c
mov rax, qword [0x1400dbcd0]
ror rax, 0x26
add rax, rcx
mov qword [rbp + 0x17], r15
rol rax, 5
movabs rcx, 0x611c52741c4e0f74
add rcx, 0x43751884
add rcx, 0x81bac03
add rax, rcx
mov qword [rbp + 0x2f], r15
xor ecx, ecx
mov qword [rbp + 0x3f], r15
mov dword [rbp - 9], 0x4525551e
add dword [rbp - 9], 0x384578bc
xor dword [rbp - 9], 0x7d6acd8a
mov dword [rbp - 5], 0x274dbf35
add dword [rbp - 5], 0x31d30207
sub dword [rbp - 5], 0x5920c139
mov qword [rbp + 0xf], r14
call rax
mov qword [rbp + 0x1f], rax
movabs rcx, 0x185366f06149b51c
add rcx, 0x9c43af4
sub rcx, 0x6938b5dc
add rcx, 0x4c08ee7e
mov rax, qword [0x1400dbef0]
ror rax, 6
add rax, rcx
movabs rcx, 0x21fd9ea0e858f29
xor rcx, 0x5ebade5a
add rcx, 0x7fffffff
add rcx, 0x178d6337
rol rax, 0xe
add rax, rcx
movabs rcx, 0x34179a907cf53708
sub rcx, 0x6e9403be
add rcx, 0x5fae82ac
xor rax, rcx
movabs rcx, 0x596a7fa00ac334e5
add rcx, 0x3898b928
xor rcx, 0x6e456f42
add rcx, 0x7fffffff
xor rcx, 0x4fe4bb55
not rax
add rax, rcx
xor ecx, ecx
call rax
mov qword [rbp + 0x27], rax
movabs rcx, 0x19bab27965c77cad
sub rcx, 0x136248f4
sub rcx, 0x12d67299
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x37], rax
mov rax, qword [0x1400dbba0]
not rax
add rax, rcx
movabs rcx, 0x58b8f6851a65d846
sub rcx, 0x1206e527
add rcx, 0x2e40d2d6
sub rcx, 0x32896a7f
rol rax, 0x27
sub rax, rcx
lea rcx, [rbp - 9]
rol rax, 0x14
not rax
call rax
mov rcx, qword [rbp - 0x49]
test ax, ax
lea rax, [rbp - 0x41]
setne bl
cmp rcx, rax
jne 0x14003228e
xor eax, eax
lea rdi, [rbp - 0x41]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
jmp 0x140032293
call fcn.140083f00
mov al, bl
jmp 0x14003229c
xor al, al
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140033e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
add rsp, 0xffffffffffffffd0
mov dword [rcx + 8], 0x43aaf585
add dword [rcx + 8], 0x5803b26
xor dword [rcx + 8], 0x492b30aa
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140003c28]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.1400166e8
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x140033f1c
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x140033f02
mov ecx, dword [rsi + 0x40]
mov edx, 0x4eed72aa
sub edx, 0x3a215894
add edx, 0x94e4edf
sub edx, 0xe974b9c
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x321c44f3
add r15d, 0x1b156c3b
add r15d, 0x264dc141
xor r15d, 0x5ef83ce4
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x68ef37e3
add edx, 0xbc04470
add edx, 0xe0687
sub edx, 0x74bd82ca
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
sub r14, 0xffffffffffff0001
mov rcx, r14
shl rcx, 4
call fcn.140083da0
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x1400dc460]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140034004
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x1400dc460]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x140034026
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.14002ee0c
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffd0
neg rsp
pop r15
pop r14
pop rdi
ret
Function at 0x1400344b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov qword [rsp + 0x78], rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400166e8
mov edx, 0x6081daf
xor edx, 0x6c37572
xor edx, 0x2d99befc
xor edx, 0x677b98fd
test rbp, rbp
je 0x14003458b
mov rdi, rax
sub rbx, rax
mov r9, rbp
mov r8d, 0x22a4a322
xor r8d, 0x453c7361
xor r8d, 0x6798d0bc
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x14003456a
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
call fcn.14007b1e0
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x1400345ef
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x1ec4bd8f
xor ecx, 0x260393dc
sub ecx, 0x38c72e23
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
call fcn.140083f00
mov rax, rsi
mov rsi, qword [rsp + 0x80]
sub rsp, 0xffffffffffffffa0
pop rdi
ret
Function at 0x140035d48
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x59b47888
sub r10d, 0x92c734c
sub r10d, 0x4104e7e3
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x2d874e8b
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x140035dde
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400dc460]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x140035da2
mov eax, r9d
ret

Function at 0x140035edc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x2c1c0915
add r10d, 0x8c9fc1e
sub r10d, 0x2562e7da
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x2d874e8b
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x140035f7a
mov r10, qword [rcx + 0x300]
movzx eax, ax
sub rdx, 0xfffffffffffffffe
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x1400dc460]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x140035f3b
mov eax, r9d
ret

Function at 0x140035f80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x7516bb35
add rsp, 0x7516ba85
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x14003601a
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x3847d1c9
sub ecx, 0x31c857bd
add ecx, 0x903a34d
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140083d30
test rsi, rsi
jle 0x140036037
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x7c32534
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x140035ff6
jmp 0x140036037
lea rdx, [rsp + 0xc0]
call fcn.140036194
test al, al
je 0x14003608d
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rdi + 0x318]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [0x140003d28]
mov qword [rsp + 0x20], rdi
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0xa8], 0x19506a75
add qword [rsp + 0xa8], 0x2faa479c
xor qword [rsp + 0xa8], 0x48fab209
mov qword [rsp + 0x30], rax
movdqu xmmword [rsp + 0x38], xmm0
call fcn.1400350b4
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140037e8c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rbp - 0x20]
mov r12, r9
call fcn.14006e258
mov r8d, 0x3534331a
add r8d, 0x82b2844
sub r8d, 0x3d5f5b5c
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.14006e2d8
test al, al
je 0x140038120
mov eax, dword [rdi + 0x2e8]
lea rdx, [rbp - 0x40]
and dword [rbp - 0x28], 0
mov ecx, 0x200a2ac1
xor ecx, 0x6ed0227e
xor ecx, 0x41307521
sub ecx, 0x676045
and dword [rbp - 0x24], 0
xor eax, ecx
mov dword [rbp - 0x38], eax
mov r8d, 0x421cd7ee
sub r8d, 0x8e4a2ed
xor r8d, 0x37e6fc7a
sub r8d, 0xedec95b
mov eax, dword [rdi + 0x2ec]
xor eax, ecx
mov dword [rbp - 0x40], 0x5a08e8bf
sub dword [rbp - 0x40], 0x3ded8216
add dword [rbp - 0x40], 0x162cdc9d
mov dword [rbp - 0x34], eax
mov eax, dword [rdi + 0x2f4]
xor eax, ecx
mov dword [rbp - 0x3c], 0x385cc8b2
add dword [rbp - 0x3c], 0x3e82c626
xor dword [rbp - 0x3c], 0x76df8ef8
mov dword [rbp - 0x30], eax
mov eax, dword [rdi + 0x30c]
xor eax, ecx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
call fcn.1400700b0
test al, al
je 0x140038120
mov r14d, dword [rdi + 0x2d8]
mov edx, 0x3f51fbcc
sub edx, 0x249e7763
xor edx, 0x1ab38479
and r14d, 0x2000
mov eax, r14d
neg eax
sbb rbx, rbx
and rbx, 0xffffffffffff0100
sub rbx, 0x7f9918dd
add rbx, 0x7f9a18dc
mov r15, rbx
shl r15, 4
mov rcx, r15
call fcn.140083da0
mov rsi, rax
test rax, rax
je 0x140038120
mov rdx, qword [rdi + 0x300]
xor r8d, r8d
sub rdx, rax
lea edi, [r8 + 1]
movups xmm0, xmmword [rdx + rax]
add r8, rdi
xorps xmm0, xmmword [0x1400dc460]
movups xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp r8, rbx
jl 0x140037ff5
mov rcx, r15
call fcn.140083d30
neg r14d
mov rdx, rax
mov rcx, rsi
mov rbx, rax
sbb r8d, r8d
and r8d, 0xfff01000
add r8d, 0x45a5bf99
sub r8d, 0x4595bfa9
mov r9d, r8d
call fcn.14007d450
mov r8d, eax
mov dword [rbp - 0x28], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400700b0
mov rcx, rsi
test al, al
jne 0x140038071
call fcn.140083d50
mov rcx, rbx
jmp 0x1400380cc
call fcn.140083d50
mov rcx, rbx
call fcn.140083d40
mov eax, dword [rbp - 0x34]
imul eax, dword [rbp - 0x38]
movsxd rcx, eax
shl rcx, 2
call fcn.140083d30
mov r8d, dword [rbp - 0x34]
mov rdx, rax
imul r8d, dword [rbp - 0x38]
mov rcx, r12
mov rbx, rax
shl r8d, 2
mov r9d, r8d
call fcn.14007d450
mov r8d, eax
mov dword [rbp - 0x24], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400700b0
mov rcx, rbx
test al, al
jne 0x1400380d6
call fcn.140083d40
jmp 0x140038120
call fcn.140083d40
lea rcx, [rbp - 0x20]
call fcn.140070334
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14006f904
test al, al
je 0x140038120
mov r8d, 0x2cdbd917
add r8d, 0x33ecd539
sub r8d, 0x60c8ae30
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400700b0
test al, al
jne 0x140038123
xor dil, dil
lea rcx, [rbp - 0x20]
call fcn.14006e2d0
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14003b2ea
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rbx, rcx
xor r15d, r15d
mov qword [rcx], r15
mov rsi, rdx
mov dword [rcx + 8], r15d
mov edi, r9d
mov rax, qword [0x1400dbae8]
movabs rcx, 0x66f025236e9ae94f
sub rcx, 0x8d60552
sub rcx, 0x490c09b9
ror rax, 0x3e
xor rax, rcx
movzx edx, r8w
movabs rcx, 0x7bc34e4d447f9724
xor rcx, 0x4855488f
xor rcx, 0x74663492
add rcx, 0x5df587a0
lea r8d, [r15 + 0xa]
add rax, rcx
mov rcx, rsi
not rax
call rax
mov rbp, rax
test rax, rax
je 0x14003b452
mov r8, qword [0x1400dbaf0]
movabs rax, 0xda8453d45fbbfee1
sub rax, 0x41bfe6fb
add rax, 0x7fffffff
add rax, 0x5ebf39a8
not r8
mov qword [rsp + 0x40], r14
rol r8, 0x1d
mov rdx, rbp
xor r8, rax
mov rcx, rsi
call r8
mov r14, rax
test rax, rax
je 0x14003b42c
mov r8, qword [0x1400dbaf8]
movabs rax, 0x2f4cee0e3ada6b2c
xor rax, 0x5b702014
xor rax, 0x5b17327b
add rax, 0x1aa56c1d
not r8
mov rdx, rbp
rol r8, 0x2f
mov rcx, rsi
add r8, rax
not r8
ror r8, 0x11
call r8
mov ecx, eax
mov eax, 0x22182afe
add eax, 0x2c8aaa42
xor eax, 0x43b182ba
sub eax, 0xd1357f6
mov dword [rbx + 8], ecx
shr rcx, 2
mul rcx
pushf
movabs rcx, 0xffffffff6fcc8c65
sub rcx, 0x20d9b144
add rcx, 0x7fffffff
add rcx, 0x310d24df
popf
cmovo rax, rcx
mov rcx, rax
call fcn.140083d30
mov r8d, dword [rbx + 8]
mov rdx, r14
mov rcx, rax
mov qword [rbx], rax
call fcn.140084390
mov rax, qword [rbx]
movzx r8d, byte [rsp + 0x60]
mov edx, dword [rbx + 8]
shl r8d, 0x18
add rdx, rax
cmp rax, rdx
jae 0x14003b42c
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rax]
xor ecx, 0x7c32534
or ecx, r8d
cmp ecx, edi
cmove ecx, r15d
mov dword [rax], ecx
neg rax
add rax, 0xfffffffffffffffc
neg rax
cmp rax, rdx
jb 0x14003b406
mov r14, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
nop
sub rsp, 0x5cb27a49
add rsp, 0x5cb27a69
pop r15
pop rdi
pop rsi
ret
mov rax, rbx
jmp 0x14003b434