joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495c9b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00495ce0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0049cc80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0049cdc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00495be0
Function at 0x49eee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43faef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00446c00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0049cdc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x43fac0
cmp byte [0x00794df0], 0
je 0x49eef5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x49bec0
jmp 0x43fac0

Function at 0x49ef00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00795140]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00794df0], 0
je 0x49ef35
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00795460]
aesenc xmm0, xmmword [0x00795470]
aesenc xmm0, xmmword [0x00795480]
movq rax, xmm0
ret
jmp 0x446e00

Function at 0x49ef40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00795140]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00794df0], 0
je 0x49ef76
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00795460]
aesenc xmm0, xmmword [0x00795470]
aesenc xmm0, xmmword [0x00795480]
movq rax, xmm0
ret
jmp 0x446e60

Function at 0x4a0fc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle_1]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x007953e0]
mov qword [rsp + 8], rdx
lea r8d, [0x00794e08]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile_1]
call rax
call fcn.0049ee20
add rsp, 0x30
ret
Function at 0x140030ab4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov dword [rcx + 8], 0x1efcaf07
add dword [rcx + 8], 0x47f054b0
sub dword [rcx + 8], 0x66ed03b6
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x1400012d8]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.140016fb8
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x140030b50
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x140030b36
mov ecx, dword [rsi + 0x40]
mov edx, 0x56aa31e0
add edx, 0x12a7caa3
sub edx, 0x4918f8f8
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x3235ae5d
xor r15d, 0x65f7fab0
sub r15d, 0x12576fb5
xor r15d, 0x46f2bbe0
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x7685590e
xor edx, 0x390525b5
sub edx, 0x989c0b5
sub edx, 0x45f6bbf6
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
add r14, 0x1a174a8c
sub r14, 0x1a164a8d
mov rcx, r14
shl rcx, 4
call fcn.1400bb650
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x14048a530]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140030c39
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x14048a530]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x140030c5b
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.140030768
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffd0
pop r15
pop r14
pop rdi
ret
Function at 0x1400310de
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
nop
add rsp, 0x22e9a159
sub rsp, 0x22e9a1b9
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov qword [rsp + 0x78], rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140016fb8
mov edx, 0x1cf0613d
sub edx, 0x10afd1b
add edx, 0x1551d92f
add edx, 0x122c23f1
test rbp, rbp
je 0x1400311b7
mov rdi, rax
sub rbx, rax
mov r9, rbp
mov r8d, 0x3f11009b
xor r8d, 0x686ac0f2
sub r8d, 0x3d83b6d3
sub r8d, 0x19f80897
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x140031196
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rdx, qword [rsp + 0x20]
call fcn.140096190
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x140031221
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x29f2e976
xor ecx, 0xd9ca82e
xor ecx, 0x798088ad
sub ecx, 0x5deec9c5
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
call fcn.1400bb730
mov rax, rsi
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x140032bf8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.1400310d0
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x140032c78
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x3dd282e0
sub r8d, 0x11f48a58
add r8d, 0x173058b7
xor r8d, 0x430e513e
inc rdi
call fcn.140095260
cmp byte [rdi], 0
jne 0x140032c3a
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x140032cb2
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x5771c6cb
sub ecx, 0x1dc8aba3
xor ecx, 0x56c5c239
sub ecx, 0x6f6cd891
rep stosb byte [rdi], al
jmp 0x140032cb7
call fcn.1400bb730
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x38b
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x140032e00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0xcb47439
xor r10d, 0x3779ac0d
sub r10d, 0x2695cc29
add r10d, 0xb00f780
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x3985ed8
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x140032e9d
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x14048a530]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x140032e61
mov eax, r9d
ret

Function at 0x140032f90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x73c403ff
sub r10d, 0x5b7101fd
add r10d, 0x241cc3d6
sub r10d, 0x1c36c24d
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x3985ed8
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x140033035
mov r10, qword [rcx + 0x300]
movzx eax, ax
sub rdx, 0xfffffffffffffffe
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x14048a530]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x140032ff6
mov eax, r9d
ret
Function at 0x1400330a8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
add rsp, 0xf4b929a
sub rsp, 0xf4b933a
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x140033148
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x24741434
add ecx, 0x6282306
add ecx, 0x5beead1
sub ecx, 0x10221e80
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400bb5d0
test rsi, rsi
jle 0x140033165
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x255e503b
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x140033124
jmp 0x140033165
lea rdx, [rsp + 0xb0]
call fcn.140033328
test al, al
je 0x1400331bc
mov rax, qword [rsp + 0xb0]
lea rcx, [0x140001470]
mov qword [rsp + 0x98], 0x15d1e1be
add qword [rsp + 0x98], 0x63a313eb
sub qword [rsp + 0x98], 0x189c0fd6
sub qword [rsp + 0x98], 0x60d8e5bb
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.140031de4
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004a200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140016fb8
mov edi, 0x7121bbd2
sub edi, 0x69e3252a
xor edi, 0x445df7ea
mov r9, rax
mov ecx, edi
mov r15d, 0x77e0359
xor r15d, 0x2afbec5
xor r15d, 0x5d1e26bb
sub r15d, 0x58cf9a28
test rbp, rbp
je 0x14004a2c6
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x14004a2a5
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x14004a311
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x14004a311
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x14004a2f1
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff7d9152a5
xor rdx, 0x1fa3a45e
xor rdx, 0x119d0913
add rdx, 0x7fffffff
add rdx, 0xc500018
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x14004a355
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140016fb8
cmp qword [r14 + 0x38], rbx
jbe 0x14004a3a1
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x14004a37d
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14004a3d9
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x117999c4
add ecx, 0x4380a3af
sub ecx, 0x382a2699
sub ecx, 0x1cd016aa
rep stosb byte [rdi], al
jmp 0x14004a3de
call fcn.1400bb730
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140055560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140055596
mov rdi, qword [rcx + 0x640]
jmp 0x14005559d
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x1400555b6
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x1400555b9
mov rcx, rsi
cmp rdi, rcx
je 0x1400557e6
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x1400555d8
add rdi, 8
jmp 0x14005559d
test r8, r8
je 0x14005569c
cmp rdi, qword [rbx + 0x640]
jb 0x14005569c
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14005569c
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x14005562f
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140055632
mov rax, rsi
neg rax
add rax, 8
neg rax
cmp rdx, rax
jae 0x140055655
mov rax, qword [rdx + 8]
mov qword [rdx], rax
add rdx, 8
jmp 0x14005560f
test rcx, rcx
je 0x14005569c
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14005569c
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x14005568e
call fcn.1400bb730
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400556be
mov rax, qword [rcx]
mov edx, 0x6c5ce81
xor edx, 0x29480659
sub edx, 0x2f8dc8d7
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x1400557e6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004eb60
mov rcx, qword [rsp + 0x30]
mov r10d, 0x7266f51a
sub r10d, 0x4d949b93
xor r10d, 0x351a4f4d
xor r10d, 0x11c8166a
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140055797
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140055797
mov r9d, r10d
xor r9d, 0x2039038b
xor r8d, 0x2039038b
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x2039038b
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0xb9cfedc
add dword [rcx + 0x34], 0x6f46dad3
sub dword [rcx + 0x34], 0x3f569f70
sub dword [rcx + 0x34], 0x1b5436b4
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x14005574c
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1400557de
sub ecx, r8d
mov dword [rax + 0x14], 0x350cf281
xor dword [rax + 0x14], 0x2d25b59c
add dword [rax + 0x14], 0x63ce5cc2
sub dword [rax + 0x14], 0x5bbea054
xor ecx, 0x2039038b
xor r8d, 0x2039038b
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.140041a60
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
pop rdi
ret
Function at 0x140055800
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140042060
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140055420
mov rcx, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rbx
jmp 0x140055800
push rbx
nop
sub rsp, 0x9ee34f6
add rsp, 0x9ee34d6
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140055944
lea rdx, [rsp + 0x30]
call fcn.14004eb60
mov r8, qword [rsp + 0x30]
mov r11d, 0x13d35502
add r11d, 0x6a29333b
xor r11d, 0x95ba88a
sub r11d, 0x74a72017
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1400558fa
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x1400558f5
mov r8d, r11d
xor r8d, 0x2039038b
xor r9d, 0x2039038b
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x2039038b
add r10d, r11d
sub rax, 0xfffffffffffffff8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x74c5dfaf
sub dword [rdx + 0x34], 0x6554ca47
xor dword [rdx + 0x34], 0x7bc63827
xor dword [rdx + 0x34], 0x548e2ec4
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x1400558a8
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x14005593c
sub r8d, r9d
mov dword [rax + 0x14], 0x49d8ce
xor dword [rax + 0x14], 0x642ba9ff
xor dword [rax + 0x14], 0x445b72ba
xor r8d, 0x2039038b
xor r9d, 0x2039038b
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.140041a60
sub rsp, 0xffffffffffffffe0
pop rbx
ret

Function at 0x140057550
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x33c09350
add rsp, 0x33c09330
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
xchg r11, rcx
mov rdi, r11
xchg r11, rcx
nop
movabs rdx, 0xffffffff1f1e659f
add rdx, 0x2936518b
xor rdx, 0x742a83d4
add rdx, 0x7fffffff
add rdx, 0x4381cb02
nop word [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
mov dword [rsp - 0x20], ecx
jne 0x1400575b5
xchg rdx, r15
mov qword [rcx + 0x38], r15
xchg rdx, r15
call fcn.140016fb8
mov rcx, rcx
xor r8d, r8d
mov edx, 0xbf09e12
add edx, 0x710fe391
sub edx, 0x49d73872
xor edx, 0x557e603e
sub edx, 0x22f3c7cd
cmp qword [rdi + 0x38], r8
jbe 0x140057663
xchg r10, r10
sub rbx, rax
mov r9d, 0x2e43ee02
xor r9d, 0x29f0e576
add r9d, 0x56fb201c
xor r9d, 0x682db359
sub r9d, 0x368397ca
nop word [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
mov dword [rsp - 0x34], 0x11606776
and cx, r9w
ror edx, 5
ror edx, 3
xor cx, word [rbx + rax - 2]
inc r8
mov word [rax - 2], cx
mov rdi, rdi
cmp r8, qword [rdi + 0x38]
jb 0x140057631
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
sub rsp, 0xffffffffffffffe0
pop rdi
xchg r12, r12
ret
Function at 0x140058040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x18], esp
xchg rsi, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffe0
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x20], 0x13d89295
mov rbx, rdx
xchg r8, r9
mov r9, qword [rdx + 0x38]
xchg r8, r9
mov rdi, rcx
add r8, rsi
xchg r14, r14
xchg rsi, rsp
mov rdx, rsp
xchg rsp, rsi
mov qword [rcx + 0x38], r8
call fcn.140058c90
mov rdx, rdx
xchg r9, rdi
mov rdi, qword [rbx]
xchg rdi, r9
mov ecx, esi
and ecx, 3
mov r8d, 0x12a2632
add r8d, 0x2ebc97e2
xor r8d, 0x2db01768
xor r8d, 0x39e9cc0
add r8d, 0x419b2b86
shl ecx, 1
shl ecx, 1
shl ecx, 1
mov edx, r8d
ror edx, cl
xchg r8, rax
mov r10, r8
xchg r8, rax
xor ecx, ecx
mov dword [rsp - 0x1c], ebp
cmp qword [rbx + 0x38], rcx
jbe 0x14005815d
lea rax, [rsi + rsi]
xchg rbx, rbx
mov r11d, 0x49b53761
add r11d, 0x1b3d7b89
sub r11d, 0x62435af8
xor r11d, 0x64639b60
sub r11d, 0x66cccb93
sub rax, r9
xchg rdx, rdx
add r10, rax
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
mov r10, r10
xor ax, r8w
ror edx, 5
ror edx, 1
ror edx, 1
ror edx, 1
and ax, r11w
xchg r8, r8
ror r8d, 8
xor ax, word [r9 - 2]
inc rcx
mov word [r10 + r9 - 2], ax
mov dword [rsp - 0x10], edi
cmp rcx, qword [rbx + 0x38]
jb 0x14005811f
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x24], 0x6a943a78
xchg r15, rdi
mov rax, r15
xchg rdi, r15
mov rsi, qword [rsp + 0x38]
xchg rcx, rcx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140058190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rcx
mov qword [rsp + 0x10], rsi
xchg rdi, rdx
mov qword [rsp + 0x18], rdx
xchg rdi, rdx
push r8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r14, rbp
mov rbp, qword [rcx + 0x38]
xchg rbp, r14
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
mov rsi, rcx
nop
movabs rbx, 0xffffffff3c695eae
xor rbx, 0x3a2bd43d
add rbx, 0x19cfbcd5
xor rbx, 0x731300f4
add rbx, 0x7fffffff
xor rbx, 0x2cfeb864
inc rbx
cmp word [rdx + rbx*2], 0
mov dword [rsp - 0xc], 0x3975f98d
jne 0x1400581fc
lea r8, [r14 + rbx]
xchg r11, r14
mov rdx, r11
xchg r14, r11
xchg r9, r8
mov qword [rcx + 0x38], r9
xchg r9, r8
call fcn.140058c90
mov dword [rsp - 0x40], 0x59e7f2e6
mov ecx, r14d
mov edx, 0x6fb64e4c
sub edx, 0xe206bf1
add edx, 0x843e77a
xor edx, 0x6e71940f
add edx, 0x3bbb0368
and ecx, 3
shl ecx, 3
ror edx, cl
xchg r9, r9
test rbx, rbx
je 0x1400582c9
lea r8, [r14 + r14]
mov dword [rsp - 0x30], edi
mov ecx, 0x3b122e7b
xor ecx, 0x46e9f851
sub ecx, 0x57255e14
sub ecx, 0x26d67717
sub r8, rdi
mov r12, r12
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov rsi, rsi
lea rdi, [rdi + 2]
and ax, cx
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
sub rbx, 1
xchg r8, r8
jne 0x14005829e
mov rbx, qword [rsp + 0x30]
mov rax, rsi
xchg r12, r12
xchg rdx, rsi
mov rdx, qword [rsp + 0x38]
xchg rsi, rdx
xchg r9, rdi
mov r9, qword [rsp + 0x40]
xchg r9, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret