joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
movzx eax, word [rcx]
mov rbx, rbx
mov r15d, edx
xor eax, 0x2d12297d
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x2d127330
jne 0x140085d71
movsxd rdx, dword [rcx + 0x3c]
mov rbx, rbx
mov eax, dword [rdx + rcx]
xor eax, 0x2d12297d
cmp eax, 0x2d126c2d
jne 0x140085d71
mov dword [rsp - 0x38], ecx
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085b00
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
mov r14, rax
mov dword [rsp - 0x28], ebx
mov edx, dword [rax + 0x20]
call fcn.140085b00
mov edx, dword [r14 + 0x24]
mov rcx, rsi
mov dword [rsp - 0x30], esp
mov r12, rax
call fcn.140085b00
mov edx, dword [r14 + 0x1c]
mov r15, r15
xchg rsi, r13
mov rcx, r13
xchg r13, rsi
mov r13, rax
xchg rcx, rcx
call fcn.140085b00
xor edi, edi
mov qword [rsp + 0x70], rax
mov dword [rsp - 0x1c], esp
cmp dword [r14 + 0x18], edi
jbe 0x140085d71
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsp, rsp
mov rcx, rsi
call fcn.140085b00
mov ecx, 0x2e1331b3
sub ecx, 0x1225c24f
xor ecx, 0x46276d
xor ecx, 0xaee0660
add ecx, 0xeebab196
mov rbx, rax
mov dword [rsp - 0x44], 0x120024f2
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140085d4e
nop dword [rax]
mov dword [rsp - 0x44], 0x76a5143d
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x76460fee
sub r8d, 0x5faa17c4
add r8d, 0x7b5bf72
sub r8d, 0x1e51b79b
inc rbx
call fcn.14008efe0
cmp byte [rbx], 0
xchg r8, r8
jne 0x140085d13
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x34], 0x78b8c08a
je 0x140085dbe
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140085cc4
mov dword [rsp - 0x38], ecx
xor eax, eax
xchg r11, rbx
mov r11, qword [rsp + 0x68]
xchg r11, rbx
sub rsp, 0xffffffffffffffe0
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x2c], 0x19db2e40
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov rbp, rbp
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x20], esp
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov rax, qword [rsp + 0x70]
mov rcx, rcx
mov edx, dword [rax + rdx*4]
call fcn.140085b00
jmp 0x140085d73
Function at 0x14008a213
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x30], edx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x16ef8dc5
sub rsp, 0x16ef8e25
xchg rbx, r13
mov r13, qword [rcx]
xchg rbx, r13
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov dword [rsp - 0x30], 0x3ce90d27
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
xchg rsp, r9
movups xmmword [r9 + 0x28], xmm0
xchg rsp, r9
lea rdx, [rsi + 1]
xchg rsp, r14
movups xmmword [r14 + 0x38], xmm0
xchg r14, rsp
xchg rsp, r10
movups xmmword [r10 + 0x48], xmm0
xchg r10, rsp
call fcn.140017bbc
mov dword [rsp - 0x3c], 0x2463c64c
mov edx, 0x71b7cacf
xor edx, 0x67650372
sub edx, 0x141cc1d0
xor edx, 0x39021d49
test rsi, rsi
je 0x14008a284
mov dword [rsp - 0x30], ecx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x24], 0x17cb6352
xchg rsi, r8
mov rsi, r8
xchg rsi, r8
mov r9d, 0x69692f3a
sub r9d, 0x125ccc99
sub r9d, 0x3fbc6ee7
xor r9d, 0x7b77f679
sub r9d, 0x6c3804c4
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg rbx, rbx
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r8, r8
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008a25b
xor ecx, ecx
xchg rbp, rbp
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.14008a330
xchg rdi, rcx
mov rdi, qword [rsp + 0x20]
xchg rcx, rdi
mov ebx, eax
xchg r12, r12
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov r15, r15
jne 0x14008a302
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x1c], edx
mov ecx, 0x5f9b66b9
xor ecx, 0x4aa19fd
sub ecx, 0x59d1bff9
sub ecx, 0x15fbf1b
rep stosb byte [rdi], al
mov dword [rsp - 0x18], 0x40d0c883
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
xchg r13, r13
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400999a0
mov eax, ebx
xchg rcx, rcx
xchg rbx, r15
mov r15, qword [rsp + 0x78]
xchg rbx, r15
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008b7d3
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, r11
mov rdi, rsp
xchg rdi, r11
xchg rbx, r8
mov qword [r11 + 0x20], r8
xchg r8, rbx
nop
push 0x5d15b205
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg r10, rbx
mov r10, qword [rcx]
xchg r10, rbx
lea rax, [r11 - 0x40]
xchg rbp, rbx
mov qword [r11 + 8], rbx
xchg rbx, rbp
xorps xmm0, xmm0
mov dword [rsp - 0x18], esp
xchg r12, rax
mov qword [r11 - 0x48], r12
xchg r12, rax
mov ebp, r8d
xchg rsi, rsi
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov dword [rsp - 0x34], edx
xchg r13, r14
mov qword [r11 + 0x18], r13
xchg r13, r14
xchg rdx, r9
mov r14, r9
xchg rdx, r9
xchg rsp, rsi
movups xmmword [rsi + 0x28], xmm0
xchg rsi, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x10], 0x4d0d092b
xchg rsp, r12
movups xmmword [r12 + 0x38], xmm0
xchg r12, rsp
xchg r15, rsp
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.140017bbc
mov rsp, rsp
mov edx, 0x4f2d33e5
add edx, 0x1d8db702
add edx, 0xf816eb7
sub edx, 0x40883efa
test rsi, rsi
mov dword [rsp - 0x10], 0x3a1ed77d
je 0x14008b8fb
xchg r9, rax
mov rdi, r9
xchg r9, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x10], edi
mov r9d, 0x6c920f11
sub r9d, 0x15292b89
sub r9d, 0x484be5eb
xor r9d, 0xf1cfd62
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov rsi, rsi
and cx, r9w
ror edx, 1
ror edx, 4
ror edx, 3
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x40], 0x1e3324ef
sub r8, 1
jne 0x14008b8ca
xor ecx, ecx
mov r8d, ebp
mov dword [rsp - 0x3c], 0x66b86e7b
mov word [rax + rsi*2], cx
xchg rdx, r14
mov r14, rdx
xchg rdx, r14
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x14], 0x569d5902
call fcn.14008b9d0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r14, qword [rsp + 0x80]
mov dword [rsp - 0x1c], ebp
lea rax, [rsp + 0x28]
xchg rsi, r11
mov r11, qword [rsp + 0x78]
xchg rsi, r11
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
xchg r9, r9
jne 0x14008b9a0
xor eax, eax
lea rdi, [rsp + 0x28]
xchg rbx, rbx
mov ecx, 0x1e321397
xor ecx, 0x629597da
xor ecx, 0x54bfb609
sub ecx, 0x28183214
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov dword [rsp - 0x30], ebp
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400999a0
mov eax, ebx
mov dword [rsp - 0x30], esp
xchg rbx, r13
mov r13, qword [rsp + 0x88]
xchg rbx, r13
add rsp, 0x60
mov dword [rsp - 0x18], ebx
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008f340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140144084], 0
mov dword [rsp - 0xc], 0x10ec052a
jne 0x14008f44d
xor edx, edx
lea r8, [0x140144080]
mov dword [rsp - 0x40], edx
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x2c], ecx
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x30], 0x6107d5a4
neg ecx
and ecx, 0xedb88320
inc edx
mov dword [rsp - 0x20], 0x4e8f5f07
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], edx
and eax, 1
neg eax
and eax, 0xedb88320
xchg r12, r12
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rdx, rdx
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x1c], 0x33ca96d4
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x38], ebx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0xc], esp
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x18], ebp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov rcx, rcx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xchg r8, r8
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov r9, r9
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x38], ebp
shr ecx, 1
and eax, 1
neg eax
xchg rsi, rsi
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
xchg rsp, rsp
cmp edx, 0x100
jb 0x14008f36c
ret
Function at 0x140094794
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x4b518a93
sub rsp, 0x4b518ab3
movzx eax, byte [rdx + 1]
mov r15, r8
mov dword [rsp - 0x20], 0x5371eaea
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
mov r11, r11
shl ebx, 7
shl ebx, 1
dec r8d
or ebx, eax
mov dword [rsp - 0xc], 0x670249da
shl edi, 4
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x38], esi
shl ebx, 2
shl ebx, 1
shl ebx, 3
shl ebx, 2
or ebx, eax
movzx eax, byte [rdx + 3]
xchg r10, r10
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x18], 0x46a936db
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 1
shl edi, 3
shl edi, 2
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
xchg r8, r8
test r8d, r8d
jle 0x1400948f1
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov dword [rsp - 0x14], ebx
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
xchg r10, r10
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov r9, r9
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rdx, rbp
mov rbp, rsi
xchg rbp, rdx
mov ecx, edi
mov dword [rsp - 0x34], 0x1545868e
call fcn.14009504c
xor ebx, eax
mov rdx, rbp
mov dword [rsp - 0x38], 0x1b527b98
mov ecx, ebx
call fcn.14009504c
xor edi, eax
mov dword [rsp - 0x40], esp
neg rsi
sub rsi, 0xffffffffffffffe8
neg rsi
neg rbp
sub rbp, 0xffffffffffffffe8
neg rbp
sub r14, 1
jne 0x1400948a1
lea rax, [r15 + 7]
mov dword [rsp - 0x2c], 0x3f647846
mov ecx, 0x3c1fda34
add ecx, 0x24e17ad5
sub ecx, 0x3b39943e
sub ecx, 0x1a4ecfee
sub ecx, 0xb78f0d9
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
xchg r15, r15
shr ebx, 8
shr edi, 2
shr edi, 4
shr edi, 1
shr edi, 1
sub rcx, 1
mov rsp, rsp
jne 0x14009491a
xchg rcx, rbx
mov rcx, qword [rsp + 0x40]
xchg rcx, rbx
xchg rdi, rbp
mov rdi, qword [rsp + 0x48]
xchg rbp, rdi
xchg rsi, rbp
mov rbp, qword [rsp + 0x50]
xchg rbp, rsi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140094984
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg rbx, rdi
mov qword [rax + 8], rdi
xchg rdi, rbx
mov qword [rax + 0x10], rbp
xchg rsi, rdi
mov qword [rax + 0x18], rdi
xchg rsi, rdi
mov qword [rax + 0x20], rdi
push r14
mov dword [rsp - 0x34], 0x5e8a359f
nop
sub rsp, 0x18007cf4
add rsp, 0x18007cd4
movzx eax, byte [rdx + 1]
mov rbx, rbx
xchg r8, rdx
mov r14, rdx
xchg rdx, r8
movzx ebx, byte [rdx]
mov dword [rsp - 0x1c], 0x1146e0f7
movzx edi, byte [rdx + 4]
shl ebx, 1
shl ebx, 4
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 2
shl edi, 6
movzx eax, byte [rdx + 2]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x18], 0xb92cf23
movzx eax, byte [rdx + 3]
shl ebx, 1
shl ebx, 4
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
mov r12, r12
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 6
or edi, eax
mov dword [rsp - 0x28], esp
movzx eax, byte [rdx + 7]
shl edi, 3
shl edi, 2
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
mov rdi, rdi
mov eax, dword [rcx + 4]
test eax, eax
jle 0x140094aa9
xchg rsi, rdx
mov rdx, qword [rcx + 8]
xchg rdx, rsi
lea ebp, [rax - 1]
shr ebp, 1
mov dword [rsp - 0x34], esp
inc ebp
xchg rsi, rbx
mov rdx, rbx
xchg rbx, rsi
mov ecx, edi
call fcn.14009504c
mov dword [rsp - 0x20], edx
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov r13, r13
call fcn.14009504c
xor edi, eax
nop
sub rsi, 0x60490baf
add rsi, 0x60490bc7
sub rbp, 1
jne 0x140094a62
mov dword [rsp - 0x2c], 0x3b281f3
lea rax, [r14 + 7]
mov ecx, 0x38c3a092
xor ecx, 0x7f75dd09
sub ecx, 0x5dd865d
xor ecx, 0x41d8f73a
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x24], esi
shr ebx, 5
shr ebx, 2
shr ebx, 1
shr edi, 5
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x140094ac4
xchg r14, r14
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg rbx, r11
xchg r15, rbp
mov r15, qword [rsp + 0x38]
xchg rbp, r15
mov rsi, qword [rsp + 0x40]
xchg r10, r10
xchg rdi, r15
mov r15, qword [rsp + 0x48]
xchg r15, rdi
nop
sub rsp, 0x197321ca
add rsp, 0x197321ea
pop r14
mov dword [rsp - 0x14], 0x72605da3
ret
Function at 0x140094d14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg r14, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
push r14
xchg rdx, rdx
lea rbp, [rsp - 0x47]
add rsp, 0xffffffffffffff60
movdqa xmm0, xmmword [0x140001e30]
mov r14, r14
xor edi, edi
movdqa xmm1, xmmword [0x140001e50]
mov rbx, rdx
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rsp - 0x40], esi
mov rsi, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001e60]
mov r8d, edi
mov dword [rsp - 0x30], esi
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x140001db0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rsp - 0x28], ebx
xchg rbp, rdi
movdqu xmmword [rdi - 9], xmm1
xchg rbp, rdi
mov ecx, edx
mov dword [rsp - 0x30], 0x520deeb1
lea r8, [r8 + 4]
mov eax, 0x4cea4295
sub eax, 0x1f05d611
sub eax, 0x1bd052ca
add eax, 0x2ee5e883
inc rdx
mov dword [rsp - 0x3c], ecx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
mov rbx, rbx
cmp rdx, 0x10
jb 0x140094d95
cmp dword [rsi + 4], 8
mov dword [rsp - 0x44], ebp
jne 0x140094e48
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
mov rdi, rdi
inc rdi
shl cx, 6
shl cx, 1
shl cx, 1
or cx, ax
mov word [rdx], cx
mov dword [rsp - 0x38], 0x56f79151
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140094de9
lea r9, [rbp + 7]
mov dword [rsp - 0x34], 0x12df2b92
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rcx, rsp
mov rsp, rsi
xchg rsp, rcx
call fcn.140094b34
mov dword [rsp - 0x38], ecx
jmp 0x140094f2e
cmp dword [rsi], edi
mov dword [rsp - 0x14], ebp
jle 0x140094f2e
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x30], ecx
mov r8d, 0x5666be7
xor r8d, 0x74f6080d
sub r8d, 0x17a92c89
sub r8d, 0x37c5677
sub r8d, 0x566ae0e6
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov dword [rsp - 0x44], 0x320e4848
nop
add rbx, 0xb4ba3cd
sub rbx, 0xb4ba3cb
shl ax, 5
shl ax, 2
shl ax, 1
or cx, ax
mov word [rdx], cx
xchg rsp, rsp
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140094e81
lea r9, [rbp + 7]
mov dword [rsp - 0x28], 0x6f20e74
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
mov dword [rsp - 0x2c], 0x887a4ee
call fcn.140094b34
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
mov dword [rsp - 0x10], ebp
sub r8d, r14d
lea rdx, [rbp + 0x67]
add r8d, 0xfffffff8
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140094b34
mov dword [rsp - 0xc], 0x5e7308b9
inc edi
nop
add r14d, 0x593d5b85
sub r14d, 0x593d5b7d
cmp edi, dword [rsi]
jl 0x140094e57
mov dword [rsp - 0x3c], ebx
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbx, r9
mov r9, qword [r11 + 0x28]
xchg rbx, r9
lea rdi, [rbp + 7]
mov r14, r14
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg rsp, rbx
mov rbx, r11
xchg rsp, rbx
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140094ffc
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r8, r8
mov r11d, ecx
test edx, edx
je 0x140095048
lea ecx, [r11 + r11]
mov dword [rsp - 0x2c], 0x58514e7e
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov dword [rsp - 0x18], 0x7bd833df
test dl, 1
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
xchg r8, r8
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
jne 0x140095009
mov dword [rsp - 0x34], ecx
mov eax, r10d
ret
Function at 0x14009ad50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
xchg r11, r11
xchg r10, rdx
mov qword [rsp], rdx
xchg r10, rdx
xchg r11, r8
mov qword [rsp + 8], r8
xchg r11, r8
xor r11, r11
mov rsi, rsi
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
mov dword [rsp - 0x10], 0x71bf49b3
cmp r10, r11
bnd jae 0x14009adc3
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov dword [rsp - 0x40], 0x1af7a206
mov byte [r11], 0x49
sub byte [r11], 0x31
xor byte [r11], 0xa
xor byte [r11], 0x12
cmp r10, r11
bnd jne 0x14009ad9b
mov r14, r14
xchg r14, r10
mov r14, qword [rsp]
xchg r10, r14
mov r11, qword [rsp + 8]
mov r10, r10
sub rsp, 0xfffffffffffffff0
bnd ret
Function at 0x1400a00f8
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
mov r14, r14
xor r8d, r8d
xchg r9, rbx
mov rbx, rdx
xchg r9, rbx
test rax, rax
je 0x1400a0166
mov ecx, r8d
xchg r15, r15
mov edx, 0x63881337
xor edx, 0x6a916ea4
add edx, 0x3c7a1342
add edx, 0x1661634d
sub edx, 0x1afaf1e5
rol edx, cl
mov dword [rsp - 0x18], 0x63ad7f4
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
inc r8
mov r12, r12
cmp r8, 0x20
jb 0x1400a0117
mov al, 0x27
add al, 0x49
xor al, 0x73
sub al, 2
ret
mov rax, qword [rcx + 0x100]
test rax, rax
xchg rdi, rdi
je 0x1400a019c
movups xmm0, xmmword [rax]
xchg rsi, rdx
movups xmmword [rsi], xmm0
xchg rsi, rdx
xchg rbp, rax
movups xmm1, xmmword [rbp + 0x10]
xchg rbp, rax
xchg rdx, rdi
movups xmmword [rdi + 0x10], xmm1
xchg rdi, rdx
jmp 0x1400a015d
xorps xmm0, xmm0
mov r15, r15
xor al, al
xchg rdx, rdi
movups xmmword [rdi], xmm0
xchg rdi, rdx
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1400b6cd4
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg r11, rsp
xchg r10, rbx
mov qword [r11 + 8], r10
xchg r10, rbx
xchg r12, rsi
mov qword [r11 + 0x18], r12
xchg rsi, r12
mov qword [r11 + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov rdx, qword [0x1401434c8]
mov rbx, rcx
mov dword [rsp - 0x10], ebp
movabs rcx, 0x86e56ad60b1f080a
xor rcx, 0x1f803e6
xor rcx, 0x2bfd412d
add rcx, 0x2d6d3b0
add rcx, 0x13e7a29a
mov dword [rsp + 0x58], 0x54a1bc97
sub dword [rsp + 0x58], 0x216e374f
sub dword [rsp + 0x58], 0x33115ab
add dword [rsp + 0x58], 0x38fda288
sub dword [rsp + 0x58], 0x69001215
add rdx, rcx
xchg rcx, rcx
movabs rax, 0x2f1393e92b1f22c6
xor rax, 0x3b0bfa1a
add rax, 0x38ed29bd
add rax, 0x31203134
add rax, 0xc050fe9
ror rdx, 3
ror rdx, 1
lea rcx, [r11 - 0x28]
mov dword [rsp - 0x30], 0x6969d527
add rax, rdx
lea rdx, [r11 + 0x10]
not rax
ror rax, 0xf
ror rax, 0x16
ror rax, 2
ror rax, 1
ror rax, 1
call rax
mov dword [rsp - 0x38], ebp
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rdi
xor esi, esi
mov dword [rsp - 0x3c], 0x4519dd50
xchg r11, rdi
movups xmmword [r11], xmm0
xchg rdi, r11
xchg r10, rdi
movups xmmword [r10 + 0x10], xmm0
xchg r10, rdi
xchg r14, rdi
movups xmmword [r14 + 0x20], xmm0
xchg r14, rdi
test eax, eax
mov dword [rsp - 0xc], esi
jne 0x1400b6e0a
mov qword [rbx + 0x38], rsi
jmp 0x1400b6f5b
lea rax, [rsp + 0x20]
mov r9, r9
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov dword [rsp - 0x34], 0x3f83a600
jne 0x1400b6e16
xchg r14, r12
mov qword [rbx + 0x38], r12
xchg r14, r12
cmp qword [rbx], rdi
je 0x1400b6e50
xchg rsi, rsi
xchg rbp, rcx
mov rbp, qword [rbx]
xchg rbp, rcx
call fcn.1400999a0
cmp r14, 0x18
jbe 0x1400b6e8f
xchg rdi, rdi
lea rcx, [r14 + r14]
call fcn.140099bc0
xchg r11, rax
mov qword [rbx], r11
xchg r11, rax
test rax, rax
mov dword [rsp - 0x1c], 0x71d363dc
jne 0x1400b6e9f
mov qword [rbx], rdi
xchg r12, rsi
mov rcx, r12
xchg rsi, r12
jmp 0x1400b6ec8
xchg rdi, rsi
mov qword [rbx], rsi
xchg rdi, rsi
xchg r11, rax
mov r11, rdi
xchg r11, rax
xorps xmm0, xmm0
xchg r15, r15
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
xchg rbx, rax
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rax
xchg rcx, r8
mov r8, qword [rbx]
xchg rcx, r8
mov edx, 0x1abb703f
add edx, 0x59dd7910
sub edx, 0x307fa30
xor edx, 0x353d7f78
sub edx, 0x8f975c3
cmp qword [rbx + 0x38], rsi
jbe 0x1400b6f5b
mov dword [rsp - 0x30], ebx
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x38], 0x850d631
mov r9d, 0x13d7049d
sub r9d, 0x13bbe7a0
add r9d, 0x56ed1736
sub r9d, 0x2f71f612
xor r9d, 0x27963ede
and ax, r9w
mov r12, r12
ror edx, 4
ror edx, 3
ror edx, 1
xor ax, word [r8 + rcx]
inc rsi
mov dword [rsp - 0x24], 0xca31fe3
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400b6efb
mov rsp, rsp
xchg rsi, r14
mov r14, qword [rsp + 0x60]
xchg r14, rsi
xchg rbp, rbx
mov rax, rbp
xchg rbp, rbx
mov rbx, qword [rsp + 0x50]
mov dword [rsp - 0x28], ebp
xchg r8, rdi
mov r8, qword [rsp + 0x68]
xchg rdi, r8
nop
sub rsp, 0x60b8772e
add rsp, 0x60b8776e
pop r14
ret
Function at 0x1400daf10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg r12, rbp
mov r12, rsp
xchg rbp, r12
add rsp, 0xffffffffffffffb0
xchg r15, r15
xor esi, esi
mov dword [rbp - 0x30], 0x4016771c
xor dword [rbp - 0x30], 0x12bbc68f
sub dword [rbp - 0x30], 0x2d71edbc
add dword [rbp - 0x30], 0x24863417
xor dword [rbp - 0x30], 0x49a8f71d
mov dword [rbp - 0x2c], 0x6c55296f
xor dword [rbp - 0x2c], 0x682d077a
xor dword [rbp - 0x2c], 0x4979f343
sub dword [rbp - 0x2c], 0x66a59c0
xor dword [rbp - 0x2c], 0x46f38310
mov rbx, rcx
mov r12, r12
mov dword [rbp - 0x28], 0x79552420
xor dword [rbp - 0x28], 0x7dab372f
add dword [rbp - 0x28], 0x2cc4d17
sub dword [rbp - 0x28], 0x7a25f8f
mov dword [rbp - 0x24], 0x4f7e050
add dword [rbp - 0x24], 0x3f8452ba
sub dword [rbp - 0x24], 0x3879bd7f
sub dword [rbp - 0x24], 0xba374f1
mov dword [rbp - 0x20], 0x3f9bcefa
sub dword [rbp - 0x20], 0x335af87a
xor dword [rbp - 0x20], 0x65f96879
sub dword [rbp - 0x20], 0x212b65e1
sub dword [rbp - 0x20], 0x48185850
xchg rcx, rsi
mov qword [rbp + 0x10], rcx
xchg rcx, rsi
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x18], 0x4b2bbbc0
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
and cl, 3
mov rcx, rcx
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x3457bb56
xor eax, 0x540508b2
xor eax, 0x3c0db97c
sub eax, 0x20aaeff4
shr eax, cl
xchg r14, r14
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
xchg r9, r9
mov rax, qword [rbp + 0x10]
inc rax
xchg r11, rax
mov qword [rbp + 0x10], r11
xchg r11, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x34], edi
cmp rax, 0xa
jb 0x1400daff9
xor edx, edx
mov dword [rsp - 0x24], 0x6be50ae7
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008bd40
xchg rdx, r8
mov rdx, rax
xchg rdx, r8
xchg rsp, rax
mov qword [rbx + 0x200], rsp
xchg rsp, rax
xor eax, eax
lea rdi, [rbp - 0x1c]
mov dword [rsp - 0x2c], edi
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
test r8, r8
mov dword [rsp - 0x20], 0x5e2a6b85
je 0x1400db0fc
lea rdx, [rbx + 0x208]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1400db7b4
test al, al
jne 0x1400db0f2
mov rsi, rsi
mov rcx, qword [rbx + 0x200]
call fcn.14008e310
xor al, al
mov dword [rsp - 0x1c], edi
mov qword [rbx + 0x200], rsi
jmp 0x1400db0fc
mov al, 0x4d
sub al, 0x46
add al, 0x43
xor al, 0x55
xor al, 0x1e
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x18], esi
xchg rdi, rsi
mov rdi, qword [rsp + 0x70]
xchg rsi, rdi
mov rdi, qword [rsp + 0x78]
mov rdi, rdi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret