joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006df0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0xf], 0
mov rax, rcx
je 0x140006f6f
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0xe
jb 0x140006e20
mov rbx, qword [rsp]
mov byte [rax + 0xf], 0
add rsp, 8
ret
Function at 0x140006fd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x15], 0
mov rax, rcx
je 0x1400071c5
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xa]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 5]
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, r10d
or dl, r8b
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 4]
mov byte [rdi - 5], dl
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 1]
mov byte [rdi - 4], dl
add bl, 0x19
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x14
jb 0x140007000
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x15], 0
add rsp, 8
ret
Function at 0x140008d60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140008dbd
lea rbx, [0x1400a8370]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140008da4
cmp r10, 2
jb 0x140008da4
cmp byte [r9], r8b
jne 0x140008da4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140008d80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140008dff
lea rbx, [0x1400a8370]
cmp r8b, 0x23
jne 0x140008de3
cmp byte [r9], r8b
jne 0x140008de3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140008dd0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000bbb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x14000bbe5
mov r8d, 0x6d4
lea rdx, str.C:UsersPCDesktop_sobfox_launcherimguiimgui.h
lea rcx, str.Size___0
call fcn.140089f2c
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400a8370]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140105f58]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x14000bc5f
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x14000bc6e
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140018a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [0x140105f58]
mov edi, ecx
mov esi, ecx
shr edi, 0x18
mov ebp, ecx
shr esi, 0x10
shr ebp, 8
mov r14, qword [rax + 0x1d18]
mov ebx, ecx
cmp dword [r14 + 0x108], 0
jg 0x140018ae4
mov r8d, 0x6d4
lea rdx, str.C:UsersPCDesktop_sobfox_launcherimguiimgui.h
lea rcx, str.Size___0
call fcn.140089f2c
movsxd rcx, dword [r14 + 0x108]
lea r9, [0x1400a8370]
mov rax, qword [r14 + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx eax, bl
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, bpl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, sil
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
mov eax, edi
xor r8d, dword [r9 + rcx*4]
lea rcx, [r14 + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
lea rdx, [rsp + 0x40]
not r8d
mov dword [rsp + 0x40], r8d
call fcn.14002f1d0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14001a2d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140105f58]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x14001a321
cmp byte [rbx + 0x20d6], 0
jne 0x14001a321
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140008ce0
test dil, 1
je 0x14001a448
jmp 0x14001a3b2
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400b5304]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1400b52f0]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400b51ec]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140008ce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001a402
lea r11, [0x1400a8370]
cmp r9b, 0x23
jne 0x14001a3e5
cmp byte [r8], r9b
jne 0x14001a3e5
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a3d2
not ecx
call fcn.140011bb0
test rax, rax
je 0x14001a448
cmp byte [rax + 0xcf], 0
je 0x14001a448
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.140008ce0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140014460
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140020330
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x140020386
lea r11, [0x1400a8370]
cmp r9b, 0x23
jne 0x140020369
cmp byte [r8], r9b
jne 0x140020369
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140020356
not ecx
call fcn.140020240
test rax, rax
jne 0x14002039f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140020150
add rsp, 0x20
pop rbx
ret
Function at 0x1400247b0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x1400249ce
push rbp
push rsi
sub rsp, 0x48
mov qword [rsp + 0x68], rdi
mov rbp, rcx
mov qword [rsp + 0x70], r14
lea rdi, [rdx + 0x1a]
mov qword [rsp + 0x40], r15
mov r14d, 0xffffffff
lea r15, [0x1400a8370]
mov qword [rsp + 0x60], rbx
movsxd rsi, r8d
nop word [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x1400249a6
mov rcx, rbp
call fcn.140023a80
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140024871
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140024861
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140024859
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14002485c
mov rdx, rcx
test rdx, rdx
jne 0x140024830
cmp r8, r10
je 0x140024871
cmp dword [r8], r9d
jne 0x140024871
mov rcx, qword [r8 + 8]
jmp 0x140024873
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140024907
cmp qword [rcx + 0x18], 0
jne 0x1400248fc
mov qword [rcx + 0x18], rbx
jmp 0x140024907
cmp qword [rcx + 0x20], 0
jne 0x140024907
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002493c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140024930
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140008ce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140024998
cmp r9b, 0x23
jne 0x14002497b
cmp byte [r8], r9b
jne 0x14002497b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140024968
not ecx
call fcn.140011bb0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x1400247f0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x14004e370
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
test r8, r8
je 0x14004e421
test dword [rcx + 0x10], 0x100000
jne 0x14004e3a4
mov r8d, 0x1cfe
lea rdx, str.C:UsersPCDesktop_sobfox_launcherimguiimgui_widgets.cpp
lea rcx, str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call fcn.140089f2c
movzx r9d, byte [rsi]
lea r8, [rsi + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14004e3f1
lea r11, [0x1400a8370]
cmp r9b, 0x23
jne 0x14004e3d4
cmp byte [r8], r9b
jne 0x14004e3d4
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14004e3c1
mov rcx, qword [0x140105f58]
not eax
cmp dword [rcx + 0x1d6c], eax
jne 0x14004e408
mov dword [rcx + 0x1d70], eax
cmp dword [rcx + 0x1da8], eax
jne 0x14004e4a6
mov byte [rcx + 0x1dac], 1
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140105f58]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx + 0x1d18]
cmp dword [rdi + 0x108], 0
jg 0x14004e462
mov r8d, 0x6d4
lea rdx, str.C:UsersPCDesktop_sobfox_launcherimguiimgui.h
lea rcx, str.Size___0
call fcn.140089f2c
mov rbx, qword [0x140105f58]
movsxd rax, dword [rdi + 0x108]
xor edx, edx
mov r8, qword [rdi + 0x110]
mov rcx, rsi
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140008d60
mov rdi, qword [rsp + 0x38]
cmp dword [rbx + 0x1d6c], eax
jne 0x14004e492
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x14004e4a1
mov byte [rbx + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140050910
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ebx, r9d
mov ecx, r9d
xor ebp, ebp
shl rcx, 2
mov r14, rdx
mov r15d, r8d
mov esi, ebp
call fcn.14008a040
mov r11, rax
mov r10d, ebp
test ebx, ebx
je 0x1400509f4
cmp ebx, 0x10
jb 0x1400509cf
movdqa xmm2, xmmword [0x1400b54f0]
lea rcx, [rax + 0x20]
mov r8d, ebx
mov edx, 8
and r8d, 0xfffffff0
nop
lea eax, [rdx - 4]
movd xmm0, r10d
pshufd xmm0, xmm0, 0
lea rcx, [rcx + 0x40]
paddd xmm0, xmm2
movd xmm1, eax
movdqu xmmword [rcx - 0x60], xmm0
lea eax, [rdx + 4]
add r10d, 0x10
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movd xmm0, edx
movdqu xmmword [rcx - 0x50], xmm1
add edx, 0x10
movd xmm1, eax
pshufd xmm0, xmm0, 0
pshufd xmm1, xmm1, 0
paddd xmm0, xmm2
paddd xmm1, xmm2
movdqu xmmword [rcx - 0x40], xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp r10d, r8d
jb 0x140050970
cmp r10d, ebx
jae 0x1400509f4
movsxd rax, r10d
lea rcx, [r11 + rax*4]
nop dword [rax + rax]
mov dword [rcx], r10d
lea rcx, [rcx + 4]
inc r10d
cmp r10d, ebx
jb 0x1400509e0
mov r9d, ebp
jmp 0x1400509fb
mov r9d, ebp
test ebx, ebx
je 0x140050a3c
mov r10, r11
nop
mov r8d, dword [r10]
lea r10, [r10 + 4]
xor edx, edx
mov eax, r9d
div ebx
inc r9d
movsxd rax, edx
xor edx, edx
movzx eax, byte [rax + r14]
add eax, r8d
add eax, esi
div ebx
movsxd rsi, edx
mov eax, dword [r11 + rsi*4]
lea rcx, [r11 + rsi*4]
mov dword [r10 - 4], eax
movzx eax, r8b
mov dword [rcx], eax
cmp r9d, ebx
jb 0x140050a00
test r15d, r15d
je 0x140050aba
mov r14, rdi
mov r10, r15
nop word [rax + rax]
xor edx, edx
lea eax, [rbp + 1]
div ebx
lea r14, [r14 + 1]
movsxd rbp, edx
xor edx, edx
mov ecx, dword [r11 + rbp*4]
lea r9, [r11 + rbp*4]
lea eax, [rcx + rsi]
movzx ecx, cl
div ebx
movsxd rsi, edx
xor edx, edx
mov eax, dword [r11 + rsi*4]
lea r8, [r11 + rsi*4]
mov dword [r9], eax
mov dword [r8], ecx
mov eax, dword [r9]
add eax, ecx
div ebx
movsxd rax, edx
movzx ecx, byte [r11 + rax*4]
xor byte [r14 - 1], cl
sub r15, 1
jne 0x140050a50
nop dword [rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
ror al, 3
not al
ror al, 6
not al
mov byte [rdi - 1], al
sub r10, 1
jne 0x140050aa0
mov rcx, r11
call fcn.14007730c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140051cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5a], 0
mov rax, rcx
je 0x140051cf8
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x59
jb 0x140051cc0
mov byte [rax + 0x5a], 0
ret
Function at 0x140052cd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x10], 0
mov rax, rcx
je 0x140052df9
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
lea r11, [r11 + 5]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 7], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 6]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 6], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11 - 5]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11 - 5], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 4]
mov byte [r11 - 4], dl
add r10b, 0x14
xor r10b, byte [r11 - 3]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0xf
jb 0x140052d00
mov rbx, qword [rsp]
mov byte [rax + 0x10], 0
add rsp, 8
ret

Function at 0x140057360
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x1b], 0
mov rax, rcx
je 0x1400573f0
mov qword [rsp], rbx
mov r11, rcx
mov rbx, rcx
neg rbx
nop
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11]
lea r11, [r11 + 2]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 + 1]
mov byte [r11 - 2], dl
add r10b, 0x11
xor r10b, byte [r11 - 1]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 1], dl
cmp rcx, 0x1a
jb 0x140057380
mov rbx, qword [rsp]
mov byte [rax + 0x1b], 0
add rsp, 8
ret
Function at 0x140074e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x100], 0
mov rax, rcx
je 0x140074e9e
xor r10d, r10d
nop
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0xff
jb 0x140074e60
mov byte [rax + 0x100], 0
ret

Function at 0x140074ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
mov rax, rcx
je 0x140074f08
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x1d
jb 0x140074ed0
mov byte [rax + 0x1e], 0
ret

Function at 0x140075010
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x1d], 0
mov rax, rcx
je 0x14007518f
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x1c
jb 0x140075040
mov rbx, qword [rsp]
mov byte [rax + 0x1d], 0
add rsp, 8
ret

Function at 0x1400751a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x100], 0
mov r10, rcx
je 0x1400751ee
xor eax, eax
nop
mov r9d, eax
lea r8d, [rax + 0x10]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0xff
jb 0x1400751b0
mov byte [r10 + 0x100], 0
ret
Function at 0x1400751f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x3d], 0
mov rax, rcx
je 0x14007543b
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xc]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 8], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 7]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
and r9d, 7
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 6]
mov ecx, r10d
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 5]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x1a]
xor r8b, byte [rdi - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 3]
mov byte [rdi - 4], dl
add bl, 0x1b
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x3c
jb 0x140075220
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x3d], 0
add rsp, 8
ret