joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002be5c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x14017f7f0]
mov rcx, rbx
test rdi, rdi
je 0x14002beb1
cmp qword [0x14017f7f0], 0
je 0x14002beb1
mov rsi, qword [rdi + 8]
cmp qword [rcx + 8], rsi
jne 0x14002bea4
mov rdx, qword [rdi + 0x10]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14013a7b5
test eax, eax
je 0x14002bec3
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002be8b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x14002beb3

Function at 0x14002cfdc
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
xor eax, eax
xorps xmm0, xmm0
lea r8, [r11 - 0x28]
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov rdi, r9
call fcn.140018aa0
test eax, eax
je 0x14002d018
add eax, 0xffffc580
jmp 0x14002d05d
cmp qword [0x14017fdb0], 0
lea rbx, [0x14017fdb0]
mov rcx, rbx
je 0x14002d058
mov rsi, qword [rsp + 0x28]
cmp qword [rcx + 8], rsi
jne 0x14002d04b
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14013a7b5
test eax, eax
je 0x14002d073
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002d031
mov eax, 0xffffc380
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rbx, rbx
je 0x14002d058
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
cmp eax, 1
jne 0x14002d0a4
cmp dword [rdi], 5
je 0x14002d094
cmp dword [rdi], 0
je 0x14002d094
mov eax, 0xffffc580
jmp 0x14002d05d
mov rax, qword [rdi + 8]
neg rax
sbb eax, eax
and eax, 0xffffc580
jmp 0x14002d05d
xor eax, eax
jmp 0x14002d05d

Function at 0x14002fe3c
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x5c]
call fcn.14013a51c
mov r8, rbx
mov dword [rsp + 0x28], 0x67452301
mov rdx, rdi
mov dword [rsp + 0x2c], 0xefcdab89
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
call fcn.14002fca8
mov r8d, eax
test eax, eax
jne 0x14002fec1
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14002fd7c
mov r8d, eax
xor eax, eax
lea rdi, [rsp + 0x20]
lea ecx, [rax + 0x5c]
rep stosb byte [rdi], al
mov eax, r8d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140138940
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x140030e74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x90
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r14, rcx
mov r13, r9
mov ecx, dword [rbp + 0x7f]
mov r12, r8
mov rsi, rdx
call fcn.14002a1a4
mov rdi, rax
test rax, rax
jne 0x140030ec4
mov eax, 0xffffbf80
jmp 0x140030f97
xorps xmm0, xmm0
lea rcx, [rbp - 0x49]
xor eax, eax
xor r8d, r8d
mov rdx, rdi
mov qword [rbp - 0x39], rax
movups xmmword [rbp - 0x49], xmm0
call fcn.14002a474
mov ebx, eax
test eax, eax
jne 0x140030f81
movzx edi, byte [rdi + 0xc]
lea r8d, [rax + 0x40]
xor edx, edx
lea rcx, [rbp - 0x31]
call fcn.14013a51c
and dword [rbp - 0x51], ebx
test rsi, rsi
je 0x140030f81
mov r15d, edi
cmp rsi, r15
lea rcx, [rbp - 0x49]
mov rdi, rsi
cmovae rdi, r15
call fcn.14002a564
mov ebx, eax
test eax, eax
jne 0x140030f81
mov r8, r13
lea rcx, [rbp - 0x49]
mov rdx, r12
call fcn.14002a680
mov ebx, eax
test eax, eax
jne 0x140030f81
lea r8d, [rax + 4]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.14002a680
mov ebx, eax
test eax, eax
jne 0x140030f81
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x49]
call fcn.14002a6f0
mov ebx, eax
test eax, eax
jne 0x140030f81
xor edx, edx
test rdi, rdi
je 0x140030f79
mov al, byte [rbp + rdx - 0x31]
inc rdx
xor byte [r14], al
inc r14
cmp rdx, rdi
jb 0x140030f67
inc byte [rbp - 0x4e]
sub rsi, rdi
jne 0x140030f08
xor eax, eax
lea rdi, [rbp - 0x31]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
lea rcx, [rbp - 0x49]
call fcn.14002a204
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140031380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x470], rax
cmp dword [rcx + 0x148], 1
mov rsi, rcx
mov r12, qword [rsp + 0x4e8]
mov r9, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4f8]
jne 0x14003158a
mov rbx, qword [rcx + 8]
lea rax, [rbx - 0x10]
cmp rax, 0x3f0
ja 0x14003158a
lea rax, [0x14017ecf0]
mov ecx, 1
cmp ecx, dword [rsi + 0x14c]
je 0x140031404
mov ecx, dword [rax + 0x10]
add rax, 0xc
test ecx, ecx
jne 0x1400313f1
movzx edi, byte [rax + 8]
test edi, edi
je 0x14003158a
lea r15d, [rdi + rdi]
lea ecx, [r15 + 2]
cmp rcx, rbx
ja 0x14003158a
lea rax, [rsp + 0x70]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400307fc
mov edx, eax
test eax, eax
jne 0x14003156e
mov eax, dword [rsi + 0x14c]
lea rcx, [rsp + 0x71]
mov ebp, edi
mov dword [rsp + 0x20], eax
mov r14, rbx
mov edx, ebp
sub r14, rdi
lea rdi, [rsp + 0x71]
add rdi, rbp
mov r8, rdi
lea r9, [r14 - 1]
call fcn.140030e74
mov edx, eax
test eax, eax
jne 0x14003156e
mov eax, dword [rsi + 0x14c]
lea r8, [rsp + 0x71]
mov r9d, ebp
mov dword [rsp + 0x20], eax
lea rdx, [r14 - 1]
mov rcx, rdi
call fcn.140030e74
mov edx, eax
test eax, eax
jne 0x14003156e
mov ecx, dword [rsi + 0x14c]
call fcn.14002a1a4
test rax, rax
jne 0x1400314b6
mov edx, 0xffffbf80
jmp 0x14003156e
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14002a760
mov edx, eax
test eax, eax
jne 0x14003156e
mov dl, byte [rsp + 0x70]
xor ecx, ecx
test rbp, rbp
je 0x1400314f0
mov al, byte [rsp + rcx + 0x30]
inc rcx
xor al, byte [rdi]
inc rdi
or dl, al
cmp rcx, rbp
jb 0x1400314dd
mov eax, r15d
mov r10, rbx
sub r10, rax
xor r9d, r9d
xor r8b, r8b
xor ecx, ecx
add r10, 0xfffffffffffffffe
je 0x140031527
or r8b, byte [rdi + rcx]
inc rcx
mov al, r8b
neg al
or al, r8b
not al
movzx eax, al
shr rax, 7
add r9, rax
cmp rcx, r10
jb 0x140031507
add rdi, r9
mov al, byte [rdi]
inc rdi
xor al, 1
or dl, al
je 0x14003153c
mov edx, 0xffffbf00
jmp 0x14003156e
sub rbx, rdi
lea r8, [rsp + 0x70]
add r8, rbx
cmp r8, qword [rsp + 0x500]
jbe 0x140031558
mov edx, 0xffffbc00
jmp 0x14003156e
mov qword [r12], r8
test r8, r8
je 0x14003156c
mov rdx, rdi
mov rcx, r13
call fcn.14013a522
xor edx, edx
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x400
rep stosb byte [rdi], al
lea ecx, [rax + 0x40]
lea rdi, [rsp + 0x30]
rep stosb byte [rdi], al
mov eax, edx
jmp 0x14003158f
mov eax, 0xffffbf80
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400345a0
Capabilities:
Hash data using sha256

Disassembly:
mov r8, rcx
cmp edx, 1
jbe 0x1400345ae
mov eax, 0xffffff8c
ret
and dword [rcx], 0
mov eax, edx
and dword [rcx + 4], 0
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0x56fbb871
add ecx, 0x6a09e667
mov dword [r8 + 8], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0x7b152682
add ecx, 0xbb67ae85
mov dword [r8 + 0xc], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0xf401e9a5
add ecx, 0x3c6ef372
mov dword [r8 + 0x10], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0x51be63ff
add ecx, 0xa54ff53a
mov dword [r8 + 0x14], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0xaeb1b8b2
add ecx, 0x510e527f
mov dword [r8 + 0x18], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0xcd52ac85
add ecx, 0x9b05688c
mov dword [r8 + 0x1c], ecx
neg eax
mov eax, edx
sbb ecx, ecx
and ecx, 0x4575b5fc
add ecx, 0x1f83d9ab
mov dword [r8 + 0x20], ecx
neg eax
sbb ecx, ecx
xor eax, eax
and ecx, 0x6319828b
add ecx, 0x5be0cd19
mov dword [r8 + 0x24], ecx
mov dword [r8 + 0x68], edx
ret

Function at 0x140035538
Capabilities:
Hash data using sha512

Disassembly:
mov r8, rcx
cmp edx, 1
jbe 0x140035546
mov eax, 0xffffff8b
ret
mov eax, edx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
neg eax
movabs rax, 0x61b1b6f5cd48d5d0
sbb rcx, rcx
and rcx, rax
movabs rax, 0x6a09e667f3bcc908
add rcx, rax
mov eax, edx
mov qword [r8 + 0x10], rcx
neg eax
movabs rax, 0xa7327aa4b1b22dcc
sbb rcx, rcx
and rcx, rax
movabs rax, 0xbb67ae8584caa73b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x18], rcx
neg eax
movabs rax, 0x54ea0de731dbe4ec
sbb rcx, rcx
and rcx, rax
movabs rax, 0x3c6ef372fe94f82b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x20], rcx
neg eax
movabs rax, 0x6fdff79e97f12248
sbb rcx, rcx
and rcx, rax
movabs rax, 0xa54ff53a5f1d36f1
add rcx, rax
mov eax, edx
mov qword [r8 + 0x28], rcx
neg eax
movabs rax, 0x1624d3e851d98860
sbb rcx, rcx
and rcx, rax
movabs rax, 0x510e527fade682d1
add rcx, rax
mov eax, edx
mov qword [r8 + 0x30], rcx
neg eax
movabs rax, 0xf3aee1fb3d19a8f2
sbb rcx, rcx
and rcx, rax
movabs rax, 0x9b05688c2b3e6c1f
add rcx, rax
mov eax, edx
mov qword [r8 + 0x38], rcx
neg eax
movabs rax, 0xbb88546169b7d23c
sbb rcx, rcx
and rcx, rax
movabs rax, 0x1f83d9abfb41bd6b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x40], rcx
neg eax
movabs rax, 0xebd47b04ab7c2e2b
sbb rcx, rcx
and rcx, rax
movabs rax, 0x5be0cd19137e2179
add rcx, rax
xor eax, eax
mov qword [r8 + 0x48], rcx
mov dword [r8 + 0xd0], edx
ret
Function at 0x140054948
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
movdqa xmm0, xmmword [0x140214290]
mov rbx, rdx
movdqa xmm1, xmmword [0x140213840]
xor edx, edx
mov ecx, edx
mov word [rsp + 0x50], 0x100
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
lea eax, [rcx + 0x29]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x20
jb 0x14005499d
xorps xmm0, xmm0
mov byte [rsp + 0x51], dl
xorps xmm1, xmm1
lea rax, [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm0
or r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x70], xmm1
inc r8
cmp byte [rax + r8], dl
jne 0x1400549cb
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140012434
mov rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
cmp rdx, 0xf
cmova rax, rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
jbe 0x140054a3d
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054a38
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054a38
push rax
call fcn.14099b35e
int3
call fcn.1401389a4
mov rax, qword [0x14024ed88]
lea rdx, [rsp + 0x30]
mov r8d, 0x100
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140015bec
mov edi, dword [rbx + 0x54]
lea r9, [rsp + 0x60]
mov rdx, qword [rbx + 0x70]
mov rcx, qword [0x14024ed88]
add rdx, 0xfffffffffffffff0
mov r8d, dword [rbx + 0x58]
add rdx, rdi
add rcx, rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
sub r8d, edi
lea rcx, [rbp - 0x80]
xor edx, edx
call fcn.140016a50
xor eax, eax
lea rdi, [rbp - 0x80]
mov ecx, 0x120
movabs rdx, 0x7ff000000
xor qword [rbx + 0x70], rdx
rep stosb byte [rdi], al
mov rcx, qword [0x14024ed88]
cmp rcx, qword [0x14024ed90]
je 0x140054acc
mov qword [0x14024ed90], rcx
mov al, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140138940
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400555f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov r8d, 6
cmp byte [r9 + 7], 0
je 0x140055630
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [r9 + rcx], al
inc rcx
cmp rcx, r8
jb 0x14005561c
mov byte [r9 + 7], 0
lea rax, [r9 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
cmp r9, rax
jne 0x14005565f
movdqa xmm0, xmmword [0x140213570]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
jmp 0x14005566d
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140012434
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14005567b
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14005aa04
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400556f8
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400556f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400556f3
push rax
call 0x140c1c634
int3
call fcn.1401389a4
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140055898
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov rbx, rdx
cmp byte [rcx + 3], r8b
je 0x1400558c5
mov edx, r8d
lea eax, [rdx + 0x29]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 2
jb 0x1400558b2
mov byte [rcx + 3], r8b
xorps xmm0, xmm0
lea rax, [rcx + 2]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rcx, rax
jne 0x1400558ed
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x1400558fe
mov rdx, rcx
mov r8d, 2
mov rcx, rbx
call fcn.140012434
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140055908
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov rbx, rdx
cmp byte [rcx + 4], r8b
je 0x140055935
mov edx, r8d
lea eax, [rdx + 0x29]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 3
jb 0x140055922
mov byte [rcx + 4], r8b
xorps xmm0, xmm0
lea rax, [rcx + 3]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rcx, rax
jne 0x14005595d
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14005596e
mov rdx, rcx
mov r8d, 3
mov rcx, rbx
call fcn.140012434
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140055978
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov rbx, rdx
cmp byte [rcx + 6], r8b
je 0x1400559a5
mov edx, r8d
lea eax, [rdx + 0x29]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 5
jb 0x140055992
mov byte [rcx + 6], r8b
xorps xmm0, xmm0
lea rax, [rcx + 5]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rcx, rax
jne 0x1400559cd
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x1400559de
mov rdx, rcx
mov r8d, 5
mov rcx, rbx
call fcn.140012434
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400559e8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov rbx, rdx
cmp byte [rcx + 5], r8b
je 0x140055a15
mov edx, r8d
lea eax, [rdx + 0x29]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 4
jb 0x140055a02
mov byte [rcx + 5], r8b
xorps xmm0, xmm0
lea rax, [rcx + 4]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rcx, rax
jne 0x140055a3d
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x140055a4e
mov rdx, rcx
mov r8d, 4
mov rcx, rbx
call fcn.140012434
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140058078
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140057958
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.140138960
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0x11
cmp byte [rdi + 0x12], 0
je 0x140058102
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, r8
jb 0x1400580f0
mov byte [rdi + 0x12], 0
lea rax, [rdi + 0x11]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x140058128
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140058134
mov rdx, rdi
mov rcx, rbx
call fcn.140012434
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14005852c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140057958
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.140138960
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xe
cmp byte [rdi + 0xf], 0
je 0x1400585b6
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, r8
jb 0x1400585a4
mov byte [rdi + 0xf], 0
lea rax, [rdi + 0xe]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x1400585dc
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x1400585e8
mov rdx, rdi
mov rcx, rbx
call fcn.140012434
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x14005860c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140057958
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.140138960
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0x10
cmp byte [rdi + 0x11], 0
je 0x140058696
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, r8
jb 0x140058684
mov byte [rdi + 0x11], 0
lea rax, [rdi + 0x10]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x1400586bc
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x1400586c8
mov rdx, rdi
mov rcx, rbx
call fcn.140012434
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140072c74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
test rdx, rdx
jne 0x140072c9c
xor eax, eax
jmp 0x140072ce1
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov edi, dword [rbp + rdx + 0x20]
mov esi, dword [rbp + rdx + 0x24]
add rdi, rbx
add rsi, rbx
jmp 0x140072cbf
lea rdi, [rdi + 4]
add rsi, 2
mov ecx, dword [rdi]
mov rdx, r14
add rcx, rbx
push rdx
call 0x140691dbb
test eax, eax
jne 0x140072cb7
mov ecx, dword [rbp + rbx + 0x1c]
movzx edx, word [rsi]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140076dc4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov r9, r8
mov rdi, rdx
mov rbx, rcx
xor r10d, r10d
cmp byte [r8 + 0xa], r10b
je 0x140076e30
mov ecx, 0x321b
mov rdx, r8
lea r8d, [r10 + 2]
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, 2
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140076dec
mov byte [r9 + 0xa], r10b
lea r8, [r9 + 8]
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140082014
nop
lea r8, [rsp + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.140081ae8
nop
lea rcx, [rsp + 0x28]
call fcn.140010424
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140080eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov rbx, rdx
cmp byte [rcx + 7], r8b
je 0x140080edd
mov edx, r8d
lea eax, [rdx + 0x29]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 6
jb 0x140080eca
mov byte [rcx + 7], r8b
xorps xmm0, xmm0
lea rax, [rcx + 6]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rcx, rax
jne 0x140080f05
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x140080f16
mov rdx, rcx
mov r8d, 6
mov rcx, rbx
call fcn.140012434
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140081d34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140057958
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.140138960
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xc
cmp byte [rdi + 0xd], 0
je 0x140081dbe
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, r8
jb 0x140081dac
mov byte [rdi + 0xd], 0
lea rax, [rdi + 0xc]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x140081de4
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140081df0
mov rdx, rdi
mov rcx, rbx
call fcn.140012434
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140081e14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov byte [rcx], 0
lea r14, [rcx + 8]
xor eax, eax
mov qword [r14], rax
mov dl, byte [rcx]
mov rcx, r14
call fcn.140057958
mov byte [rsi], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov ecx, 0x20
call fcn.140138960
mov rbx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov r8d, 0xd
cmp byte [rdi + 0xe], 0
je 0x140081e9e
xor ecx, ecx
lea eax, [rcx + 0x29]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, r8
jb 0x140081e8c
mov byte [rdi + 0xe], 0
lea rax, [rdi + 0xd]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
cmp rdi, rax
jne 0x140081ec4
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140081ed0
mov rdx, rdi
mov rcx, rbx
call fcn.140012434
nop
mov qword [r14], rbx
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140138940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret