joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rbx, rcx
lea rcx, [rbp - 0x4f]
xor edx, edx
mov r8d, 0x103
mov word [rsp + 0x38], 0x4f53
mov dword [rsp + 0x3d], 0x5c455241
mov byte [rsp + 0x41], 0
mov word [rsp + 0x3b], 0x5754
mov byte [rsp + 0x3a], 0x46
mov dword [rbp + 0x319], 0x732573
mov byte [rbp + 0x318], 0x25
mov byte [rbp - 0x50], 0
call fcn.18000dea0
lea rcx, [rbp - 0x70]
call fcn.18000ac10
cmp qword [rax + 0x18], 8
jb 0x18000c59f
mov rax, qword [rax]
xor edi, edi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp word [rax], di
jne 0x18000c5be
mov r8d, edi
jmp 0x18000c5cc
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x18000c5c2
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18000bb60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8d, 3
call fcn.18000c2f0
cmp qword [rax + 0x18], 0x10
jb 0x18000c5f8
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r9, [rbp + 0x318]
lea rcx, [rbp - 0x50]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.18000ef80
cmp qword [rbp - 0x78], 0x10
jb 0x18000c631
mov rcx, qword [rsp + 0x70]
call fcn.18000ec84
cmp qword [rsp + 0x68], 8
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x70], dil
jb 0x18000c654
mov rcx, qword [rsp + 0x50]
call fcn.18000ec84
cmp qword [rbp - 0x58], 8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
jb 0x18000c677
mov rcx, qword [rbp - 0x70]
call fcn.18000ec84
lea rax, [rsp + 0x48]
lea rdx, [rbp - 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000a0b0
test eax, eax
jne 0x18000c792
lea rcx, [rbp + 0x1d1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x1d0], dil
call fcn.18000dea0
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x310]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1d0]
xor r8d, r8d
mov dword [rsp + 0x32], 0x736c61
mov word [rsp + 0x30], 0x7668
mov qword [rsp + 0x20], rax
call fcn.18000a168
test eax, eax
jne 0x18000c788
cmp dword [rbp + 0x310], edi
jbe 0x18000c788
lea rcx, [rbp + 0xc1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0xc0], dil
call fcn.18000dea0
lea r9, [rbp + 0x308]
lea rcx, [rbp + 0xc0]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x308], 0x6425
mov byte [rbp + 0x30a], dil
mov qword [rsp + 0x20], rbx
call fcn.18000ef80
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18000c788
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov eax, 1
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov rcx, rbx
call qword [0x18006e0f8]
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
Function at 0x18000c7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rbx, rcx
lea rcx, [rbp - 0x4f]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x3a], 0x41575446
mov word [rsp + 0x38], 0x4f53
mov dword [rsp + 0x3e], 0x5c4552
mov word [rbp + 0x318], 0x7325
mov word [rbp + 0x31b], 0x73
mov byte [rbp + 0x31a], 0x25
mov byte [rbp - 0x50], 0
call fcn.18000dea0
lea rcx, [rbp - 0x70]
call fcn.18000ac10
cmp qword [rax + 0x18], 8
jb 0x18000c81e
mov rax, qword [rax]
xor edi, edi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp word [rax], di
jne 0x18000c83d
mov r8d, edi
jmp 0x18000c84b
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x18000c841
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18000bb60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8d, 3
call fcn.18000c2f0
cmp qword [rax + 0x18], 0x10
jb 0x18000c877
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r9, [rbp + 0x318]
lea rcx, [rbp - 0x50]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.18000ef80
cmp qword [rbp - 0x78], 0x10
jb 0x18000c8b0
mov rcx, qword [rsp + 0x70]
call fcn.18000ec84
cmp qword [rsp + 0x68], 8
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x70], dil
jb 0x18000c8d3
mov rcx, qword [rsp + 0x50]
call fcn.18000ec84
cmp qword [rbp - 0x58], 8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
jb 0x18000c8f6
mov rcx, qword [rbp - 0x70]
call fcn.18000ec84
lea rax, [rsp + 0x48]
lea rdx, [rbp - 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000a0b0
test eax, eax
jne 0x18000ca0f
lea rcx, [rbp + 0x1d1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x1d0], dil
call fcn.18000dea0
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x310]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1d0]
xor r8d, r8d
mov dword [rsp + 0x32], 0x736c61
mov word [rsp + 0x30], 0x7668
mov qword [rsp + 0x20], rax
call fcn.18000a168
test eax, eax
jne 0x18000ca05
cmp dword [rbp + 0x310], edi
jbe 0x18000ca05
lea rcx, [rbp + 0xc1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0xc0], dil
call fcn.18000dea0
lea r9, [rbp + 0x308]
lea rcx, [rbp + 0xc0]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x308], 0x6425
mov byte [rbp + 0x30a], dil
mov qword [rsp + 0x20], rbx
call fcn.18000ef80
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18000ca05
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov rax, rbx
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov rcx, rbx
call qword [0x18006e138]
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
Function at 0x18000ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rbx, rcx
lea rcx, [rbp - 0x4f]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x39], 0x5754464f
mov dword [rsp + 0x3d], 0x5c455241
mov byte [rsp + 0x38], 0x53
mov byte [rsp + 0x41], 0
mov word [rbp + 0x318], 0x7325
mov word [rbp + 0x31b], 0x73
mov byte [rbp + 0x31a], 0x25
mov byte [rbp - 0x50], 0
call fcn.18000dea0
lea rcx, [rbp - 0x70]
call fcn.18000ac10
cmp qword [rax + 0x18], 8
jb 0x18000caa1
mov rax, qword [rax]
xor edi, edi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp word [rax], di
jne 0x18000cac0
mov r8d, edi
jmp 0x18000cace
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x18000cac4
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.18000bb60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8d, 3
call fcn.18000c2f0
cmp qword [rax + 0x18], 0x10
jb 0x18000cafa
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r9, [rbp + 0x318]
lea rcx, [rbp - 0x50]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.18000ef80
cmp qword [rbp - 0x78], 0x10
jb 0x18000cb33
mov rcx, qword [rsp + 0x70]
call fcn.18000ec84
cmp qword [rsp + 0x68], 8
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x70], dil
jb 0x18000cb56
mov rcx, qword [rsp + 0x50]
call fcn.18000ec84
cmp qword [rbp - 0x58], 8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
jb 0x18000cb79
mov rcx, qword [rbp - 0x70]
call fcn.18000ec84
lea rax, [rsp + 0x48]
lea rdx, [rbp - 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000a0b0
test eax, eax
jne 0x18000cc9d
lea rcx, [rbp + 0x1d1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x1d0], dil
call fcn.18000dea0
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x310]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1d0]
xor r8d, r8d
mov word [rsp + 0x33], 0x736c
mov word [rsp + 0x30], 0x7668
mov byte [rsp + 0x35], dil
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x32], 0x61
call fcn.18000a168
test eax, eax
jne 0x18000cc93
cmp dword [rbp + 0x310], edi
jbe 0x18000cc93
lea rcx, [rbp + 0xc1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0xc0], dil
call fcn.18000dea0
lea r9, [rbp + 0x308]
lea rcx, [rbp + 0xc0]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x308], 0x6425
mov byte [rbp + 0x30a], dil
mov qword [rsp + 0x20], rbx
call fcn.18000ef80
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18000cc93
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov eax, 1
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x48]
call fcn.18000a028
mov rcx, rbx
call qword [0x18006e0b8]
add rsp, 0x3e0
pop rdi
pop rbx
pop rbp
ret
Function at 0x18000cf70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1800098c8
mov rdi, rax
test rax, rax
je 0x18000998b
lea rdx, [rbp - 0x10]
mov rcx, rax
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], bl
mov dword [rbp - 9], 0x6f6f4874
mov dword [rbp - 0xd], 0x78654e6c
mov word [rbp - 0xf], 0x6c61
mov byte [rbp - 5], 0x6b
mov byte [rbp - 0x10], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009982
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x180009900
Function at 0x14000e750
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400f5e70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000e770
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000e778
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000e770
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000e7cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000e7c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000e770
add rax, 0x28
cmp rax, r9
jne 0x14000e7b0
xor eax, eax
ret

Function at 0x14000e7d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400f5e70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000e7ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000e7f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000e7ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000e890
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400f5e70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000e8af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000e8b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400e23d0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400e2428
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400e2400
and edx, 7
je 0x1400e245d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400e2438
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x140019a3e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
lea rax, [rcx + 8]
mov dword [rsp - 0x38], 0x229e1225
xchg rbx, r8
mov qword [rsp + 0x70], r8
xchg r8, rbx
mov qword [rcx], rax
mov r15, r15
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
xchg r12, rbp
mov qword [rsp + 0x78], r12
xchg rbp, r12
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rax
lea rcx, [rsp + 0x20]
mov rsp, rsp
movups xmmword [rax + 0x20], xmm0
xchg r14, rax
movups xmmword [r14 + 0x30], xmm0
xchg r14, rax
xchg r10, rax
movups xmmword [r10 + 0x40], xmm0
xchg r10, rax
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
xchg r12, r12
xchg r13, rax
movups xmmword [r13 + 0x70], xmm0
xchg r13, rax
mov rbp, qword [rdx + 0x38]
mov rsi, rsi
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp - 0x34], ebx
lea rdx, [rbp + 1]
xchg rcx, rsp
movups xmmword [rcx + 0x38], xmm0
xchg rsp, rcx
movups xmmword [rsp + 0x48], xmm0
call fcn.14000ee10
mov edx, 0x3a37e44c
add edx, 0x1044994f
add edx, 0x2897bbd2
sub edx, 0x35161d31
sub edx, 0x234dcc25
test rbp, rbp
je 0x140019b7a
xchg r10, rdi
mov r10, rax
xchg rdi, r10
sub rbx, rax
mov r12, r12
xchg r13, rbp
mov r9, r13
xchg r13, rbp
mov r8d, 0x58303976
add r8d, 0x1b45ba16
xor r8d, 0xddbe8da
sub r8d, 0x7eae1a57
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg rcx, rcx
and cx, r8w
ror edx, 3
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rdi + rbx - 2]
xchg r14, r14
mov word [rdi - 2], cx
sub r9, 1
jne 0x140019b4a
xor ecx, ecx
mov rdi, rdi
xchg r9, rbp
mov r8, r9
xchg r9, rbp
mov word [rax + rbp*2], cx
xchg rcx, r12
mov r12, rsi
xchg r12, rcx
mov rdx, qword [rsp + 0x20]
call fcn.140073180
mov rbp, rbp
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov dword [rsp - 0x34], edi
cmp rcx, rax
jne 0x140019c05
xor eax, eax
mov r14, r14
lea rdi, [rsp + 0x28]
mov ecx, 0x46c1f0bf
sub ecx, 0x42ffd635
add ecx, 0x211273d
sub ecx, 0x5d34197
rep stosb byte [rdi], al
xchg rsi, r10
mov rax, r10
xchg r10, rsi
mov rsi, qword [rsp + 0x80]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099240
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x80]
mov dword [rsp - 0x10], 0x6ecd0894
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400277b0
Capabilities:
Encode data using xor

Disassembly:
push r14
mov qword [rsp], rbx
add rsp, 0xffffffffffffffa0
movsxd rax, r8d
movabs rcx, 0x25fda20a5
sub rcx, 0x4ee826ab
add rcx, 0x13696a29
add rcx, 0x7fffffff
xor rcx, 0x124bf522
mov r8, qword [0x1404a36f0]
add rax, rcx
xchg rbx, rbx
imul rcx, rax, 0x989680
ror r8, 0x23
ror r8, 5
ror r8, 0xb
ror r8, 2
ror r8, 1
movabs rax, 0x152f03d204031840
add rax, 0x6db87fca
sub rax, 0x5cf6469a
add rax, 0x7fffffff
add rax, 0x3c1e1f01
mov dword [rsp + 0x78], ecx
xchg rbx, r12
mov r12, rdx
xchg rbx, r12
sar rcx, 0xd
sar rcx, 8
sar rcx, 7
sar rcx, 1
sar rcx, 1
sar rcx, 1
sar rcx, 1
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x7c], ecx
mov dword [rsp - 0x40], ecx
movabs rcx, 0x3fb460d75f3faf35
sub rcx, 0x3f7012d3
xor rcx, 0x4a663846
sub rcx, 0x1714970c
add rcx, 0x7fffffff
add rcx, 0x129e491d
add r8, rcx
mov dword [rsp - 0x14], 0x3c6fa683
lea rcx, [rsp + 0x78]
xor r8, rax
movabs rax, 0x78679037ffb5c0d
sub rax, 0x48c93dfe
add rax, 0x39fe9a32
sub rax, 0x68831c26
xor rax, 0x61438566
add r8, rax
call r8
mov rax, qword [0x1404a36e0]
xchg rsi, rsi
lea r8, [rsp + 0x30]
not rax
mov dword [rsp + 0x28], 0x4596e0ef
sub dword [rsp + 0x28], 0x434afc68
add dword [rsp + 0x28], 0x397a1cfe
add dword [rsp + 0x28], 0x2c608cfd
xor dword [rsp + 0x28], 0x68268e8e
ror rax, 0x28
ror rax, 1
ror rax, 1
movabs rcx, 0x723276e504c5628f
add rcx, 0x3cf4c4e3
add rcx, 0xccef513
sub rcx, 0x41a81ff8
not rax
xchg r14, r14
xor r9d, r9d
add rax, rcx
xor edx, edx
mov r12, r12
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov ecx, 0x23508831
add ecx, 0x58fc9590
sub ecx, 0x1d64eeac
sub ecx, 0x33d6ac6e
sub ecx, 0x2b117ea7
call rax
mov dword [rsp - 0x10], 0x43f5686f
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
mov r14, r14
nop
movabs rdx, 0xffffffff1d83b7db
add rdx, 0x46e8cb98
xor rdx, 0x3b0694e3
add rdx, 0x7fffffff
add rdx, 0x2095e870
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg r8, rax
movups xmmword [r8 + 0x10], xmm0
xchg r8, rax
movups xmmword [rax + 0x20], xmm0
lea rax, [rsp + 0x40]
nop dword [rax]
mov rdx, rdx
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400279bf
xchg rsp, rbx
mov rcx, rsp
xchg rbx, rsp
xchg r9, rdx
mov qword [rbx + 0x38], r9
xchg rdx, r9
call fcn.14000ee10
xor r8d, r8d
mov ecx, 0x4def6e3b
sub ecx, 0x30d6dc50
xor ecx, 0x6c4421f
add ecx, 0x4170d00a
xor ecx, 0x47fdf3e9
cmp qword [rbx + 0x38], r8
mov r12, r12
jbe 0x140027a70
lea r9, [rsp + 0x40]
mov r10d, 0x61554dc3
sub r10d, 0x5b4db1eb
sub r10d, 0x5b771ac
xor r10d, 0x502ad3
sub r9, rax
mov r9, r9
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
mov dword [rsp - 0x34], 0x1a3424c5
ror ecx, 5
ror ecx, 2
ror ecx, 1
xor dx, word [rax + r9 - 2]
xchg r12, r12
inc r8
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
jb 0x140027a38
mov rsp, rsp
xchg r12, rbx
mov rax, r12
xchg rbx, r12
nop
add rsp, 0x21dd35bd
sub rsp, 0x21dd355d
pop rbx
ret
Function at 0x1400324f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov dword [rcx + 8], 0x3eebf1aa
sub dword [rcx + 8], 0x3c8d2c53
xor dword [rcx + 8], 0x1d6cd32d
xor dword [rcx + 8], 0x1f32167b
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ee10
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140032593
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140032579
mov ecx, dword [rbx + 0x40]
mov esi, 0x28a17156
add esi, 0x4455e831
xor esi, 0x27c5ca
sub esi, 0x6ccf9c4e
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x764e9aff
sub edx, 0x237a40f8
sub edx, 0x340ca6ad
xor edx, 0x1ec7b34a
mov eax, dword [rbx + 0x54]
xor eax, 0x7c556718
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x7c556718
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x7c556718
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x7c556718
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x33b30109
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x7c556718
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x50495ef5
sub eax, 0x169aa655
sub eax, 0x18ae3d89
sub eax, 0x21007a18
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.1400990e0
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a4550]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140032674
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rdx + rax - 0x10]
xor ecx, 0x33b30109
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rdx + rax - 0xc]
xor ecx, 0x33b30109
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rdx + rax - 8]
xor ecx, 0x33b30109
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rdx + rax - 4]
xor ecx, 0x33b30109
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a4550]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140032698
lea rcx, [r14 + 0xa8]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.140012020
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
nop
sub rsp, 0x224644a7
add rsp, 0x224644d7
pop r14
pop rdi
pop rsi
ret
Function at 0x140034530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffff50
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140019a30
mov ebx, 0x56bc64c3
xor ebx, 0x228581f9
add ebx, 0x8bc61ac5
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x1400345b7
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x13785df3
xor r8d, 0x14c1c26d
xor r8d, 0x7b99f9f
inc rdi
call fcn.140083320
cmp byte [rdi], 0
jne 0x140034580
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400345eb
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x6993e413
sub ecx, 0x212289c8
xor ecx, 0x48715acb
rep stosb byte [rdi], al
jmp 0x1400345f0
call fcn.140099240
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x6718
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x140034640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov eax, dword [rcx + 0x2e8]
mov r14, rdx
mov edi, dword [rcx + 0x2f4]
xor eax, 0x7c556718
movaps xmmword [rsp + 0x30], xmm6
mov rbp, rcx
movaps xmmword [rsp + 0x20], xmm7
xor ebx, ebx
xor edi, 0x7c556718
xor edx, edx
movd xmm6, eax
add edi, edi
mov eax, dword [rcx + 0x308]
mov esi, ebx
xor eax, 0x33b30109
mov rcx, r14
mov dword [rsp + 0x60], eax
movss xmm7, dword [rsp + 0x60]
cvtdq2ps xmm6, xmm6
call fcn.140054480
test ax, ax
je 0x140034704
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov rax, qword [rbp + 0x300]
add rcx, rcx
mov rdx, rsi
movups xmm0, xmmword [rax + rcx*8]
xorps xmm0, xmmword [0x1404a4550]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm6
addss xmm1, xmm7
cvttss2si ecx, xmm1
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.140054480
test ax, ax
jne 0x1400346ba
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140034730
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
xor r8d, r8d
mov r9d, dword [rcx + 0x2f4]
xor eax, 0x7c556718
xor r9d, 0x7c556718
add r9d, r9d
movd xmm3, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x33b30109
mov dword [rsp + 8], eax
movss xmm4, dword [rsp + 8]
movzx eax, byte [rdx]
cvtdq2ps xmm3, xmm3
test al, al
je 0x1400347bd
mov r10, qword [rcx + 0x300]
movaps xmm2, xmmword [0x1404a4550]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
movzx eax, byte [rdx]
xorps xmm0, xmm2
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm3
addss xmm1, xmm4
cvttss2si ecx, xmm1
sub ecx, r9d
add r8d, ecx
test al, al
jne 0x140034784
mov eax, r8d
ret