joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x79
sub byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x68
add byte [rbx + rax], 2
sub byte [rbx + rax], 0x47
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x63
inc rax
cmp rax, 0x98
jb 0x14007d3c5
xchg rcx, rdi
mov rax, rcx
xchg rdi, rcx
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rcx
push rdx
push rax
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x56]
xchg rbx, r15
mov rdx, r15
xchg rbx, r15
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x6a
add byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x22
inc rax
cmp rax, 0xa8
jb 0x14007d45d
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x5a]
xchg rdx, rbp
mov rbp, rbx
xchg rbp, rdx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 2
xor byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x2b
inc rax
cmp rax, 0xb0
jb 0x14007d4db
xchg rdx, rdi
mov rax, rdx
xchg rdi, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret

Function at 0x14007d530
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
push rdx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 0x70]
xchg rbx, r15
mov rdx, r15
xchg r15, rbx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x31
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x50
inc rax
cmp rax, 0xdc
jb 0x14007d567
xchg rdi, r10
mov rax, r10
xchg rdi, r10
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d5b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rdx
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x76
xor byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x54
add byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0xde
jb 0x14007d5e3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rdi
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x76]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x40
add byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x40
inc rax
cmp rax, 0xea
jb 0x14007d655
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x7c]
xchg r10, rdx
mov r10, rbx
xchg r10, rdx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x24
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x21
add byte [rbx + rax], 0x38
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0xf4
jb 0x14007d6d0
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rdx
push rcx
push rcx
push rax
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
xchg r15, rdx
mov r15, rbx
xchg r15, rdx
call fcn.14007ad00
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x6a
inc rax
cmp rax, 0x130
jb 0x14007d76e
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d7c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x23
xor byte [rbx + rax], 0
sub byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x21
add byte [rbx + rax], 9
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x6d
inc rax
cmp rax, 0x14
jb 0x14007d7f6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d850
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xe]
xchg r10, rdx
mov r10, rbx
xchg rdx, r10
call fcn.14007ad00
nop
xor eax, eax
mov byte [rbx + rax], 0x23
add byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x44
add byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0x18
jb 0x14007d889
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x140084190
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r8
mov rax, rcx
xchg rcx, r8
cmp rcx, rdx
je 0x1400842fb
xchg rdi, r9
mov rdi, rax
xchg r9, rdi
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg r10, rsi
mov qword [r9 + r8 - 0x70], rsi
xchg rsi, r10
mov qword [r9 + r8 - 0x68], r10
movups xmm0, xmmword [r8 - 0x80]
movups xmmword [rax], xmm0
xchg rbx, r8
movups xmm1, xmmword [rbx - 0x70]
xchg rbx, r8
xorps xmm0, xmm0
xchg r11, rax
movups xmmword [r11 + 0x10], xmm1
xchg r11, rax
xchg rbp, r10
mov qword [r8 - 0x70], rbp
xchg r10, rbp
neg rax
add rax, 0xffffffffffffffb8
neg rax
mov qword [r8 - 0x68], 0x6c23941f
sub qword [r8 - 0x68], 0x6736ddc4
add qword [r8 - 0x68], 0x5d2ba6e3
sub qword [r8 - 0x68], 0x5611def6
xor qword [r8 - 0x68], 0x1a2d6e2f
add qword [r8 - 0x68], 0x21421848
xor qword [r8 - 0x68], 0x36c77744
xor qword [r8 - 0x68], 0x1aa5fec
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r10, rdx
mov qword [r9 + r8 - 0x50], rdx
xchg r10, rdx
mov qword [r9 + r8 - 0x48], r10
xchg rbx, r8
movups xmm0, xmmword [rbx - 0x60]
xchg rbx, r8
xchg r9, rsi
movups xmmword [rsi + r8 - 0x60], xmm0
xchg rsi, r9
xchg r8, rsi
movups xmm1, xmmword [rsi - 0x50]
xchg rsi, r8
xchg r9, rdi
movups xmmword [rdi + r8 - 0x50], xmm1
xchg rdi, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x7f41b5ea
xor qword [r8 - 0x48], 0x7a37ea05
add qword [r8 - 0x48], 0x6cad7230
sub qword [r8 - 0x48], 0x50899bcc
add qword [r8 - 0x48], 0x186299cc
add qword [r8 - 0x48], 0x2b9cff1e
sub qword [r8 - 0x48], 0x2a50f9f7
sub qword [r8 - 0x48], 0x1412e448
sub qword [r8 - 0x48], 0x2735f0f7
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x1400841bc
ret
Function at 0x140084300
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
cmp rcx, rdx
je 0x1400843d3
xchg r12, rbx
mov rax, r12
xchg rbx, r12
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r9, rbx
movups xmmword [r9], xmm0
xchg rbx, r9
xchg r12, r10
mov qword [rax + r8 - 0x28], r12
xchg r12, r10
lea rcx, [r8 - 0x18]
mov qword [r8 + rax - 0x20], r10
xchg rsi, r8
movups xmm0, xmmword [rsi - 0x38]
xchg rsi, r8
xchg rdi, rbx
movups xmmword [rdi], xmm0
xchg rbx, rdi
xchg r8, r10
movups xmm1, xmmword [r10 - 0x28]
xchg r8, r10
xchg rbx, r15
movups xmmword [r15 + 0x10], xmm1
xchg r15, rbx
mov qword [r8 - 0x28], r10
neg rbx
add rbx, 0xffffffffffffffe0
neg rbx
mov qword [r8 - 0x20], 0x5a649673
sub qword [r8 - 0x20], 0xc8607a
sub qword [r8 - 0x20], 0x421db08e
add qword [r8 - 0x20], 0x4cc055df
add qword [r8 - 0x20], 0x1a754643
xor qword [r8 - 0x20], 0x16e559e1
sub qword [r8 - 0x20], 0x22539b69
xor qword [r8 - 0x20], 0x45fddd0c
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x14008432a
mov r8, r9
xchg r10, rdx
mov r10, rbx
xchg r10, rdx
mov rcx, rbx
call fcn.14007f430
xchg rbx, r10
mov rax, r10
xchg rbx, r10
add rsp, 0x20
push rdx
push rax
push rcx
push rax
push rdx
push rdx
push rcx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084410
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x1400844e7
xchg rbp, r9
mov rbp, rax
xchg rbp, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
xchg rcx, r10
mov qword [r9 + r8 - 0x28], rcx
xchg r10, rcx
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r14, r8
movups xmm0, xmmword [r14 - 0x38]
xchg r14, r8
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r9, r8
movups xmm1, xmmword [r9 - 0x28]
xchg r9, r8
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm1
xchg rsi, rax
xchg r10, rdi
mov qword [r8 - 0x28], rdi
xchg rdi, r10
nop
add rax, 0x7c2ca3f6
sub rax, 0x7c2ca3d6
mov qword [r8 - 0x20], 0x6747454d
sub qword [r8 - 0x20], 0x4909464b
xor qword [r8 - 0x20], 0x6ceec07d
xor qword [r8 - 0x20], 0x63e753e
sub qword [r8 - 0x20], 0x3ca26d00
add qword [r8 - 0x20], 0x231ccfd
sub qword [r8 - 0x20], 0x271c2bd8
sub qword [r8 - 0x20], 0x13607e5f
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008443e
ret

Function at 0x14008e7f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0xd
add byte [rcx + rax + 0xa], 0x67
xor byte [rcx + rax + 0xa], 0x14
add byte [rcx + rax + 0xa], 0x12
sub byte [rcx + rax + 0xa], 0x1e
xor byte [rcx + rax + 0xa], 0x69
sub byte [rcx + rax + 0xa], 8
xor byte [rcx + rax + 0xa], 0x35
inc rax
cmp rax, 0x10
jb 0x14008e7f2
ret
Function at 0x14008e910
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x1e
add byte [rcx + rax + 0x14], 0x5d
sub byte [rcx + rax + 0x14], 0x46
xor byte [rcx + rax + 0x14], 0x71
add byte [rcx + rax + 0x14], 5
xor byte [rcx + rax + 0x14], 9
xor byte [rcx + rax + 0x14], 0x3e
sub byte [rcx + rax + 0x14], 0x7e
inc rax
cmp rax, 0x24
jb 0x14008e912
ret
Function at 0x1401945a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r10
mov rdx, r10
xchg rdx, r10
mov r11, rcx
mov dword [rsp + 0x30], 0x511ac676
xor dword [rsp + 0x30], 0xc4b3a55
xor dword [rsp + 0x30], 0x7a5edb7b
xor dword [rsp + 0x30], 0x19424a7e
xor dword [rsp + 0x30], 0x399e7124
add dword [rsp + 0x30], 0x4f4a1fe5
sub dword [rsp + 0x30], 0x4948b633
sub dword [rsp + 0x30], 0xbc27625
xor dword [rsp + 0x30], 0xf4e4f979
mov dword [rsp + 0x36], 0x318efa33
sub dword [rsp + 0x36], 0x1ccc7367
xor dword [rsp + 0x36], 0xdff67da
xor dword [rsp + 0x36], 0x30812426
xor dword [rsp + 0x36], 0x2d46bf28
add dword [rsp + 0x36], 0x3e2a34c3
add dword [rsp + 0x36], 0x32773e4f
xor dword [rsp + 0x36], 0x44519e8d
add dword [rsp + 0x36], 0xcd8f8bb3
mov dword [rsp + 0x3a], 0x17097e6a
add dword [rsp + 0x3a], 0x3c167e9d
add dword [rsp + 0x3a], 0xce9d58e
add dword [rsp + 0x3a], 0x4df85c2
sub dword [rsp + 0x3a], 0x5453aa3e
add dword [rsp + 0x3a], 0x1f0aeb8d
xor dword [rsp + 0x3a], 0xd0fe66fb
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140194686
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
xchg r9, r10
mov qword [rsp + 0x20], r10
xchg r10, r9
xchg rdi, r9
mov rdi, r8
xchg rdi, r9
lea r8, [rsp + 0x36]
xchg r10, r15
mov rdx, r15
xchg r15, r10
xchg rdi, rcx
mov rdi, r11
xchg rdi, rcx
call fcn.140194730
nop
mov byte [rsp + rbx + 0x36], 0x1a
xor byte [rsp + rbx + 0x36], 0xe
add byte [rsp + rbx + 0x36], 0x22
xor byte [rsp + rbx + 0x36], 0x15
add byte [rsp + rbx + 0x36], 0x31
xor byte [rsp + rbx + 0x36], 0x60
sub byte [rsp + rbx + 0x36], 0x34
inc rbx
cmp rbx, 8
jb 0x1401946e4
add rsp, 0x40
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140198a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r10
mov qword [rsp + 0x20], r10
xchg r9, r10
xchg r12, r8
mov qword [rsp + 0x18], r12
xchg r12, r8
xchg rcx, r13
mov qword [rsp + 8], r13
xchg rcx, r13
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
xchg rbx, rdi
mov rdi, r9
xchg rbx, rdi
xchg rdx, r13
mov rsi, r13
xchg rdx, r13
mov r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x140198ae8
mov eax, ebp
jmp 0x140198b38
mov eax, 0x391d04b
add eax, 0x3e53527b
sub eax, 0x1251bba5
add eax, 0x408e2da1
sub eax, 0x42fdc35b
add eax, 0x48bf90fe
sub eax, 0xcb0f4ff
xor eax, 0x6932372b
cmp word [rdx], ax
je 0x140198b27
xchg r9, rbp
mov rax, r9
xchg r9, rbp
jmp 0x140198b38
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x5416f9eb
add ecx, 0x2791c428
xor ecx, 0x40c7ceab
xor ecx, 0x59cec4b8
xor ecx, 0xa046c6a
sub ecx, 0x68a5d65f
cmp word [rax + 0x18], cx
jne 0x140198c82
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x140198c82
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198c48
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x140198c3c
xchg rsi, rdx
mov qword [rsp + 0xa8], rsi
xchg rdx, rsi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg r9, rcx
test rcx, rcx
je 0x140198d01
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
xchg rdx, rbx
mov qword [rsp + 0x20], rbx
xchg rdx, rbx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198c48
xchg r8, r15
mov r15, qword [rsp + 0xb0]
xchg r8, r15
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140198ba3
xchg rcx, r10
mov r10, qword [rbx + 0x38]
xchg r10, rcx
test rcx, rcx
je 0x140198c71
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg rbp, r8
mov qword [rbx + 0x38], r8
xchg rbp, r8
mov al, 0x39
xor al, 0x69
xor al, 0xc
xor al, 0x1b
add al, 0x16
sub al, 0x5c
jmp 0x140198cad
xchg r11, rcx
mov r11, qword [rbx + 0x38]
xchg r11, rcx
test rcx, rcx
je 0x140198cab
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r14, rbp
mov qword [rbx + 0x38], r14
xchg rbp, r14
xor al, al
add rsp, 0x58
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
call fcn.1401fdf62
nop
int3
Function at 0x1401ab420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
mov r10, rcx
test rdx, rdx
je 0x1401ab498
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab485
movzx eax, byte [r10]
test bl, bl
je 0x1401ab467
lea rcx, [r9 - 1]
xchg r9, r13
mov rdx, r13
xchg r13, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab456
jmp 0x1401ab485
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab476
inc r10
sub r11, 1
jne 0x1401ab438
xchg r8, rbx
mov r8, qword [rsp]
xchg rbx, r8
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x635182e
xor r9d, 0x24c1fe25
xor r9d, 0x73e02539
xor r9d, 0xfc31f55
add r9d, 0x193a7db2
xor r9d, 0x67b08d4e
xor r9d, 0x1fa2d527
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b08f3
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b08ae
mov ecx, dword [r10]
jmp 0x1401b0a38
cmp ecx, 0x4e0
jb 0x1401b0a38
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x7e6cad51
sub ebx, 0x14fc1e85
sub ebx, 0x1b9f870c
sub ebx, 0x27d4573
sub ebx, 0x15aa43be
add ebx, 0x44333909
sub ebx, 0x3e1464cc
sub ebx, 0x3bc851e9
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b093c
lea r11, [r10 + 0xd50]
mov ebx, 0x47f21794
add ebx, 0x1adc450
sub ebx, 0xd725042
sub ebx, 0x21b376b6
xor ebx, 0x4f0453c8
sub ebx, 0x16649bfe
xor ebx, 0x4550ff4b
sub ebx, 0x7a4952e1
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b09ba
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 1
shl eax, 5
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 2
shl eax, 0xd
xor edx, eax
mov eax, edx
shr eax, 5
shr eax, 0xa
shr eax, 3
xor eax, edx
add rsp, 8
ret
Function at 0x1401b0fe0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
xchg rdx, r14
mov rdi, r14
xchg rdx, r14
mov rbx, rcx
mov byte [rax + rcx], 0x1a
xor byte [rax + rcx], 0x59
xor byte [rax + rcx], 0x1b
xor byte [rax + rcx], 0x35
sub byte [rax + rcx], 0x43
xor byte [rax + rcx], 0x20
add byte [rax + rcx], 0x5c
xor byte [rax + rcx], 0x2c
add byte [rax + rcx], 0x36
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b107d
cmp r8d, 0x38
jae 0x1401b10f2
mov ecx, r8d
mov eax, 0x1ceaf126
add eax, 0x30f05198
xor eax, 0x191aa60f
add eax, 0x292db6a1
sub eax, 0x10aa9e85
sub eax, 0x57f84650
xor eax, 0x154cb645
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fe1b6
jmp 0x1401b10f2
cmp r8d, 0x40
jae 0x1401b10c7
mov ecx, r8d
mov eax, 0x71842e84
xor eax, 0x1b5f1f79
sub eax, 0x3f0f3fbe
xor eax, 0x7448fd42
sub eax, 0x475b1ed1
add eax, 0x2b77b2a4
xor eax, 0x388c7c46
xor eax, 0x21598a0c
xor eax, 0x5a4a555a
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fe1b6
mov rdx, rbx
xchg r13, rbx
mov rcx, r13
xchg r13, rbx
call fcn.1401b1480
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
xchg rdx, rbx
movups xmmword [rdx + 0x10], xmm0
xchg rbx, rdx
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
shl edx, 2
shl edx, 1
add rdx, qword [rbx + 0x48]
mov rax, rdx
mov qword [rbx + 0x48], rdx
shr rax, 3
shr rax, 1
shr rax, 1
shr rax, 3
mov byte [rbx + 0x3e], al
xchg r9, rdx
mov rax, r9
xchg r9, rdx
shr rax, 8
shr rax, 4
shr rax, 2
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3d], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x15
shr rax, 3
mov byte [rbx + 0x3c], al
xchg rdx, r14
mov rax, r14
xchg r14, rdx
shr rax, 3
shr rax, 9
shr rax, 1
shr rax, 0x11
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x18
shr rax, 4
shr rax, 1
shr rax, 4
shr rax, 1
shr rax, 5
shr rax, 1
mov byte [rbx + 0x3a], al
mov rax, rdx
mov byte [rbx + 0x3f], dl
shr rdx, 0x1a
shr rdx, 0x14
shr rdx, 4
shr rdx, 2
shr rdx, 3
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
shr rax, 0x24
shr rax, 7
shr rax, 4
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b1480
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x53187c02
sub ecx, 0x75d65c0
sub ecx, 0x262f15e9
xor ecx, 0x23140c7
xor ecx, 0x2d115ce2
sub ecx, 0x30865e1
xor ecx, 0x36e7fb69
xor ecx, 0x5e5c04b3
sub ecx, 0x6f184929
lea rdi, [rdi + 1]
sub ecx, r8d
nop
sub r8d, 0x190b8ac4
add r8d, 0x190b8acc
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b11e7
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret