joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x3c], ecx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov rbp, rbp
push r14
push r15
sub rsp, 0x20
nop
mov r15, r15
movabs r13, 0xffffffff7f69df9c
sub r13, 0x6c5ab0dc
add r13, 0x340d92
mov dword [rsp - 0x14], 0x761ea068
xor r13, 0x4efa6c40
sub r13, 0x40118420
add r13, 0x7fffffff
add r13, 0x6258340e
mov r12, r12
mov r12, r8
mov rbx, r13
mov rsi, rdx
mov r15, rcx
mov dword [rsp - 0x40], esp
nop
inc rbx
cmp word [r8 + rbx*2], 0
jne 0x14006a567
xchg r11, r11
mov rbp, qword [rdx + 8]
mov eax, 0x6866b008
sub eax, 0xabcb98f
xor eax, 0x47dd65c5
mov dword [rsp - 0x38], 0x4ead2768
xor eax, 0x42823933
sub eax, 0x15f0260
xor eax, 0x5797a82d
add rbp, rbx
mov rsi, rsi
lea rcx, [rbp + 1]
mul rcx
cmovo rax, r13
xchg r9, r9
mov rcx, rax
call fcn.140073cf0
xor edi, edi
mov r14, rax
mov dword [rsp - 0x10], 0x28200839
mov rax, qword [rsi + 8]
mov r9d, edi
test rax, rax
je 0x14006a64a
mov dword [rsp - 0x28], esp
nop dword [rax + rax]
mov r8, rsi
cmp rax, 4
jbe 0x14006a5f1
mov dword [rsp - 0x10], 0x73e01066
mov r8, qword [rsi]
movzx ecx, r9b
mov edx, 0x514838d4
mov rbx, rbx
add edx, 0x1528aad1
sub edx, 0x458428d7
add edx, 0x47dc18c1
sub edx, 0x58d8449d
xchg r15, r15
xor edx, 0x17a3d077
and cl, 3
shl cl, 3
sar edx, cl
mov dword [rsp - 0x44], 0x3ec3dfe8
movsx eax, dl
xor ax, word [r8 + r9*2]
mov word [r14 + r9*2], ax
inc r9
xchg r8, r8
mov rax, qword [rsi + 8]
cmp r9, rax
jb 0x14006a5dd
mov rdx, rdi
mov dword [rsp - 0x1c], esp
test rbx, rbx
je 0x14006a67f
nop
mov rcx, qword [rsi + 8]
xchg r8, r8
movzx eax, word [r12 + rdx*2]
add rcx, rdx
inc rdx
mov dword [rsp - 0x14], 0x77260583
mov word [r14 + rcx*2], ax
cmp rdx, rbx
jb 0x14006a658
xchg r9, r9
mov word [r14 + rbp*2], di
mov rcx, r13
mov qword [r15], rdi
inc rcx
mov r8, r8
cmp word [r14 + rcx*2], di
jne 0x14006a68a
mov qword [r15 + 8], rcx
xchg r8, r8
mov r8, r15
cmp rcx, 4
jbe 0x14006a6ec
mov eax, 0x185c40d0
mov dword [rsp - 0x40], 0x724a3fb2
xor eax, 0x2244c4e0
add eax, 0x1930ff2
add eax, 0x306cdb7b
xchg rbp, rbp
add eax, 0x131f6cee
xor eax, 0x7f37dc89
mul rcx
mov r13, r13
cmovo rax, r13
mov rcx, rax
call fcn.140073cf0
mov dword [rsp - 0x10], edx
mov r8, rax
mov qword [r15], rax
cmp qword [r15 + 8], rdi
jbe 0x14006a770
xchg r14, r14
mov r9, r14
sub r9, r8
nop dword [rax]
mov dword [rsp - 0x28], 0x260f70e8
nop word [rax + rax]
movzx ecx, dil
lea r8, [r8 + 2]
mov dword [rsp - 0x18], 0xaa1d401
and cl, 3
mov edx, 0x1038c58
add edx, 0xc5da28d
xor edx, 0x79800c0c
xchg rsp, rsp
sub edx, 0x6a5d1e1f
xor edx, 0x12d75a4f
shl cl, 3
mov dword [rsp - 0x3c], 0x6204e42d
inc rdi
sar edx, cl
movsx eax, dl
mov dword [rsp - 0x10], edi
xor ax, word [r9 + r8 - 2]
mov word [r8 - 2], ax
cmp rdi, qword [r15 + 8]
mov r15, r15
jb 0x14006a712
mov rcx, r14
call fcn.140073d00
mov r9, r9
mov rbx, qword [rsp + 0x50]
mov rax, r15
mov rbp, qword [rsp + 0x58]
mov r10, r10
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
mov dword [rsp - 0x38], esi
pop r14
pop r13
pop r12
pop rdi
xchg r11, r11
ret
Function at 0x14006ab10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
sub rsp, 0x28
mov r13, r13
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov dword [rsp - 0x28], 0x5c7436da
mov qword [rsp + 0x50], r14
mov r14, qword [rcx + 8]
mov rcx, qword [rdx + 8]
mov dword [rsp - 0x2c], ecx
add rcx, r14
mov qword [rsp + 0x20], r15
mov qword [rbx + 8], rcx
lea r15, [rdx + 8]
mov rdx, rdx
cmp rcx, 4
jbe 0x14006ac27
cmp r14, 4
mov dword [rsp - 0xc], ecx
jbe 0x14006ab6f
mov rdi, qword [rbx]
jmp 0x14006ab72
mov rdi, rbx
mov eax, 0x5e2b046
add eax, 0x349245b1
mov rdi, rdi
sub eax, 0xfb09f15
sub eax, 0x34599c8
xor eax, 0x4c1a1fcc
xchg rsp, rsp
xor eax, 0x538aa94e
sub eax, 0x38ee0b96
mul rcx
pushf
mov r8, r8
movabs rcx, 0xffffffff32fab363
sub rcx, 0x2baa73d1
add rcx, 0x332bc582
mov dword [rsp - 0x18], esp
sub rcx, 0x38a8495d
add rcx, 0x7fffffff
add rcx, 0x7e2c4449
mov rdi, rdi
popf
cmovo rax, rcx
mov rcx, rax
call fcn.140073cf0
xchg rbx, rbx
mov rbp, rax
test r14, r14
je 0x14006ac2a
mov rdx, rax
mov dword [rsp - 0x38], edx
sub rdi, rax
mov r8, r14
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp - 0x30], 0x6fa77cce
movzx ecx, word [rdi + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
xchg rbx, rbx
sub r8, 1
jne 0x14006ac11
jmp 0x14006ac2a
mov rbp, rbx
mov rax, qword [r15]
xor r9d, r9d
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x24], 0x62b97daa
cmp rax, 4
ja 0x14006ac51
test rax, rax
mov rdi, rdi
je 0x14006ad0a
jmp 0x14006ac54
mov rsi, qword [rsi]
lea r10, [r14 + r14]
sub r10, rsi
add r10, rbp
mov dword [rsp - 0x2c], 0x7c1239f0
nop dword [rax + rax]
lea ecx, [r14 + r9]
mov r8d, 0x7f9a7a19
xchg r14, r14
sub r8d, 0x1fdb56ad
sub r8d, 0x200476db
add r8d, 0x3a3da8d1
xchg rdi, rdi
sub r8d, 0x1470bdf5
sub r8d, 0x4d3438e8
and cl, 3
lea rsi, [rsi + 2]
mov dword [rsp - 0x34], 0x2631eead
shl cl, 3
mov edx, 0x48ef6cfd
add edx, 0x110deadb
sub edx, 0x4008ee05
mov dword [rsp - 0x18], esi
add edx, 0x884bbb
sub edx, 0x2295709
sar r8d, cl
mov rcx, rcx
movzx ecx, r9b
and cl, 3
inc r9
shl cl, 3
mov dword [rsp - 0x24], ecx
sar edx, cl
xor r8b, dl
movsx eax, r8b
xchg rbx, rbx
xor ax, word [rsi - 2]
mov word [r10 + rsi - 2], ax
cmp r9, qword [r15]
jb 0x14006ac6b
mov rcx, rcx
mov r15, qword [rsp + 0x20]
cmp r14, 4
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov dword [rsp - 0x30], 0x511cc4c
jbe 0x14006ad2f
mov rcx, qword [rbx]
call fcn.140073d00
cmp qword [rbx + 8], 4
xchg rdi, rdi
mov rax, rbx
jbe 0x14006ad42
mov qword [rbx], rbp
xchg rsp, rsp
add rsp, 0x28
pop rbp
pop rbx
mov rcx, rcx
ret
Function at 0x14006ad50
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x40], rbx
mov dword [rsp - 0x14], esp
nop
movabs r8, 0xffffffff5316838c
xor r8, 0x27a6e74b
sub r8, 0xa7f197
xchg rdx, rdx
sub r8, 0x6f750a88
add r8, 0xb22f12a
add r8, 0x7fffffff
mov dword [rsp - 0x14], edx
add r8, 0x7049a62e
mov qword [rsp + 0x50], rsi
mov rdi, rcx
mov qword [rsp + 0x20], r15
mov r8, r8
mov rsi, rdx
mov r15, qword [rcx + 8]
mov rbx, r8
mov dword [rsp - 0x44], edx
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
mov dword [rsp - 0x40], esi
jne 0x14006adc0
lea rcx, [r15 + rbx]
mov qword [rsp + 0x48], rbp
mov r11, r11
mov qword [rsp + 0x28], r14
mov qword [rdi + 8], rcx
cmp rcx, 4
xchg rdi, rdi
jbe 0x14006ae7e
cmp r15, 4
jbe 0x14006adff
mov r14, qword [rdi]
mov dword [rsp - 0x1c], ecx
jmp 0x14006ae02
mov r14, rdi
mov eax, 0x518a7b8e
mov dword [rsp - 0x24], 0x6d61d33a
sub eax, 0x1bfd75dd
add eax, 0x48bf1deb
sub eax, 0x22d3df92
sub eax, 0x31c9eb10
mov dword [rsp - 0x38], ebp
xor eax, 0x6dab5175
xor eax, 0x4405098d
mul rcx
cmovo rax, r8
mov dword [rsp - 0x20], ecx
mov rcx, rax
call fcn.140073cf0
mov rbp, rax
test r15, r15
mov rsi, rsi
je 0x14006ae81
mov rdx, rax
sub r14, rax
mov r8, r15
mov dword [rsp - 0x34], edi
nop word [rax + rax]
movzx ecx, word [r14 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
xchg rdi, rdi
sub r8, 1
jne 0x14006ae67
jmp 0x14006ae81
mov rbp, rdi
mov r14, qword [rsp + 0x28]
mov dword [rsp - 0x1c], 0x41a9ce04
xor edx, edx
test rbx, rbx
je 0x14006aef5
lea r8, [r15 + r15]
xchg r13, r13
sub r8, rsi
add r8, rbp
nop dword [rax]
lea ecx, [r15 + rdx]
xchg rsi, rsi
mov eax, 0x41b131b2
xor eax, 0x247d6ca9
sub eax, 0x6201c42
sub eax, 0x40d6559e
mov dword [rsp - 0x28], 0x43fc08fc
sub eax, 0x6828cb6
and cl, 3
lea rsi, [rsi + 2]
shl cl, 3
mov dword [rsp - 0x34], ecx
inc rdx
sar eax, cl
movsx eax, al
xor ax, word [rsi - 2]
xchg r12, r12
mov word [r8 + rsi - 2], ax
cmp rdx, rbx
jb 0x14006aea5
mov rsi, qword [rsp + 0x50]
mov r9, r9
cmp r15, 4
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
jbe 0x14006af1d
mov dword [rsp - 0x24], 0x16684d80
mov rcx, qword [rdi]
call fcn.140073d00
cmp qword [rdi + 8], 4
xchg r13, r13
mov rax, rdi
jbe 0x14006af2d
mov qword [rdi], rbp
mov rbp, qword [rsp + 0x48]
mov dword [rsp - 0x18], esi
add rsp, 0x30
pop rdi
ret
Function at 0x14006b110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov dword [rsp - 0x40], edi
xor edi, edi
mov r10, r9
mov qword [rdx], rdi
mov rbp, r8
mov dword [rsp - 0x30], ebp
mov qword [rdx + 8], rdi
mov rbx, rdx
mov rax, qword [rcx + 8]
mov dword [rsp - 0x38], 0x6abf2489
cmp r8, rax
jae 0x14006b2f8
mov qword [rsp + 0x30], rsi
cmp rax, 4
xchg r15, r15
jbe 0x14006b15f
mov rcx, qword [rcx]
sub rax, rbp
lea rsi, [rcx + r8*2]
mov dword [rsp - 0x30], ebp
cmp rax, r10
mov r9, rbx
cmovb r10, rax
mov rsi, rsi
mov qword [rdx + 8], r10
cmp r10, 4
jbe 0x14006b209
mov rsp, rsp
nop
movabs rcx, 0xffffffff4893da8a
sub rcx, 0x445e384a
xor rcx, 0x525fdadd
mov dword [rsp - 0x18], esp
sub rcx, 0x4bda6225
add rcx, 0x343845bc
add rcx, 0x7fffffff
mov r9, r9
xor rcx, 0x4137a3cc
mov eax, 0x16f84dd3
xor eax, 0x57fa9c8f
mov rsp, rsp
add eax, 0x33928f1f
sub eax, 0x1a04e347
sub eax, 0x1b243095
xor eax, 0x3f6c4c9d
mov dword [rsp - 0x34], 0x6749c348
mul r10
cmovo rax, rcx
mov rcx, rax
mov dword [rsp - 0x10], esi
call fcn.140073cf0
mov r9, rax
mov qword [rbx], rax
mov rcx, rcx
cmp qword [rbx + 8], rdi
jbe 0x14006b2dd
sub rsi, r9
nop dword [rax]
mov dword [rsp - 0x24], edi
nop word [rax + rax]
lea ecx, [rdi + rbp]
mov r8d, 0x41612e3b
mov dword [rsp - 0x1c], edi
xor r8d, 0x344e20dc
sub r8d, 0x464893a6
xor r8d, 0x441a911e
xchg r15, r15
xor r8d, 0x5c9cc8ac
xor r8d, 0x1146af6d
xor r8d, 0x3f75d31b
mov dword [rsp - 0x1c], edi
and cl, 3
lea r9, [r9 + 2]
shl cl, 3
mov edx, 0x7dae8af1
mov dword [rsp - 0x30], edx
sub edx, 0x1d51dafe
xor edx, 0x26a8ee0b
add edx, 0xbbca596
mov dword [rsp - 0x1c], ebp
sub edx, 0x1b9b9e75
add edx, 0x69f9b77
xor edx, 0x25e7ba15
sar r8d, cl
mov dword [rsp - 0x3c], ebp
movzx ecx, dil
and cl, 3
inc rdi
shl cl, 3
xchg rdx, rdx
sar edx, cl
xor r8b, dl
movsx eax, r8b
xchg rbp, rbp
xor ax, word [rsi + r9 - 2]
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 8]
jb 0x14006b229
xchg r14, r14
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xchg rbx, rbx
add rsp, 0x20
pop rdi
ret
mov rbp, qword [rsp + 0x40]
mov rax, rbx
xchg rdx, rdx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14006b650
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400a5b54], 0
jne 0x14006b757
mov dword [rsp - 0x28], 0x6ac5f454
xor edx, edx
lea r8, [0x1400a5b50]
nop word [rax + rax]
mov ecx, edx
mov rdi, rdi
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov rdi, rdi
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x1c], 0x89ac206
inc edx
xor ecx, eax
mov eax, ecx
mov rsi, rsi
shr ecx, 1
and eax, 1
neg eax
mov rdx, rdx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r13, r13
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov r10, r10
mov eax, ecx
shr ecx, 1
and eax, 1
mov r12, r12
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov rcx, rcx
shr eax, 1
and ecx, 1
neg ecx
xchg r8, r8
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg r11, r11
shr ecx, 1
and eax, 1
neg eax
mov r13, r13
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rsp, rsp
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x34], edi
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov r9, r9
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x40], 0xbe5ff28
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov dword [rsp - 0x38], 0x4030134e
jb 0x14006b678
ret
Function at 0x14006c050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x44], esp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov dword [rsp - 0x30], ecx
mov r14, rcx
mov r9d, r8d
shr r9, 2
mov dword [rsp - 0x1c], ebx
mov rsi, rdx
nop
movabs rcx, 0xffffffff76bee9f9
xor rcx, 0x1a1539fd
mov dword [rsp - 0x28], 0x69b57275
sub rcx, 0x1b6963b4
add rcx, 0x21c07671
add rcx, 0x7fffffff
add rcx, 0xcfd1d3f
mov r14, r14
mov ebx, r8d
mov eax, 0x341a418d
add eax, 0x1cdc106f
mov dword [rsp - 0x10], 0x4cc34897
sub eax, 0x3c8415c0
add eax, 0x5293b175
sub eax, 0x6705edad
mul r9
mov r12, r12
cmovo rax, rcx
mov rcx, rax
call fcn.140073cf0
lea rcx, [r14 + 8]
mov dword [rsp - 0x30], 0x387ae19f
mov r8d, ebx
mov rdx, rax
mov rdi, rax
mov dword [rsp - 0x34], 0x2edb907e
call fcn.140063b70
test al, al
je 0x14006c267
mov r9d, dword [r14]
xchg rcx, rcx
xor edx, edx
shr ebx, 2
movd xmm1, r9d
mov dword [rsp - 0x14], ebp
pshufd xmm1, xmm1, 0
test ebx, ebx
je 0x14006c241
cmp ebx, 0x10
mov dword [rsp - 0x30], 0x14c1260b
jb 0x14006c213
lea eax, [rbx - 1]
lea r8, [rsi + rax*4]
lea rax, [rdi + rax*4]
mov r8, r8
cmp rsi, rax
ja 0x14006c169
cmp r8, rdi
jae 0x14006c213
mov dword [rsp - 0x18], edi
mov r8d, ebx
and r8d, 0xfffffff0
mov r10d, 0x22b70f78
mov dword [rsp - 0x3c], 0x280acca8
add r10d, 0x4a7f6fde
xor r10d, 0x7db11e9c
sub r10d, 0x792f8b3
add r10d, 0x551bd411
mov dword [rsp - 0x10], 0xa8f6d5b
sub r10d, 0x5e103d20
nop dword [rax + rax]
movdqu xmm0, xmmword [rdi + rdx*4]
mov dword [rsp - 0x40], ecx
lea eax, [r10 - 4]
xorps xmm0, xmm1
movdqu xmmword [rsi + rdx*4], xmm0
mov r9, r9
add edx, 0x10
movdqu xmm0, xmmword [rdi + rax*4]
xorps xmm0, xmm1
xchg r14, r14
movdqu xmmword [rsi + rax*4], xmm0
mov eax, r10d
movdqu xmm0, xmmword [rdi + rax*4]
xchg rsp, rsp
xorps xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
lea eax, [r10 + 4]
mov rsp, rsp
add r10d, 0x10
movdqu xmm0, xmmword [rdi + rax*4]
xorps xmm0, xmm1
mov rcx, rcx
movdqu xmmword [rsi + rax*4], xmm0
cmp edx, r8d
jb 0x14006c1ae
mov r11, r11
cmp edx, ebx
jae 0x14006c241
mov r8, rdi
lea rax, [rsi + rdx*4]
xchg rbx, rbx
sub r8, rsi
sub ebx, edx
mov edx, ebx
nop dword [rax]
mov dword [rsp - 0x18], ebx
mov ecx, r9d
xor ecx, dword [r8 + rax]
mov dword [rax], ecx
lea rax, [rax + 4]
xchg rdx, rdx
sub rdx, 1
jne 0x14006c22b
mov rcx, rdi
call fcn.140073d00
mov r14, r14
mov al, 0x52
add al, 0x19
sub al, 0x64
xor al, 0x48
mov dword [rsp - 0x2c], 0xf10e1cc
sub al, 0x3d
add al, 0x26
xor al, 0x39
xchg r12, r12
jmp 0x14006c271
mov rcx, rdi
call fcn.140073d00
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, rbp
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
mov r15, r15
pop r14
ret
Function at 0x14006c290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov r14, r14
sub rsp, 0x20
mov r14, rcx
mov r9d, r8d
mov dword [rsp - 0x28], 0x7d910468
shr r9, 2
mov rbx, rdx
nop
xchg rbx, rbx
movabs rcx, 0xffffffff2ea67c50
sub rcx, 0x120ba1bf
add rcx, 0x4f3723d3
mov dword [rsp - 0xc], ebp
sub rcx, 0x3be255df
xor rcx, 0x385c4973
add rcx, 0x2b9bc99
add rcx, 0x7fffffff
mov r10, r10
add rcx, 0x65926171
mov esi, r8d
mov eax, 0x3e0b343b
mov dword [rsp - 0x18], esi
sub eax, 0x1d6533c0
xor eax, 0x5637ce03
xor eax, 0x2df2f92a
xor eax, 0x1dd02a6
mov dword [rsp - 0x24], 0x70cfb0e3
xor eax, 0x599b4425
sub eax, 0x32571cd
mul r9
mov dword [rsp - 0x40], edx
cmovo rax, rcx
mov rcx, rax
call fcn.140073cf0
mov dword [rsp - 0x40], edi
mov r9d, dword [r14]
mov edx, esi
shr edx, 2
xor r8d, r8d
mov dword [rsp - 0x24], ebx
mov rdi, rax
movd xmm1, r9d
pshufd xmm1, xmm1, 0
test edx, edx
mov r10, r10
je 0x14006c471
cmp edx, 0x10
jb 0x14006c444
mov dword [rsp - 0x24], 0x79961c62
lea eax, [rdx - 1]
lea r10, [rdi + rax*4]
lea rax, [rbx + rax*4]
cmp rdi, rax
mov r14, r14
ja 0x14006c3a0
cmp r10, rbx
jae 0x14006c444
mov r10d, edx
mov rdx, rdx
and r10d, 0xfffffff0
mov r11d, 0x3f25df2e
xor r11d, 0x1fd71eb4
add r11d, 0x1bd286e1
mov dword [rsp - 0x18], ebp
add r11d, 0x3133875a
sub r11d, 0x6df8cfcd
nop word [rax + rax]
movdqu xmm0, xmmword [rbx + r8*4]
mov dword [rsp - 0x34], ecx
lea eax, [r11 - 4]
xorps xmm0, xmm1
movdqu xmmword [rdi + r8*4], xmm0
add r8d, 0x10
mov r9, r9
movdqu xmm0, xmmword [rbx + rax*4]
xorps xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
mov dword [rsp - 0x10], 0x20ab30af
mov eax, r11d
movdqu xmm0, xmmword [rbx + rax*4]
xorps xmm0, xmm1
xchg r13, r13
movdqu xmmword [rdi + rax*4], xmm0
lea eax, [r11 + 4]
add r11d, 0x10
movdqu xmm0, xmmword [rbx + rax*4]
xchg rdx, rdx
xorps xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
cmp r8d, r10d
jb 0x14006c3d9
mov r11, r11
cmp r8d, edx
jae 0x14006c471
sub rbx, rdi
lea rax, [rdi + r8*4]
mov r15, r15
sub edx, r8d
nop dword [rax]
mov ecx, r9d
mov rdi, rdi
xor ecx, dword [rbx + rax]
mov dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
mov dword [rsp - 0x10], 0x49c04204
jne 0x14006c454
lea rcx, [r14 + 8]
mov r8d, esi
mov dword [rsp - 0x44], 0x621ecb18
mov rdx, rdi
call fcn.140063f70
mov rcx, rdi
xchg rsi, rsi
test al, al
je 0x14006c4b3
call fcn.140073d00
mov al, 0x37
mov dword [rsp - 0x34], 0x548b18bf
xor al, 0x3e
xor al, 4
add al, 0x3f
add al, 4
mov dword [rsp - 0x28], edi
xor al, 0x1a
sub al, 0x49
jmp 0x14006c4ba
call fcn.140073d00
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r15, r15
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
xchg rbx, rbx
ret
Function at 0x14006c930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
mov rdi, rcx
mov rsi, rsi
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x6d21f334
xchg r9, r9
xor r8d, 0x49fba85d
add r8d, 0x3cff3dbd
xor r8d, 0x3c6e71e6
mov dword [rsp - 0x1c], ebp
add r8d, 0x89a6637
sub r8d, 0x22acb77d
sub r8d, 0x43a59572
xchg r11, r11
call fcn.140074120
lea rdx, [rsp + 0x240]
xor ecx, ecx
mov dword [rsp - 0x34], ecx
call fcn.14005f9e0
xor ebx, ebx
test rax, rax
je 0x14006ca13
mov r13, r13
mov rax, qword [rsp + 0x240]
lea rcx, [rsp + 0x20]
mov r9d, 0x591f6e4d
mov r10, r10
sub r9d, 0x190893ee
add r9d, 0x1d27c14c
sub r9d, 0x164ad63e
sub r9d, 0x4090bde8
mov dword [rsp - 0x34], 0x40cf1e49
xor r9d, 0x6630686
mov r8, qword [rax + 0x50]
lea edx, [r9 + 1]
xchg r8, r8
call fcn.140074660
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x40], ebp
call fcn.140074740
test rax, rax
je 0x14006ca13
xchg rdx, rdx
mov word [rax], bx
nop
movabs r9, 0xffffffff56fbee68
sub r9, 0x3b44d4cc
mov dword [rsp - 0x38], ebx
xor r9, 0x556786ae
xor r9, 0x3d38b131
xor r9, 0x2155550f
mov dword [rsp - 0x28], 0x5ff338f9
add r9, 0x7fffffff
add r9, 0x2d4284f4
mov qword [rdi], rbx
mov rcx, r9
mov dword [rsp - 0x2c], edx
lea rax, [rsp + 0x20]
nop
inc rcx
xchg r11, r11
cmp word [rax + rcx*2], bx
jne 0x14006ca64
mov qword [rdi + 8], rcx
mov rbx, rbx
mov r8, rdi
cmp rcx, 4
jbe 0x14006caca
xchg rdi, rdi
mov eax, 0x27a30ffa
xor eax, 0x404fb994
add eax, 0x12ef278f
sub eax, 0x2743471d
mov dword [rsp - 0x1c], edx
add eax, 0x2ee40ef
sub eax, 0x16ea7e44
sub eax, 0x3f9c5989
mul rcx
mov r9, r9
cmovo rax, r9
mov rcx, rax
call fcn.140073cf0
mov dword [rsp - 0x38], 0xd258440
mov r8, rax
mov qword [rdi], rax
cmp qword [rdi + 8], rbx
mov dword [rsp - 0x3c], 0x6987bae6
jbe 0x14006cb4d
lea r9, [rsp + 0x20]
sub r9, r8
mov r14, r14
nop
movzx ecx, bl
lea r8, [r8 + 2]
and cl, 3
mov dword [rsp - 0x14], 0x4d14ab4f
mov edx, 0x579b9277
sub edx, 0x31fe61e6
xor edx, 0x6f0605ca
xchg r9, r9
add edx, 0x2a39c2ec
xor edx, 0x6218fbc7
xor edx, 0x72c5f0fd
mov dword [rsp - 0x40], 0x618d0abd
sub edx, 0x4bb694f8
shl cl, 3
inc rbx
xchg r13, r13
sar edx, cl
movsx eax, dl
xor ax, word [r9 + r8 - 2]
mov word [r8 - 2], ax
mov r11, r11
cmp rbx, qword [rdi + 8]
jb 0x14006cae5
mov rbx, qword [rsp + 0x248]
mov rbp, rbp
mov rax, rdi
add rsp, 0x230
pop rdi
mov dword [rsp - 0x24], 0x2f07976f
ret
Function at 0x14006cb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
mov rdi, rdi
mov rax, qword [0x1400a4e10]
mov rdi, rcx
xor rax, qword [0x1400a4ab0]
lea rcx, [rsp + 0x20]
xchg rsi, rsi
mov edx, 0x51d9ebd6
sub edx, 0x2b679369
sub edx, 0x1518dfd6
mov r12, r12
xor edx, 0x1aaae389
add edx, 0x5c37b66
xor edx, 0x11b71780
mov r15, r15
call rax
xor ebx, ebx
lea rax, [rsp + 0x20]
mov rbx, rbx
nop
movabs rcx, 0xffffffff4ea89ee0
xor rcx, 0x465641eb
add rcx, 0x60f5bcd3
mov r14, r14
sub rcx, 0x2f2103ed
sub rcx, 0x17d4f040
xor rcx, 0x37df922d
add rcx, 0x7fffffff
mov dword [rsp - 0x3c], 0x3117233b
add rcx, 0x6adeca64
mov qword [rdi], rbx
mov rdx, rcx
mov dword [rsp - 0x2c], esi
nop
inc rdx
cmp word [rax + rdx*2], bx
jne 0x14006cc21
mov dword [rsp - 0x14], edx
mov qword [rdi + 8], rdx
mov r8, rdi
cmp rdx, 4
jbe 0x14006cc89
mov rsi, rsi
mov eax, 0x25f7feca
add eax, 0x34eacb49
xor eax, 0x35a40d0b
xor eax, 0x4fb1d582
xchg rsp, rsp
add eax, 0x257490b9
sub eax, 0x2745a266
sub eax, 0x1f2600eb
mul rdx
mov dword [rsp - 0x1c], 0x7d6c17ef
cmovo rax, rcx
mov rcx, rax
call fcn.140073cf0
mov dword [rsp - 0x3c], 0x69109e68
mov r8, rax
mov qword [rdi], rax
cmp qword [rdi + 8], rbx
mov dword [rsp - 0x18], 0x63191e19
jbe 0x14006ccfd
lea r9, [rsp + 0x20]
sub r9, r8
mov rsi, rsi
nop
movzx ecx, bl
lea r8, [r8 + 2]
and cl, 3
xchg r15, r15
mov edx, 0x50fdb8bb
add edx, 0x27ff8a7b
sub edx, 0x5064fd4c
xchg rbp, rbp
sub edx, 0x41deba3
xor edx, 0x3c2904c2
shl cl, 3
inc rbx
mov dword [rsp - 0x18], 0x3615ce7e
sar edx, cl
movsx eax, dl
xor ax, word [r9 + r8 - 2]
mov word [r8 - 2], ax
mov dword [rsp - 0x40], 0x6eab6fdf
cmp rbx, qword [rdi + 8]
jb 0x14006cca4
mov rbx, qword [rsp + 0x240]
mov rax, rdi
mov rbp, rbp
add rsp, 0x230
pop rdi
ret
Function at 0x14006dd20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r11, qword [rcx + 0x18]
mov r10, r9
mov dword [rsp - 0x20], esp
test r11, r11
je 0x14006dd67
mov r9, qword [rcx + 0x10]
mov dword [rsp - 0x1c], ecx
lea rcx, [r9 + r11*8]
cmp r9, rcx
je 0x14006dd67
mov dword [rsp - 0x38], edx
nop dword [rax]
mov rax, qword [r9]
cmp dword [rax], edx
je 0x14006dd6f
mov dword [rsp - 0x14], 0x68ca51ca
add r9, 8
cmp r9, rcx
jne 0x14006dd4c
mov r14, r14
mov rax, r10
add rsp, 0x28
ret
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x30], rbx
xchg r11, r11
mov qword [rsp + 0x20], rdi
xor edi, edi
test rdx, rdx
je 0x14006ddc1
mov dword [rsp - 0x38], 0x60bd13ba
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
cmp rcx, rdx
je 0x14006ddc1
mov rsp, rsp
nop word [rax + rax]
mov rbx, qword [rcx]
cmp dword [rbx], r8d
xchg r8, r8
je 0x14006ddc4
add rcx, 8
cmp rcx, rdx
mov dword [rsp - 0x28], 0x3ad2361b
jne 0x14006dda5
mov rbx, rdi
test rbx, rbx
xchg rbx, rbx
je 0x14006de3e
cmp byte [rbx + 4], 4
jne 0x14006de3e
movzx ecx, word [rbx + 5]
mov dword [rsp - 0x38], esp
inc rcx
call fcn.140073cf0
mov r9, rax
mov rsi, rsi
movzx eax, word [rbx + 5]
mov byte [rax + r9], dil
cmp di, word [rbx + 5]
jae 0x14006de21
xchg r11, r11
nop dword [rax]
mov rcx, qword [rbx + 8]
movzx r8d, di
mov dword [rsp - 0x40], esi
inc di
movzx edx, byte [r8 + rcx]
xor dl, 0x37
xchg r9, r9
mov byte [r8 + r9], dl
cmp di, word [rbx + 5]
jb 0x14006ddfd
mov rbx, qword [rsp + 0x30]
xchg r8, r8
mov rax, r9
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
mov dword [rsp - 0x2c], 0x64f0946
ret
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov r15, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret