joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066670
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14010a0a8]
xor rax, rsp
mov qword [rbp - 0x18], rax
cmp byte [0x1400f6151], 0
movsd xmm0, qword [0x1400f6148]
movzx eax, word [0x1400f6150]
movsd qword [rbp - 0x40], xmm0
mov word [rbp - 0x38], ax
je 0x1400666d0
xor byte [rbp - 0x3f], 0x35
xor byte [rbp - 0x3e], 0x36
xor byte [rbp - 0x3d], 0x37
xor byte [rbp - 0x3c], 0x38
xor byte [rbp - 0x3b], 0x39
xor byte [rbp - 0x3a], 0x3a
xor byte [rbp - 0x39], 0x3b
xor byte [rbp - 0x38], 0x3c
xor byte [rbp - 0x37], 0x3d
mov byte [rbp - 0x40], 0x6e
lea rcx, [rbp - 0x40]
call fcn.141114eac
nop
mov r9, rax
test rax, rax
je 0x1400668b4
cmp byte [0x1400f6375], 0
mov ecx, dword [0x1400f6370]
movsd xmm0, qword [0x1400f6368]
mov dword [rbp - 0x28], ecx
movzx ecx, word [0x1400f6374]
mov word [rbp - 0x24], cx
mov qword [rsp + 0x70], rbx
movsd qword [rbp - 0x30], xmm0
je 0x14006687d
xor ecx, ecx
cmp dword [0x14010a0c0], 2
jl 0x140066838
movdqa xmm2, xmmword [0x1400f7230]
mov eax, 4
movdqa xmm4, xmmword [0x1400f7410]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1400f7250]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x50], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400f7260]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400f6368]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400f7300]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400f7260]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x2c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400f7300]
xorps xmm2, xmm0
movd dword [rbp - 0x2c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x140066850
lea rdx, [rbp - 0x30]
mov rcx, r9
call int.14110e811
nop
mov rbx, rax
test rax, rax
je 0x1400668af
mov edx, 1
lea r9, [rbp - 0x20]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call fcn.141110bd6
nop
test eax, eax
je 0x1400668af
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400d3560
add rsp, 0x60
pop rbp
ret
Function at 0x140066f70
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x14010a0a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [rsp + 0xb8]
cmp byte [rbx], 0xcc
jne 0x140067212
mov edx, 1
lea r9, [rsp + 0x70]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call fcn.141110bd6
nop
test eax, eax
je 0x140067212
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov edx, 1
mov byte [rbx], 0x90
mov rcx, rbx
call fcn.141110bd6
nop
movups xmm0, xmmword [0x1400f6698]
mov eax, dword [0x1400f66a8]
xor r9d, r9d
cmp byte [0x1400f66ab], r9b
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], eax
je 0x1400671cd
cmp dword [0x14010a0c0], 2
mov ecx, r9d
jl 0x14006718b
movdqa xmm0, xmmword [0x1400f7300]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1400f7230]
mov eax, 4
movdqa xmm4, xmmword [0x1400f7410]
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm7
movdqa xmm7, xmmword [0x1400f7260]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140067070
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x14
jge 0x1400671cd
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x1400671a0
xorps xmm0, xmm0
mov qword [rsp + 0x60], r9
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1400671f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400504b0
lea rcx, [rsp + 0x50]
call fcn.14005f670
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d3560
add rsp, 0xb0
pop rbx
ret
Function at 0x140067610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
call fcn.1400d2d10
test eax, eax
je 0x14006784f
movups xmm0, xmmword [0x1400f6408]
xor r9d, r9d
movups xmmword [rsp + 0x20], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x1400677fd
cmp dword [0x14010a0c0], 2
jl 0x1400677c2
movdqa xmm0, xmmword [0x1400f7300]
lea rcx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1400f7230]
mov eax, 4
movdqa xmm4, xmmword [0x1400f7410]
mov edx, r9d
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [0x1400f7260]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x10
jl 0x1400676b0
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
jmp 0x1400677fd
lea r8, [rsp + 0x20]
mov ecx, r9d
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x1400677d0
xorps xmm0, xmm0
mov qword [rsp + 0x50], r9
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x140067820
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400504b0
lea rcx, [rsp + 0x40]
call fcn.14005f670
mov eax, 0x1000
add rsp, 0x98
ret
xor eax, eax
add rsp, 0x98
ret
Function at 0x140068180
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xb8
cmp byte [0x140e915fc], 0
jne 0x1400683d2
movzx eax, word [0x1400f6488]
xor r9d, r9d
cmp dword [0x14010a0c0], 2
mov ecx, r9d
movups xmm0, xmmword [0x1400f6468]
mov word [rsp + 0x70], ax
movups xmm1, xmmword [0x1400f6478]
movzx eax, byte [0x1400f648a]
mov byte [rsp + 0x72], al
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
jl 0x14006834b
movdqa xmm0, xmmword [0x1400f7300]
lea rdx, [r11 - 0x64]
movdqa xmm5, xmmword [0x1400f7230]
mov eax, 4
movdqa xmm4, xmmword [0x1400f7410]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1400f7260]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400f72c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x140068230
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x23
jge 0x14006838d
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x23
jl 0x140068360
xorps xmm0, xmm0
mov qword [rsp + 0x40], r9
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r9
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1400683b0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400504b0
lea rcx, [rsp + 0x30]
call fcn.14005f670
add rsp, 0xb8
ret
Function at 0x1400700b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400700e4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400700d0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eb60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140070109
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140050ab0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140070183
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007017e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007017e
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140070190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x1400701c4
mov ecx, ebx
lea eax, [rcx - 0x35]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400701b0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14003eb60
nop
cmp byte [rdi + 9], 0
je 0x1400701f4
lea eax, [rbx - 0x35]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x1400701e1
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14003eb60
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.140075d90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140070264
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007025e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007025e
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400702a4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007029f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007029f
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400702b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400702e4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400702d0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eb60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140070309
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140050ab0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140070383
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007037e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007037e
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140070390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400703c4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400703b0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eb60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400703e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140050ab0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140070463
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007045e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007045e
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140070470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400704a4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140070490
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003eb60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400704c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140050ab0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140070543
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007053e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007053e
call qword [fcn.1400d8c30]
int3
call fcn.1400d2d20
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140076e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140076e33
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140076e20
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003eb60
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140076e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140076e73
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140076e60
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003eb60
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140078a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140078a43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140078a30
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x140078a50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
cmp byte [0x140e90d70], 0
jne 0x140078b17
movdqa xmm0, xmmword [0x1400da480]
xor edx, edx
movdqa xmm1, xmmword [0x1400da220]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x1400da3f0]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x1400da1f0]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x1400da1d0]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmmword [rax - 0x28], xmm0
mov dword [rax - 0x18], 0x1006f75
mov eax, edx
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x140078ac0
xorps xmm0, xmm0
mov byte [rsp + 0x93], dl
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x140078af5
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400504b0
lea rcx, [rsp + 0x20]
call fcn.14007a5e0
add rsp, 0xa8
ret
Function at 0x140078b20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x14010a0a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rcx
mov byte [rsp + 0x40], dl
xor ecx, ecx
call fcn.141112c51
nop
mov r15, rax
test rax, rax
je 0x140078d93
mov r13d, 0x5a4d
cmp word [rax], r13w
jne 0x140078d93
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x140078d93
movzx ebx, word [rdi + 0x14]
add rbx, 0x18
mov dword [rsp + 0x50], 0x104
add rbx, rdi
call fcn.14110d125
nop
lea r9, [rsp + 0x50]
xor edx, edx
mov rcx, rax
lea r8, [rsp + 0x60]
call fcn.14110f6dd
nop
xor esi, esi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call fcn.14110ba1a
nop
mov r14, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140078d93
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rax
call fcn.141112fbe
nop
test rax, rax
je 0x140078d8a
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
call fcn.141114d2b
nop
mov r12, rax
test rax, rax
je 0x140078d93
cmp word [rax], r13w
jne 0x140078d81
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140078d81
mov eax, dword [rdi + 8]
cmp dword [rcx + 8], eax
jne 0x140078d81
movzx edx, word [rcx + 6]
cmp dx, word [rdi + 6]
jne 0x140078d81
movzx r14d, word [rcx + 0x14]
xor r13b, r13b
add r14, 0x18
mov r9d, esi
add r14, rcx
mov r10d, edx
test edx, edx
je 0x140078d67
nop dword [rax]
mov r8, rbp
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140078cc3
inc rax
test ecx, ecx
jne 0x140078cb0
test edx, edx
jne 0x140078cd0
test dword [rbx + 0x24], 0x20000000
jne 0x140078ce5
inc r9d
add rbx, 0x28
add r14, 0x28
cmp r9d, r10d
jl 0x140078ca0
jmp 0x140078d67
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x140078d67
nop dword [rax]
mov eax, dword [r14 + 0x14]
mov ecx, dword [rbx + 0xc]
mov edi, esi
add rax, rdi
add rcx, rdi
add rcx, r15
movzx ebp, byte [rax + r12]
mov eax, edx
cmp byte [rcx], bpl
je 0x140078d5f
cmp byte [rsp + 0x40], 0
je 0x140078d5c
mov edx, 1
mov dword [rsp + 0x50], 0x40
lea r9, [rsp + 0x54]
lea r8d, [rdx + 0x3f]
call fcn.141110bd6
nop
mov eax, dword [rbx + 0xc]
lea r9, [rsp + 0x50]
add rax, rdi
mov edx, 1
mov byte [rax + r15], bpl
mov ecx, dword [rbx + 0xc]
mov r8d, dword [rsp + 0x54]
add rcx, rdi
add rcx, r15
call fcn.141110bd6
nop
mov eax, dword [rbx + 0x10]
mov r13b, 1
inc esi
mov edx, eax
cmp esi, eax
jb 0x140078cf0
mov rcx, r12
call fcn.14110c7a2
nop
mov rcx, qword [rsp + 0x48]
call fcn.14110b479
nop
movzx eax, r13b
jmp 0x140078d95
mov rcx, r12
call fcn.14110c7a2
nop
mov rcx, r14
call fcn.14110b479
nop
mov al, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400d3560
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret