joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0ac0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg r10, rcx
mov rbx, r10
xchg rcx, r10
mov byte [rax + rcx], 0x71
sub byte [rax + rcx], 0x4e
xor byte [rax + rcx], 0x31
add byte [rax + rcx], 9
xor byte [rax + rcx], 0x51
sub byte [rax + rcx], 0x24
add byte [rax + rcx], 0x31
add byte [rax + rcx], 0x29
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b0b56
cmp r8d, 0x38
jae 0x1401b0bd9
mov ecx, r8d
mov eax, 0x5253dc0a
xor eax, 0x3a6f64d6
xor eax, 0x35733b59
sub eax, 0xd84ce94
sub eax, 0x175db1b1
add eax, 0x170490f3
sub eax, 0x627081c
sub eax, 0x494a8bdf
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fde36
jmp 0x1401b0bd9
cmp r8d, 0x40
jae 0x1401b0b9b
mov ecx, r8d
mov eax, 0x27ac9beb
sub eax, 0xa973d53
add eax, 0x22c99229
xor eax, 0x7f317d6
sub eax, 0x3330f4cb
add eax, 0x2c36c8ab
xor eax, 0x5ce14499
sub eax, 0x6dd2fe2e
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fde36
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
mov rcx, rbx
call fcn.1401b0f40
xorps xmm0, xmm0
xor eax, eax
xchg r15, rbx
movups xmmword [r15], xmm0
xchg r15, rbx
xchg r14, rbx
movups xmmword [r14 + 0x10], xmm0
xchg r14, rbx
xchg r15, rbx
movups xmmword [r15 + 0x20], xmm0
xchg r15, rbx
xchg rbp, rax
mov qword [rbx + 0x30], rbp
xchg rbp, rax
mov edx, dword [rbx + 0x40]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
shl edx, 3
add rdx, qword [rbx + 0x48]
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
xchg rdx, rcx
mov qword [rbx + 0x48], rcx
xchg rcx, rdx
shr rax, 1
shr rax, 5
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3e], al
xchg r12, rdx
mov rax, r12
xchg r12, rdx
shr rax, 2
shr rax, 2
shr rax, 0xc
mov byte [rbx + 0x3d], al
mov rax, rdx
shr rax, 0xe
shr rax, 5
shr rax, 2
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3c], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 3
shr rax, 5
shr rax, 0xe
shr rax, 3
shr rax, 3
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3b], al
xchg r11, rax
mov r11, rdx
xchg r11, rax
shr rax, 0x1f
shr rax, 1
shr rax, 8
mov byte [rbx + 0x3a], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
mov byte [rbx + 0x3f], dl
shr rdx, 7
shr rdx, 0x2e
shr rdx, 2
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rcx, rbx
mov rdx, rcx
xchg rcx, rbx
shr rax, 0xd
shr rax, 0x1a
shr rax, 8
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0f40
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x14288c56
xor ecx, 0x1d9c9b3c
add ecx, 0x4daa970a
xor ecx, 0x35e724ad
sub ecx, 0x5e01d60e
sub ecx, 0x4b7b4b3
lea rdi, [rdi + 1]
sub ecx, r8d
sub r8d, 0xfffffff8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b0cc8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba2d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9899
xchg rcx, rdx
mov rcx, qword [rbx + 0x28]
xchg rcx, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9882
xchg rsi, r8
mov rsi, qword [rcx - 8]
xchg rsi, r8
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b98b0
mov rcx, r8
call fcn.1401fcdd8
xor eax, eax
xchg r14, rax
mov qword [rbx + 0x18], r14
xchg r14, rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rcx
xchg qword [rsp + 8], rbx
add rsp, 0x10
jmp 0x1401ba2d0
call 0x140a0622d
int3
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rbx, r14
mov r14, qword [rcx]
xchg rbx, r14
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x5fac0f3a
sub qword [rax], 0x5f6cc09d
add qword [rax], 0x6959b0b3
xor qword [rax], 0x77604c6c
add qword [rax], 0x4a3b1fd0
xor qword [rax], 0x56943680
add qword [rax], 0x223851cc
sub qword [rax], 0x61e03758
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba3b3
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg r8, rcx
mov r8, rsi
xchg rcx, r8
call fcn.1401b3230
mov edx, 0x289548d0
xor edx, 0x7fd6708
xor edx, 0x46bf0d2f
sub edx, 0x1316d75
sub edx, 0x1111400c
xor edx, 0x509c13d1
sub edx, 0x510928f
add edx, 0x444f5883
sub edx, 0x46472c4b
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fcdd8
xchg r15, rdi
mov rbx, r15
xchg rdi, r15
test rdi, rdi
jne 0x1401ba344
mov rdi, qword [rsp + 0x30]
xchg rcx, r8
mov r8, qword [rsi]
xchg r8, rcx
mov edx, 0x468e5d18
add edx, 0x12517949
sub edx, 0x2b491e38
add edx, 0x16685a57
xor edx, 0x66503cdc
add edx, 0x474a77cb
sub edx, 0x6cf9a5d7
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fcdd8
Function at 0x1401ba400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b993b
xchg rdi, rdx
mov rdi, qword [rbx + 0x28]
xchg rdx, rdi
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9924
xchg r8, r10
mov r10, qword [rcx - 8]
xchg r10, r8
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9954
xchg r8, r10
mov rcx, r10
xchg r8, r10
call fcn.1401fcdd8
xor eax, eax
mov qword [rbx + 0x18], rax
xchg rbp, rax
mov qword [rbx + 0x20], rbp
xchg rbp, rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rcx
push rax
push rdx
xchg qword [rsp + 0x18], rbx
add rsp, 0x20
jmp 0x1401ba400
push rax
call 0x1406c1a27
int3
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
push rsi
sub rsp, 0x20
xchg r14, rbx
mov r14, qword [rcx]
xchg rbx, r14
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov rax, qword [rbx + 8]
mov qword [rax], 0x12d5ef1b
xor qword [rax], 0x6dd6b0ea
sub qword [rax], 0x7a23b228
add qword [rax], 0x1c1797ef
add qword [rax], 0x3798d85e
add qword [rax], 0x17b1d874
add qword [rax], 0x5e57325
sub qword [rax], 0x14a734ac
sub qword [rax], 0x61803503
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba4d8
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401ba530
mov edx, 0x105348f2
add edx, 0x57865310
sub edx, 0x46bca6d5
add edx, 0x5d0cb524
xor edx, 0x12c7f989
xor edx, 0x2aa7c9f7
sub edx, 0x464999ef
xchg rsi, rbx
mov rcx, rsi
xchg rbx, rsi
call fcn.1401fcdd8
xchg r10, rdi
mov rbx, r10
xchg rdi, r10
test rdi, rdi
jne 0x1401ba47e
mov rdi, qword [rsp + 0x30]
xchg rcx, r14
mov r14, qword [rsi]
xchg rcx, r14
mov edx, 0x8fb2d23
xor edx, 0x3d3c4b0a
xor edx, 0x4d0b4f9a
sub edx, 0x757c3f0c
xor edx, 0x1b996976
xor edx, 0xb86f95e
add edx, 0x681b98cc
xor edx, 0x7b6c131b
xchg r10, rbx
mov r10, qword [rsp + 0x38]
xchg r10, rbx
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
jmp fcn.1401fcdd8
Function at 0x1401fd7ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rax
call 0x1406c6161
test rax, rax
je 0x1401fd7f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd7f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd7f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd7f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd7f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd7f8
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x14027085a
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x1406f9650
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140d5f9e0
syscall
ret

Function at 0x140b36e61
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140d15704
syscall
ret

Function at 0x140dad6ef
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140dad6f7
syscall
ret
Function at 0x168c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x168c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x168c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x168c06f
add dl, dl
jne 0x168c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x168c0f6
xor eax, eax
add dl, dl
jne 0x168c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x168c1ad
add dl, dl
jne 0x168c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x168c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x168c07e
mov eax, 1
add dl, dl
jne 0x168c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x168c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x168c0fb
sub eax, ebx
mov ebx, 1
jne 0x168c14c
mov ecx, 1
add dl, dl
jne 0x168c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x168c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x168c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x168c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x168c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x168c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x168c15d
cmp eax, 0x7d00
jae 0x168c19b
cmp eax, 0x500
jb 0x168c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x168c07e
cmp eax, 0x7f
ja 0x168c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x168c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x168c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x168c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140006420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400064b6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140208d30]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140007050
test rdi, rdi
je 0x140006545
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14000655e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140006656
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400066d8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140006663
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140006520
cmp r9, 8
jae 0x14000666c
jmp 0x1400066d8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140007050
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400066d8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400066d8
mov r8, rcx
cmp r9, 8
jb 0x1400066d8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140006670
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140007050
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140007092
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14000709a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400070ab
jmp 0x1400070c2
xor r10d, r10d
jmp 0x14000714d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400070c2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400070d9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400070f9
add r11, r8
jmp 0x14000722a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400071c2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140007170
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400071e0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400071f2
jmp 0x14000720c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000720c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140007226
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14009c930
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
call fcn.1401cb810
cmp qword [rax], 0
je 0x14009c96f
add rax, 8
jmp 0x14009c979
mov rcx, rax
xor edx, edx
call fcn.1400e3590
movdqu xmm6, xmmword [rax]
inc qword [rax]
pshufd xmm7, xmm6, 0x44
pxor xmm7, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm8, xmm6, 0xee
pxor xmm8, xmmword [0x140208d30]
mov ebx, 1
lea r14, [rsp + 0x60]
xorps xmm9, xmm9
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x28]
nop word cs:[rax + rax]
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm6
movaps xmmword [r14], xmm9
mov qword [r14 + 0x10], 0
mov qword [rsp + 0x28], rbx
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.140007050
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
add rax, rcx
rol rcx, 0xd
xor rdx, r9
xor rcx, rax
rol rax, 0x20
mov r8, qword [rsp + 0x38]
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rdx, rax
xor rcx, r8
rol r8, 0x20
xor rax, r9
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
xor r8, 0xff
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
add r8, rdx
rol rdx, 0x10
xor rdx, r8
rol rdx, 0x15
xor rcx, rax
add r8, rcx
rol rcx, 0x11
mov rax, r8
rol rax, 0x20
xor rax, rcx
xor rax, rdx
inc rbx
xor rax, r8
je 0x14009c9c0
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400c6840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x1400c68d6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x140208d30]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140007050
test rdi, rdi
je 0x1400c6965
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400c697e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x1400c6a76
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x1400c6af8
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400c6a83
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400c6940
cmp r9, 8
jae 0x1400c6a8c
jmp 0x1400c6af8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140007050
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400c6af8
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x1400c6af8
mov r8, rcx
cmp r9, 8
jb 0x1400c6af8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400c6a90
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret