joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e190
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
cmp qword [rdx + 0x10], 0
mov rsi, r9
mov r14, r8
mov rbx, rdx
mov r15, rcx
je 0x14000e256
cmp qword [rdx + 0x18], 7
mov r8, rdx
jbe 0x14000e1ce
mov r8, qword [rdx]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rdi, rax
test rax, rax
je 0x14000e256
cmp qword [rsi + 0x18], 7
jbe 0x14000e1ed
mov rsi, qword [rsi]
cmp qword [r14 + 0x18], 7
jbe 0x14000e1f7
mov r14, qword [r14]
mov r9d, 4
mov r8, rsi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x14000e2bf
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x14000e241
mov r8, qword [rbx]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rdi, rax
test rax, rax
jne 0x14000e220
cmp qword [0x1400bcf08], 7
lea r9, [0x1400bcef0]
cmova r9, qword [0x1400bcef0]
cmp qword [r15 + 0x18], 7
jbe 0x14000e277
mov r15, qword [r15]
lea rax, [0x1400a869c]
mov dword [rsp + 0x28], 5
mov r8, r15
mov qword [rsp + 0x20], rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
xor al, al
jmp 0x14000e2a4

Function at 0x14000e2d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400b8040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov dword [rsp + 0x30], 1
test eax, eax
js 0x14000e388
lea rax, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14000e350
mov rcx, rdi
cmp rdx, 7
ja 0x14000e37e
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x40]
call fcn.140092620
mov word [rbx + rdi], si
jmp 0x14000e388
lea r9, [rsp + 0x40]
call fcn.140015aa0
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14003f810
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140013370
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140013394
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x140013422
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400133f0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x1400133f0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140092620
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001340d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140013415
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1400133b1
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x140013500
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140013439
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001343b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001346d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140092620
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400134fd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400134a8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x1400134de
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140079378
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x1400134fd
cmp rsi, rax
ja 0x1400134b1
test rsi, rsi
je 0x1400134fd
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140079378
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x14001f340
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x9c], 0
mov rbx, rcx
je 0x14001f460
mov rax, qword [rcx + 0x38]
mov rdx, qword [rax]
mov rax, qword [rcx + 0x50]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jb 0x14001f44b
mov rdi, qword [rbx + 0x68]
mov r8d, 0x8000
mov rcx, qword [rbx + 0x70]
mov rdx, rdi
call fcn.140014060
mov rax, qword [rbx + 0x70]
mov r10, qword [rax + 8]
test r10, r10
je 0x14001f460
xor r11d, r11d
test r10, r10
je 0x14001f436
mov qword [rsp + 0x30], rsi
lea rsi, [0x1400a4150]
mov edx, dword [rbx + 0x80]
movzx ecx, word [rbx + 0x88]
mov r9, qword [rbx + 0x68]
or ecx, 2
mov r8d, ecx
xor r8d, 1
imul r8d, ecx
mov ecx, edx
shr edx, 8
sar r8d, 8
xor r8b, byte [r9 + r11]
movzx eax, r8b
xor rcx, rax
movzx eax, cl
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x84]
imul ecx, eax, 0x8088405
mov dword [rbx + 0x80], edx
mov edx, dword [rbx + 0x88]
inc ecx
mov dword [rbx + 0x84], ecx
shr rcx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
xor edx, dword [rsi + rax*4]
mov dword [rbx + 0x88], edx
mov byte [r9 + r11], r8b
inc r11
cmp r11, r10
jb 0x14001f3b3
mov rsi, qword [rsp + 0x30]
mov rax, qword [rbx + 0x18]
mov qword [rax], rdi
mov rax, qword [rbx + 0x38]
mov qword [rax], rdi
mov rax, qword [rbx + 0x50]
mov dword [rax], r10d
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x14001f470
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
cmp edx, 0xffffffff
je 0x14001f60a
cmp byte [rcx + 0x9d], 0
mov qword [rsp + 0x30], rbp
lea rbp, [0x1400a4150]
jne 0x14001f56b
movzx eax, byte [rcx + 0x98]
lea r10, [rcx + 0x8c]
mov qword [rsp + 0x40], rdi
mov r11, r10
lea rdi, [r10 + 0xc]
mov byte [rcx + 0x97], al
cmp r10, rdi
je 0x14001f54d
nop word [rax + rax]
movzx r9d, byte [r11]
mov edx, dword [rbx + 0x80]
mov ecx, edx
movzx r8d, word [rbx + 0x88]
xor rcx, r9
movzx eax, cl
or r8w, 2
shr edx, 8
xor edx, dword [rbp + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x84]
imul ecx, eax, 0x8088405
mov dword [rbx + 0x80], edx
mov edx, dword [rbx + 0x88]
inc ecx
mov dword [rbx + 0x84], ecx
shr rcx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
xor edx, dword [rbp + rax*4]
movzx eax, r8w
mov ecx, eax
mov dword [rbx + 0x88], edx
xor ecx, 1
imul ecx, eax
sar ecx, 8
xor cl, r9b
mov byte [r11], cl
inc r11
cmp r11, rdi
jne 0x14001f4d0
mov rcx, qword [rbx + 0x78]
mov r8d, 0xc
mov rdx, r10
call fcn.140013e60
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x9d], 1
mov edx, dword [rbx + 0x80]
mov ecx, edx
movzx r8d, word [rbx + 0x88]
shr edx, 8
or r8w, 2
movzx eax, sil
xor rcx, rax
movzx eax, cl
xor edx, dword [rbp + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x84]
imul ecx, eax, 0x8088405
mov dword [rbx + 0x80], edx
mov edx, dword [rbx + 0x88]
inc ecx
mov dword [rbx + 0x84], ecx
shr rcx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
xor edx, dword [rbp + rax*4]
movzx eax, r8w
mov r8d, 1
mov ecx, eax
mov dword [rbx + 0x88], edx
xor ecx, 1
lea rdx, [rsp + 0x38]
imul ecx, eax
sar ecx, 8
xor cl, sil
mov byte [rsp + 0x38], cl
mov rcx, qword [rbx + 0x78]
call fcn.140013e60
movzx eax, byte [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
Function at 0x1400217c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x13c0
call fcn.140091da0
sub rsp, rax
mov rax, qword [0x1400b8040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov dword [rcx + 0x80], 0x12345678
lea rdi, [0x1400a4150]
mov dword [rcx + 0x84], 0x23456789
mov r11, rdx
mov dword [rcx + 0x88], 0x34567890
mov rbx, rcx
movzx eax, byte [rdx]
mov r9d, 0x12345678
mov r8d, 0x23456789
mov r10d, 0x34567890
nop word [rax + rax]
mov rcx, r9
lea r11, [r11 + 1]
xor rcx, rax
mov eax, r9d
shr eax, 8
movzx edx, cl
xor eax, dword [rdi + rdx*4]
mov r9d, eax
mov dword [rbx + 0x80], eax
movzx eax, al
add r8d, eax
imul r8d, r8d, 0x8088405
inc r8d
mov dword [rbx + 0x84], r8d
mov eax, r8d
shr rax, 0x18
xor rax, r10
movzx ecx, al
mov eax, r10d
shr eax, 8
xor eax, dword [rdi + rcx*4]
mov r10d, eax
mov dword [rbx + 0x88], eax
movzx eax, byte [r11]
test al, al
jne 0x140021830
call fcn.1400477b0
mov dword [rsp + 0x24], eax
mov ecx, 1
mov r9d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul edx, edx, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x24], edx
mov eax, edx
inc rcx
cmp rcx, r9
jb 0x1400218b0
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400218e0
mov ecx, dword [rsp + 0x20]
mov edx, dword [rsp + rcx*4 + 0x24]
mov eax, edx
shr eax, 0xb
inc ecx
and eax, dword [rsp + 0x13a4]
xor edx, eax
mov dword [rsp + 0x20], ecx
mov eax, edx
lea rcx, [rsp + 0x20]
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov dword [rbx + 0x8c], eax
call fcn.140021af0
lea rcx, [rsp + 0x20]
mov dword [rbx + 0x90], eax
call fcn.140021af0
mov ecx, 0x8000
mov dword [rbx + 0x94], eax
call fcn.14003f874
mov qword [rbx + 0x68], rax
lea rcx, [rax + 0x8000]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], 0
mov al, 1
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.14003f810
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13c0
pop rdi
ret
Function at 0x140021af0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140021b51
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140021b10
mov ecx, dword [r9]
jmp 0x140021c3b
cmp ecx, 0x4e0
jb 0x140021c3b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140021b70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140021bc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14002da70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
mov esi, r8d
movzx r10d, word [rcx]
mov r12, r9
movzx r8d, word [rcx + 2]
mov eax, r10d
shr rax, 4
xor r10, 0x7f0
shr r10, 4
mov r14d, edx
mov rbx, rcx
mov rdi, r9
mov ebp, dword [r11 + rax*4]
mov eax, r8d
xor r8, 0x7f0
shr rax, 4
shr r8, 4
mov r15d, dword [r11 + rax*4]
mov r13d, dword [r11 + r8*4]
add r13d, dword [r11 + r10*4]
add r15d, dword [r11 + r10*4]
xor r8d, r8d
cmp r8d, esi
jae 0x14002dc10
xor r9d, r9d
lea r10d, [r14*8]
mov edx, r8d
or edx, 8
nop
mov eax, edx
shr rax, 1
add rax, r10
movzx ecx, word [rbx + rax*2 + 4]
mov eax, edx
and eax, 1
shr rcx, 4
neg eax
shr edx, 1
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r9d, dword [r11 + rcx*4]
cmp edx, 1
jne 0x14002db00
lea eax, [r9 + rbp]
inc r8d
mov dword [rdi], eax
add rdi, 4
cmp r8d, 8
jb 0x14002dae4
cmp r8d, 0x10
jae 0x14002dbb3
lea rdi, [r12 + r8*4]
nop word [rax + rax]
cmp r8d, esi
jae 0x14002dc10
xor r9d, r9d
lea edx, [r8 - 8]
or edx, 8
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr rax, 1
add rax, r10
movzx ecx, word [rbx + rax*2 + 0x104]
mov eax, edx
and eax, 1
shr rcx, 4
neg eax
shr edx, 1
sar rax, 4
and eax, 0x7f
xor rcx, rax
add r9d, dword [r11 + rcx*4]
cmp edx, 1
jne 0x14002db70
lea eax, [r9 + r15]
inc r8d
mov dword [rdi], eax
add rdi, 4
cmp r8d, 0x10
jb 0x14002db50
cmp r8d, esi
jae 0x14002dc10
lea r10, [r12 + r8*4]
nop dword [rax]
xor r9d, r9d
lea eax, [r8 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov ecx, eax
shr rcx, 1
movzx edx, word [rbx + rcx*2 + 0x204]
mov ecx, eax
and ecx, 1
shr rdx, 4
neg ecx
shr eax, 1
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r9d, dword [r11 + rdx*4]
cmp eax, 1
jne 0x14002dbd0
lea eax, [r9 + r13]
inc r8d
mov dword [r10], eax
add r10, 4
cmp r8d, esi
jb 0x14002dbc0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140030100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
lea rdi, [rcx + 0x33e1c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + 0x344c6]
lea rdi, [rdi + 4]
shr rax, 4
mov r9d, ebx
and r9d, 1
mov r11d, ebx
mov edx, r9d
shr r11d, 1
neg edx
or r9d, 2
sar rdx, 4
mov r8d, r11d
and edx, 0x7f
shr r11d, 1
xor rdx, rax
and r8d, 1
mov eax, r8d
inc ebx
neg eax
sar rax, 4
mov r10d, dword [rcx + rdx*4 + 0x3276c]
and eax, 0x7f
movzx edx, word [rcx + r9*2 + 0x344c4]
add r9d, r9d
shr rdx, 4
or r9d, r8d
xor rdx, rax
mov r8d, r11d
and r8d, 1
shr r11d, 1
mov eax, r8d
and r11d, 1
neg eax
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + r9*2 + 0x344c4]
sar rax, 4
and eax, 0x7f
shr rdx, 4
xor rdx, rax
lea eax, [r9 + r9]
or eax, r8d
add r10d, dword [rcx + rdx*4 + 0x3276c]
movzx edx, word [rcx + rax*2 + 0x344c4]
mov eax, r11d
shr rdx, 4
neg eax
sar rax, 4
and eax, 0x7f
xor rdx, rax
mov edx, dword [rcx + rdx*4 + 0x3276c]
add edx, r10d
mov dword [rdi - 4], edx
cmp ebx, 0x10
jb 0x140030120
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x33e5c], 0
ret
Function at 0x140030210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x1400b8040]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12d, 4
lea rsi, [rsp + 0x10]
mov edi, r12d
lea r15, [rcx + 0x30770]
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r15]
mov r11d, edi
mov r10d, edx
mov eax, edx
and eax, 1
shr r10d, 1
dec r10d
or eax, 2
mov ecx, r10d
xor ebx, ebx
shl eax, cl
mov r8d, 1
sub r11d, eax
test r10d, r10d
je 0x1400302e1
mov ebp, edx
mov r14d, eax
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
mov edx, r11d
sub rax, rbp
shr r11d, 1
add rax, r14
and edx, 1
add r8d, r8d
or r8d, edx
movzx ecx, word [r9 + rax*2 + 0x343de]
mov eax, edx
neg eax
shr rcx, 4
sar rax, 4
and eax, 0x7f
xor rcx, rax
add ebx, dword [r9 + rcx*4 + 0x3276c]
sub r10d, 1
jne 0x1400302a0
mov dword [rsi], ebx
inc edi
add rsi, r12
inc r15
cmp edi, 0x80
jb 0x140030260
lea rdi, [rsp]
sub rdi, r9
lea r10, [r9 + 0x3321c]
sub rdi, 0x3361c
lea rbx, [r9 + 0x341e0]
lea rsi, [r9 + 0x33624]
nop word [rax + rax]
mov eax, dword [r9 + 0x33e60]
xor r11d, r11d
test eax, eax
je 0x140030380
nop
xor r8d, r8d
mov eax, r11d
or eax, 0x40
nop dword [rax]
mov ecx, eax
shr rcx, 1
movzx edx, word [rbx + rcx*2]
mov ecx, eax
and ecx, 1
shr rdx, 4
neg ecx
shr eax, 1
sar rcx, 4
and ecx, 0x7f
xor rdx, rcx
add r8d, dword [r9 + rdx*4 + 0x3276c]
cmp eax, 1
jne 0x140030340
mov dword [r10 + r11*4], r8d
inc r11d
mov eax, dword [r9 + 0x33e60]
cmp r11d, eax
jb 0x140030330
mov edx, 0xe
cmp eax, edx
jbe 0x1400303ad
nop dword [rax]
mov eax, edx
lea rcx, [r10 + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r9 + 0x33e60]
jb 0x140030390
mov eax, dword [r10]
lea r8, [r9 + 0x30772]
mov dword [rsi - 8], eax
lea rdx, [rsi + 0xc]
mov eax, dword [r10 + 4]
mov r11d, 0x1f
mov dword [rsi - 4], eax
mov eax, dword [r10 + 8]
mov dword [rsi], eax
mov eax, dword [r10 + 0xc]
mov dword [rsi + 4], eax
nop dword [rax + rax]
movzx eax, byte [r8 - 2]
lea rdx, [rdx + 0x10]
lea r8, [r8 + 4]
mov ecx, dword [r10 + rax*4]
add ecx, dword [rdi + rdx - 0x14]
mov dword [rdx - 0x14], ecx
movzx eax, byte [r8 - 5]
mov ecx, dword [r10 + rax*4]
add ecx, dword [rdi + rdx - 0x10]
mov dword [rdx - 0x10], ecx
movzx eax, byte [r8 - 4]
mov ecx, dword [r10 + rax*4]
add ecx, dword [rdi + rdx - 0xc]
mov dword [rdx - 0xc], ecx
movzx eax, byte [r8 - 3]
mov ecx, dword [r10 + rax*4]
add ecx, dword [rdi + rdx - 8]
mov dword [rdx - 8], ecx
sub r11, 1
jne 0x1400303e0
sub rbx, 0xffffffffffffff80
add r10, 0x100
add rsi, 0x200
sub rdi, 0x200
sub r12, 1
jne 0x140030320
mov dword [r9 + 0x3d5d8], r12d
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.14003f810
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140030490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x60
xor ebp, ebp
mov qword [rsp + 0x78], rsi
mov qword [rcx + 0x3d5b0], rbp
lea r9, [rcx + 0x248]
mov qword [rcx + 0x3d5a8], rbp
lea r8, [rcx + 0x2d4]
mov qword [rcx + 0x288], rbp
mov edx, ebp
mov qword [rcx + 0x270], rbp
mov rdi, rcx
mov qword [rsp + 0x80], r14
mov qword [rcx + 0x2a8], 4
mov dword [rcx + 0x284], 0x20
mov qword [rcx + 0x2b8], 1
nop dword [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140030500
lea rdx, [rsp + 0x20]
mov qword [rdi + 0x178], rbp
mov rcx, rdi
mov dword [rdi + 0x1c0], ebp
mov qword [rdi + 0x200], rbp
mov qword [rdi + 0x1d0], rbp
mov qword [rdi + 0x1d8], rbp
mov qword [rdi + 0x1e0], rbp
mov qword [rdi + 0x1e8], rbp
mov qword [rdi + 0x1f0], rbp
mov qword [rdi + 0x1f8], rbp
mov dword [rdi + 0x80], ebp
mov qword [rdi + 0xc0], rbp
mov qword [rdi + 0x90], rbp
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0xa0], rbp
mov qword [rdi + 0xa8], rbp
mov qword [rdi + 0xb0], rbp
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0x240], r9
mov qword [rsp + 0x20], 5
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x30], 0xffffffffffffffff
call fcn.14002d030
mov esi, 2
mov word [rdi + 0x3076c], 0x100
mov r14d, esi
mov qword [rsp + 0x70], rbx
nop word [rax + rax]
mov ecx, esi
mov eax, 1
sar ecx, 1
dec ecx
shl eax, cl
test eax, eax
je 0x1400306ac
lea rcx, [rdi + 0x3076c]
mov r8d, eax
add rcx, r14
mov ebx, eax
movzx edx, sil
call fcn.140092260
add r14, rbx
inc esi
cmp esi, 0x1a
jl 0x140030680
mov r14, qword [rsp + 0x80]
mov r8d, 8
mov rsi, qword [rsp + 0x78]
mov r9d, r8d
mov rbx, qword [rsp + 0x70]
nop
mov eax, r8d
mov edx, ebp
mov ecx, 4
nop word [rax + rax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x1400306fb
nop dword [rax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x1400306f0
sub rcx, 1
jne 0x1400306e0
mov rax, r9
mov ecx, 0xa1
shr rax, 4
sub ecx, edx
add r8d, 0x10
add r9, 0x10
mov dword [rdi + rax*4 + 0x3276c], ecx
cmp r8d, 0x800
jb 0x1400306d0
mov qword [rdi + 0x33e78], rbp
mov qword [rdi + 0x3d5f0], rbp
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140034ac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x140034afc
mov edx, dword [rcx + 0x288]
lea r11, [0x1400a75d0]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
sub r9, 1
jne 0x140034ae0
mov dword [rcx + 0x288], edx
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x140034bd4
sub edx, 1
je 0x140034bc6
cmp edx, 1
je 0x140034b90
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x140034baf
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret