joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400925b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a8dad
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404dbfc8]
mov dword [rsp - 0x10], edx
cmp qword [0x1404dc0a8], 0
jne 0x1400a8ad0
syscall
ret

Function at 0x1400925e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a93c7
sub rsp, 0x140c96f9
add rsp, 0x140c95d9
lea rcx, [0x1400a8b44]
mov dword [rsp - 0x38], 0x791be790
nop
push r15
mov qword [rsp], rcx
push rbp
mov rbp, rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push qword [0x1404dc0b0]
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x24], 0x7d0c9774
mov ecx, 0x41567327
sub ecx, 0x11ae24c0
xor ecx, 0x1abbab29
xor ecx, 0x490e07cb
sub ecx, 0x7c1de275
rep movsq qword [rdi], qword [rsi]
jmp qword [0x1404dc0a8]
xchg rdi, r10
mov rdi, rcx
xchg r10, rdi
mov eax, dword [0x1404dc05c]
cmp qword [0x1404dc0a8], 0
xchg r11, r11
jne 0x1400a8ad0
syscall
ret

Function at 0x1400925f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a8c39
mov r10, rcx
mov eax, dword [0x1404dbfa4]
mov dword [rsp - 0x18], ebp
cmp qword [0x1404dc0a8], 0
jne 0x1400a8ad0
syscall
mov dword [rsp - 0xc], ebx
ret

Function at 0x140092600
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a9341
xchg r10, r8
mov r8, rcx
xchg r10, r8
mov eax, dword [0x1404dc050]
mov dword [rsp - 0x18], ecx
cmp qword [0x1404dc0a8], 0
jne 0x1400a8ad0
syscall
ret

Function at 0x140092610
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a91f5
xchg rcx, r8
mov r10, r8
xchg rcx, r8
mov eax, dword [0x1404dc030]
cmp qword [0x1404dc0a8], 0
mov dword [rsp - 0x38], 0x3bcafb4e
jne 0x1400a8ad0
syscall
ret

Function at 0x140092620
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a92f1
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404dc048]
cmp qword [0x1404dc0a8], 0
mov dword [rsp - 0x24], ebx
jne 0x1400a8ad0
syscall
ret

Function at 0x140092630
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a90dc
mov r10, rcx
mov eax, dword [0x1404dc014]
cmp qword [0x1404dc0a8], 0
mov dword [rsp - 0x18], 0x55f4b77d
jne 0x1400a8ad0
syscall
ret

Function at 0x140092640
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a931b
mov r10, rcx
mov rdx, rdx
mov eax, dword [0x1404dc04c]
cmp qword [0x1404dc0a8], 0
jne 0x1400a8ad0
mov rsp, rsp
syscall
ret

Function at 0x140092650
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a8c0b
xchg rbx, r10
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1404dbfa0]
cmp qword [0x1404dc0a8], 0
jne 0x1400a8ad0
mov dword [rsp - 0x20], 0xc127676
syscall
ret

Function at 0x140092660
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a8dd7
xchg rcx, r9
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1404dbfcc]
cmp qword [0x1404dc0a8], 0
mov dword [rsp - 0x18], 0x6e5f200d
jne 0x1400a8ad0
syscall
ret
Function at 0x140092670
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg r15, rbp
xchg rbp, rsi
mov qword [rsp + 0x18], rbp
xchg rbp, rsi
xchg rdi, r8
mov qword [rsp + 0x20], r8
xchg rdi, r8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x2a0c88ee
add rsp, 0x2a0c88ce
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x30], esp
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
xchg rsi, rdi
mov rdi, rcx
xchg rsi, rdi
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x44], ebx
call fcn.1400943b0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
xchg r14, r14
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
xchg r9, r9
je 0x14009286a
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
xchg rbp, rbp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x30], edi
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x38], edx
jae 0x140092795
mov eax, dword [rdx + 8]
test eax, eax
xchg rsp, rsp
jne 0x14009274d
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x18], esi
cmp r11d, r9d
jb 0x14009276d
add eax, r9d
mov r8, r8
cmp r11d, eax
jb 0x140092821
inc r8w
mov rbx, rbx
nop
add rdx, 0x29900460
sub rdx, 0x29900438
cmp r8w, cx
mov dword [rsp - 0x18], 0x3d5b078d
jb 0x14009273c
xchg r11, r14
mov r8, r11
xchg r14, r11
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x10], ebx
nop
sub rax, 0x64b00cd6
add rax, 0x64b00cce
nop
sub r10, 0x5ecfc8fd
add r10, 0x5ecfc905
shr rax, 1
test eax, eax
mov dword [rsp - 0x2c], 0x36c7ed60
je 0x14009285b
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x18], ecx
movzx eax, word [r10]
mov ecx, eax
shr ecx, 2
shr ecx, 6
shr ecx, 1
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x28], edx
je 0x140092836
cmp ecx, 0xa
jne 0x14009283f
and eax, 0xfff
mov dword [rsp - 0x30], ebx
add qword [rax + r8], rdi
jmp 0x14009283f
mov r8d, dword [rdx + 0x14]
mov rsi, rsi
sub r8, r9
add r8, rsi
add r8, r11
jmp 0x14009279e
and eax, 0xfff
add dword [rax + r8], edi
nop
add r10, 0x1a5669f7
sub r10, 0x1a5669f5
sub rdx, 1
xchg r9, r9
jne 0x1400927e5
add ebx, dword [r9]
cmp ebx, ebp
mov dword [rsp - 0x40], ebp
jb 0x140092708
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov dword [rsp - 0x20], 0x1291a74
mov rdi, qword [rsp + 0x48]
nop
sub rsp, 0x6c625491
add rsp, 0x6c6254b1
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400943b0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
mov rcx, rcx
add r8, rcx
mov r10d, edx
mov rbx, rcx
movzx eax, word [r8 + 0x14]
mov rbp, rbp
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
cmp r9w, r11w
xchg r12, r12
jae 0x14009442f
nop dword [rax]
mov ecx, dword [rax + 8]
xchg r14, r14
test ecx, ecx
jne 0x1400943f9
mov ecx, dword [rax + 0x10]
mov r12, r12
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x14009440b
xchg r15, r15
add ecx, edx
cmp r10d, ecx
jb 0x140094437
inc r9w
mov dword [rsp - 0x18], 0x3436a119
neg rax
add rax, 0xffffffffffffffd8
neg rax
cmp r9w, r11w
mov dword [rsp - 0x18], 0xf9c9926
jb 0x1400943e9
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
mov dword [rsp - 0x10], esp
add rax, rbx
xchg rbx, rdx
mov rdx, qword [rsp + 8]
xchg rbx, rdx
add rax, r10
ret
Function at 0x140094460
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
mov dword [rsp - 0x38], 0x6fb43d40
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
mov dword [rsp - 0xc], 0x4e94fbd1
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x1e41dce9
add rsp, 0x1e41dcc9
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x14], edx
xor eax, 0x643e38cc
xchg rsi, rdi
mov rdi, rcx
xchg rsi, rdi
cmp eax, 0x643e6281
mov dword [rsp - 0x34], edi
jne 0x140094628
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x643e38cc
mov dword [rsp - 0x28], esi
cmp eax, 0x643e7d9c
jne 0x140094628
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400943b0
xchg r12, r12
mov rcx, rsi
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.1400943b0
mov dword [rsp - 0x2c], 0x36ba575c
mov edx, dword [r14 + 0x24]
xchg rdi, rcx
mov rdi, rsi
xchg rdi, rcx
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.1400943b0
mov dword [rsp - 0x28], 0x5f0ad5af
mov edx, dword [r14 + 0x1c]
xchg rcx, r12
mov r12, rsi
xchg rcx, r12
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.1400943b0
xor edi, edi
mov r10, r10
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140094628
nop dword [rax]
mov dword [rsp - 0x20], ebx
mov edx, dword [r12 + rdi*4]
xchg rsi, r11
mov rcx, r11
xchg r11, rsi
call fcn.1400943b0
mov ecx, 0x577dce0b
add ecx, 0x20708f63
sub ecx, 0x3cfd67a6
add ecx, 0xc50f0a37
mov rbx, rax
mov dword [rsp - 0x24], ecx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x14009460b
xchg r11, r11
nop dword [rax]
xchg r10, rbx
mov rdx, r10
xchg r10, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0xa28d5c6
add r8d, 0x36cc7594
sub r8d, 0x24f60944
xor r8d, 0x47863887
sub r8d, 0x5c797a90
inc rbx
call fcn.14009e1d0
cmp byte [rbx], 0
xchg rdx, rdx
jne 0x1400945c3
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
xchg rcx, rcx
je 0x14009467b
inc edi
cmp edi, dword [r14 + 0x18]
xchg r8, r8
jb 0x140094580
xor eax, eax
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg rbx, r10
sub rsp, 0xffffffffffffffe0
mov r14, r14
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov rdi, rdi
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
xchg r12, rax
mov r12, qword [rsp + 0x70]
xchg r12, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0xc], 0x2a2be080
call fcn.1400943b0
jmp 0x14009462a
Function at 0x1400946b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x3c00d7fd
sub rsp, 0x3c00d81d
movzx eax, word [rcx]
mov edi, edx
mov dword [rsp - 0xc], ebx
xor eax, 0x643e38cc
xchg rcx, rdi
mov rbx, rdi
xchg rcx, rdi
cmp eax, 0x643e6281
mov dword [rsp - 0x2c], esi
jne 0x14009476d
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x643e38cc
xchg rdi, rdi
cmp eax, 0x643e7d9c
jne 0x14009476d
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400943b0
mov r8, r8
sub edi, dword [rax + 0x10]
cmp edi, dword [rax + 0x14]
jae 0x14009476d
mov edx, dword [rax + 0x1c]
xchg rsi, rsi
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400943b0
mov dword [rsp - 0x44], ebx
xchg r10, rcx
mov r10, rbx
xchg r10, rcx
mov edx, dword [rax + rdi*4]
mov rbx, qword [rsp + 0x30]
mov rdx, rdx
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.1400943b0
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x3c], 0x21c65ea1
xor eax, eax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140098b75
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
mov r13, r13
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov dword [rsp - 0x28], ebp
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
xchg rsp, r14
movups xmmword [r14 + 0x28], xmm0
xchg r14, rsp
lea rdx, [rsi + 1]
mov rdx, rdx
xchg rsp, r10
movups xmmword [r10 + 0x38], xmm0
xchg r10, rsp
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x10], ecx
call fcn.140010f10
mov edx, 0x76e3e0c2
xor edx, 0x3fd3b85b
sub edx, 0x2828ee5b
xor edx, 0x3ca5a3dd
add edx, 0x138d63a4
test rsi, rsi
je 0x140098c4d
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov r8, rsi
mov r9d, 0x615dfabd
sub r9d, 0x35bdf537
add r9d, 0x22b0cdcb
sub r9d, 0x4e50d252
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x3c], ebp
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x18], edi
sub r8, 1
jne 0x140098c22
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rsp, rsp
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg rcx, r11
call fcn.140098d10
mov dword [rsp - 0x44], 0x59a0f70
xchg rcx, r15
mov r15, qword [rsp + 0x20]
xchg rcx, r15
mov ebx, eax
mov dword [rsp - 0x18], edx
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140098cdb
xchg rdx, rdx
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x770df08
xor ecx, 0x78aa244d
xor ecx, 0x7ab7f282
add ecx, 0x6be4d47
sub ecx, 0xc2b56de
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0x2c], edx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400b6f90
mov r14, r14
mov eax, ebx
xchg r9, rbx
mov r9, qword [rsp + 0x78]
xchg r9, rbx
nop
sub rsp, 0x7afa7f3b
add rsp, 0x7afa7f9b
pop rdi
xchg rbp, rbp
ret
Function at 0x14009a350
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rsp
mov r11, rdi
xchg rdi, rsp
mov qword [r11 + 0x20], rbx
push rdi
mov dword [rsp - 0xc], esp
add rsp, 0xffffffffffffffa0
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
mov dword [rsp - 0x44], ebx
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg r13, r13
mov qword [r11 + 0x10], rsi
xchg rbp, rsi
mov rbp, qword [rcx + 0x38]
xchg rsi, rbp
lea rcx, [r11 - 0x48]
xchg rcx, rcx
xchg rbx, r14
mov qword [r11 + 0x18], rbx
xchg rbx, r14
xchg rcx, rdx
mov r14, rcx
xchg rdx, rcx
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg r14, r14
xchg rsp, rdx
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg rsp, rbp
movups xmmword [rbp + 0x48], xmm0
xchg rsp, rbp
call fcn.140010f10
mov rcx, rcx
mov edx, 0x4f7b9365
add edx, 0x13a3db2a
sub edx, 0x29684afc
xor edx, 0x8870e14
test rsi, rsi
je 0x14009a45e
xchg r15, r15
xchg rcx, rax
mov rdi, rcx
xchg rcx, rax
sub rbx, rax
mov rsi, rsi
mov r8, rsi
mov r9d, 0x79ef07cd
sub r9d, 0x3e10434a
xor r9d, 0x3149bc26
xor r9d, 0xa97785a
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x20], 0x36b0cf0
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 3
ror edx, 3
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rsp, rsp
mov word [rdi - 2], cx
sub r8, 1
jne 0x14009a42b
xor ecx, ecx
xchg r13, r13
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rdx, r12
mov r12, r14
xchg r12, rdx
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
call fcn.14009a540
xchg rcx, r11
mov r11, qword [rsp + 0x20]
xchg rcx, r11
mov ebx, eax
mov rsp, rsp
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rsi, r12
mov r12, qword [rsp + 0x78]
xchg r12, rsi
xchg rbx, rbp
mov rbx, qword [rsp + 0x70]
xchg rbx, rbp
cmp rcx, rax
jne 0x14009a50b
mov dword [rsp - 0xc], 0x147e4f73
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x76236e9c
sub ecx, 0x5d6bf531
add ecx, 0x25a3e7b1
add ecx, 0x2472cc6a
xor ecx, 0x62ce2db6
rep stosb byte [rdi], al
mov eax, ebx
xchg rcx, rbx
mov rcx, qword [rsp + 0x88]
xchg rcx, rbx
add rsp, 0x60
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400b6f90
mov eax, ebx
mov rsi, rsi
xchg rdx, rbx
mov rdx, qword [rsp + 0x88]
xchg rdx, rbx
add rsp, 0x60
mov dword [rsp - 0x1c], 0x4a9695eb
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009a540
Capabilities:
Access peb ldr_data

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
mov dword [rsp + 0x18], r8d
xchg r10, r10
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xfffffffffffffdc0
mov rcx, rcx
xchg r13, rbx
mov r13, rdx
xchg r13, rbx
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
xor edx, edx
mov r11, r11
lea rcx, [rsp + 0x30]
mov r8d, 0x4f47cd61
xor r8d, 0x645dbeb3
add r8d, 0x50c1fa4a
sub r8d, 0x7bdc6c14
call fcn.1400b7560
mov r11, r11
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rdi, rax
mov rdi, qword [r8 + 0x10]
xchg rdi, rax
xchg rsi, r8
mov rsi, qword [rax]
xchg r8, rsi
test r8, r8
je 0x14009a83e
mov r8, qword [r8 + 0x50]
mov dword [rsp - 0x2c], 0x205fbb53
test r8, r8
je 0x14009a83e
mov edx, 0x3c5f69f3
xor edx, 0x764d9320
sub edx, 0x294a8e3e
xor edx, 0x55973c8c
sub edx, 0x755f4f15
lea rcx, [rsp + 0x30]
mov dword [rsp - 0xc], ebx
lea r9d, [rdx - 1]
call fcn.1400b8170
mov edx, 0x6f477d32
sub edx, 0x63d7055c
add edx, 0x372d45cd
sub edx, 0x429dbd47
lea rcx, [rsp + 0x30]
xchg rdx, rdx
call fcn.1400b8290
test rax, rax
je 0x14009a803
mov rbx, rbx
xor ecx, ecx
xchg rdi, rbx
mov rdx, rbx
xchg rbx, rdi
mov word [rax], cx
mov rsp, rsp
movabs rcx, 0x1cb0259720b5e7a8
sub rcx, 0x177075e1
xor rcx, 0x72a56f4e
add rcx, 0x7fffffff
sub rcx, 0x3f41d783
mov rax, qword [0x1404db7f0]
ror rax, 0x24
ror rax, 3
ror rax, 1
not rax
sub rax, rcx
mov dword [rsp - 0x20], esp
movabs rcx, 0x7176592f24187910
xor rcx, 0x7f0c7897
xor rcx, 0x6e89947a
xor rcx, 0xecafbc3
add rcx, 0x7fffffff
xor rcx, 0x60314a1c
ror rax, 3
mov dword [rsp - 0x18], 0x58422f2c
add rax, rcx
lea rcx, [rsp + 0x20]
not rax
mov dword [rsp - 0x24], 0x49d7f560
rol rax, 1
rol rax, 0x1b
rol rax, 0x13
call rax
mov rdi, rdi
movabs rcx, 0xf558b86b799f3b08
sub rcx, 0x2fb3c778
sub rcx, 0x208e6065
add rcx, 0x50ff7b71
lea r8, [rsp + 0x20]
add rcx, qword [0x1404db7e0]
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x14], ebx
ror rcx, 1
ror rcx, 9
ror rcx, 3
ror rcx, 2
movabs rax, 0x160d994616cabe43
sub rax, 0x7a1760
add rax, 0x125a1970
xor rax, 0x60c6cc43
add rax, rcx
xchg r9, r14
mov r14, rbx
xchg r14, r9
not rax
movabs rcx, 0x6c1df94b0d77a964
xor rcx, 0x14a4dce5
sub rcx, 0x12a6da99
add rcx, 0x3ad5b094
add rcx, 0x7fffffff
sub rcx, 0x5bf33e1
ror rax, 3
ror rax, 0xb
ror rax, 9
ror rax, 3
ror rax, 1
ror rax, 1
xor rax, rcx
xchg r11, r11
movabs rcx, 0x4192f63644d3607
sub rcx, 0x452bf77a
xor rcx, 0x7a223492
sub rcx, 0x1ce92873
add rcx, 0x3e946b3a
sub rax, rcx
lea rcx, [rsp + 0x30]
xchg rsp, rsp
call rax
xchg rbx, r11
mov r11, qword [rsp + 0x250]
xchg rbx, r11
add rsp, 0x447ed08b
sub rsp, 0x447ece4b
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x307259ab
add eax, 0x49d9fdf9
xor eax, 0x72284fe1
xor eax, 0x33a6cd2f
add eax, 0x843d2a97
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x20], 0x53a44ccd
sub rsp, 0xfffffffffffffdc0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x199eaf20
add eax, 0x8648f6b
add eax, 0x5bd897b3
xor eax, 0x491ad50
add eax, 0x46b585c7
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009d650
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x38], 0x63654483
sub rsp, 0x230
mov r10, qword [0x1404db3e0]
lea rdx, [rsp + 0x20]
xchg rbx, r13
mov r13, rcx
xchg r13, rbx
movabs rax, 0x348084e30e292c05
sub rax, 0xfb34cd
add rax, 0x422ca6e4
add rax, 0x7e8fd2a9
movabs rcx, 0xa39b934685a20c9
sub rcx, 0x318a5c77
sub rcx, 0x20b1ca30
xor rcx, 0x52a41287
xor r9d, r9d
xchg rcx, rcx
add r10, rcx
xor ecx, ecx
not r10
mov rsi, rsi
rol r10, 4
rol r10, 5
rol r10, 9
rol r10, 1
rol r10, 1
rol r10, 1
xor r10, rax
lea r8d, [r9 + 0x1a]
mov r13, r13
ror r10, 0x20
ror r10, 1
not r10
mov dword [rsp - 0xc], 0x72d47b73
call r10
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg r14, r14
xchg r14, rcx
mov qword [rbx], r14
xchg r14, rcx
xchg rcx, r12
movups xmmword [r12], xmm0
xchg r12, rcx
movups xmmword [rcx + 0x10], xmm0
xchg rcx, r8
movups xmmword [r8 + 0x20], xmm0
xchg r8, rcx
test eax, eax
je 0x14009d84c
mov dword [rsp - 0x3c], edx
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff35dd6399
add rdx, 0x25bdfa3f
sub rdx, 0x4159c85c
add rdx, 0x7fffffff
xor rdx, 0x65be6a84
inc rdx
cmp word [rax + rdx*2], 0
mov dword [rsp - 0xc], 0x43bb731d
jne 0x14009d75b
xchg rcx, r10
mov r10, rbx
xchg r10, rcx
xchg rbp, rdx
mov qword [rbx + 0x38], rbp
xchg rbp, rdx
call fcn.140010f10
mov rdi, rdi
xor r8d, r8d
xchg rbx, rax
mov rdx, rbx
xchg rbx, rax
mov ecx, 0x727db474
xor ecx, 0x6c2c607e
add ecx, 0x5208bec4
xor ecx, 0x416abf49
cmp qword [rbx + 0x38], r8
jbe 0x14009d856
mov dword [rsp - 0x24], ecx
lea r9, [rsp + 0x20]
mov r10d, 0x1d5e55b3
xor r10d, 0x64e7f750
sub r10d, 0x2d3b3ec3
sub r10d, 0x2ac8d55d
sub r10d, 0x21b58dc4
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0x10], ebx
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov rsi, rsi
ror ecx, 2
ror ecx, 2
ror ecx, 1
ror ecx, 1
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
mov r11, r11
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14009d7f3
mov dword [rsp - 0x34], ebp
xchg r12, rax
mov r12, rbx
xchg r12, rax
add rsp, 0x543fba31
sub rsp, 0x543fb801
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
mov r14, r14
mov qword [rbx + 0x38], r8
mov rax, rbx
sub rsp, 0xfffffffffffffdd0
pop rbx
mov dword [rsp - 0x24], esi
ret
Function at 0x14009e540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404dc0e4], 0
jne 0x14009e64c
xor edx, edx
mov dword [rsp - 0x44], 0x4ba2c9dc
lea r8, [0x1404dc0e0]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov rdx, rdx
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x3c], esp
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
xchg rbp, rbp
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r11, r11
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg r9, r9
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x14], edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x24], 0x471f1b8c
shr ecx, 1
and eax, 1
neg eax
xchg r14, r14
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x34], ebp
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x28], 0x51d5e1d4
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x18], 0x3ad91be7
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r14, r14
mov ecx, eax
shr eax, 1
and ecx, 1
xchg rsi, rsi
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x18], ebp
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x14], 0x74ba9521
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
xchg r9, r9
cmp edx, 0x100
jb 0x14009e568
ret
Function at 0x1400a44e0
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov dword [rsp - 0x3c], ebp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x1f7f402e
mov qword [rsp], r15
sub rsp, 0x28
xchg r14, r15
mov r15, rdx
xchg r15, r14
mov r13d, r8d
mov edx, 0x6455fb63
xor edx, 0x2332664c
sub edx, 0x9ad0120
sub edx, 0x3db69c0f
cmp r8d, edx
mov rcx, rcx
jae 0x1400a4551
mov edx, r13d
nop
movabs rcx, 0xffffffff5deb06b1
sub rcx, 0xf1449b6
add rcx, 0x30976020
add rcx, 0x7fffffff
add rcx, 0x91e2e5
mov eax, 0x2112a4da
xor eax, 0x2136d8f2
xor eax, 0x523af0f9
add eax, 0x208564e7
sub eax, 0x72a3f1b4
mul rdx
mov rbp, rbp
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400b6e40
mov r15, rax
mov byte [rsp + 0x70], 0x5c
sub byte [rsp + 0x70], 0x10
sub byte [rsp + 0x70], 0x16
add byte [rsp + 0x70], 0x47
sub byte [rsp + 0x70], 0x7c
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
lea r12d, [r13 + 0xfffff]
xor esi, esi
shr r12d, 0x10
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
je 0x1400a4712
mov dword [rsp - 0x28], 0x2fb0c4c4
xchg r13, rbx
mov qword [rsp + 0x68], r13
xchg rbx, r13
mov ecx, 0x791a2e8e
xor ecx, 0x2139777f
sub ecx, 0x2dd321f2
add ecx, 0x3bb94cca
xor ecx, 0x661984c9
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
mov edi, esi
mov r10, r10
mov ebx, r13d
shl edi, 0x11
shl edi, 1
shl edi, 1
shl edi, 1
mov rdx, r15
sub ebx, edi
cmp ebx, ecx
mov dword [rsp - 0x40], edi
cmova ebx, ecx
xchg rcx, r11
mov r11, rax
xchg rcx, r11
mov r8d, ebx
call fcn.1400a0dc0
mov dword [rsp - 0x28], ebx
test al, al
je 0x1400a46eb
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
mov rsp, rsp
test ebx, ebx
je 0x1400a46b2
xchg r9, rcx
mov rcx, r15
xchg rcx, r9
lea ecx, [rdi + rax]
mov dword [rsp - 0x2c], ebx
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
mov dword [rsp - 0x1c], esp
xor r8d, 0x643e38cc
inc eax
mov dword [r14 + rcx*4], r8d
mov dword [rsp - 0x28], 0x3c7543f1
cmp eax, ebx
jb 0x1400a4680
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0xc], esp
inc esi
mov ecx, 0x77d28940
xor ecx, 0xfea707a
sub ecx, 0x73503b3c
xor ecx, 0x64db70e7
sub ecx, 0x6023cd19
cmp esi, r12d
xchg r8, r8
jb 0x1400a4627
jmp 0x1400a46ff
mov byte [rsp + 0x70], 0x71
xor byte [rsp + 0x70], 3
xor byte [rsp + 0x70], 0x44
sub byte [rsp + 0x70], 0x36
mov rbx, qword [rsp + 0x68]
mov r14, r14
xchg rdi, r12
mov r12, qword [rsp + 0x20]
xchg r12, rdi
xchg r15, rcx
mov r15, rcx
xchg r15, rcx
call fcn.1400b6e50
mov dword [rsp - 0x18], 0x2482470a
movzx eax, byte [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x20], 0x50b868e8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
mov dword [rsp - 0x1c], 0xa4447a6
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret