joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028c80
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x6e
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x222f2867
mov dword [rcx + 0x34], 0x672b3d
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140028cc3
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140028cd2
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140028cf0
mov ecx, 7
nop
inc ecx
test cl, 0xf
jne 0x140028d30
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140028d61
mov qword [rbx + 0x28], rax
jmp 0x140028dae
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 7
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
mov eax, dword [rbx + 0x30]
mov dword [rdi + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rdi + 0xc], ax
movzx eax, byte [rbx + 0x36]
mov byte [rdi + 0xe], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140028dd0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x2c
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0x2c
mov byte [rcx + 0x30], al
xor eax, eax
mov byte [rcx + 0x31], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140028e12
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140028e21
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140028e40
mov ecx, 1
nop
inc ecx
test cl, 0xf
jne 0x140028e80
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140028eb1
mov qword [rbx + 0x28], rax
jmp 0x140028ef0
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 1
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movzx eax, byte [rbx + 0x30]
mov byte [rdi + 8], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140028f10
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x43
mov rbx, rcx
movsx edi, byte [rcx]
mov word [rcx + 0x30], 0x4a
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140028f4b
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140028f5a
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140028f80
mov ecx, 1
nop
inc ecx
test cl, 0xf
jne 0x140028fc0
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140028ff1
mov qword [rbx + 0x28], rax
jmp 0x140029030
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 1
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movzx eax, byte [rbx + 0x30]
mov byte [rdi + 8], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029050
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x46
xor eax, eax
mov word [rcx + 0x30], 0x4c4b
mov rbx, rcx
mov byte [rcx + 0x32], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029090
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x14002909f
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1400290c0
mov ecx, 2
nop
inc ecx
test cl, 0xf
jne 0x140029100
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029131
mov qword [rbx + 0x28], rax
jmp 0x140029171
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 2
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movzx eax, word [rbx + 0x30]
mov word [rdi + 8], ax
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029190
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x46
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x322a330b
mov dword [rcx + 0x34], 0x323f042f
mov dword [rcx + 0x38], 0x11291223
mov dword [rcx + 0x3c], 0x523222f
mov dword [rcx + 0x40], 0x34272e
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x1400291e8
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x1400291f7
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029220
mov eax, 0x13
nop
inc eax
test al, 0xf
jne 0x140029260
lea esi, [rax + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029290
mov qword [rbx + 0x28], rax
jmp 0x1400292df
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0x13
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rdi + 8], xmm0
movzx eax, word [rbx + 0x40]
mov word [rdi + 0x18], ax
movzx eax, byte [rbx + 0x42]
mov byte [rdi + 0x1a], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029300
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x12
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x667e675f
mov dword [rcx + 0x34], 0x666b507b
mov dword [rcx + 0x38], 0x457d4677
mov dword [rcx + 0x3c], 0x5177767b
mov dword [rcx + 0x40], 0x60737a
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029358
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140029367
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029390
mov eax, 0x13
nop
inc eax
test al, 0xf
jne 0x1400293d0
lea esi, [rax + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029400
mov qword [rbx + 0x28], rax
jmp 0x14002944f
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0x13
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rdi + 8], xmm0
movzx eax, word [rbx + 0x40]
mov word [rdi + 0x18], ax
movzx eax, byte [rbx + 0x42]
mov byte [rdi + 0x1a], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029470
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x5f
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x1a131a0c
mov dword [rcx + 0x34], 0x757f0b1c
mov dword [rcx + 0x38], 0x100d197f
mov dword [rcx + 0x3c], 0x30327f12
mov dword [rcx + 0x40], 0x303c0025
mov dword [rcx + 0x44], 0x3a363430
mov word [rcx + 0x48], 0x2c
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x1400294d5
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x1400294e4
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029510
mov eax, 0x19
nop
inc eax
test al, 0xf
jne 0x140029550
lea esi, [rax + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029580
mov qword [rbx + 0x28], rax
jmp 0x1400295d1
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0x19
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rdi + 8], xmm0
movsd xmm1, qword [rbx + 0x40]
movsd qword [rdi + 0x18], xmm1
movzx eax, byte [rbx + 0x48]
mov byte [rdi + 0x20], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400295f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov word [rcx], 0x3f
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x560079
mov dword [rcx + 0x34], 0x5a004d
mov word [rcx + 0x38], 0x59
mov dword [rcx + 0x3a], 0x470050
mov dword [rcx + 0x3e], 0x5c0063
mov dword [rcx + 0x42], 0x500050
mov dword [rcx + 0x46], 0x560054
mov dword [rcx + 0x4a], 0x4c005a
mov dword [rcx + 0x4e], 0x12
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029660
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x14002966f
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029690
lea edx, [r9 + 0x28]
mov qword [0x140187190], r9
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x1400296ff
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov dword [0x14018719c], 0x28
lea rcx, [rdi + 8]
mov dword [0x140187198], 0x20
lea r9, [rbx + 4]
mov dword [rax], 0x28
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rdi + 8], xmm0
movups xmm1, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x18], xmm1
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov qword [rbx + 0x28], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140029770
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x5d
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0x5d
mov byte [rcx + 0x30], al
movzx eax, byte [rdx + 1]
xor al, 0x5d
mov byte [rcx + 0x31], al
movzx eax, byte [rdx + 2]
xor al, 0x5d
mov byte [rcx + 0x32], al
movzx eax, byte [rdx + 3]
xor al, 0x5d
mov byte [rcx + 0x33], al
movzx eax, byte [rdx + 4]
xor al, 0x5d
mov byte [rcx + 0x34], al
movzx eax, byte [rdx + 5]
xor al, 0x5d
mov byte [rcx + 0x35], al
movzx eax, byte [rdx + 6]
xor al, 0x5d
mov byte [rcx + 0x36], al
movzx eax, byte [rdx + 7]
xor al, 0x5d
mov byte [rcx + 0x37], al
movzx eax, byte [rdx + 8]
xor al, 0x5d
mov byte [rcx + 0x38], al
movzx eax, byte [rdx + 9]
xor al, 0x5d
mov byte [rcx + 0x39], al
movzx eax, byte [rdx + 0xa]
xor al, 0x5d
mov byte [rcx + 0x3a], al
movzx eax, byte [rdx + 0xb]
xor al, 0x5d
mov byte [rcx + 0x3b], al
movzx eax, byte [rdx + 0xc]
xor al, 0x5d
mov byte [rcx + 0x3c], al
movzx eax, byte [rdx + 0xd]
xor al, 0x5d
mov byte [rcx + 0x3d], al
xor eax, eax
mov byte [rcx + 0x3e], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029827
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140029836
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029860
mov ecx, 0xe
nop
inc ecx
test cl, 0xf
jne 0x1400298a0
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x1400298d1
mov qword [rbx + 0x28], rax
jmp 0x140029921
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0xe
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movsd xmm0, qword [rbx + 0x30]
movsd qword [rdi + 8], xmm0
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x10], eax
movzx eax, word [rbx + 0x3c]
mov word [rdi + 0x14], ax
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029940
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0xe
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0xe
mov byte [rcx + 0x30], al
xor eax, eax
mov byte [rcx + 0x31], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029982
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140029991
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x1400299b0
mov ecx, 1
nop
inc ecx
test cl, 0xf
jne 0x1400299f0
lea esi, [rcx + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029a21
mov qword [rbx + 0x28], rax
jmp 0x140029a60
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 1
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movzx eax, byte [rbx + 0x30]
mov byte [rdi + 8], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029a80
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x29
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x46464a75
mov dword [rcx + 0x34], 0x5a4c4042
mov dword [rcx + 0x38], 0x45585a07
mov dword [rcx + 0x3c], 0x4c5d40
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029ad1
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140029ae0
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029b00
mov eax, 0xf
nop
inc eax
test al, 0xf
jne 0x140029b40
lea esi, [rax + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029b70
mov qword [rbx + 0x28], rax
jmp 0x140029bc7
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0xf
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movsd xmm0, qword [rbx + 0x30]
movsd qword [rdi + 8], xmm0
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x10], eax
movzx eax, word [rbx + 0x3c]
mov word [rdi + 0x14], ax
movzx eax, byte [rbx + 0x3e]
mov byte [rdi + 0x16], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140029be0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x65
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x10b0c23
mov dword [rcx + 0x34], 0x111d002b
mov dword [rcx + 0x38], 0x90c23
mov word [rcx + 0x3c], 0x24
mov ecx, edi
call fcn.140014160
add edi, eax
cmp edi, 0xfffffff0
jg 0x140029c30
mov edx, 0x84
call fcn.140052d80
cmp edi, 0xffffffb7
jg 0x140029c3f
mov edx, 0x9d
call fcn.140052d80
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r10d, ecx, 0x5bd1e995
xor edx, edx
lea r9d, [rdx + 8]
nop dword [rax]
mov eax, edx
lea r8, [r8 + 4]
xor eax, r10d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r8 - 4], eax
sub r9, 1
jne 0x140029c60
mov eax, 0xd
nop
inc eax
test al, 0xf
jne 0x140029ca0
lea esi, [rax + 8]
mov qword [0x140187190], 0
mov edx, esi
call fcn.140052d80
mov qword [0x140187190], rax
mov rdi, rax
test rax, rax
jne 0x140029cd0
mov qword [rbx + 0x28], rax
jmp 0x140029d1f
mov dword [0x14018719c], esi
lea rcx, [rdi + 8]
mov dword [0x140187198], 0xd
lea r9, [rbx + 4]
mov dword [rax], esi
mov r8b, 1
mov eax, dword [0x140187198]
mov dword [rdi + 4], eax
movsd xmm0, qword [rbx + 0x30]
movsd qword [rdi + 8], xmm0
mov eax, dword [rbx + 0x38]
mov dword [rdi + 0x10], eax
movzx eax, byte [rbx + 0x3c]
mov byte [rdi + 0x14], al
mov edx, dword [0x14018719c]
add edx, 0xfffffff8
call fcn.140052470
mov qword [rbx + 0x28], rdi
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14002d5b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14002d5bb
xor eax, eax
ret
lea r11, [0x14015f7b0]
not ecx
cmp r8, 8
jb 0x14002d68d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x14002d5e0
test r8, r8
je 0x14002d6bd
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x14002d6a0
not ecx
mov eax, ecx
ret
Function at 0x140030020
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test r8d, r8d
jne 0x140030028
xor eax, eax
ret
jmp fcn.140030030