joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], 0x687740c6
xchg rbx, rsi
mov qword [rsp + 0x18], rbx
xchg rsi, rbx
xchg r13, rdi
mov qword [rsp + 0x20], r13
xchg rdi, r13
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rbp, r10
mov r10, rsp
xchg rbp, r10
nop
add rsp, 0x5b51c71d
sub rsp, 0x5b51c77d
movabs rbx, 0x7839482a4088b27d
xor rbx, 0x52cfc80e
xor rbx, 0x5e31e79a
add rbx, 0x1840a88d
sub rbx, 0x48b8ea99
mov rdi, rcx
cmp qword [rcx + 0x30], rbx
mov rdx, rdx
jne 0x140077a46
xor esi, esi
mov dword [rbp - 0x40], 0x18457cec
xor dword [rbp - 0x40], 0x2624f69d
xor dword [rbp - 0x40], 0x4b83af37
sub dword [rbp - 0x40], 0x694f5a41
sub dword [rbp - 0x40], 0xc30ca92
mov dword [rbp - 0x3c], 0x295f0a97
sub dword [rbp - 0x3c], 0x26677c94
xor dword [rbp - 0x3c], 0x2b2f2c6c
sub dword [rbp - 0x3c], 0x2988a22a
mov dword [rbp - 0x38], 0xacc6390
add dword [rbp - 0x38], 0x6d06e535
xor dword [rbp - 0x38], 0x1a61f80
xor dword [rbp - 0x38], 0x761a5707
mov dword [rbp - 0x34], 0x3fa1a88a
add dword [rbp - 0x34], 0x1559822
xor dword [rbp - 0x34], 0x182c8993
sub dword [rbp - 0x34], 0x58d8c93f
mov dword [rbp - 0x30], 0x2661cb55
add dword [rbp - 0x30], 0x8c61e8a
sub dword [rbp - 0x30], 0x25f3efa6
sub dword [rbp - 0x30], 0x8d1fa1d
lea r8d, [rsi + 3]
mov dword [rbp - 0x2c], 0x561c046b
xor dword [rbp - 0x2c], 0x6a32b7b9
add dword [rbp - 0x2c], 0xba2a4eb
sub dword [rbp - 0x2c], 0x4198341
sub dword [rbp - 0x2c], 0x435ad51d
mov qword [rbp + 0x10], rsi
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
xchg rcx, r12
mov r12, qword [rbp + 0x10]
xchg rcx, r12
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
and cl, r8b
mov rdx, rdx
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
xchg rdi, rdi
mov eax, 0x20a4a836
add eax, 0x1afa94f8
add eax, 0x9c9d0e5
sub eax, 0x143607e1
shr eax, cl
movzx ecx, al
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
inc rax
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 0xc
jb 0x140077963
xor edx, edx
mov dword [rsp - 0x10], esp
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
call fcn.1400b0bb0
xchg rbp, rbp
xchg r9, rdx
mov r9, rax
xchg r9, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
mov dword [rsp - 0x34], edi
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov dword [rsp - 0x34], esp
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140077a50
xchg r8, r8
lea rdx, [0x14012f2c0]
xchg rcx, rdi
mov rdi, r8
xchg rcx, rdi
call fcn.14007c148
test al, al
mov dword [rsp - 0x40], ebp
setne al
jmp 0x140077a50
mov al, 0x61
sub al, 0x55
add al, 0x48
sub al, 0x2e
xor al, 0x27
lea r11, [rsp + 0x60]
xchg r10, rbx
mov r10, qword [r11 + 0x18]
xchg r10, rbx
xchg rsi, rbx
mov rbx, qword [r11 + 0x20]
xchg rsi, rbx
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x18], ecx
mov rsp, r11
pop rbp
ret
Function at 0x140077a78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg rsi, r13
xchg rcx, rdi
mov qword [rsp + 0x20], rcx
xchg rcx, rdi
push rbp
mov dword [rsp - 0x10], ebx
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
nop
add rsp, 0x76e58f68
sub rsp, 0x76e58fb8
movabs rsi, 0x7839482a640da024
xor rsi, 0x7b61788c
add rsi, 0x14dc604c
sub rsi, 0x184add17
xchg r15, rcx
mov rdi, r15
xchg rcx, r15
cmp qword [rcx + 0x28], rsi
mov rsp, rsp
jne 0x140077c45
xor ebx, ebx
mov dword [rbp - 0x30], 0x5ec9b75c
sub dword [rbp - 0x30], 0xa705f7e
add dword [rbp - 0x30], 0x21402848
sub dword [rbp - 0x30], 0x752f7fa9
mov dword [rbp - 0x2c], 0x6783b14b
sub dword [rbp - 0x2c], 0x16510cb
xor dword [rbp - 0x2c], 0x672f58a4
add dword [rbp - 0x2c], 0xf9f7024
sub dword [rbp - 0x2c], 0x10cf67f2
mov dword [rbp - 0x28], 0x5d370ba3
sub dword [rbp - 0x28], 0x637c3e2
xor dword [rbp - 0x28], 0x3d126fa3
sub dword [rbp - 0x28], 0x6bc52862
mov dword [rbp - 0x24], 0x54a8e71a
sub dword [rbp - 0x24], 0x9f7ad01
sub dword [rbp - 0x24], 0x30061631
sub dword [rbp - 0x24], 0x1a4e2391
lea eax, [rbx + 0x5e]
xchg r11, r11
mov word [rbp - 0x20], ax
mov qword [rbp + 0x10], rbx
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov r9, r9
mov eax, 0x28dba046
add eax, 0x32718f5f
sub eax, 0x19dc7d5d
sub eax, 0x103dac16
shr eax, cl
movzx ecx, al
mov r10, r10
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
inc rax
xchg rsi, rax
mov qword [rbp + 0x10], rsi
xchg rsi, rax
mov rax, qword [rbp + 0x10]
cmp rax, 9
xchg r15, r15
jb 0x140077b74
xor edx, edx
mov word [rbp - 0xc], bx
xchg rcx, rcx
lea rcx, [rbp - 0x1e]
call fcn.1400b0bb0
xchg r13, rdx
mov r13, rax
xchg rdx, r13
xchg r10, rax
mov r8, r10
xchg r10, rax
xor eax, eax
xor rdx, rsi
mov dword [rsp - 0x34], 0x921cb22
mov qword [rdi + 0x28], rdx
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
mov rbp, rbp
rep stosb byte [rdi], al
cmp rdx, rsi
je 0x140077c4d
xchg r13, r13
lea rdx, [0x14012f810]
mov rcx, r8
call fcn.140080588
mov dword [rsp - 0x2c], ebx
test al, al
setne al
jmp 0x140077c4d
mov al, 0x75
xor al, 0x2d
sub al, 0x2e
xor al, 0x2b
mov rbx, qword [rsp + 0x68]
xchg r15, r15
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
mov dword [rsp - 0x14], 0x56ca8d42
pop rbp
ret
Function at 0x140077c70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg rbx, r14
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x3c], ebp
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg r11, rdi
push rbp
xchg rsi, rsi
xchg rbp, r8
mov r8, rsp
xchg r8, rbp
nop
add rsp, 0x2282ac44
sub rsp, 0x2282ac94
movabs rbx, 0x7839482a08e6eb6a
add rbx, 0x2934fe97
xor rbx, 0x2b8cdc39
add rbx, 0x26725a5
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x38], rbx
jne 0x140077e70
xor esi, esi
xchg r8, r8
mov dword [rbp - 0x30], 0x4ef919e9
sub dword [rbp - 0x30], 0xc40cbdc
sub dword [rbp - 0x30], 0x3b724d95
xor dword [rbp - 0x30], 0x7300018
mov dword [rbp - 0x2c], 0x1ab45eb2
add dword [rbp - 0x2c], 0x26c5b0e8
sub dword [rbp - 0x2c], 0x3e54663f
sub dword [rbp - 0x2c], 0x2e2a90b
mov dword [rbp - 0x28], 0x383fa990
xor dword [rbp - 0x28], 0x4275da41
sub dword [rbp - 0x28], 0x3cc4e3b3
sub dword [rbp - 0x28], 0x3d538fd8
mov dword [rbp - 0x24], 0x400575ce
xor dword [rbp - 0x24], 0x66cb29b0
add dword [rbp - 0x24], 0x55850f57
xor dword [rbp - 0x24], 0x315de331
sub dword [rbp - 0x24], 0x4cb988c7
mov dword [rbp - 0x20], 0x4b3b6440
xor dword [rbp - 0x20], 0x3e81eb59
sub dword [rbp - 0x20], 0x330b657b
sub dword [rbp - 0x20], 0x42452940
xchg r13, rsi
mov qword [rbp + 0x10], r13
xchg rsi, r13
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x18], 0x7656dc03
xchg rdi, rcx
mov rdi, qword [rbp + 0x10]
xchg rdi, rcx
mov rax, qword [rbp + 0x10]
mov rdx, rdx
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x41191c79
sub eax, 0x3225785e
add eax, 0x21f6bcfd
sub eax, 0xe899230
add eax, 0xed2374a
shr eax, cl
mov dword [rsp - 0xc], 0x404c578
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov rcx, rcx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r10, rax
mov qword [rbp + 0x10], r10
xchg r10, rax
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
cmp rax, 0xa
jb 0x140077d8b
xor edx, edx
xchg rbp, rbp
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.1400b0bb0
mov rcx, rcx
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
mov dword [rsp - 0x44], ebp
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x38], rdx
mov dword [rsp - 0x24], 0x6cb75cf4
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x18], ecx
je 0x140077e78
lea rdx, [0x14012f830]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.140080984
test al, al
mov dword [rsp - 0x10], 0x3ed7d4cc
setne al
jmp 0x140077e78
mov al, 0x7d
sub al, 0x4c
add al, 0x14
sub al, 0x44
xchg rbx, rsi
mov rsi, qword [rsp + 0x68]
xchg rsi, rbx
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rsi, rbp
mov rdi, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140077ea8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg rsi, r14
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
push r14
mov r8, r8
xchg rbp, rbx
mov rbx, rsp
xchg rbp, rbx
sub rsp, 0x50
mov dword [rsp - 0x18], ecx
movabs rsi, 0x7839482a4a480b95
add rsi, 0xb48bd12
add rsi, 0x28ab136d
xor rsi, 0x65c587c9
xchg rcx, r12
mov rbx, r12
xchg rcx, r12
cmp qword [rcx + 0x20], rsi
jne 0x1400780c5
mov rdx, rdx
mov edi, 0x497d2e69
xor edi, 0xf3e5a56
xor edi, 0x72360953
xor edi, 0x34757d6d
mov dword [rbp - 0x30], 0x15aaf101
xor dword [rbp - 0x30], 0x555e5121
add dword [rbp - 0x30], 0x33213552
sub dword [rbp - 0x30], 0x73a7d511
xor r14d, r14d
xchg rdx, rdx
mov dword [rbp - 0x2c], 0x2196d07
xor dword [rbp - 0x2c], 0x68d10143
sub dword [rbp - 0x2c], 0x64cc9c65
xor dword [rbp - 0x2c], 0x52d71a23
xor dword [rbp - 0x2c], 0x5771d5aa
mov dword [rbp - 0x28], 0x2b25adfc
add dword [rbp - 0x28], 0x16aa9f93
xor dword [rbp - 0x28], 0x682ac026
add dword [rbp - 0x28], 0x55a747b9
sub dword [rbp - 0x28], 0x7f6cd504
mov dword [rbp - 0x24], 0x429aa3eb
sub dword [rbp - 0x24], 0x366abcea
xor dword [rbp - 0x24], 0x30b86f31
sub dword [rbp - 0x24], 0x3c78882f
lea eax, [rdi + 0x5e]
mov dword [rbp - 0x20], 0x61488e6e
xor dword [rbp - 0x20], 0x75aa226f
xor dword [rbp - 0x20], 0x2bad8038
xor dword [rbp - 0x20], 0x3f252c6f
mov word [rbp - 0x1c], ax
mov rcx, rcx
xchg r13, r14
mov qword [rbp + 0x20], r13
xchg r13, r14
mov rax, qword [rbp + 0x20]
xchg r8, r8
xchg r12, rcx
mov r12, qword [rbp + 0x20]
xchg r12, rcx
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x24], 0x397f230d
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov rdi, rdi
mov eax, 0x25d63c4c
sub eax, 0x1ce4a044
add eax, 0x668afec0
sub eax, 0x3e499496
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x34], 0x44795163
xchg r12, rax
mov r12, qword [rbp + 0x20]
xchg r12, rax
xor cx, dx
mov dword [rsp - 0x40], 0x48b719c0
mov word [rbp + rax*2 - 0x1a], cx
mov rax, qword [rbp + 0x20]
add rax, rdi
mov qword [rbp + 0x20], rax
xchg r12, r12
mov rax, qword [rbp + 0x20]
cmp rax, 0xb
jb 0x140077fdf
xor edx, edx
mov dword [rsp - 0x14], esi
mov word [rbp - 4], r14w
lea rcx, [rbp - 0x1a]
call fcn.1400b0bb0
mov rdx, rax
mov dword [rsp - 0x3c], esp
lea rdi, [rbp - 0x1a]
xor rdx, rsi
xchg r11, r8
mov r11, rax
xchg r11, r8
xor eax, eax
mov dword [rsp - 0x10], 0x2bf728fa
mov qword [rbx + 0x20], rdx
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
mov dword [rsp - 0x38], ecx
cmp rdx, rsi
je 0x1400780de
lea rdx, [0x14012f298]
xchg r14, r8
mov rcx, r14
xchg r8, r14
call fcn.140080c44
xchg r12, r12
test al, al
setne al
jmp 0x1400780de
mov eax, 0x504cfc75
sub eax, 0x1ba8db97
xor eax, 0xa28bb7
xor eax, 0x11fb7f86
sub eax, 0x25fdd4ee
lea r11, [rsp + 0x50]
xchg rbp, rbx
mov rbp, qword [r11 + 0x28]
xchg rbp, rbx
xchg rsi, r10
mov r10, qword [r11 + 0x30]
xchg r10, rsi
xchg rsp, r14
mov r14, r11
xchg r14, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140093830
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
mov qword [rsp + 0x18], rsi
xchg rcx, rdi
mov qword [rsp + 0x20], rcx
xchg rcx, rdi
push rsi
mov qword [rsp], rbp
xchg rsp, r9
mov rbp, r9
xchg r9, rsp
sub rsp, 0x7b1fafed
add rsp, 0x7b1faf6d
xor esi, esi
mov rsp, rsp
mov dword [rbp - 0x50], 0x64b91d6d
xor dword [rbp - 0x50], 0x501640a5
xor dword [rbp - 0x50], 0x208e9d63
sub dword [rbp - 0x50], 0x13cdc049
mov dword [rbp - 0x4c], 0x503348aa
sub dword [rbp - 0x4c], 0x4bb51628
add dword [rbp - 0x4c], 0x63d750a9
sub dword [rbp - 0x4c], 0x67e382af
mov dword [rbp - 0x48], 0x495ab17d
sub dword [rbp - 0x48], 0x297c9dfc
add dword [rbp - 0x48], 0x5a87d502
sub dword [rbp - 0x48], 0x7a07e80c
mov dword [rbp - 0x44], 0xa013c06
add dword [rbp - 0x44], 0x72491d7d
xor dword [rbp - 0x44], 0x5be120c3
xor dword [rbp - 0x44], 0x27d67923
mov qword [rbp + 0x10], rsi
lea ebx, [rsi + 1]
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x10], 0x17a7d2e5
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x483c27aa
add eax, 0x18543df6
xor eax, 0x298c005f
xor eax, 0x782f63cd
shr eax, cl
movzx ecx, al
xchg rdi, rdi
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
xor cx, dx
mov dword [rsp - 0xc], edi
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x10]
add rax, rbx
mov r12, r12
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 8
jb 0x1400938eb
xchg rbx, rbx
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov qword [rbp - 0x38], rax
mov r8, r8
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x3282f51e
sub dword [rbp - 0x40], 0x1fbbc2e2
add dword [rbp - 0x40], 0x27717898
add dword [rbp - 0x40], 0x16388bf0
xor dword [rbp - 0x40], 0x506336d4
lea r8, [rbp - 0x40]
mov dword [rsp - 0xc], edx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
xchg rdi, rbp
movups xmmword [rdi - 0x30], xmm0
xchg rbp, rdi
call fcn.1400b51a0
mov dword [rsp - 0x28], 0x5071c9c8
xchg rbx, rax
mov rdi, rbx
xchg rbx, rax
test rax, rax
mov dword [rsp - 0x34], ecx
je 0x140093a01
xchg r11, rcx
mov r11, rax
xchg rcx, r11
call fcn.14008a144
test al, al
xchg rbx, rbx
je 0x140093a01
lea rdx, [rbp - 0x40]
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.140088f88
xchg rsp, rsp
test al, al
jne 0x140093a07
mov bl, sil
mov r13, r13
xor eax, eax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
mov r10, r10
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
xchg rdi, r8
mov r8, qword [r11 + 0x28]
xchg r8, rdi
mov al, bl
xchg r13, r13
mov rbx, qword [r11 + 0x18]
xchg r11, r13
mov rsp, r13
xchg r11, r13
pop rbp
mov rdx, rdx
ret
Function at 0x14009d05c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x14000b958]
mov rsi, rsi
sub r10, rcx
xchg r14, r8
mov r14, rcx
xchg r8, r14
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x519c4523
sub edx, 0x2f0f6168
xor edx, 0x466f2eb6
sub edx, 0x106376e7
inc r9
mov dword [rsp - 0x14], ebp
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov dword [rsp - 0x20], 0x7af7a39f
jb 0x14009d075
mov rax, r8
ret
Function at 0x14009df48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r10, rcx
mov qword [rsp + 8], r10
xchg rcx, r10
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov dword [rsp - 0x18], 0x68c6086d
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x29f2146e
sub rsp, 0x29f2148e
mov rbx, rcx
mov rsp, rsp
mov r13d, r8d
mov r9d, 0x4eb0042a
sub r9d, 0x2bafa5fc
add r9d, 0x4923681d
xor r9d, 0x59648f09
sub r9d, 0x35434942
mov r12, rdx
mov dword [rsp - 0x30], 0x4f10aa8
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff76b78760
xor rcx, 0x64112ff9
xor rcx, 0x724dd37e
add rcx, 0x7fffffff
xor rcx, 0x1f148419
popf
pushf
mov eax, 0x7e0d9109
sub eax, 0x685ff595
xor eax, 0x7a698bb6
xor eax, 0x56c8e46e
xor eax, 0x390cf4a8
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x1c], 0x141ac6f8
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400b96e0
lea r15d, [r13 + 0xfffff]
xor esi, esi
mov r15, r15
shr r15d, 6
shr r15d, 0xd
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x79bd99c6
sub ebx, 0x73ff963a
add ebx, 0x1cfe5a11
xor ebx, 0x22bc5d9c
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
xchg r11, r11
test r15d, r15d
je 0x14009e17d
mov eax, 0x3ad5b044
sub eax, 0x2f8ebb37
xor eax, 0x5e4fd9fc
sub eax, 0x54f92cf1
xchg r10, rcx
mov r10, qword [rsp + 0x60]
xchg r10, rcx
mov r14d, esi
shl r14d, 0x11
shl r14d, 2
shl r14d, 1
mov edi, r13d
mov dword [rsp - 0x18], edx
sub edi, r14d
mov rdx, rbp
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x2c], edx
mov r8d, edi
call fcn.1400a42f0
test al, al
je 0x14009e17b
mov dword [rsp - 0x24], 0x596a923a
shr edi, 2
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
xchg rcx, rcx
je 0x14009e147
mov r15d, dword [rsp + 0x70]
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
lea eax, [r14 + r8]
mov rcx, rcx
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov rbx, rbx
xor edx, 0x71c6092d
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
xchg rdx, rdx
cmp r8d, edi
jb 0x14009e115
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov rbp, rbp
mov eax, 0x7d82310c
sub eax, 0x3f4af5f6
add eax, 0x109bc233
add eax, 0x1ee456a9
xor eax, 0x6da753f2
cmp esi, r15d
mov dword [rsp - 0x30], 0x5bb4df27
jb 0x14009e0a9
jmp 0x14009e17d
xor bl, bl
xchg rbp, rdi
mov rcx, rdi
xchg rbp, rdi
call fcn.1400b96f0
mov al, bl
mov dword [rsp - 0x34], 0x53b4b019
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffe0
pop r15
pop r14
mov dword [rsp - 0x40], 0x11778455
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14009e8ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x40], edx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r9, r15
mov r9, rcx
xchg r15, r9
mov r14d, r8d
mov r9d, 0x25c4b863
xor r9d, 0x133e20a2
xor r9d, 0x1fb48b10
xor r9d, 0x6f668b02
sub r9d, 0x462498d3
xchg rdx, r12
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
mov dword [rsp - 0x1c], 0x20a21fd3
pushf
movabs rcx, 0xffffffff02d12380
add rcx, 0x2d9e4dbd
xor rcx, 0x3eb99789
add rcx, 0x7fffffff
add rcx, 0x7129194c
popf
pushf
mov eax, 0x5af8aca5
add eax, 0x1e56e09f
xor eax, 0x44271b8e
sub eax, 0x3d5f48ee
xor eax, 0x94dd8
popf
cmovb r9d, r14d
xchg rcx, rcx
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400b96e0
mov dword [rsp - 0x40], ebp
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xc
shr ebp, 7
shr ebp, 1
xor edi, edi
mov rsi, rax
mov r15, r15
mov ebx, 0x60bab5b
add ebx, 0xa895421
add ebx, 0x89e0100
sub ebx, 0x1933007b
test ebp, ebp
mov r11, r11
je 0x14009eafc
mov eax, 0x4c4a99f8
xor eax, 0x7a301925
xor eax, 0x5d9afd34
xor eax, 0x6bf07de9
mov r9d, edi
mov r8d, r14d
mov dword [rsp - 0x10], ebp
shl r9d, 1
shl r9d, 0xa
shl r9d, 4
shl r9d, 2
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov r9, r9
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x14], esp
xor r10d, r10d
shr r11d, 2
test r11d, r11d
je 0x14009eaa8
xchg r12, r12
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
xor eax, dword [r12 + rcx*4]
mov r11, r11
add r10d, ebx
xor eax, 0x71c6092d
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov rdi, rdi
cmp r10d, r11d
jb 0x14009ea80
xchg rsi, r12
mov rdx, r12
xchg rsi, r12
xchg rcx, r15
mov r15, rcx
xchg r15, rcx
call fcn.1400a4940
test al, al
xchg rdi, rdi
je 0x14009eaf6
add edi, ebx
mov eax, 0x649e4353
sub eax, 0x3441b05f
xor eax, 0x70b9d922
xor eax, 0x7c6c8edf
xor eax, 0x3c99c509
cmp edi, ebp
mov dword [rsp - 0x2c], esp
jb 0x14009ea2a
jmp 0x14009eafc
xor bl, bl
mov dword [rsp - 0x3c], ecx
xchg rbp, rsi
mov rcx, rbp
xchg rsi, rbp
call fcn.1400b96f0
mov dword [rsp - 0x24], esp
xchg rbp, r8
mov r8, qword [rsp + 0x58]
xchg r8, rbp
mov al, bl
mov dword [rsp - 0x20], 0x5d552a46
xchg r15, rbx
mov r15, qword [rsp + 0x50]
xchg r15, rbx
xchg rsi, r8
mov r8, qword [rsp + 0x60]
xchg rsi, r8
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov rsi, rsi
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400a18b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1401300a4], 0
jne 0x1400a19c4
mov r13, r13
xor edx, edx
lea r8, [0x1401300a0]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x44], 0xbb621b9
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x3c], 0x2ccfccf8
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
xchg r15, r15
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r8, r8
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x38], ebp
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0xc], 0x9eaa76a
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0xc], 0x5daf0993
shr ecx, 1
and eax, 1
neg eax
mov r12, r12
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x40], 0x2e361998
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x3c], ebx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0xc], 0xd21f5b3
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov r15, r15
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x40], 0x1f77ffe4
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg r13, r13
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xchg rsi, rsi
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov rbp, rbp
jb 0x1400a18d3
ret

Function at 0x1400a19d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7ca2
mov r10, rcx
mov dword [rsp - 0x20], ebx
mov eax, dword [0x14012ff50]
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
xchg r11, r11
ret

Function at 0x1400a19f0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
xchg rdi, rdi
jmp 0x1400b82e9
mov r10, rcx
mov dword [rsp - 0x10], ecx
mov eax, dword [0x14012ffe8]
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov rbp, rbp
ret

Function at 0x1400a1a10
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7a99
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x14012ff20]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov rbp, rbp
syscall
ret

Function at 0x1400a1a20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b804f
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x14012ffa8]
mov dword [rsp - 0x28], ebp
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov dword [rsp - 0x2c], 0x65dab51
ret

Function at 0x1400a1a30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7ef9
xchg rbx, r10
mov rbx, rcx
xchg r10, rbx
mov eax, dword [0x14012ff88]
mov rcx, rcx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov rbx, rbx
ret

Function at 0x1400a1a40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7af5
mov r10, rcx
mov eax, dword [0x14012ff28]
mov dword [rsp - 0x34], 0x14410408
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov dword [rsp - 0x10], 0xd8590da
ret

Function at 0x1400a1a50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b817b
mov r10, rcx
mov eax, dword [0x14012ffc4]
cmp qword [0x140130038], 0
xchg rsp, rsp
jne 0x1400b7a10
syscall
ret