joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057930
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg rbx, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x50
movabs rbx, 0x25f71030712adb80
sub rbx, 0x4e59cafe
add rbx, 0x4bf02ae
add rbx, 0x43a408bc
xchg rbp, rdi
mov rbp, rcx
xchg rbp, rdi
cmp qword [rcx + 0x20], rbx
mov dword [rsp - 0x2c], 0x848dcaa
jne 0x140057b6e
mov eax, 0x404db60a
add eax, 0x278ea1ec
sub eax, 0x4d8418c8
sub eax, 0x1a583f17
mov dword [rsp + 0x20], 0xa8776ba
add dword [rsp + 0x20], 0x148cd3c
add dword [rsp + 0x20], 0x3df3bed5
sub dword [rsp + 0x20], 0x49b30292
mov word [rsp + 0x34], ax
xchg r13, r13
xor r8d, r8d
mov dword [rsp + 0x24], 0x1bc9f8bf
add dword [rsp + 0x24], 0x5c460ea8
sub dword [rsp + 0x24], 0x449357fc
xor dword [rsp + 0x24], 0x2969f116
sub dword [rsp + 0x24], 0x199b5e5f
mov dword [rsp + 0x28], 0x5472a643
sub dword [rsp + 0x28], 0x4587e336
sub dword [rsp + 0x28], 0x7d66a
sub dword [rsp + 0x28], 0xe98ec9d
mov dword [rsp + 0x2c], 0x6b81e7e2
xor dword [rsp + 0x2c], 0x3f996bce
sub dword [rsp + 0x2c], 0x35d16ae2
xor dword [rsp + 0x2c], 0x1e7f2103
mov dword [rsp + 0x30], 0x1cf4fedc
sub dword [rsp + 0x30], 0x102cbca5
add dword [rsp + 0x30], 0x56458a9c
sub dword [rsp + 0x30], 0x62f8ccc5
xchg r11, r8
mov qword [rsp + 0x60], r11
xchg r11, r8
mov rax, qword [rsp + 0x60]
xchg r12, rcx
mov r12, qword [rsp + 0x60]
xchg r12, rcx
mov rax, qword [rsp + 0x60]
and cl, 3
mov dword [rsp - 0x3c], ebp
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x5075f8d0
xor eax, 0x73709aeb
xor eax, 0x1da8cead
sub eax, 0x2832332c
shr eax, cl
mov dword [rsp - 0x3c], 0x34e073b6
movzx ecx, al
mov rax, qword [rsp + 0x60]
xor cx, dx
xchg r9, r9
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
inc rax
mov dword [rsp - 0x10], 0x341bf000
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 0xb
mov dword [rsp - 0x18], ebx
jb 0x140057a5a
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
mov dword [rsp - 0x1c], esi
call fcn.14007a870
mov rdx, rax
xchg r8, r13
mov r13, rax
xchg r13, r8
xor rdx, rbx
mov r14, r14
xor eax, eax
xchg r10, rdx
mov qword [rdi + 0x20], r10
xchg r10, rdx
lea rdi, [rsp + 0x36]
mov ecx, 0x2842bd6d
sub ecx, 0x193c91d4
add ecx, 0x196763d6
xor ecx, 0x3a0af325
xor ecx, 0x12677c41
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140057b78
mov rbp, rbp
lea rdx, [0x1404a03c8]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.14006b5e0
test al, al
mov dword [rsp - 0x10], 0x176ab849
setne al
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffb0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x3c
add al, 0xb
sub al, 0x40
add al, 0x5b
sub al, 0x61
xchg rbx, r12
mov r12, qword [rsp + 0x68]
xchg rbx, r12
nop
sub rsp, 0x3602c3c2
add rsp, 0x3602c412
pop rdi
ret
Function at 0x140072520
Capabilities:
Encode data using xor

Disassembly:
push rdi
add rsp, 0xfffffffffffffff0
mov dword [rsp + 0x20], 0x4c90c3e9
sub dword [rsp + 0x20], 0x4853d498
add dword [rsp + 0x20], 0x1b3983f9
mov r8, rcx
mov byte [rsp + 0x24], 0x79
sub byte [rsp + 0x24], 0x24
add byte [rsp + 0x24], 0x11
mov qword [rsp + 0x28], 0x61ed7def
add qword [rsp + 0x28], 0xb6b0914
xor qword [rsp + 0x28], 0x6d588703
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x3e5dd962
add edx, 0x754094c
xor edx, 0x148b9b4
sub edx, 0x2e7de1b0
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x14007257c
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x68
add byte [rsp + 7], 7
xor byte [rsp + 7], 0x6f
popf
je 0x140072632
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x140072635
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140072625
movzx eax, byte [rcx]
test al, al
jne 0x140072609
jmp 0x140072635
inc r8
cmp byte [r8], 0
jne 0x1400725f4
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x62412221
sub ecx, 0x2edc2b7b
xor ecx, 0x2285384
sub ecx, 0x314ca51d
rep stosb byte [rdi], al
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x140072660
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x4c76710d
add rsp, 0x4c7670fd
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x14007281a
mov dword [rsp + 0x28], 0x6250c263
sub dword [rsp + 0x28], 0x3d5e3a40
add dword [rsp + 0x28], 0x23cd9a48
xor dword [rsp + 0x28], 0x57b65121
mov byte [rsp + 0x2c], 0x2e
sub byte [rsp + 0x2c], 0x29
add byte [rsp + 0x2c], 0x61
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x5337e366
sub edx, 0x17005807
add edx, 0x437fcd3
sub edx, 0x29f40ec8
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x1400726be
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x14007273f
lea rcx, [rcx + 1]
cmp dil, al
je 0x140072806
movzx eax, byte [rcx]
test al, al
jne 0x140072727
mov word [rsp + 0x20], 0x5969
add word [rsp + 0x20], 0x1a51
xor word [rsp + 0x20], 0x57ad
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x59a2b6b9
xor edx, 0x5c1b5bdc
xor edx, 0x657b7da7
sub edx, 0x4a471758
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x140072769
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x1400727eb
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007287c
movzx eax, byte [rcx]
test al, al
jne 0x1400727d3
xor dl, dl
mov r8d, 0x3a8864c
xor r8d, 0xe7f1c83
xor r8d, 0xdd79acc
jmp 0x140072822
mov r8d, 0x2d9bcc1d
add r8d, 0xd9f8450
xor r8d, 0x3b3b506c
mov dl, 0x78
xor dl, 0x25
xor dl, 0x5c
test r8b, 2
je 0x140072849
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x6fe5d176
xor ecx, 0x5b47c114
xor ecx, 0x34a21060
rep stosb byte [rdi], al
test r8b, 1
je 0x14007286d
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x54729806
add ecx, 0x2973134e
xor ecx, 0x7de5ab51
rep stosb byte [rdi], al
movzx eax, dl
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov r8d, 0x3bbe3e3
add r8d, 0xb10bc2b
sub r8d, 0xecca00b
jmp 0x14007281a
Function at 0x1400734d0
Capabilities:
Encode data using xor

Disassembly:
push rdi
add rsp, 0xfffffffffffffff0
mov word [rsp + 0x20], 0x4755
sub word [rsp + 0x20], 0x291e
add word [rsp + 0x20], 0x5e0
mov r8, rcx
mov qword [rsp + 0x28], 0x41966546
sub qword [rsp + 0x28], 0x132c2ec9
add qword [rsp + 0x28], 0x3e3c9a88
xor qword [rsp + 0x28], 0x6ca6d105
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x2effcde8
add edx, 0x3284bef4
xor edx, 0x195081c8
xor edx, 0x6eaf747e
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x140073519
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x47
sub byte [rsp + 2], 0x27
xor byte [rsp + 2], 0x1d
xor byte [rsp + 2], 0x3d
test al, al
je 0x1400735a9
lea rcx, [rcx + 1]
cmp dl, al
je 0x1400735ea
movzx eax, byte [rcx]
test al, al
jne 0x140073592
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x5bc54caf
add ecx, 0xcea6117
xor ecx, 0x7bfedbfd
xor ecx, 0x13517639
rep stosb byte [rdi], al
test dl, dl
jne 0x1400735f7
mov byte [r8], al
lea rax, [r8 + 1]
nop
sub rsp, 0x1044b721
add rsp, 0x1044b731
pop rdi
ret
mov dl, 0x1a
add dl, 0x4b
sub dl, 0x64
jmp 0x1400735ab
mov rax, r8
sub rsp, 0xfffffffffffffff0
pop rdi
ret
Function at 0x1400736f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r8, r8
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rdi, rsi
nop
push 0x12192378
mov qword [rsp], r14
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdx
mov dword [rsp - 0x30], 0x159819a4
xchg rcx, r13
mov rsi, r13
xchg r13, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov rcx, rcx
call fcn.1400750a0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov r15, r15
mov ebp, dword [rbx + rsi + 0xb4]
xchg r12, r10
mov r12, rax
xchg r12, r10
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x34], 0x5f01d6f9
je 0x1400738c5
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x18], ebp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov dword [rsp - 0x30], 0x17721df2
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
xchg r14, r14
jae 0x140073807
mov eax, dword [rdx + 8]
test eax, eax
jne 0x1400737c1
mov dword [rsp - 0x24], 0xf1e518a
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x3c], ebp
jb 0x1400737e2
add eax, r9d
cmp r11d, eax
jb 0x140073885
mov dword [rsp - 0x34], ecx
inc r8w
nop
add rdx, 0x616d5da3
sub rdx, 0x616d5d7b
cmp r8w, cx
jb 0x1400737ab
mov dword [rsp - 0x1c], 0x439c83f1
mov r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x20], edi
neg rax
sub rax, 0xfffffffffffffff8
neg rax
nop
sub r10, 0x7f27f1ef
add r10, 0x7f27f1f7
shr rax, 1
mov dword [rsp - 0x10], esp
test eax, eax
je 0x1400738ba
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x34], 0x7da39b02
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xb
shr ecx, 1
cmp ecx, 3
je 0x14007389a
mov dword [rsp - 0x40], ecx
cmp ecx, 0xa
jne 0x1400738a3
and eax, 0xfff
add qword [rax + r8], rdi
mov dword [rsp - 0x14], 0x1be3c33
jmp 0x1400738a3
mov r8d, dword [rdx + 0x14]
sub r8, r9
xchg r15, r15
add r8, rsi
add r8, r11
jmp 0x14007380a
and eax, 0xfff
add dword [rax + r8], edi
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
jne 0x14007384e
mov r9, r9
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140073773
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0xc], esp
xchg r9, rbp
mov r9, qword [rsp + 0x38]
xchg r9, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xchg rbp, rbp
nop
sub rsp, 0x5910744f
add rsp, 0x5910746f
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140075170
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg rbx, r8
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x26d1908a
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov r11, r11
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x7d1d1101
mov rsi, rcx
xchg rsp, rsp
cmp eax, 0x7d1d4b4c
jne 0x14007532b
movsxd rdx, dword [rcx + 0x3c]
mov rdi, rdi
mov eax, dword [rdx + rcx]
xor eax, 0x7d1d1101
cmp eax, 0x7d1d5451
mov dword [rsp - 0x28], ebp
jne 0x14007532b
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400750a0
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg rbx, rax
mov r14, rbx
xchg rbx, rax
mov edx, dword [rax + 0x20]
call fcn.1400750a0
mov dword [rsp - 0x14], ebp
mov edx, dword [r14 + 0x24]
xchg rbp, rcx
mov rbp, rsi
xchg rcx, rbp
xchg rdx, rax
mov r12, rdx
xchg rdx, rax
call fcn.1400750a0
mov dword [rsp - 0x44], 0x5502e5b9
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r12, rax
mov r13, r12
xchg r12, rax
call fcn.1400750a0
xor edi, edi
xchg r10, r10
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x14007532b
nop dword [rax]
mov rbx, rbx
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.1400750a0
mov dword [rsp - 0x10], ebp
mov ecx, 0x4c453558
sub ecx, 0x6da86cc
xor ecx, 0x3fb5ba1d
add ecx, 0x8520eb6e
mov rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov dword [rsp - 0x20], 0x545345ff
je 0x140075309
nop dword [rax]
xchg rbx, rsp
mov rdx, rsp
xchg rsp, rbx
lea rcx, [rsp + 0x60]
xchg rbp, rbp
mov r8d, 0x712630a0
sub r8d, 0x28b40035
xor r8d, 0x16db05a5
sub r8d, 0xd40ca8c
sub r8d, 0x51686b41
inc rbx
call fcn.140081670
mov dword [rsp - 0x34], ecx
cmp byte [rbx], 0
jne 0x1400752b5
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x30], 0x2561b99b
not ecx
cmp ecx, r15d
je 0x14007536e
mov r12, r12
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140075273
mov dword [rsp - 0x18], 0x59b9fb36
xor eax, eax
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg rbx, r14
sub rsp, 0xffffffffffffffe0
xchg r9, r9
pop r15
pop r14
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, rbp
mov rbp, rsi
xchg rcx, rbp
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
mov edx, dword [rax + rdx*4]
xchg rcx, rcx
call fcn.1400750a0
jmp 0x14007532d
Function at 0x140079400
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg r9, rbx
mov r9, qword [rcx]
xchg rbx, r9
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, r14
mov qword [rsp + 0x70], r14
xchg rsi, r14
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
xchg rdi, rsp
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rsi + 1]
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg rsp, r14
xchg rdi, rsp
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.14000ed40
mov dword [rsp - 0x18], edi
mov edx, 0xc18cfd5
xor edx, 0x379a743f
sub edx, 0x3e96d14
xor edx, 0x21e237bc
test rsi, rsi
je 0x1400794fc
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rdx, r8
mov rdx, rsi
xchg rdx, r8
mov r9d, 0x4434701
add r9d, 0x16a34bd3
xor r9d, 0x4801028b
xor r9d, 0x52e790a0
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0xc], 0x3c8b19b4
and cx, r9w
ror edx, 5
ror edx, 3
xor cx, word [rbx + rdi - 2]
xchg r12, r12
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400794cd
xor ecx, ecx
mov dword [rsp - 0x18], 0xd1a05f4
mov word [rax + rsi*2], cx
xchg rcx, rbp
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
call fcn.1400795b0
mov r13, r13
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rsi, rbp
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x3c], 0x7f5e5ebc
jne 0x14007958a
xor eax, eax
lea rdi, [rsp + 0x28]
mov r11, r11
mov ecx, 0x39fba76e
xor ecx, 0x13404018
sub ecx, 0xeebb071
sub ecx, 0x1bd036d5
rep stosb byte [rdi], al
mov eax, ebx
xchg rbx, r12
mov r12, qword [rsp + 0x78]
xchg rbx, r12
nop
sub rsp, 0x3026a202
add rsp, 0x3026a262
pop rdi
mov dword [rsp - 0x14], esi
ret
call fcn.140095ef0
mov eax, ebx
mov rsi, rsi
mov rbx, qword [rsp + 0x78]
nop
sub rsp, 0x5eaf8980
add rsp, 0x5eaf89e0
pop rdi
mov r15, r15
ret
Function at 0x14007a5b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0xc], 0x3d426485
push rdi
sub rsp, 0x36be7df6
add rsp, 0x36be7bb6
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
xchg rbp, rbp
lea rcx, [rsp + 0x30]
mov r8d, 0x3c427535
xor r8d, 0x75e8402d
xor r8d, 0x26b2a9e3
xor r8d, 0x7cebb4d4
sub r8d, 0x13f32627
call fcn.140096540
mov rax, qword gs:[0x60]
xchg r8, r8
mov r8, qword [rax + 0x18]
xchg r9, rax
mov r9, qword [r8 + 0x10]
xchg r9, rax
xchg r8, rcx
mov rcx, qword [rax]
xchg rcx, r8
test r8, r8
je 0x14007a837
xchg rdi, rdi
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14007a837
mov edx, 0x3113c717
xor edx, 0x551fd7cc
sub edx, 0x575af040
sub edx, 0xcb11f97
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
xchg r8, r8
call fcn.140096f10
mov edx, 0x5c487c0
add edx, 0x208db98f
sub edx, 0x9acaa59
add edx, 0x14b3ada2
sub edx, 0x3159443c
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x18], 0x4d3a990e
call fcn.140096fd0
test rax, rax
je 0x14007a800
xor ecx, ecx
mov r14, r14
xchg rcx, rdx
mov rcx, rdi
xchg rdx, rcx
mov word [rax], cx
movabs rcx, 0x3ca77da51641e941
add rcx, 0x46de0b
add rcx, 0x29426183
xor rcx, 0x5a152278
add rcx, 0x3bb9b58f
mov r8, qword [0x1404a07f0]
movabs rax, 0x640ef32a68979f89
sub rax, 0x5bd58ee5
add rax, 0x4048ae09
xor rax, 0x167982d4
add r8, rcx
mov r12, r12
lea rcx, [rsp + 0x20]
not r8
sub r8, rax
mov rsp, rsp
ror r8, 0x1e
ror r8, 6
ror r8, 1
ror r8, 2
ror r8, 1
ror r8, 1
ror r8, 1
call r8
mov r15, r15
movabs rax, 0x3e8edc122320732c
add rax, 0xa74a657
sub rax, 0x2bd0d857
add rax, 0x7fffffff
xor rax, 0x3e6eecb0
lea r8, [rsp + 0x20]
mov dword [rsp - 0x28], 0x35e05ad9
movabs rcx, 0xed7b034065313edb
xor rcx, 0x26e57c25
xor rcx, 0x66b6555b
xor rcx, 0x8126bf8
xor rcx, 0x3c044df9
lea rdx, [rsp + 0x260]
add rcx, qword [0x1404a07e0]
xchg r12, r12
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
xor rcx, rax
mov dword [rsp - 0x14], 0x6f1189ec
movabs rax, 0x4d0d7c8d261afa9d
add rax, 0x2fc38239
sub rax, 0x107da155
sub rax, 0x6b22039
rol rcx, 8
xchg r13, r13
add rax, rcx
lea rcx, [rsp + 0x30]
call rax
mov dword [rsp - 0x28], ebx
xchg r10, rbx
mov r10, qword [rsp + 0x250]
xchg rbx, r10
sub rsp, 0xfffffffffffffdc0
xchg rsi, rsi
pop rdi
ret
mov eax, 0x78e44e09
xor eax, 0x7e3dcfa3
add eax, 0x277c9653
sub eax, 0x1bbc3af0
add eax, 0xad6622f4
mov rbx, qword [rsp + 0x250]
mov rsp, rsp
add rsp, 0x5c74f41a
sub rsp, 0x5c74f1da
pop rdi
xchg rbp, rbp
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x62aeb1bd
xor eax, 0x669e8f35
add eax, 0x38136d82
xor eax, 0x947af13
xor eax, 0xf504022c
add rsp, 0x3efdaa88
sub rsp, 0x3efda848
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400819d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a10c4], 0
mov dword [rsp - 0x38], ebx
jne 0x140081ada
xor edx, edx
lea r8, [0x1404a10c0]
nop word [rax + rax]
mov dword [rsp - 0x18], 0x62c926bf
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov dword [rsp - 0x20], 0x1914e675
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0x1c], ebx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x10], 0x83eb209
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x34], edi
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rcx, rcx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov r9, r9
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x14], ecx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r8, r8
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x14], ebp
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], ecx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov r12, r12
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x24], edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov rdx, rdx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xchg rsp, rsp
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov dword [rsp - 0x3c], 0x20f2f107
jb 0x1400819fc
ret
Function at 0x140086733
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r12
mov qword [rsp + 8], r12
xchg r12, rcx
push rbp
mov dword [rsp - 0x34], ebp
push rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov dword [rsp - 0x38], edi
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x28
xchg r8, r8
xchg r12, rdx
mov r14, r12
xchg r12, rdx
mov r13d, r8d
xchg rsp, rsp
mov edx, 0x2b7d496
add edx, 0x4c3524e9
xor edx, 0x465a0bda
xor edx, 0x8b2f2a5
cmp r8d, edx
jae 0x140086744
mov edx, r13d
mov dword [rsp - 0x10], 0x40a40b3d
nop
movabs rcx, 0xffffffff24e0a0de
sub rcx, 0x1dabe7b1
xor rcx, 0x7872b113
sub rcx, 0x24ee22a2
add rcx, 0x7fffffff
xor rcx, 0x25a81a64
mov eax, 0x2b2b9bf3
add eax, 0x34acff33
xor eax, 0x7c9f41cf
xor eax, 0xf18f777
sub eax, 0x2c5f2d9a
mul rdx
cmovo rax, rcx
mov dword [rsp - 0x40], ebx
xchg rcx, rsp
mov rsp, rax
xchg rsp, rcx
call fcn.140095da0
mov dword [rsp - 0x18], 0x77878f67
xchg r11, rax
mov r15, r11
xchg r11, rax
mov byte [rsp + 0x70], 0x59
sub byte [rsp + 0x70], 0x30
xor byte [rsp + 0x70], 0x6b
xor byte [rsp + 0x70], 0x66
sub byte [rsp + 0x70], 0x23
mov rax, qword [rsp + 0x60]
mov r12, r12
lea r12d, [r13 + 0xfffff]
xor esi, esi
shr r12d, 0xb
shr r12d, 1
shr r12d, 2
shr r12d, 2
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
mov r10, r10
test r12d, r12d
je 0x140086916
mov qword [rsp + 0x68], rbx
xchg r14, r14
mov ecx, 0x33cc96c3
sub ecx, 0x2bc86afd
add ecx, 0x15d4c08a
sub ecx, 0x1dc8ec50
mov qword [rsp + 0x20], rdi
mov edi, esi
mov dword [rsp - 0x38], 0x1e25fd1e
mov ebx, r13d
shl edi, 1
shl edi, 8
shl edi, 8
shl edi, 3
xchg r14, r15
mov rdx, r14
xchg r15, r14
sub ebx, edi
mov dword [rsp - 0x1c], edi
cmp ebx, ecx
cmova ebx, ecx
xchg r12, rcx
mov r12, rax
xchg r12, rcx
mov r8d, ebx
call fcn.140083350
mov dword [rsp - 0x10], esp
test al, al
je 0x1400868f0
shr ebx, 2
xchg r14, r14
xor eax, eax
shr edi, 1
shr edi, 1
test ebx, ebx
mov dword [rsp - 0x20], 0x1a6757d2
je 0x1400868bd
xchg r13, r9
mov r13, r15
xchg r9, r13
lea ecx, [rdi + rax]
mov r8d, ebp
xor r8d, dword [r9]
mov rdi, rdi
lea r9, [r9 + 4]
xor r8d, 0x7d1d1101
inc eax
mov dword [r14 + rcx*4], r8d
mov dword [rsp - 0xc], esp
cmp eax, ebx
jb 0x140086894
mov rax, qword [rsp + 0x60]
inc esi
mov dword [rsp - 0x10], edx
mov ecx, 0x3e93f1c0
xor ecx, 0x5cadbae3
sub ecx, 0x310479c2
xor ecx, 0x3129d161
cmp esi, r12d
xchg rbp, rbp
jb 0x140086826
jmp 0x140086909
mov byte [rsp + 0x70], 0x2a
sub byte [rsp + 0x70], 0x19
add byte [rsp + 0x70], 0xf
sub byte [rsp + 0x70], 0x10
sub byte [rsp + 0x70], 0x10
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20]
xchg r15, r15
mov rcx, r15
call fcn.140095db0
movzx eax, byte [rsp + 0x70]
mov dword [rsp - 0x30], ebx
nop
sub rsp, 0x54aec1da
add rsp, 0x54aec202
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
pop r13
pop r12
mov dword [rsp - 0x14], ecx
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x20], ecx
ret