joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400802b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rsi
xchg r15, r15
push rcx
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov dword [rsp - 0x10], 0x1449d99
nop
sub rsp, 0x2fb9c317
add rsp, 0x2fb9c2f7
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
mov r14d, r8d
mov dword [rsp - 0x18], esi
mov r9d, 0xc5a3c62
xor r9d, 0x43a13af3
sub r9d, 0x410e8036
xor r9d, 0x4afbcf00
sub r9d, 0x4413495b
xchg rdx, r12
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff1c7754c6
add rcx, 0x39ff1ed5
xor rcx, 0x5011103a
add rcx, 0x7fffffff
add rcx, 0x79989c5f
popf
pushf
mov eax, 0x19b53410
xor eax, 0x3568c51
add eax, 0x9dad274
xor eax, 0x740e7bb
sub eax, 0x23fe6d0a
popf
cmovb r9d, r14d
mul r9
mov dword [rsp - 0x1c], edx
cmovo rax, rcx
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.140098a70
mov r13d, dword [r15 + 0x18]
mov r11, r11
lea ebp, [r14 + 0xfffff]
shr ebp, 5
shr ebp, 5
shr ebp, 2
shr ebp, 7
shr ebp, 1
xor edi, edi
mov rcx, rcx
mov rsi, rax
mov ebx, 0x7fc2e570
sub ebx, 0x2c652d02
add ebx, 0x5e596f9
sub ebx, 0x57d695f7
xor ebx, 0x16cb971
test ebp, ebp
je 0x1400804cd
mov eax, 0x627b7543
add eax, 0x1029930e
xor eax, 0x7e0d6146
sub eax, 0xc986917
mov r9d, edi
mov r14, r14
mov r8d, r14d
shl r9d, 0xf
shl r9d, 1
shl r9d, 1
shl r9d, 2
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0xc], ecx
cmp r8d, eax
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov dword [rsp - 0x40], 0x78e2af93
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
mov rsi, rsi
je 0x140080488
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
lea ecx, [r9 + r10]
mov dword [rsp - 0x10], ecx
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x39a0640c
mov rcx, rcx
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0x44], 0x1ff5572b
jb 0x140080457
mov rdx, rsi
xchg rcx, r11
mov r11, r15
xchg rcx, r11
call fcn.140093210
mov dword [rsp - 0x30], edi
test al, al
je 0x1400804cb
add edi, ebx
mov eax, 0x59558f3b
add eax, 0x1e334153
xor eax, 0x3c1dc361
sub eax, 0x4b8513ef
cmp edi, ebp
xchg rdi, rdi
jb 0x140080400
jmp 0x1400804cd
xor bl, bl
xchg rsi, r10
mov rcx, r10
xchg rsi, r10
call fcn.140098a80
mov rbp, qword [rsp + 0x58]
mov al, bl
xchg r14, r14
mov rbx, qword [rsp + 0x50]
xchg rsi, r13
mov r13, qword [rsp + 0x60]
xchg r13, rsi
add rsp, 0x20
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
mov r11, r11
ret
Function at 0x140082f90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x20], ebx
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg r9, rdi
push r14
xchg r9, r9
nop
sub rsp, 0x5ab34a02
add rsp, 0x5ab349e2
movsxd rbx, dword [rcx + 0x3c]
xchg rbx, rdx
mov rdi, rbx
xchg rbx, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x3c], 0x4a0c12b5
call fcn.140084d80
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov dword [rsp - 0x18], esi
xchg rbx, r10
mov rbx, rax
xchg r10, rbx
mov ebx, r14d
test ebp, ebp
je 0x14008314e
mov r14, r14
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x18], ebp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
xchg rbp, rbp
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov r10, r10
cmp r14w, cx
jae 0x140083096
mov eax, dword [rdx + 8]
mov r15, r15
test eax, eax
jne 0x140083057
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x14], ecx
cmp r11d, r9d
jb 0x14008307c
add eax, r9d
mov dword [rsp - 0x38], 0x3d612362
cmp r11d, eax
jb 0x140083110
inc r8w
sub rdx, 0xffffffffffffffd8
mov dword [rsp - 0x44], 0x7735395e
cmp r8w, cx
jb 0x140083046
xchg r8, rcx
mov rcx, r14
xchg r8, rcx
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg r12, r12
nop
sub rax, 0x27068959
add rax, 0x27068951
nop
add r10, 0x28d01544
sub r10, 0x28d0153c
shr rax, 1
mov r9, r9
test eax, eax
je 0x140083143
mov edx, eax
mov rbx, rbx
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 7
shr ecx, 4
shr ecx, 1
cmp ecx, 3
je 0x140083125
cmp ecx, 0xa
xchg r9, r9
jne 0x140083132
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140083132
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov r11, r11
add r8, r11
jmp 0x14008309f
and eax, 0xfff
mov dword [rsp - 0x18], edx
add dword [rax + r8], edi
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x1400830df
mov rdx, rdx
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083013
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x2c], esp
mov rsi, qword [rsp + 0x40]
xchg rdx, rdi
mov rdx, qword [rsp + 0x48]
xchg rdi, rdx
add rsp, 0x20
xchg rdx, rdx
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140084e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x44], 0x433e3d0c
nop
sub rsp, 8
mov qword [rsp], r12
push r13
xchg rsp, rsp
push r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x710cb86c
sub rsp, 0x710cb88c
movzx eax, word [rcx]
mov r15d, edx
mov r15, r15
xor eax, 0x39a0640c
mov rsi, rcx
cmp eax, 0x39a03e41
mov dword [rsp - 0x14], 0x2cc672ba
jne 0x140085005
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x39a0640c
mov r12, r12
cmp eax, 0x39a0215c
jne 0x140085005
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084d80
xchg rsi, rsi
xchg rsi, rbp
mov rcx, rbp
xchg rsi, rbp
mov r14, rax
mov edx, dword [rax + 0x20]
call fcn.140084d80
mov dword [rsp - 0x30], 0xf7a3766
mov edx, dword [r14 + 0x24]
xchg r15, rsi
mov rcx, r15
xchg rsi, r15
xchg rsi, rax
mov r12, rsi
xchg rsi, rax
call fcn.140084d80
mov edx, dword [r14 + 0x1c]
xchg r15, rcx
mov r15, rsi
xchg rcx, r15
mov r13, rax
mov r15, r15
call fcn.140084d80
xor edi, edi
xchg r13, rax
mov qword [rsp + 0x70], r13
xchg r13, rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x20], 0x49056659
jbe 0x140085005
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x24], 0x68626511
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140084d80
xchg r13, r13
mov ecx, 0x24c8cf27
xor ecx, 0x2889ef28
add ecx, 0x56ed93fc
sub ecx, 0x65309ce
add ecx, 0xa32455c2
xchg r13, rax
mov rbx, r13
xchg r13, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
xchg rdi, rdi
je 0x140084fea
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x60]
xchg rsp, rsp
mov r8d, 0xc300188
add r8d, 0x36c6c5c8
add r8d, 0x299ceb30
sub r8d, 0x6c93b27f
inc rbx
call fcn.14008e090
mov r15, r15
cmp byte [rbx], 0
jne 0x140084fa8
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x14], ecx
not ecx
cmp ecx, r15d
je 0x140085051
inc edi
mov dword [rsp - 0x20], ecx
cmp edi, dword [r14 + 0x18]
jb 0x140084f54
xor eax, eax
mov dword [rsp - 0x40], 0x6809288a
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x448f7c3d
sub rsp, 0x448f7c1d
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov r9, r9
ret
movzx edx, word [r13 + rdi*2]
xchg r12, rcx
mov r12, rsi
xchg r12, rcx
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
mov edx, dword [rax + rdx*4]
mov r13, r13
call fcn.140084d80
jmp 0x14008500f
Function at 0x1400893e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg r8, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
xchg rbx, rsi
mov rsi, qword [rcx]
xchg rsi, rbx
lea rax, [rsp + 0x28]
xchg rcx, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
xchg rsi, rdi
mov rdi, qword [rcx + 0x38]
xchg rdi, rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rdx, rdx
xchg r11, rsp
movups xmmword [r11 + 0x28], xmm0
xchg r11, rsp
lea rdx, [rsi + 1]
mov r13, r13
xchg r9, rsp
movups xmmword [r9 + 0x38], xmm0
xchg rsp, r9
xchg rsp, r10
movups xmmword [r10 + 0x48], xmm0
xchg r10, rsp
call fcn.1400177dc
mov rdi, rdi
mov edx, 0x150ebf0d
add edx, 0x16edeb72
xor edx, 0x73c96dee
sub edx, 0x3e7067de
test rsi, rsi
mov dword [rsp - 0xc], 0x1150a9b1
je 0x1400894ea
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rsi, r10
mov r8, r10
xchg rsi, r10
mov r9d, 0x45f15447
sub r9d, 0x3ddb4868
add r9d, 0x30b52154
sub r9d, 0x2c0e52a
sub r9d, 0x360a470a
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x18], 0xbb28d74
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov r10, r10
sub r8, 1
jne 0x1400894bc
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rbx, rbx
mov rcx, qword [rsp + 0x20]
call fcn.1400895a0
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg r11, rcx
mov ebx, eax
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov r12, r12
cmp rcx, rax
jne 0x14008956a
xor eax, eax
xchg rdx, rdx
lea rdi, [rsp + 0x28]
mov ecx, 0x5480139d
xor ecx, 0x7590390b
sub ecx, 0x1b3052f1
add ecx, 0x1293c1f9
sub ecx, 0x1873996e
rep stosb byte [rdi], al
mov dword [rsp - 0x20], 0x7f4901fc
mov eax, ebx
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
mov dword [rsp - 0x44], ebp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098be0
mov eax, ebx
mov dword [rsp - 0xc], 0x4dcdb8ff
xchg r11, rbx
mov r11, qword [rsp + 0x78]
xchg r11, rbx
nop
sub rsp, 0x1bb7d7c
add rsp, 0x1bb7ddc
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008aa13
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg rsp, r11
mov qword [r11 + 0x20], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x2968a205
add rsp, 0x2968a1a5
xchg r10, rbx
mov r10, qword [rcx]
xchg rbx, r10
lea rax, [r11 - 0x40]
mov rbp, rbp
xchg rbp, rbx
mov qword [r11 + 8], rbx
xchg rbx, rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov dword [rsp - 0x20], esp
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
xchg rbp, rbp
mov qword [r11 + 0x18], r14
mov r14, rdx
xchg r15, rsp
movups xmmword [r15 + 0x28], xmm0
xchg rsp, r15
lea rdx, [rsi + 1]
xchg r8, r8
xchg rsp, r11
movups xmmword [r11 + 0x38], xmm0
xchg r11, rsp
xchg r15, rsp
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.1400177dc
mov edx, 0x591df6bf
add edx, 0x238a1389
sub edx, 0x782adb96
add edx, 0x15483101
test rsi, rsi
je 0x14008ab1c
xchg r9, r9
mov rdi, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x18], 0x480a3268
mov r9d, 0x5343813
xor r9d, 0x42a2f000
sub r9d, 0x428030a4
add r9d, 0x2aad865f
xor r9d, 0x2fc41d31
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x24], edi
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 8
mov r15, r15
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov r12, r12
jne 0x14008aaf1
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rsi, rsi
xchg rdx, r14
mov r14, rdx
xchg rdx, r14
xchg r10, rcx
mov r10, qword [rsp + 0x20]
xchg r10, rcx
call fcn.14008ac00
mov rcx, qword [rsp + 0x20]
mov r8, r8
mov ebx, eax
xchg r14, r15
mov r15, qword [rsp + 0x80]
xchg r15, r14
lea rax, [rsp + 0x28]
xchg r12, rsi
mov r12, qword [rsp + 0x78]
xchg rsi, r12
xchg r13, rbp
mov r13, qword [rsp + 0x70]
xchg rbp, r13
cmp rcx, rax
jne 0x14008abcb
mov r8, r8
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x6a567b6a
sub ecx, 0x1235c778
sub ecx, 0x4b3cf7b3
sub ecx, 0xce3bc0f
rep stosb byte [rdi], al
mov dword [rsp - 0x30], 0x3600b38b
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
sub rsp, 0x6ad6afe7
add rsp, 0x6ad6b047
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098be0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov dword [rsp - 0x30], 0x27fd8c70
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008ac00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
xchg rdx, rdx
push rdi
sub rsp, 0x240
xchg r8, rdx
mov rbx, r8
xchg rdx, r8
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
xor edx, edx
xchg rbp, rbp
lea rcx, [rsp + 0x30]
mov r8d, 0x1f3d06de
xor r8d, 0x3abff902
add r8d, 0x1d70555d
sub r8d, 0x42f35331
call fcn.1400991f0
mov dword [rsp - 0x24], 0x62294691
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg r11, r11
xchg r8, r9
mov r9, qword [rax]
xchg r9, r8
test r8, r8
je 0x14008ae91
mov r8, qword [r8 + 0x50]
mov dword [rsp - 0x3c], edi
test r8, r8
je 0x14008ae91
mov edx, 0x6dbc9d36
xor edx, 0x1de5a6e4
xor edx, 0x30ee2578
xor edx, 0x40b71fae
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov dword [rsp - 0x20], esi
call fcn.140099d30
mov edx, 0x62b34b0f
xor edx, 0x15aa204a
sub edx, 0x4a1d6d53
add edx, 0x49e4828f
sub edx, 0x76e08025
lea rcx, [rsp + 0x30]
call fcn.140099e40
mov rbp, rbp
test rax, rax
je 0x14008ae55
xor ecx, ecx
mov r12, r12
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
movabs rcx, 0x2e3e9f3a13fb52e8
add rcx, 0x4110dee6
add rcx, 0x143e3203
add rcx, 0x7fffffff
xor rcx, 0x583cb3a4
mov rax, qword [0x140142690]
xchg rbp, rbp
not rax
sub rax, rcx
movabs rcx, 0x46548ccd1cb4b739
sub rcx, 0x3a42b5d
sub rcx, 0x1cb3296
add rcx, 0x7fffffff
add rcx, 0x43250f0
ror rax, 1
not rax
xchg r12, r12
ror rax, 0x22
ror rax, 2
ror rax, 3
ror rax, 1
sub rax, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x34], ecx
rol rax, 4
rol rax, 1
rol rax, 2
rol rax, 1
rol rax, 1
rol rax, 1
call rax
mov r10, qword [0x140142680]
mov dword [rsp - 0x1c], 0x49f6f5a5
lea r8, [rsp + 0x20]
movabs rcx, 0x3efb526559c14a4e
sub rcx, 0x3e74404a
xor rcx, 0x4c21b0dc
add rcx, 0x7fffffff
xor rcx, 0x5eaf26d2
lea rdx, [rsp + 0x260]
add r10, rcx
movabs rax, 0x5ffbb7a24bd1d722
sub rax, 0x37e6650c
add rax, 0x4bafb525
xor rax, 0x79741559
add rax, 0x7ca944c2
xor r10, rax
xchg r14, r14
lea rcx, [rsp + 0x30]
movabs rax, 0x4f2e6ea6791c6dd
sub rax, 0x5b38e5c6
xor rax, 0x7bc0e2ab
add rax, 0xd6e58ee
mov r9, rbx
sub r10, rax
rol r10, 0xc
rol r10, 1
call r10
mov dword [rsp - 0x14], ecx
mov rbx, qword [rsp + 0x250]
sub rsp, 0x49a0d0ff
add rsp, 0x49a0d33f
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x31fcd041
add eax, 0xf2df65d
add eax, 0x1c3b0053
xor eax, 0x6c07650
add eax, 0x645a4f60
mov rbx, qword [rsp + 0x250]
mov r15, r15
sub rsp, 0x32ba7d65
add rsp, 0x32ba7fa5
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xchg r8, rbx
mov r8, qword [rsp + 0x250]
xchg r8, rbx
mov eax, 0x70ffed1b
xor eax, 0x14d99f25
xor eax, 0x6d999bf8
add eax, 0xb640176f
add rsp, 0x240
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008aed0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov r8d, edx
mov qword [rsp + 0x40], 0x5df036bc
sub qword [rsp + 0x40], 0x186f9899
sub qword [rsp + 0x40], 0x2750ab0
sub qword [rsp + 0x40], 0x430b9373
lea rdx, [rsp + 0x40]
call fcn.14008ac00
test eax, eax
mov dword [rsp - 0x3c], 0x1742f203
jns 0x14008b023
movabs rcx, 0x365c94a4091f73f1
xor rcx, 0x23119713
add rcx, 0x2d775da9
sub rcx, 0x11a920c
add rcx, 0x410cafbd
movabs r8, 0x417e11f136bb4dd2
sub r8, 0xaf119d4
add r8, 0x17f3bb0
xor r8, 0x37d85ace
add r8, 0x29fe870b
add r8, qword [0x1401426d0]
rol r8, 5
rol r8, 0xd
rol r8, 1
rol r8, 1
rol r8, 1
add r8, rcx
movabs rcx, 0xb461728323c45be
sub rcx, 0x160b8dc9
add rcx, 0x5ebd4716
add rcx, 0x3d443833
not r8
sub r8, rcx
mov ecx, eax
mov r9, r9
not r8
rol r8, 4
rol r8, 0x16
rol r8, 7
rol r8, 2
rol r8, 0xf
rol r8, 1
call r8
movabs rcx, 0x1360704509a7d645
add rcx, 0x31b95da4
xor rcx, 0x390068b8
add rcx, 0x10deaef2
movabs rdx, 0x279257fd7bb6d580
xor rdx, 0x49fe4f01
sub rdx, 0x157d3d3c
xor rdx, 0x6c350dfb
xor rdx, 0x4b5ab562
add rdx, qword [0x140142478]
mov r11, r11
not rdx
ror rdx, 1
add rdx, rcx
mov dword [rsp - 0x1c], esp
mov ecx, eax
call rdx
mov rax, qword [rsp + 0x40]
add rsp, 0x28
mov dword [rsp - 0x2c], ebp
ret
Function at 0x14008e400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140143084], 0
jne 0x14008e512
xchg rsp, rsp
xor edx, edx
lea r8, [0x140143080]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x1c], edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov dword [rsp - 0x2c], ebx
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x18], 0x6917e891
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov rbp, rbp
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x10], esp
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x44], ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x44], 0x415b23e
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x24], edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x20], 0x3b789403
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x44], 0x6aaa8d5f
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], 0x7e2e7d84
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg rcx, rcx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0xc], 0x4532eb32
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg r15, r15
shr ecx, 1
and eax, 1
neg eax
xchg rsi, rsi
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov rsp, rsp
jb 0x14008e423
ret
Function at 0x1400939a8
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rbp, rcx
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x3cc93841
add rsp, 0x3cc93821
movzx eax, byte [rdx + 1]
xchg r8, rcx
mov r15, rcx
xchg rcx, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x1c], ebx
mov r8d, dword [rcx + 4]
shl ebx, 4
shl ebx, 3
shl ebx, 1
dec r8d
or ebx, eax
shl edi, 3
shl edi, 5
movzx eax, byte [rdx + 2]
shl ebx, 7
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x34], 0x74e478af
movzx eax, byte [rdx + 3]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x30], edx
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 4
shl edi, 2
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x2c], 0x5a106130
movzx eax, byte [rdx + 7]
shl edi, 3
shl edi, 5
or edi, eax
mov dword [rsp - 0x44], edi
test r8d, r8d
jle 0x140093b03
xchg rdx, r12
mov r12, qword [rcx + 8]
xchg r12, rdx
lea r14d, [r8 - 1]
mov dword [rsp - 0x1c], esi
movsxd rax, r8d
shr r14d, 1
inc r14d
mov dword [rsp - 0x3c], 0x5009ba46
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov dword [rsp - 0xc], 0x306efe16
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg r11, rsi
mov rdx, r11
xchg r11, rsi
mov ecx, edi
call fcn.140094210
mov dword [rsp - 0x38], 0x136af28d
xor ebx, eax
xchg rbp, rbx
mov rdx, rbx
xchg rbx, rbp
mov ecx, ebx
call fcn.140094210
xor edi, eax
mov rdi, rdi
nop
add rsi, 0x4f1791ae
sub rsi, 0x4f1791c6
add rbp, 0xffffffffffffffe8
mov r9, r9
sub r14, 1
jne 0x140093ab4
lea rax, [r15 + 7]
mov ecx, 0x3e63c053
add ecx, 0xc42849c
sub ecx, 0x1a85b21b
sub ecx, 0x5808902
sub ecx, 0x2aa009ce
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x18], edx
shr ebx, 3
shr ebx, 4
shr ebx, 1
shr edi, 1
shr edi, 2
shr edi, 3
shr edi, 2
sub rcx, 1
jne 0x140093b24
mov dword [rsp - 0x10], 0x3a70fe89
xchg rbx, rbp
mov rbp, qword [rsp + 0x40]
xchg rbx, rbp
xchg r10, rbp
mov r10, qword [rsp + 0x48]
xchg rbp, r10
xchg rbx, rsi
mov rbx, qword [rsp + 0x50]
xchg rsi, rbx
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140093b9c
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, rsp
xchg rsi, rax
xchg rbx, rbp
mov qword [rax + 8], rbp
xchg rbp, rbx
xchg r12, rbp
mov qword [rax + 0x10], r12
xchg rbp, r12
xchg rsi, r12
mov qword [rax + 0x18], r12
xchg rsi, r12
xchg rdi, r14
mov qword [rax + 0x20], r14
xchg r14, rdi
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
xchg r14, r8
mov r8, r14
xchg r14, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 2
shl ebx, 4
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 1
shl ebx, 2
or ebx, eax
mov rdi, rdi
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
mov r12, r12
shl edi, 6
shl edi, 2
or edi, eax
movzx eax, byte [rdx + 7]
xchg r10, r10
shl edi, 8
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x10], 0x593af265
test eax, eax
jle 0x140093cb3
mov rsi, qword [rcx + 8]
xchg r11, r11
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
mov dword [rsp - 0x2c], esp
xchg rsi, r11
mov rdx, r11
xchg r11, rsi
mov ecx, edi
mov dword [rsp - 0x40], esp
call fcn.140094210
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov dword [rsp - 0x2c], 0x3734324b
call fcn.140094210
xor edi, eax
nop
sub rsi, 0x1b6becc2
add rsi, 0x1b6becda
sub rbp, 1
mov dword [rsp - 0x10], edx
jne 0x140093c6b
lea rax, [r14 + 7]
mov ecx, 0x419abfb7
xor ecx, 0x27312801
sub ecx, 0x13359226
add ecx, 0x4d6d305
sub ecx, 0x584cd891
mov byte [rax - 4], dil
mov dword [rsp - 0x20], 0x8c05a6e
mov byte [rax], bl
dec rax
shr ebx, 2
shr ebx, 3
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 8
mov dword [rsp - 0x1c], 0x21055dac
sub rcx, 1
jne 0x140093cd4
mov rbx, qword [rsp + 0x30]
xchg rbx, rbp
mov rbx, qword [rsp + 0x38]
xchg rbp, rbx
xchg r9, rsi
mov r9, qword [rsp + 0x40]
xchg rsi, r9
xchg r11, rdi
mov r11, qword [rsp + 0x48]
xchg r11, rdi
sub rsp, 0xffffffffffffffe0
pop r14
mov r12, r12
ret