joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e750
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx r14d, byte [r8 + 3]
xor r14, rcx
imul r14, rax
mov rcx, qword [rdi + 0x30]
and rcx, r14
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov r13, qword [rdx + rax + 8]
cmp r13, qword [rdi + 8]
je 0x14000e806
mov eax, dword [rbx]
cmp eax, dword [r13 + 0x10]
je 0x14000e7ff
add rcx, rcx
mov r15, qword [rdx + rcx*8]
nop word cs:[rax + rax]
cmp r13, r15
je 0x14000e809
mov r13, qword [r13 + 8]
cmp eax, dword [r13 + 0x10]
jne 0x14000e7f0
xor eax, eax
jmp 0x14000e9a2
mov r15, r13
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x14000e9bc
mov ecx, 0x18
call fcn.14010eb54
mov r13, rax
mov r12d, dword [rbx]
mov dword [rax + 0x10], r12d
mov dword [rax + 0x14], 0
mov rax, qword [rdi + 0x10]
inc rax
js 0x14000e848
cvtsi2ss xmm0, rax
jmp 0x14000e85d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [rdi]
mov rbx, qword [rdi + 0x38]
test rbx, rbx
js 0x14000e871
cvtsi2ss xmm2, rbx
jmp 0x14000e888
mov rax, rbx
shr rax, 1
mov ecx, ebx
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x14000e94d
divss xmm0, xmm1
call fcn.14018d588
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1401ae154]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdx, 9
mov eax, 8
cmovae rax, rdx
cmp rbx, rax
mov qword [rbp - 8], r13
jae 0x14000e8f3
lea rcx, [rbx*8]
cmp rcx, rax
cmovb rcx, rax
cmp rbx, 0x200
cmovae rcx, rax
mov rbx, rcx
mov rcx, rdi
mov rdx, rbx
call fcn.14000d9e0
mov rax, qword [rdi + 0x30]
and rax, r14
mov rcx, qword [rdi + 0x18]
mov rdx, rax
shl rdx, 4
mov r15, qword [rcx + rdx + 8]
cmp r15, qword [rdi + 8]
je 0x14000e944
cmp r12d, dword [r15 + 0x10]
mov r13, qword [rbp - 8]
je 0x14000e93f
add rax, rax
mov rax, qword [rcx + rax*8]
nop dword [rax]
cmp r15, rax
je 0x14000e94a
mov r15, qword [r15 + 8]
cmp r12d, dword [r15 + 0x10]
jne 0x14000e930
mov r15, qword [r15]
jmp 0x14000e94d
mov r13, qword [rbp - 8]
jmp 0x14000e94d
mov r15, rax
mov rcx, qword [r15 + 8]
inc qword [rdi + 0x10]
mov qword [r13], r15
mov qword [r13 + 8], rcx
mov qword [rcx], r13
mov qword [r15 + 8], r13
mov rax, qword [rdi + 0x18]
and r14, qword [rdi + 0x30]
shl r14, 4
lea rdx, [rax + r14]
lea r8, [rax + r14]
add r8, 8
mov rax, qword [rax + r14]
cmp rax, qword [rdi + 8]
je 0x14000e997
cmp rax, r15
je 0x14000e99d
mov al, 1
mov rdx, r8
cmp qword [r8], rcx
jne 0x14000e9a2
jmp 0x14000e99d
mov qword [rdx], r13
mov rdx, r8
mov qword [rdx], r13
mov al, 1
mov qword [rsi], r13
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14010fac4
int3
Function at 0x1400104a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140010536
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14001053d
mov r15, rsi
jmp 0x1400104fb
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.14017c490
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14001052e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140010513
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x1400104d0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001052e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x1400104fb
sub rsi, r15
jmp 0x14001062a
xor esi, esi
jmp 0x14001062a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140010590
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140010590
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.14017c490
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400105a1
jmp 0x140010627
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140010627
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400105d0
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x140010603
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14018e754
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x1400105d0
jmp 0x140010627
test r14, r14
je 0x140010624
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14018e754
sub r14, rax
jmp 0x140010627
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400150f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x14001516a
mov rdi, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14001516a
movsxd rax, dword [rdi + 0x3c]
cmp rax, 0x400
jg 0x14001516a
cmp dword [rdi + rax], 0x4550
jne 0x14001516a
mov ecx, dword [rdi + rax + 0x90]
test rcx, rcx
je 0x14001516a
mov edx, dword [rdi + rax + 0x94]
mov al, 1
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x14001516c
add rcx, rdi
xor edx, edx
movabs rbp, 0x8000000080000000
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rcx
jmp 0x140015199
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x30]
add rdx, 0x14
cmp rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jae 0x14001522f
mov esi, dword [rcx + rdx]
mov r13d, dword [rcx + rdx + 0x10]
mov eax, r13d
or eax, esi
je 0x14001522f
mov qword [rsp + 0x30], rdx
mov ebx, dword [rdx + rcx + 0xc]
add rbx, rdi
test rsi, rsi
cmove rsi, r13
add r13, rdi
add rsi, rdi
jmp 0x1400151d8
add r13, 8
add rsi, 8
mov rax, qword [rsi]
test rax, rbp
je 0x140015200
movzx r14d, ax
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
test rax, rax
jne 0x14001520d
jmp 0x140015180
mov rax, qword [r13]
test rax, rax
je 0x140015180
cmp rax, qword [rsi]
jne 0x1400151d0
lea r14, [rax + rdi]
add r14, 2
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
jmp 0x1400151d0
mov al, 1
jmp 0x14001516c
Function at 0x14001bec0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdx, qword [0x1404493b0]
mov rdi, qword [rdx + 0x1ed0]
mov rsi, qword [rdi + 0xe0]
movsxd rax, dword [rdi + 0xd8]
mov r8d, dword [rsi + rax*4 - 4]
not r8d
mov r9d, r8d
shr r9d, 8
xor r8d, ecx
movzx r10d, r8b
lea r8, [0x1401b0020]
xor r9d, dword [r8 + r10*4]
mov r10d, ecx
shr r10d, 8
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10d, ecx
shr r10d, 0x10
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
movzx r10d, r9b
shr r9d, 8
mov r11d, ecx
shr r11d, 0x18
xor r11d, r10d
xor r9d, dword [r8 + r11*4]
mov r10, rcx
shr r10, 0x20
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10, rcx
shr r10, 0x28
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10, rcx
shr r10, 0x30
xor r10d, r9d
mov ebx, r9d
shr ebx, 8
movzx r9d, r10b
xor ebx, dword [r8 + r9*4]
movzx r9d, bl
shr rcx, 0x38
xor ecx, r9d
mov ebp, dword [r8 + rcx*4]
cmp eax, dword [rdi + 0xdc]
jne 0x14001c049
lea r14d, [rax + 1]
test eax, eax
je 0x14001bfbd
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14001bfc2
mov ecx, 8
cmp ecx, r14d
cmovg r14d, ecx
cmp eax, r14d
jge 0x14001c049
movsxd rcx, r14d
shl rcx, 2
inc dword [rdx + 0x3c8]
mov rdx, qword [0x1404493c0]
call qword [0x1401f7810]
mov rsi, rax
mov rdx, qword [rdi + 0xe0]
test rdx, rdx
je 0x14001c035
movsxd r8, dword [rdi + 0xd8]
shl r8, 2
mov rcx, rsi
call fcn.14017c490
mov rcx, qword [rdi + 0xe0]
test rcx, rcx
je 0x14001c028
mov rax, qword [0x1404493b0]
test rax, rax
je 0x14001c028
dec dword [rax + 0x3c8]
mov rdx, qword [0x1404493c0]
call qword [0x1401f7818]
mov qword [rdi + 0xe0], rsi
mov dword [rdi + 0xdc], r14d
mov eax, dword [rdi + 0xd8]
shr ebx, 8
xor ebp, ebx
not ebp
cdqe
mov dword [rsi + rax*4], ebp
inc dword [rdi + 0xd8]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14001df80
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov edi, r8d
mov rbx, rcx
mov rax, qword [0x1401f7798]
xor rax, rsp
mov qword [rsp + 0x50], rax
not edi
test rdx, rdx
je 0x14001e0dd
mov r12, rdx
movabs r13, 0xfe8f2fd923d29824
lea r14, [rsp + 0x30]
lea rsi, [0x1401b0020]
mov dword [rsp + 0x2c], edi
jmp 0x14001dfeb
movzx ecx, dil
shr edi, 8
xor ecx, eax
xor edi, dword [rsi + rcx*4]
mov r12, rbp
mov rbx, r15
test rbp, rbp
je 0x14001e1e7
lea rbp, [r12 - 1]
lea r15, [rbx + 1]
movzx eax, byte [rbx]
cmp eax, 7
jne 0x14001e0a0
movabs rax, 0x3bacf0d571949eeb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], r13
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
movabs rax, 0x3bf8bc8030d2dbaf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
mov r8d, 7
mov rcx, r15
mov rdx, r14
call fcn.140193e60
test eax, eax
je 0x14001e0ca
cmp rbp, 8
jb 0x14001dfdc
add rbx, 9
add r12, 0xfffffffffffffff7
jmp 0x14001e0d2
cmp al, 0x23
jne 0x14001dfd0
cmp rbp, 2
jb 0x14001dfd0
cmp byte [r15], 0x23
jne 0x14001dfd0
cmp byte [rbx + 2], 0x23
cmove edi, dword [rsp + 0x2c]
jmp 0x14001dfd0
add rbx, 8
add r12, 0xfffffffffffffff8
mov r15, rbx
mov rbp, r12
jmp 0x14001dfdc
movzx eax, byte [rbx]
test al, al
je 0x14001e1e7
movabs rsi, 0xfe8f2fd923d29824
xor r13d, r13d
lea rbp, [rsp + 0x40]
lea r14, [rsp + 0x30]
mov r12d, 8
mov dword [rsp + 0x2c], edi
jmp 0x14001e1a7
movabs rax, 0x3bacf0d571949eeb
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
movabs rax, 0x3bf8bc8030d2dbaf
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
mov r8d, 7
mov rcx, r15
mov rdx, r14
call fcn.140193e60
add rbx, 8
test eax, eax
cmovne r13d, r12d
cmove r15, rbx
mov ecx, r13d
movzx eax, byte [r15]
mov rbx, r15
mov r13d, ecx
test al, al
je 0x14001e1e7
lea r15, [rbx + 1]
cmp al, 7
je 0x14001e110
lea ecx, [r13 - 1]
test r13d, r13d
jg 0x14001e199
cmp al, 0x23
jne 0x14001e1cf
cmp byte [r15], 0x23
jne 0x14001e1cf
cmp byte [rbx + 2], 0x23
cmove edi, dword [rsp + 0x2c]
movzx eax, al
movzx edx, dil
shr edi, 8
xor edx, eax
lea rax, [0x1401b0020]
xor edi, dword [rax + rdx*4]
jmp 0x14001e199
not edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010ed10
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140023f50
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rdx
mov rdx, r8
sub rdx, rax
test r8, r8
cmove rdx, r8
mov r8, qword [rcx + 0xe0]
movsxd rcx, dword [rcx + 0xd8]
mov r8d, dword [r8 + rcx*4 - 4]
mov rcx, rax
jmp fcn.14001df80

Function at 0x140023fa0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdx, qword [0x1404493b0]
mov rdi, qword [rdx + 0x1ed0]
mov r9d, ecx
shr r9d, 8
mov r8d, ecx
shr r8d, 0x10
mov rsi, qword [rdi + 0xe0]
movsxd rax, dword [rdi + 0xd8]
mov r10d, dword [rsi + rax*4 - 4]
not r10d
mov r11d, r10d
shr r11d, 8
xor r10d, ecx
movzx r10d, r10b
lea r14, [0x1401b0020]
xor r11d, dword [r14 + r10*4]
mov r10d, r11d
shr r10d, 8
xor r11d, r9d
movzx r9d, r11b
xor r10d, dword [r14 + r9*4]
shr ecx, 0x18
mov ebx, r10d
shr ebx, 8
xor r10d, r8d
movzx r8d, r10b
xor ebx, dword [r14 + r8*4]
movzx r8d, bl
xor r8d, ecx
mov ebp, dword [r14 + r8*4]
cmp eax, dword [rdi + 0xdc]
jne 0x1400240d3
lea r14d, [rax + 1]
test eax, eax
je 0x140024047
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14002404c
mov ecx, 8
cmp ecx, r14d
cmovg r14d, ecx
cmp eax, r14d
jge 0x1400240d3
movsxd rcx, r14d
shl rcx, 2
inc dword [rdx + 0x3c8]
mov rdx, qword [0x1404493c0]
call qword [0x1401f7810]
mov rsi, rax
mov rdx, qword [rdi + 0xe0]
test rdx, rdx
je 0x1400240bf
movsxd r8, dword [rdi + 0xd8]
shl r8, 2
mov rcx, rsi
call fcn.14017c490
mov rcx, qword [rdi + 0xe0]
test rcx, rcx
je 0x1400240b2
mov rax, qword [0x1404493b0]
test rax, rax
je 0x1400240b2
dec dword [rax + 0x3c8]
mov rdx, qword [0x1404493c0]
call qword [0x1401f7818]
mov qword [rdi + 0xe0], rsi
mov dword [rdi + 0xdc], r14d
mov eax, dword [rdi + 0xd8]
shr ebx, 8
xor ebp, ebx
not ebp
cdqe
mov dword [rsi + rax*4], ebp
inc dword [rdi + 0xd8]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400532f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x1401f7798]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movzx eax, byte [rdx + 6]
mov qword [rsp + 0x78], rax
movzx eax, byte [rdx + 7]
mov qword [rsp + 0x70], rax
movzx eax, byte [rdx + 8]
mov qword [rsp + 0x68], rax
movzx eax, byte [rdx + 9]
mov qword [rsp + 0x60], rax
movzx eax, byte [rdx + 0xa]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdx + 0xb]
mov qword [rsp + 0x50], rax
movzx eax, byte [rdx + 0xc]
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
mov qword [rsp + 0x40], rax
movzx eax, byte [rdx + 1]
mov qword [rsp + 0x38], rax
movzx eax, byte [rdx + 2]
mov qword [rsp + 0x30], rax
movzx r15d, byte [rdx + 3]
movzx r12d, byte [rdx + 4]
movzx r13d, byte [rdx + 5]
movzx ebp, byte [rdx + 0xd]
movzx eax, byte [rdx + 0xe]
mov qword [rsp + 0x28], rdx
movzx edx, byte [rdx + 0xf]
mov ecx, 3
lea r8, [0x1401b4420]
lea r9, [0x1401b3420]
nop dword [rax]
movzx ebx, byte [rcx + r8 - 3]
shl rbx, 8
add rbx, r9
movzx r10d, byte [rsp + rcx + 0x7d]
movzx r11d, byte [rsp + rcx + 0x7e]
mov rsi, qword [rsp + 0x40]
xor r10b, byte [rsi + rbx]
mov rsi, qword [rsp + 0x38]
xor r11b, byte [rsi + rbx]
movzx esi, byte [rsp + rcx + 0x7f]
mov rdi, qword [rsp + 0x30]
xor sil, byte [rdi + rbx]
movzx edi, byte [rsp + rcx + 0x80]
xor dil, byte [r15 + rbx]
movzx ebx, byte [rcx + r8 - 2]
shl rbx, 8
add rbx, r9
xor r10b, byte [r12 + rbx]
xor r11b, byte [r13 + rbx]
mov r14, qword [rsp + 0x78]
xor sil, byte [r14 + rbx]
mov r14, qword [rsp + 0x70]
xor dil, byte [r14 + rbx]
movzx ebx, byte [rcx + r8 - 1]
shl rbx, 8
add rbx, r9
mov r14, qword [rsp + 0x68]
xor r10b, byte [r14 + rbx]
mov r14, qword [rsp + 0x60]
xor r11b, byte [r14 + rbx]
mov r14, qword [rsp + 0x58]
xor sil, byte [r14 + rbx]
mov r14, qword [rsp + 0x50]
xor dil, byte [r14 + rbx]
movzx ebx, byte [rcx + r8]
shl rbx, 8
add rbx, r9
mov r14, qword [rsp + 0x48]
xor r10b, byte [r14 + rbx]
xor r11b, byte [rbp + rbx]
xor sil, byte [rax + rbx]
xor dil, byte [rdx + rbx]
mov byte [rsp + rcx + 0x7d], r10b
mov byte [rsp + rcx + 0x7e], r11b
mov byte [rsp + rcx + 0x7f], sil
mov byte [rsp + rcx + 0x80], dil
add rcx, 4
cmp rcx, 0x13
jne 0x1400533b0
movaps xmm0, xmmword [rsp + 0x80]
mov rax, qword [rsp + 0x28]
movups xmmword [rax], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14010ed10
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140053890
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r12, r9
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov edx, r8d
call fcn.140053500
mov ecx, esi
call fcn.14010ebcc
mov r14, rax
mov ecx, dword [rbx + 4]
shl ecx, 4
add ecx, 0x10
call fcn.14010ebcc
mov r15, rax
mov rcx, rbx
mov rdx, r12
mov r8, rax
call fcn.1400535d0
test esi, esi
je 0x140053923
mov rax, qword [rsp + 0xa0]
xor ebp, ebp
mov r13d, ebp
lea r8, [r14 + r13]
lea r12, [rdi + r13]
movups xmm6, xmmword [rax]
mov rcx, rbx
mov rdx, r12
mov r9, r15
call fcn.140052a50
movups xmm0, xmmword [r14 + r13]
xorps xmm0, xmm6
movups xmmword [r14 + r13], xmm0
add ebp, 0x10
mov rax, r12
cmp ebp, esi
jb 0x1400538f0
mov rcx, r15
call fcn.14010eb98
mov rax, r14
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140056040
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [0x1401f7798]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor eax, eax
nop word [rax + rax]
mov edx, dword [rcx + rax*4]
bswap edx
mov dword [rsp + rax*4 + 0x50], edx
inc rax
cmp rax, 0x10
jne 0x140056070
mov eax, 0x10
movabs rdx, 0x100000000
xor r10d, r10d
movabs r8, 0xe00000000
movabs r9, 0x900000000
nop dword [rax + rax]
lea r11, [r10 + r8]
sar r11, 0x1e
mov r11d, dword [rsp + r11 + 0x50]
mov esi, r11d
rol esi, 0xf
mov edi, r11d
rol edi, 0xd
xor edi, esi
shr r11d, 0xa
xor r11d, edi
lea rsi, [r10 + r9]
sar rsi, 0x1e
add r11d, dword [rsp + rsi + 0x50]
lea rsi, [r10 + rdx]
mov rdi, rsi
sar rdi, 0x1e
mov edi, dword [rsp + rdi + 0x50]
mov ebx, edi
rol ebx, 0x19
mov ebp, edi
rol ebp, 0xe
sar r10, 0x1e
add r11d, dword [rsp + r10 + 0x50]
mov r10, rsi
xor ebp, ebx
shr edi, 3
xor edi, ebp
add r11d, edi
mov dword [rsp + rax*4 + 0x50], r11d
inc rax
cmp rax, 0x40
jne 0x1400560b0
mov ebp, dword [rcx + 0x50]
mov r15d, dword [rcx + 0x54]
mov r11d, dword [rcx + 0x58]
mov r12d, dword [rcx + 0x5c]
mov r13d, dword [rcx + 0x60]
mov r9d, dword [rcx + 0x64]
mov eax, dword [rcx + 0x68]
mov qword [rsp + 0x48], rcx
mov edx, dword [rcx + 0x6c]
xor r14d, r14d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], r15d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x34], r12d
nop word cs:[rax + rax]
mov ecx, r12d
mov r8d, r13d
mov esi, r13d
rol esi, 0x1a
mov r10d, r9d
mov r9d, r13d
rol r9d, 0x15
xor r9d, esi
mov ebx, r13d
rol ebx, 7
xor ebx, r9d
add ebx, edx
mov edx, eax
mov edi, ebp
mov esi, r15d
mov r12d, r11d
mov eax, r15d
or eax, r11d
and eax, ebp
mov r9d, r15d
and r9d, r11d
or r9d, eax
mov eax, ebp
rol eax, 0x1e
mov r11d, ebp
rol r11d, 0x13
rol ebp, 0xa
xor r11d, eax
xor ebp, r11d
mov r13d, r10d
xor r13d, edx
and r13d, r8d
xor r13d, edx
add r13d, dword [rsp + r14 + 0x50]
add ebp, r9d
lea rax, [0x1401b4470]
add r13d, dword [r14 + rax]
add r13d, ebx
add ebp, r13d
add r13d, ecx
add r14, 4
mov r11d, esi
mov r15d, edi
mov eax, r10d
mov r9d, r8d
cmp r14, 0x100
jne 0x140056170
mov ecx, dword [rsp + 0x28]
add ecx, ebp
mov rax, qword [rsp + 0x48]
mov dword [rax + 0x50], ecx
mov ecx, dword [rsp + 0x2c]
add ecx, edi
mov dword [rax + 0x54], ecx
mov ecx, dword [rsp + 0x30]
add ecx, esi
mov dword [rax + 0x58], ecx
mov ecx, dword [rsp + 0x34]
add ecx, r12d
mov dword [rax + 0x5c], ecx
mov ecx, dword [rsp + 0x38]
add ecx, r13d
mov dword [rax + 0x60], ecx
mov ecx, dword [rsp + 0x3c]
add ecx, r8d
mov dword [rax + 0x64], ecx
mov ecx, dword [rsp + 0x40]
add ecx, r10d
mov dword [rax + 0x68], ecx
mov ecx, dword [rsp + 0x44]
add ecx, edx
mov dword [rax + 0x6c], ecx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14010ed10
nop
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400571f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
lea rsi, [rcx + 8]
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0xf
mov r9, qword [rdx]
mov rdi, qword [rdx + 8]
cmp rdi, 0xf
mov qword [rbp - 8], rcx
jbe 0x14005723e
mov rcx, rsi
mov rdx, rdi
call fcn.140003aa0
jmp 0x140057258
mov rbx, rcx
mov qword [rcx + 0x18], rdi
mov rcx, rsi
mov rdx, r9
mov r8, rdi
call fcn.14017c490
mov byte [rbx + rdi + 8], 0
rdtsc
mov r9, qword [rbp - 8]
mov word [r9], ax
mov rdx, qword [r9 + 0x18]
cmp qword [r9 + 0x20], 0x10
jb 0x140057271
mov rsi, qword [r9 + 8]
test rdx, rdx
je 0x1400572d4
mov r8, rdx
mov rcx, rsi
and r8, 3
je 0x14005729d
nop word cs:[rax + rax]
ror ax, 1
xor byte [rcx], al
inc rcx
dec r8
jne 0x140057290
cmp rdx, 4
jb 0x1400572d4
add rsi, rdx
nop word cs:[rax + rax]
mov edx, eax
shr edx, 1
xor byte [rcx], dl
mov edx, eax
rol dx, 0xe
xor byte [rcx + 1], dl
shr edx, 1
xor byte [rcx + 2], dl
rol ax, 0xc
xor byte [rcx + 3], al
add rcx, 4
cmp rcx, rsi
jne 0x1400572b0
mov rax, r9
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140110928
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140110972
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140110972
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140110972
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140110972
cmp dword [rcx + 0x84], 0xe
jbe 0x140110972
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140110974
xor al, al
add rsp, 0x28
ret