joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110157e2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rsp + 0x80]
mov eax, ecx
and al, 8
mov r10d, 0xffff
neg al
mov rbp, r9
mov rbx, r8
mov edi, ecx
mov r14, qword [rsi]
sbb eax, eax
dec dword [r9]
mov dword [rsp + 0x78], eax
cmp r10w, word [r8]
je 0x110157e83
mov rdx, qword [rsp + 0x90]
movzx ecx, word [r8]
call fcn.11014f290
mov rax, qword [rsp + 0x98]
xor r9d, r9d
mov r12d, edi
mov ecx, edi
and r12d, 0x10
lea r15, [rax - 1]
cmovne r15, rax
and ecx, 1
mov dword [rsp + 0x60], ecx
test ecx, ecx
je 0x110157ec4
mov ecx, dword [rsp + 0x88]
mov eax, ecx
dec ecx
mov dword [rsp + 0x88], ecx
test eax, eax
je 0x11015800d
mov rcx, qword [rsp + 0x90]
inc dword [rbp]
call fcn.11014cf70
mov r10d, 0xffff
mov word [rbx], ax
xor r9d, r9d
movzx r8d, ax
cmp r10w, ax
je 0x110157ff1
test r12d, r12d
jne 0x110157f47
test dil, 0x20
je 0x110157f0c
cmp ax, 9
jb 0x110157f05
cmp ax, 0xd
jbe 0x110157f0c
cmp r8w, 0x20
jne 0x110157f47
test dil, 0x40
je 0x110157ff1
movzx ecx, r8w
shr cx, 3
cmp r8w, cx
jb 0x110157ff1
movzx eax, cx
mov edx, r8d
mov rcx, qword [rsp + 0x68]
and edx, 7
movsx ecx, byte [rax + rcx]
xor ecx, dword [rsp + 0x78]
bt ecx, edx
jae 0x110157ff1
test dil, 4
jne 0x110157fb8
mov ebx, edi
and ebx, 2
test r15, r15
je 0x110157fc5
mov rdx, qword [rsi]
test ebx, ebx
je 0x110157f70
mov rbx, qword [rsp + 0x70]
mov word [rdx], r8w
add qword [rsi], 2
dec r15
jmp 0x110157fbc
mov dword [rsp + 0x80], r9d
lea rcx, [rsp + 0x80]
movzx r9d, r8w
mov r8, r15
call sym.msvcrt.dll_wctomb_s
cmp eax, 0x22
je 0x110157fc5
movsxd rax, dword [rsp + 0x80]
xor r9d, r9d
mov rbx, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
test eax, eax
jle 0x110157ea6
add qword [rsi], rax
sub r15, rax
jmp 0x110157ea6
add r14, 2
mov ecx, dword [rsp + 0x60]
jmp 0x110157ea6
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
xor eax, eax
test ebx, ebx
je 0x110157fec
mov word [r14], ax
or eax, 0xffffffff
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov byte [r14], al
jmp 0x110157fda
dec dword [rbp]
cmp r10w, word [rbx]
je 0x11015800d
mov rdx, qword [rsp + 0x90]
movzx ecx, word [rbx]
call fcn.11014f290
xor r9d, r9d
cmp r14, qword [rsi]
je 0x110157fda
test dil, 4
jne 0x110158039
mov rax, qword [rsp + 0xa8]
inc dword [rax]
test r12d, r12d
jne 0x110158039
mov rax, qword [rsi]
test dil, 2
je 0x110158036
mov word [rax], r9w
jmp 0x110158039
mov byte [rax], r9b
xor eax, eax
jmp 0x110157fdd
Function at 0x110161d40
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movsxd rbx, ecx
mov rdi, rdx
cmp ebx, 0xfffffffe
jne 0x110161d83
call sym.msvcrt.dll__errno
mov dword [rax], 9
jmp 0x110161f1e
xor esi, esi
test ecx, ecx
js 0x110161eff
cmp ebx, dword [0x110195924]
jae 0x110161eff
mov rcx, rbx
lea rdx, [sym.msvcrt.dll___pioinfo]
and ecx, 0x1f
mov rax, rbx
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
test byte [rax + rcx + 8], 1
je 0x110161eff
test rdi, rdi
jne 0x110161dd8
lea rcx, [rbp - 0x15]
call sym.msvcrt.dll__time32
mov eax, dword [rbp - 0x15]
lea rdi, [rbp - 0x19]
mov dword [rbp - 0x19], eax
lea rdx, [rdi + 4]
lea rcx, [rbp + 0x17]
call sym.msvcrt.dll__localtime32_s
test eax, eax
je 0x110161df9
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x110161f1e
movzx eax, word [rbp + 0x2b]
lea rdx, [rbp - 0x11]
mov r14d, 0x76c
mov word [rbp + 0x15], si
add ax, r14w
lea rcx, [rbp + 7]
mov word [rbp + 7], ax
movzx eax, word [rbp + 0x27]
inc ax
mov word [rbp + 9], ax
movzx eax, word [rbp + 0x23]
mov word [rbp + 0xd], ax
movzx eax, word [rbp + 0x1f]
mov word [rbp + 0xf], ax
movzx eax, word [rbp + 0x1b]
mov word [rbp + 0x11], ax
movzx eax, word [rbp + 0x17]
mov word [rbp + 0x13], ax
call qword [sym.imp.KERNELBASE.dll_SystemTimeToFileTime]
test eax, eax
je 0x110161de9
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x110161de9
mov rdx, rdi
lea rcx, [rbp + 0x17]
call sym.msvcrt.dll__localtime32_s
test eax, eax
jne 0x110161de9
movzx eax, word [rbp + 0x2b]
lea rdx, [rbp - 0x11]
add ax, r14w
mov word [rbp + 0x15], si
mov word [rbp + 7], ax
lea rcx, [rbp + 7]
movzx eax, word [rbp + 0x27]
inc ax
mov word [rbp + 9], ax
movzx eax, word [rbp + 0x23]
mov word [rbp + 0xd], ax
movzx eax, word [rbp + 0x1f]
mov word [rbp + 0xf], ax
movzx eax, word [rbp + 0x1b]
mov word [rbp + 0x11], ax
movzx eax, word [rbp + 0x17]
mov word [rbp + 0x13], ax
call qword [sym.imp.KERNELBASE.dll_SystemTimeToFileTime]
test eax, eax
je 0x110161de9
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x110161de9
mov ecx, ebx
call sym.msvcrt.dll__get_osfhandle
mov rcx, rax
lea r9, [rbp - 9]
lea r8, [rbp - 1]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
je 0x110161de9
xor eax, eax
jmp 0x110161f21
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 9
call sym.msvcrt.dll__invalid_parameter
or eax, 0xffffffff
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1101304b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x110168430
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x20], 0x1084a8f
jmp 0x1101077ff

Function at 0x110174700
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x20], 0x1084a8f
jmp 0x110107fde

Function at 0x110174a40
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x18], 0x48f12603
xor ebx, dword [rbp - 0x18]
xor edx, 0x580a2301
sub esi, 0xfc9e1469
xor edi, 0x846e0514
xor edx, 0xfff58b71
add ebx, eax
add ebx, ecx
add ebx, esi
and ebx, 0x2000
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x20], 0x1084a8f
jmp 0x110108292
Function at 0x14008e23c
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, ecx
mov rcx, qword [0x1407a3b20]
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.1400bbfb0
mov r12, rax
test r15, r15
je 0x14008e37e
mov rcx, qword [0x14079f19c]
lea edx, [rbx + 8]
mov r8d, 0x98
call qword [0x14079b528]
lea ebp, [rbx + 1]
mov rcx, r15
or dword [rax + 4], 0xffffffff
mov dword [rax], ebp
mov rdi, rax
call fcn.140067852
lea rcx, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
mov qword [rdi + 8], rax
call fcn.140067852
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 0x60], rax
mov dword [rdi + 0x40], ecx
mov eax, dword [r12]
mov dword [rdi + 0x44], eax
mov eax, dword [r12 + 4]
mov dword [rdi + 0x80], r13d
mov dword [rdi + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x78], rax
test bpl, cl
je 0x14008e36f
test rsi, rsi
je 0x14008e328
mov rcx, qword [0x14079f19c]
mov r8, rsi
xor edx, edx
call qword [0x14079b528]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x14008e322
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.1400677ce
cmp qword [rdi + 0x70], rbx
je 0x14008e365
lea rax, [rsp + 0x68]
lea r8, [0x14008e3a0]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [0x14079b518]
test rax, rax
je 0x14008e35d
mov rcx, rax
call qword [0x14079b2f8]
jmp 0x14008e361
mov ebp, dword [rsp + 0x68]
test ebp, ebp
jne 0x14008e37b
mov rcx, rdi
call fcn.14008dcc8
jmp 0x14008e37e
mov rcx, rdi
mov qword [rdi + 0x70], r14
call fcn.14008dd64
mov rbx, rdi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400a0ee4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9d, edx
mov r10, rcx
test rcx, rcx
jne 0x1400a0efe
mov eax, r8d
jmp 0x1400a0f6c
not r8d
lea rdi, [0x14019fbd0]
cmp r9d, 8
jb 0x1400a0f42
mov r11, r9
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r8d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rdi + rdx*4]
xor r8d, eax
dec rbx
jne 0x1400a0f1a
add r9d, 0xfffffff8
dec r11
jne 0x1400a0f15
test r9d, r9d
je 0x1400a0f66
movzx ecx, byte [r10]
mov eax, r8d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rdi + rdx*4]
xor r8d, eax
dec r9d
jne 0x1400a0f47
not r8d
movsxd rax, r8d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400a1e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400a2080
xor r10d, r10d
lea edx, [rax*4]
mov r11d, eax
movsxd r9, edx
test edx, edx
jle 0x1400a1ec9
lea r8, [rbx + 8]
lea rcx, [rbx + 8]
lea r8, [r8 + r9*4]
nop
mov eax, dword [r8 - 8]
mov edx, dword [rcx - 8]
add r10, 4
mov dword [rcx - 8], eax
mov eax, dword [r8 - 4]
mov dword [r8 - 8], edx
mov edx, dword [rcx - 4]
mov dword [rcx - 4], eax
mov eax, dword [r8]
mov dword [r8 - 4], edx
mov edx, dword [rcx]
mov dword [rcx], eax
mov eax, dword [r8 + 4]
mov dword [r8], edx
mov edx, dword [rcx + 4]
mov dword [rcx + 4], eax
sub r9, 4
mov dword [r8 + 4], edx
lea r8, [r8 - 0x10]
lea rcx, [rcx + 0x10]
cmp r10, r9
jl 0x1400a1e80
cmp r11d, 1
jle 0x1400a206d
mov qword [rsp + 0x30], rdi
add rbx, 2
lea r10d, [r11 - 1]
lea rdi, [0x140000000]
nop word [rax + rax]
mov r8d, dword [rbx + 0xe]
lea rbx, [rbx + 0x10]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx - 1]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
mov r9d, dword [rdi + rdx*4 + 0x1a13d0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x1a1bd0]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx]
xor r9d, dword [rdi + rcx*4 + 0x1a1fd0]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx + 3]
movzx edx, byte [rdi + rax*4 + 0x1a0fd0]
xor r9d, dword [rdi + rcx*4 + 0x1a17d0]
movzx eax, byte [rbx + 4]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
mov r8d, dword [rdi + rdx*4 + 0x1a1bd0]
mov dword [rbx - 2], r9d
xor r8d, dword [rdi + rcx*4 + 0x1a17d0]
mov r9d, dword [rbx + 2]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, r9b
mov r9d, dword [rbx + 6]
xor r8d, dword [rdi + rcx*4 + 0x1a13d0]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx + 7]
xor r8d, dword [rdi + rcx*4 + 0x1a1fd0]
movzx edx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx + 8]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
mov dword [rbx + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x1a1bd0]
xor r8d, dword [rdi + rcx*4 + 0x1a17d0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, r9b
mov r9d, dword [rbx + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x1a13d0]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x1a1fd0]
movzx edx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, byte [rbx + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
mov dword [rbx + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x1a1bd0]
xor r8d, dword [rdi + rcx*4 + 0x1a17d0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1a13d0]
movzx ecx, byte [rdi + rax*4 + 0x1a0fd0]
xor r8d, dword [rdi + rcx*4 + 0x1a1fd0]
mov dword [rbx + 0xa], r8d
dec r10
jne 0x1400a1ef0
mov rdi, qword [rsp + 0x30]
mov eax, r11d
add rsp, 0x20
pop rbx
ret
Function at 0x1400a2590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rdi, rdx
mov rax, r9
mov r12, r9
cqo
mov rbx, r8
mov r13, rcx
and edx, 0xf
add rax, rdx
mov rbp, rax
and eax, 0xf
sub rax, rdx
sar rbp, 4
mov rsi, rax
test rax, rax
je 0x1400a25db
test rbp, rbp
jne 0x1400a25d8
xor eax, eax
jmp 0x1400a27b9
dec rbp
mov qword [rsp + 0x80], r14
mov r14, qword [rsp + 0xa0]
movups xmm0, xmmword [r14]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
test rbp, rbp
je 0x1400a2662
mov qword [rsp + 0x88], r15
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r13 + 4]
lea rcx, [r13 + 0xf8]
mov r9, rbx
mov r8, rdi
call fcn.1400a1220
mov eax, dword [rsp + 0x20]
add rdi, 0x10
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
add rbx, 0x10
xor dword [rbx - 0xc], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx - 4], eax
movups xmm0, xmmword [rdi - 0x10]
movups xmm1, xmm0
movups xmmword [rsp + 0x20], xmm0
dec rbp
jne 0x1400a2610
mov r15, qword [rsp + 0x88]
test rsi, rsi
je 0x1400a27aa
movups xmm0, xmmword [rdi]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [r13 + 0xf8]
movups xmmword [r14], xmm0
mov edx, dword [r13 + 4]
movups xmmword [rsp + 0x40], xmm0
call fcn.1400a1220
xor r9d, r9d
test rsi, rsi
je 0x1400a2775
cmp rsi, 0x10
jb 0x1400a2739
lea r10, [rsi + 0xf]
lea rdx, [rsi + 0xf]
lea r8, [rbx + 0x10]
add r10, rdi
add rdx, rbx
lea rcx, [rdi + 0x10]
cmp r8, r10
ja 0x1400a26c7
cmp rdx, rcx
jae 0x1400a2739
lea rax, [rsp + rsi + 0x2f]
cmp r8, rax
ja 0x1400a26db
lea r8, [rsp + 0x30]
cmp rdx, r8
jae 0x1400a2739
lea rdx, [rsp + 0x30]
cmp rdx, r10
ja 0x1400a26ea
cmp rax, rcx
jae 0x1400a2739
mov rax, rsi
mov rdx, rsi
lea r8, [rsp + 0x30]
and eax, 0xf
sub r8, rdi
sub rdx, rax
mov rax, rbx
sub rax, rdi
nop dword [rax]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add r9, 0x10
lea rcx, [rcx + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax + rcx - 0x10], xmm0
movdqu xmmword [r8 + rcx - 0x20], xmm1
cmp r9, rdx
jb 0x1400a2710
cmp r9, rsi
jae 0x1400a2775
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov r10, rbx
sub rdi, rax
sub r10, rcx
lea r8, [rsp + 0x30]
add r8, r9
inc r9
movzx eax, byte [r8 + rdi + 0x10]
movzx edx, al
xor dl, byte [r8]
mov byte [r8], al
mov byte [r8 + r10 + 0x10], dl
cmp r9, rsi
jb 0x1400a2751
mov edx, dword [r13 + 4]
lea r8, [rsp + 0x30]
lea rcx, [r13 + 0xf8]
mov r9, rbx
call fcn.1400a1220
mov eax, dword [rsp + 0x20]
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
jmp 0x1400a27ae
movups xmmword [r14], xmm1
mov r14, qword [rsp + 0x80]
mov rax, r12
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ad7f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r10d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov ebx, r8d
mov r12, rdx
mov r11, rcx
test r10d, r10d
je 0x1400ad8b7
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov ebp, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r13, eax
mov eax, esi
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg ebp
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x1400ad89c
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 4]
xor byte [rdx], al
add rdx, rsi
dec rdi
jne 0x1400ad878
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x1400ad8b0
add ecx, ebp
jmp 0x1400ad8b2
add ecx, ebx
test r10d, r10d
jne 0x1400ad84c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400ae658
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r11d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov edi, r8d
mov r12, rdx
mov rbx, rcx
test r11d, r11d
je 0x1400ae721
mov eax, dword [rsp + 0x50]
mov ecx, r8d
mov ebp, r8d
lea r10d, [rax + rax*2]
mov eax, esi
imul ecx, dword [rsp + 0x58]
movsxd r13, r10d
imul eax, r9d
mov r9d, dword [rsp + 0x48]
movsxd r10, eax
mov qword [rsp + 0x28], r10
neg ebp
mov eax, dword [rbx + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [rbx + 0x150]
add rdx, r10
cmp dword [rsp + 0x60], 0
jle 0x1400ae707
mov r10d, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 3]
xor byte [rdx], al
add rdx, rsi
dec r10
jne 0x1400ae6e3
mov r10, qword [rsp + 0x28]
dec r11d
inc r9d
cmp dword [rbx + 0x174], 0
jne 0x1400ae71a
add ecx, ebp
jmp 0x1400ae71c
add ecx, edi
test r11d, r11d
jne 0x1400ae6b7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400be310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
lea rbx, [rcx + 0x588]
lea rsi, [rcx + 0x1c58]
xor edi, edi
lea r14, [rcx + 0x1018]
lea r15, [rcx + 0x1038]
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rsi + 2]
mov r8d, edi
mov r10d, edi
shr rax, 4
and r8d, 1
shr r10d, 1
mov edx, r10d
mov ecx, r8d
add r8d, 2
neg ecx
and edx, 1
shr r10d, 1
shr rcx, 4
lea r9d, [rdx + r8*2]
and r10d, 1
and ecx, 0x7f
inc edi
lea r15, [r15 + 4]
xor rcx, rax
mov eax, edx
lea r14, [r14 + 4]
mov r11d, dword [rbx + rcx*4]
movzx ecx, word [rsi + r8*2]
neg eax
shr rax, 4
shr rcx, 4
and eax, 0x7f
xor rcx, rax
mov eax, r10d
add r11d, dword [rbx + rcx*4]
movzx ecx, word [rsi + r9*2]
neg eax
shr rax, 4
shr rcx, 4
and eax, 0x7f
xor rcx, rax
lea eax, [r10 + r9*2]
add r11d, dword [rbx + rcx*4]
movzx eax, word [rsi + rax*2]
mov edx, eax
shr rax, 4
mov ecx, dword [rbx + rax*4]
xor rdx, 0x7f0
add ecx, r11d
shr rdx, 4
mov dword [r14 - 4], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r11d
mov dword [r15 - 4], ecx
cmp edi, 8
jb 0x1400be350
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
Function at 0x1400c06b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, 0x100
xor ebx, ebx
mov r11d, r8d
or edx, r10d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
mov ecx, edx
shr ecx, 7
shr r8d, 8
mov eax, r10d
and ecx, 1
and eax, r11d
add edx, edx
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
movzx r8d, word [rdi + r8*2]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
mov ecx, edx
add ebx, dword [r9 + r8*4]
xor ecx, r11d
not ecx
and r10d, ecx
cmp edx, 0x10000
jb 0x1400c06d0
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x1400c1c40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0
mov rbp, rcx
jne 0x1400c1c6d
call fcn.1400be420
mov rcx, rbp
call fcn.1400be310
mov ecx, dword [rbp + 0xc4]
mov eax, dword [rbp + 0x48]
mov ebx, 1
dec eax
mov edx, ebx
lea r8, [rbp + 0x22d8]
shl edx, cl
lea r9, [rbp + 0x588]
lea rcx, [rbp + 0x6ad8]
mov dword [rbp + 0xaedc], eax
mov dword [rbp + 0x6ad8], eax
mov dword [rbp + 0xec], 0x40
call fcn.1400c0320
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x26d8]
shl ebx, cl
lea r9, [rbp + 0x588]
lea rcx, [rbp + 0xaedc]
mov edx, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400c0320

Function at 0x1400c2540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r9d, r11d
mov r10d, r11d
add r11d, 2
shr r9d, 2
shr r10d, 1
lea rdi, [rdi + 8]
lea eax, [r9 + 2]
mov ecx, r10d
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
and ecx, 1
neg ecx
shr rdx, 4
shr rax, 4
shr rcx, 4
and ecx, 0x7f
xor rdx, rcx
mov ecx, r9d
mov r8d, dword [rbx + rdx*4]
neg ecx
shr rcx, 4
and ecx, 0x7f
xor rcx, rax
lea eax, [r10 + 4]
add r8d, dword [rbx + rcx*4]
movzx eax, word [rsi + rax*2]
add r8d, ebp
mov edx, eax
shr rax, 4
mov ecx, dword [rbx + rax*4]
xor rdx, 0x7f0
add ecx, r8d
shr rdx, 4
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x1400c2562
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400c4c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov dword [rcx + 0x3c], 0x20
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
lea r8, [rcx + 0x78]
mov qword [rcx + 0x40], rdx
mov word [rcx + 0x22], dx
mov qword [rcx + 0x28], rdx
nop
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
lea r8, [r8 + 4]
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400c4ca0
ret
Function at 0x1400cae50
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
mov r8d, 0x80000000
test rcx, rcx
je 0x1400caebf
mov qword [rsp], rbx
lea rbx, [0x1401a5d90]
test r10b, 1
je 0x1400caeb3
mov ecx, r11d
mov eax, r8d
mov edx, 0x80000000
and ecx, 0x1f
xor r8d, r8d
mov r9d, dword [rbx + rcx*4]
nop dword [rax + rax]
test r9d, edx
je 0x1400caea0
lea ecx, [rdx - 1]
xor r8d, eax
test r9d, ecx
je 0x1400caeb3
shr edx, 1
test al, 1
je 0x1400caeaf
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400cae90
shr eax, 1
jmp 0x1400cae90
inc r11d
sar r10, 1
jne 0x1400cae70
mov rbx, qword [rsp]
mov eax, r8d
add rsp, 8
ret