joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8c60
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, edx
mov eax, 0xaaaaaaab
mul edx
mov r15, r8
mov rbp, rcx
shr edx, 1
xor edi, edi
xor r14d, r14d
lea ebx, [rdx*4 + 5]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
lea edx, [rdi + 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
test esi, esi
je 0x1400a8da7
lea r10, [rax + 1]
nop dword [rax]
xor dl, dl
xor eax, eax
xor r9d, r9d
mov byte [rsp + 0x48], dl
xor ecx, ecx
mov word [rsp + 0x49], ax
cmp edi, esi
jae 0x1400a8d01
mov edx, edi
add rdx, rbp
nop dword [rax + rax]
cmp rcx, 3
jge 0x1400a8cfc
movzx eax, byte [rdx]
inc r9d
mov byte [rsp + rcx + 0x48], al
inc edi
inc rcx
inc rdx
cmp edi, esi
jb 0x1400a8ce0
movzx edx, byte [rsp + 0x48]
mov rax, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add r14d, 4
movzx r8d, byte [rsp + 0x49]
movzx ecx, dl
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov eax, r8d
mov byte [r10 - 1], cl
and r8d, 0xf
shr eax, 4
movzx ecx, dl
movzx edx, byte [rsp + 0x4a]
and ecx, 3
shl ecx, 4
add ecx, eax
mov rax, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movsxd rcx, ecx
movzx ecx, byte [rcx + rax]
mov eax, edx
mov byte [r10], cl
shr eax, 6
lea eax, [rax + r8*4]
movsxd rcx, eax
mov rax, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ecx, byte [rcx + rax]
mov byte [r10 + 1], cl
mov ecx, edx
mov rax, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
movzx ecx, byte [rcx + rax]
mov eax, 3
mov byte [r10 + 2], cl
sub eax, r9d
add r10, 4
movsxd rcx, eax
test eax, eax
jle 0x1400a8d9f
lea rax, [r10 - 2]
mov byte [rax], 0x3d
lea rax, [rax - 1]
sub rcx, 1
jne 0x1400a8d92
cmp edi, esi
jb 0x1400a8cc0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movsxd rax, r14d
mov byte [rax + r11], 0
mov qword [r15], r11
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400a9400
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rax + 0x10], 0
mov qword [rax + 0x18], rbx
mov r9d, 0x220
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x40], ebx
mov dl, 2
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400a945d
add rsp, 0x60
pop rbx
ret
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov edx, dword [rsp + 0x70]
test eax, eax
mov rcx, qword [rsp + 0x80]
cmove edx, ebx
mov dword [rsp + 0x70], edx
test rcx, rcx
je 0x1400a9496
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [rsp + 0x70]
mov eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x1400a94a0
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rax + 0x10], 0
mov qword [rax + 0x18], rbx
xor r9d, r9d
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
lea r8d, [rbx + 0x12]
mov dword [rsp + 0x40], ebx
mov dl, 1
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1400a94fa
add rsp, 0x60
pop rbx
ret
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov edx, dword [rsp + 0x70]
test eax, eax
mov rcx, qword [rsp + 0x80]
cmove edx, ebx
mov dword [rsp + 0x70], edx
test rcx, rcx
je 0x1400a9533
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [rsp + 0x70]
mov eax, edx
add rsp, 0x60
pop rbx
ret

Function at 0x1400aa0b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [rcx + 0x40]
xor edi, edi
mov rbx, rcx
mov r8d, edi
test rdx, rdx
je 0x1400aa1d7
lea rax, [rdx + 0x14]
cmp qword [rax], rax
je 0x1400aa1d7
mov rcx, qword [rax]
lea rax, [rcx + 0x17]
cmp qword [rax], rax
je 0x1400aa0eb
mov r8, qword [rax]
test rcx, rcx
je 0x1400aa1d7
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
movzx eax, word [rbx + 0x14]
inc ax
mov word [rsp + 0x40], ax
movzx eax, word [rdx + 6]
mov word [rsp + 0x42], ax
movzx eax, word [rdx + 8]
mov word [rsp + 0x44], ax
movzx eax, word [rdx + 0xa]
mov word [rsp + 0x46], ax
movzx eax, byte [rdx + 0x10]
mov byte [rsp + 0x48], al
movzx eax, byte [rcx + 0x12]
mov byte [rsp + 0x49], al
cmp al, 1
jbe 0x1400aa151
movzx eax, byte [rdx + 2]
mov byte [rsp + 0x4a], al
movzx eax, byte [rdx + 3]
mov byte [rsp + 0x4b], al
movzx eax, byte [rdx + 4]
jmp 0x1400aa16f
jne 0x1400aa173
test r8, r8
je 0x1400aa173
movzx eax, byte [r8 + 0x13]
mov byte [rsp + 0x4a], al
movzx eax, byte [r8 + 0x14]
mov byte [rsp + 0x4b], al
movzx eax, byte [r8 + 0x15]
mov byte [rsp + 0x4c], al
mov rcx, qword [rbx + 0x28]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r9d, setsockopt
mov dword [rsp + 0x28], edi
mov edx, 0x2a6804
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400aa1d7
mov qword [rsp + 0x28], rdi
lea r8, [0x1400aab70]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400aa1e4
mov rcx, rbx
call fcn.1400ac100
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400aefe0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400af071
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400af071
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400af071
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400af055
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400af04f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400af057
add rdx, 0x28
jmp 0x1400af034
xor edx, edx
test rdx, rdx
jne 0x1400af060
xor al, al
jmp 0x1400af077
test dword [rdx + 0x24], 0x80000000
je 0x1400af06d
xor al, al
jmp 0x1400af077
mov al, 1
jmp 0x1400af077
xor al, al
jmp 0x1400af077
add rsp, 0x18
ret

Function at 0x1400b2930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ecx, dword [0x14012dd20]
cmp ecx, 0xffffffff
jne 0x1400b2956
xor esi, esi
jmp 0x1400b295f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x50], rsi
test rsi, rsi
je 0x1400b2a53
nop dword [rax]
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x1400b2986
test rbx, rbx
je 0x1400b2a2c
jmp 0x1400b2990
test rbx, rbx
je 0x1400b29e4
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b29c7
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1400b2990
cmp qword [rsi + 0x30], 0
je 0x1400b2970
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400b2a0f
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400b2a0f
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rsi + 0x28]
call fcn.14001ad90
cmp qword [rsi + 0x30], 0
jne 0x1400b29f0
jmp 0x1400b2970
lea rdx, [0x1400b1f70]
lea rcx, [0x140134210]
call fcn.1400b1b10
mov ecx, dword [0x14012dd20]
cmp ecx, 0xffffffff
je 0x1400b2a53
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1400b2a84
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400b2a84
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b2ac0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x1400b2b50]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.1400bc4fc
mov rsi, rax
test rax, rax
jne 0x1400b2b04
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rdi]
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b2b27
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c8ca0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, reloc.imgengine.dll_Ordinal_8
mov r14, rcx
lea r8, [0x1400fe310]
lea rdx, str.GetLocaleInfoEx
mov ecx, ntohl
call fcn.1400c88e8
mov rbx, rax
test rax, rax
je 0x1400c8d03
mov rcx, rax
call qword [fcn.14009c640]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x1400c8d1d
xor edx, edx
mov rcx, r14
call fcn.1400c9060
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140013370
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [0x14024acf8]
movsxd rbx, ecx
test rdx, rdx
jne 0x1400133ee
xor ecx, ecx
mov edx, 0x12000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x14024acf8], rax
mov rdx, rax
test rax, rax
jne 0x1400133ee
movdqa xmm0, xmmword [0x1400b5580]
movdqu xmmword [rsp + 0x20], xmm0
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
add rdx, rcx
lea ecx, [rax - 0x17]
inc eax
xor byte [rdx], cl
cmp eax, 0xf
jb 0x1400133c0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
call fcn.14006cb30
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx + rbx*8]
lea rax, [rdx + rcx*8]
add rsp, 0x30
pop rbx
ret

Function at 0x140013880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x14024acf8]
test rbx, rbx
jne 0x1400138f5
mov edx, 0x12000
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x14024acf8], rax
mov rbx, rax
test rax, rax
jne 0x1400138f5
movdqa xmm0, xmmword [0x1400b5580]
mov edx, ebx
movdqu xmmword [rsp + 0x20], xmm0
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx - 0x17]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x1400138d0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], bl
call fcn.14006cb30
xor edx, edx
mov r8d, 0x12000
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140071a90
Function at 0x14001a040
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001a09d
lea rbx, [0x1400b31c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001a084
cmp r10, 2
jb 0x14001a084
cmp byte [r9], r8b
jne 0x14001a084
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001a060
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001a0df
lea rbx, [0x1400b31c0]
cmp r8b, 0x23
jne 0x14001a0c3
cmp byte [r9], r8b
jne 0x14001a0c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001a0b0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14001c160
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x1400b31c0]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret

Function at 0x14001c830
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14024ad10]
mov dword [rsp + 0x20], 0x83adc9ca
mov dword [rsp + 0x24], 0x82888b9f
mov dword [rsp + 0x28], 0x909d879e
mov rcx, qword [rax + 0x40b0]
xor eax, eax
mov byte [rsp + 0x2c], al
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movsxd rax, r8d
lea rdx, [rsp + 0x20]
add rdx, rax
lea eax, [r8 - 0x17]
inc r8d
xor byte [rdx], al
cmp r8d, 0xc
jb 0x14001c870
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
mov edx, 1
mov byte [rsp + 0x2c], 0
call fcn.14001c660
add rsp, 0x38
ret
Function at 0x140025f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbx, qword [0x14024ad10]
cmp dword [rbx + 0x3e78], 1
mov rbp, qword [rbx + 0x3ea8]
jg 0x140025f3e
cmp byte [rbx + 0x3e35], 0
jne 0x1400260e9
cmp qword [rbp + 0x190], 0
mov qword [rsp + 0x38], rsi
je 0x140025f52
call fcn.1400432f0
call fcn.14001fb40
xor esi, esi
test dword [rbp + 0xc], 0x1000000
jne 0x14002604f
mov r8, qword [0x14024ad10]
mov qword [rsp + 0x40], rdi
mov rdi, r8
cmp byte [r8 + 0x53d4], sil
je 0x14002604a
xor eax, eax
mov word [rsp + 0x30], 0xe0e4
mov byte [rsp + 0x32], al
mov edx, esi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x17]
inc edx
xor byte [rcx], al
cmp edx, 2
jb 0x140025fa0
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x32], sil
call fcn.14002d650
cmp dword [r8 + 0x53d8], 4
jne 0x14002600b
cmp dword [r8 + 0x53e0], 1
jle 0x14002600b
mov rax, qword [r8 + 0x53e8]
lea rdx, [0x14024acf4]
test rax, rax
cmovne rdx, rax
mov rax, qword [r8 + 0xb0]
test rax, rax
je 0x14002600b
mov rcx, qword [r8 + 0xb8]
call rax
mov r8, qword [0x14024ad10]
mov byte [rdi + 0x53d4], sil
mov dword [rdi + 0x53d8], esi
mov rcx, qword [rdi + 0x53e8]
test rcx, rcx
je 0x14002604a
mov qword [rdi + 0x53e0], rsi
test r8, r8
je 0x140026037
dec dword [r8 + 0xec]
mov rdx, qword [0x14024ad08]
call fcn.140019140
mov qword [rdi + 0x53e8], rsi
mov rdi, qword [rsp + 0x40]
mov rax, qword [rbx + 0x3e80]
movsxd r8, dword [rbx + 0x3e78]
imul rcx, r8, 0x58
lea edx, [r8 - 1]
movups xmm0, xmmword [rcx + rax - 0x50]
movups xmmword [rbx + 0x3f70], xmm0
movups xmm1, xmmword [rcx + rax - 0x40]
movups xmmword [rbx + 0x3f80], xmm1
movups xmm0, xmmword [rcx + rax - 0x30]
movups xmmword [rbx + 0x3f90], xmm0
movsd xmm1, qword [rcx + rax - 0x20]
movsd qword [rbx + 0x3fa0], xmm1
mov eax, dword [rcx + rax - 0x18]
mov dword [rbx + 0x3fa8], eax
mov eax, dword [rbp + 0xc]
bt eax, 0x1c
jae 0x1400260b3
dec dword [rbx + 0x40a0]
mov eax, dword [rbp + 0xc]
bt eax, 0x1a
jae 0x1400260bf
dec dword [rbx + 0x4090]
mov dword [rbx + 0x3e78], edx
test edx, edx
je 0x1400260dc
lea rax, [r8 - 2]
imul rcx, rax, 0x58
mov rax, qword [rbx + 0x3e80]
mov rsi, qword [rcx + rax]
mov rcx, rsi
call fcn.14001c320
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x140026990
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x14024ad10]
mov r8d, ecx
mov rbx, qword [rax + 0x3ea8]
add rbx, 0xd0
movzx eax, r8b
lea r8, [0x1400b31c0]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140026a50
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140026a36
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140026a3b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14002f380
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400285a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, qword [0x14024ad10]
xor ebx, ebx
mov esi, ecx
cmp byte [rdi + 0x424d], bl
jne 0x1400285d2
cmp byte [rdi + 0x424e], bl
je 0x14002863e
movss xmm1, dword [rdi + 0x38b0]
mov esi, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x1400b52f4]
mulss xmm0, dword [0x1400b530c]
addss xmm1, dword [rdi + 0xd98]
addss xmm0, dword [rdi + 0xd94]
mov qword [rdi + 0x3fc8], rbx
mov dword [rdi + 0x3fb4], esi
movss dword [rdi + 0x3fc4], xmm1
movss dword [rdi + 0x3fc0], xmm0
movss xmm0, dword [rdi + 0x390c]
mulss xmm0, dword [0x1400b5240]
or dword [rdi + 0x3fb0], 0x41
movss dword [rdi + 0x4010], xmm0
movsx r9d, word [rdi + 0x532e]
xor eax, eax
mov byte [rbp - 0x12], al
mov edx, ebx
mov dword [rbp - 0x20], 0x83bfc9ca
mov dword [rbp - 0x1c], 0x999b8282
mov dword [rbp - 0x18], 0xc4d6ad81
mov word [rbp - 0x14], 0x92c7
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx - 0x17]
inc edx
xor byte [rbp + rcx - 0x20], al
cmp edx, 0xe
jb 0x140028670
lea r8, [rbp - 0x20]
mov byte [rbp - 0x12], bl
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.140019f30
test sil, 1
je 0x140028768
movzx r9d, byte [rbp - 0x10]
lea r8, [rbp - 0xf]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400286f0
lea r11, [0x1400b31c0]
nop
cmp r9b, 0x23
jne 0x1400286d3
cmp byte [r8], r9b
jne 0x1400286d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400286c0
not ecx
call fcn.140021380
test rax, rax
je 0x140028768
cmp byte [rax + 0x96], bl
je 0x140028768
mov byte [rax + 0x9d], 1
mov byte [rax + 0xb8], 1
inc word [rdi + 0x532e]
movsx r9d, word [rdi + 0x532e]
xor eax, eax
mov byte [rbp - 0x12], al
mov dword [rbp - 0x20], 0x83bfc9ca
mov dword [rbp - 0x1c], 0x999b8282
mov dword [rbp - 0x18], 0xc4d6ad81
mov word [rbp - 0x14], 0x92c7
movsxd rcx, ebx
lea eax, [rbx - 0x17]
inc ebx
xor byte [rbp + rcx - 0x20], al
cmp ebx, 0xe
jb 0x140028741
lea r8, [rbp - 0x20]
mov byte [rbp - 0x12], 0
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.140019f30
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x20c0347
call fcn.140023bb0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140028ba0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov r8, qword [0x14024ad10]
mov r9d, ecx
movsxd rax, dword [r8 + 0x4090]
cmp dword [r8 + 0x4080], eax
jle 0x140028cac
lea rdx, [rax + rax*2]
mov rax, qword [r8 + 0x4088]
add rdx, rdx
cmp dword [rax + rdx*8], ecx
jne 0x140028cac
xor eax, eax
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x2c], al
xor edx, edx
mov dword [rsp + 0x20], 0x83bbc9ca
mov dword [rsp + 0x24], 0xaf9f9b9d
mov dword [rsp + 0x28], 0x8ccbc2d4
nop
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx - 0x17]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x140028c00
lea r8, [rsp + 0x20]
mov byte [rsp + 0x2c], 0
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.140019f30
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x4000141
call fcn.140023bb0
movzx edi, al
test al, al
jne 0x140028c9e
mov qword [rsp + 0x60], rbx
mov rbx, qword [0x14024ad10]
mov rcx, qword [rbx + 0x3ea8]
cmp qword [rbx + 0x40b8], rcx
jne 0x140028c7d
cmp byte [rbx + 0x4115], al
je 0x140028c7d
cmp dword [rbx + 0x40f4], 0
jne 0x140028c7d
or dword [rbx + 0x4118], 2
test dword [rcx + 0xc], 0x1000000
je 0x140028c8d
mov byte [rbx + 0x3e36], 1
call fcn.140025f10
mov byte [rbx + 0x3e36], 0
mov rbx, qword [rsp + 0x60]
movzx eax, dil
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
ret
xor edx, edx
mov dword [r8 + 0x3fb0], edx
xor al, al
add rsp, 0x58
ret