joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a355
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x1400c90c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400d9e90]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x1400c90b0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14003a46a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x1400c90c0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14003a438
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x1400c90c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14003a479
lea rax, [0x1400c90c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14003a4b5
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14003a523
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x1400c90b0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14003a56d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14003a56d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x1400c90c0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14003a55f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1400293ac
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ca74
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ca74
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400294fc
cmp rax, 0xffffffffffffffff
je 0x1400294fc
xor edi, edi
test rbp, rbp
jle 0x1400294a7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f3a0
mov rbx, rax
test rax, rax
jne 0x140029434
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002949d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a3a8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d750
cmp eax, 0xffffffff
je 0x14002947d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029444
mov edx, r15d
mov ecx, r14d
call fcn.14001a3a8
jmp 0x14002949d
cmp byte [rsi + 0x38], dil
je 0x140029494
cmp dword [rsi + 0x34], 5
jne 0x140029494
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002949d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b13c
jmp 0x140029510
jns 0x140029510
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ca74
cmp rax, 0xffffffffffffffff
jne 0x1400294c8
cmp byte [rsi + 0x30], dil
je 0x140029510
mov edi, dword [rsi + 0x2c]
jmp 0x140029510
mov ecx, r14d
call fcn.140018864
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029510
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029510
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029509
mov eax, dword [rsi + 0x2c]
jmp 0x14002950e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ca74
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x403d00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004077f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x403d6d
mov rcx, r8
call fcn.00403be0
test eax, eax
je 0x403d6d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x403d6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403d64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403d6f
add rax, 0x28
cmp rax, r9
jne 0x403d50
xor eax, eax
add rsp, 0x28
ret
Function at 0x140027f90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14002aca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x18
mov eax, dword [rdx + 0x10]
mov r9, qword [rdx]
mov r10d, dword [rdx + 0xc]
add r10d, eax
mov qword [rsp], r9
mov r9d, dword [rdx + 8]
mov dword [rsp + 8], r9d
bswap r10d
mov dword [rsp + 0xc], r10d
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
add rsp, 0x18
ret
Function at 0x14002f9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x14002fa11
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x14002fa06
cmp edi, 0x2d
jne 0x14002fa11
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x14002fba1
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x14002fbac
movzx r10d, r10b
cmp rbx, r11
jae 0x14002faa9
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x14002fa6c
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x14002faa9
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14002faa9
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccc
jl 0x14002fa50
jne 0x14002fa91
cmp r11b, 7
jbe 0x14002fa50
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1401d0410
jmp 0x14002fb8e
mov ecx, dword [rsp + 0x80]
test al, al
je 0x14002fac5
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x14002fad5
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1401de200]
subpd xmm1, xmmword [0x1401de210]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x14002fb48
xorpd xmm1, xmm1
movsd xmm2, qword [0x1401de220]
nop word cs:[rax + rax]
ucomisd xmm0, xmm1
jne 0x14002fb28
jnp 0x14002fb77
test ecx, ecx
jns 0x14002fbd2
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x14002fb20
mov eax, eax
mov r9, qword [0x14028c780]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x14002fb96
mulsd xmm0, xmm1
ucomisd xmm0, qword [0x1401de228]
jae 0x14002fbd2
movsd xmm1, qword [0x1401de230]
ucomisd xmm1, xmm0
jae 0x14002fbd2
test r8b, r8b
jne 0x14002fb84
xorpd xmm0, xmmword [0x1401de240]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x14002fb7c
jmp 0x14002fb84
mov qword [rsp + 0x28], 5
jmp 0x14002fbb5
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401d04b0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14002fb8e
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401d04b0
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14002fb8b
Function at 0x140061cb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rax
add qword [rdx + 0x30], 8
mov rcx, qword [rcx]
mov qword [rsp], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x140061d52
mov r11d, 8
mov r8d, 8
sub r8, r9
cmp r8, 8
cmovb r11, r8
xor r10d, r10d
xor eax, eax
cmp r11, 4
mov ecx, ecx
cmovae r10, rcx
setae al
lea rcx, [rax*4 + 1]
shl rax, 2
cmp rcx, r11
jae 0x140061d1b
movzx esi, word [rsp + rax]
lea ecx, [rax*8]
shl rsi, cl
or r10, rsi
or rax, 2
cmp rax, r11
jae 0x140061d30
movzx r11d, byte [rsp + rax]
shl eax, 3
mov ecx, eax
shl r11, cl
or r10, r11
lea ecx, [r9*8]
shl r10, cl
or r10, qword [rdx + 0x38]
mov qword [rdx + 0x38], r10
cmp r9, 8
jbe 0x140061d57
add r9, 8
jmp 0x140061e96
xor r8d, r8d
jmp 0x140061dab
mov r9, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx]
add rax, rcx
rol rcx, 0xd
xor r9, r10
xor rcx, rax
rol rax, 0x20
mov r11, qword [rdx + 8]
add r11, r9
rol r9, 0x10
xor r9, r11
add rax, r9
rol r9, 0x15
xor r9, rax
add r11, rcx
rol rcx, 0x11
mov qword [rdx + 0x18], r9
xor rcx, r11
rol r11, 0x20
mov qword [rdx + 0x10], rcx
mov qword [rdx + 8], r11
xor rax, r10
mov qword [rdx], rax
mov eax, 8
sub rax, r8
mov r9d, eax
and r9d, 7
and rax, 0xfffffffffffffff8
cmp r8, rax
jae 0x140061e32
mov rcx, qword [rdx]
mov r10, qword [rdx + 8]
mov rsi, qword [rdx + 0x18]
mov r11, qword [rdx + 0x10]
nop word cs:[rax + rax]
add rcx, r11
rol r11, 0xd
mov rdi, qword [rsp + r8]
xor r11, rcx
rol rcx, 0x20
xor rsi, rdi
add r10, rsi
rol rsi, 0x10
xor rsi, r10
add rcx, rsi
rol rsi, 0x15
add r10, r11
rol r11, 0x11
xor r11, r10
rol r10, 0x20
xor rsi, rcx
xor rcx, rdi
add r8, 8
cmp r8, rax
jb 0x140061de0
mov qword [rdx + 0x18], rsi
mov qword [rdx + 0x10], r11
mov qword [rdx + 8], r10
mov qword [rdx], rcx
cmp r9d, 3
jbe 0x140061e4f
mov r10d, dword [rsp + r8]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x140061e60
jmp 0x140061e7a
xor eax, eax
xor r10d, r10d
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x140061e7a
lea rcx, [rax + r8]
movzx r11d, word [rsp + rcx]
lea ecx, [rax*8]
shl r11, cl
or r10, r11
or rax, 2
cmp rax, r9
jae 0x140061e92
add r8, rax
movzx r8d, byte [rsp + r8]
shl eax, 3
mov ecx, eax
shl r8, cl
or r10, r8
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r9
add rsp, 8
pop rdi
pop rsi
ret
Function at 0x14006dec0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14006df02
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14006df0a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14006df1b
jmp 0x14006df32
xor r10d, r10d
jmp 0x14006dfbd
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14006df32
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14006df49
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14006df69
add r11, r8
jmp 0x14006e09a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14006e032
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14006dfe0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14006e050
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14006e062
jmp 0x14006e07c
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14006e07c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14006e096
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400b98e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x1400b9afd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x14022b760]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x1400b9950
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x14022b770]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400b9a7a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x1400b9a50
movdqa xmm1, xmmword [0x14022b770]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x14022b780], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x1400b9b1b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400b9470
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400c2000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
mov rax, rcx
test r8, r8
je 0x1400c202e
mov r9d, r8d
and r9d, 7
movabs rcx, 0x100000001b3
cmp r8, 8
jae 0x1400c203d
mov esi, 0x811c9dc5
mov r10, rdx
jmp 0x1400c20b9
movabs r11, 0x1c9d3adb639f298e
jmp 0x1400c20f2
mov r11, r8
and r11, 0xfffffffffffffff8
mov esi, 0x811c9dc5
mov r10, rdx
nop dword [rax]
movzx edi, byte [r10]
xor rdi, rsi
imul rdi, rcx
movzx esi, byte [r10 + 1]
xor rsi, rdi
imul rsi, rcx
movzx edi, byte [r10 + 2]
xor rdi, rsi
imul rdi, rcx
movzx esi, byte [r10 + 3]
xor rsi, rdi
imul rsi, rcx
movzx edi, byte [r10 + 4]
xor rdi, rsi
imul rdi, rcx
movzx esi, byte [r10 + 5]
xor rsi, rdi
imul rsi, rcx
movzx edi, byte [r10 + 6]
xor rdi, rsi
imul rdi, rcx
movzx esi, byte [r10 + 7]
add r10, 8
xor rsi, rdi
imul rsi, rcx
add r11, 0xfffffffffffffff8
jne 0x1400c2050
mov r11, rsi
test r9, r9
je 0x1400c20e7
xor edi, edi
nop word cs:[rax + rax]
movzx r11d, byte [r10 + rdi]
xor r11, rsi
imul r11, rcx
inc rdi
mov rsi, r11
cmp r9, rdi
jne 0x1400c20d0
xor r11, 0xff
imul r11, rcx
mov qword [rax], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x40], 0
mov qword [rax + 0x50], 0
mov qword [rax + 0x68], 0
mov qword [rax + 0x78], 5
mov qword [rax + 0x90], rdx
mov qword [rax + 0x98], r8
mov qword [rax + 0xa0], 8
xorps xmm0, xmm0
movups xmmword [rax + 0xa8], xmm0
mov qword [rax + 0xb8], 8
movups xmmword [rax + 0xc0], xmm0
mov qword [rax + 0xd0], 8
movups xmmword [rax + 0xd8], xmm0
mov qword [rax + 0xe8], 8
movups xmmword [rax + 0xf0], xmm0
mov qword [rax + 0x100], 8
movups xmmword [rax + 0x108], xmm0
mov qword [rax + 0x118], 8
movups xmmword [rax + 0x120], xmm0
mov qword [rax + 0x130], 8
movups xmmword [rax + 0x138], xmm0
mov qword [rax + 0x148], 8
movups xmmword [rax + 0x150], xmm0
mov qword [rax + 0x160], 8
movups xmmword [rax + 0x168], xmm0
mov qword [rax + 0x178], 4
movups xmmword [rax + 0x180], xmm0
mov qword [rax + 0x190], 8
movups xmmword [rax + 0x198], xmm0
mov qword [rax + 0x1a8], 8
movups xmmword [rax + 0x1b0], xmm0
mov qword [rax + 0x1c0], 8
movups xmmword [rax + 0x1c8], xmm0
mov qword [rax + 0x1d8], 8
movups xmmword [rax + 0x1e0], xmm0
mov qword [rax + 0x1f0], 8
movups xmmword [rax + 0x1f8], xmm0
mov qword [rax + 0x208], r11
mov qword [rax + 0x210], 0
mov qword [rax + 0x220], 0
mov qword [rax + 0x230], 0
mov qword [rax + 0x240], 0
mov qword [rax + 0x250], 0
mov qword [rax + 0x260], 0
movabs rcx, 0x11000000110000
mov qword [rax + 0x270], rcx
mov dword [rax + 0x278], 0
mov word [rax + 0x27c], 0x902
mov byte [rax + 0x27e], 0xd
pop rdi
pop rsi
ret
Function at 0x1400d7bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
mov r10, qword [rcx]
test r8, r8
je 0x1400d7cb8
movabs rax, 0x100000001b3
mov r11, r8
and r11, 7
je 0x1400d7c3e
mov rsi, r10
mov r9, rdx
nop word cs:[rax + rax]
movzx r10d, byte [r9]
inc r9
xor r10, rsi
imul r10, rax
mov rsi, r10
dec r11
jne 0x1400d7c20
cmp r8, 8
jae 0x1400d7c47
jmp 0x1400d7cb8
mov r9, rdx
cmp r8, 8
jb 0x1400d7cb8
add rdx, r8
nop word [rax + rax]
movzx r8d, byte [r9]
xor r8, r10
imul r8, rax
movzx r10d, byte [r9 + 1]
xor r10, r8
imul r10, rax
movzx r8d, byte [r9 + 2]
xor r8, r10
imul r8, rax
movzx r10d, byte [r9 + 3]
xor r10, r8
imul r10, rax
movzx r8d, byte [r9 + 4]
xor r8, r10
imul r8, rax
movzx r10d, byte [r9 + 5]
xor r10, r8
imul r10, rax
movzx r8d, byte [r9 + 6]
xor r8, r10
imul r8, rax
movzx r10d, byte [r9 + 7]
add r9, 8
xor r10, r8
imul r10, rax
cmp r9, rdx
jne 0x1400d7c50
mov qword [rcx], r10
pop rsi
ret
Function at 0x140119fd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret