joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov r12, r12
movabs rbx, 0x41c44f3069c50047
sub rbx, 0x37103ed8
add rbx, 0x2e6281a5
sub rbx, 0x34918d33
add rbx, 0x3175c41d
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x20], rbx
jne 0x140057ed9
xchg r15, r15
mov eax, 0x77629cd5
sub eax, 0x1f7f5cd3
sub eax, 0x3dbfd842
sub eax, 0x1a2366ec
mov dword [rsp + 0x20], 0x557d5677
add dword [rsp + 0x20], 0x8702b8f
sub dword [rsp + 0x20], 0x17a03180
xor dword [rsp + 0x20], 0x467a50b8
mov word [rsp + 0x34], ax
mov dword [rsp - 0x1c], ecx
xor r8d, r8d
mov dword [rsp + 0x24], 0x10d281b3
add dword [rsp + 0x24], 0x5b87b683
xor dword [rsp + 0x24], 0x4b6d6eab
sub dword [rsp + 0x24], 0x271a55c0
mov dword [rsp + 0x28], 0x5e1158f4
xor dword [rsp + 0x28], 0x2d53a373
sub dword [rsp + 0x28], 0x47bf26c0
add dword [rsp + 0x28], 0x3c8683f4
sub dword [rsp + 0x28], 0x679e58ba
mov dword [rsp + 0x2c], 0x7f4881b4
sub dword [rsp + 0x2c], 0x3eb5eda4
sub dword [rsp + 0x2c], 0x8e48a07
sub dword [rsp + 0x2c], 0x374f097f
mov dword [rsp + 0x30], 0x25c17e52
xor dword [rsp + 0x30], 0x535b9449
sub dword [rsp + 0x30], 0x5cb21027
add dword [rsp + 0x30], 0x15a4d3
sub dword [rsp + 0x30], 0x19cb7ebe
xchg r8, rsi
mov qword [rsp + 0x60], rsi
xchg r8, rsi
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
mov rcx, qword [rsp + 0x60]
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x681c2597
xor eax, 0xc668282
sub eax, 0x52f3b6be
add eax, 0x60316f16
shr eax, cl
movzx ecx, al
mov rdx, rdx
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x36], cx
mov dword [rsp - 0x28], 0x3af53c2
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
xchg r8, rax
mov r8, qword [rsp + 0x60]
xchg r8, rax
cmp rax, 0xb
mov dword [rsp - 0x44], 0x2b6d32c2
jb 0x140057dcd
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
xchg rdx, rdx
call fcn.14007ae80
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
xor rdx, rbx
xchg r12, r12
xor eax, eax
mov qword [rdi + 0x20], rdx
lea rdi, [rsp + 0x36]
mov dword [rsp - 0x38], esi
mov ecx, 0x73152e70
sub ecx, 0x4f1ac3a2
add ecx, 0x31ead004
sub ecx, 0x3145da2a
sub ecx, 0x249f609d
rep stosb byte [rdi], al
xchg r14, r14
cmp rdx, rbx
je 0x140057ee3
lea rdx, [0x1404a03c8]
xchg rdx, rdx
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
call fcn.14006b860
test al, al
mov dword [rsp - 0xc], 0x34458919
setne al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x61
xor al, 0x14
xor al, 0x4f
xor al, 0x17
sub al, 0x2c
xchg r8, rbx
mov r8, qword [rsp + 0x68]
xchg r8, rbx
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140072a60
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp + 0x20], 0x353edb60
add dword [rsp + 0x20], 0x38a805ae
sub dword [rsp + 0x20], 0x525a8411
xor dword [rsp + 0x20], 0x633909b0
mov r8, rcx
mov byte [rsp + 0x24], 0x17
add byte [rsp + 0x24], 0x1e
add byte [rsp + 0x24], 0x2c
mov qword [rsp + 0x28], 0x7d50377d
sub qword [rsp + 0x28], 0x6afb58b4
xor qword [rsp + 0x28], 0x2bc09a4
sub qword [rsp + 0x28], 0x10e8d76d
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x5b8b3a4c
sub edx, 0x2cdf986d
xor edx, 0x57125b9b
sub edx, 0x8019ad7
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x140072acd
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 1
add byte [rsp + 7], 0x55
sub byte [rsp + 7], 0x56
popf
je 0x140072b83
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x140072b86
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140072b76
movzx eax, byte [rcx]
test al, al
jne 0x140072b5a
jmp 0x140072b86
inc r8
cmp byte [r8], 0
jne 0x140072b45
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x519d2fd2
xor ecx, 0xe75c53e
add ecx, 0x14ffdde5
sub ecx, 0x74e8c8cc
rep stosb byte [rdi], al
mov rax, r8
nop
sub rsp, 0x59acce0f
add rsp, 0x59acce1f
pop rdi
ret
Function at 0x140072bc0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x140072d70
mov dword [rsp + 0x28], 0x2317c9d4
add dword [rsp + 0x28], 0x545b0a86
sub dword [rsp + 0x28], 0x7ee747e
add dword [rsp + 0x28], 0x930f571
mov byte [rsp + 0x2c], 0x73
sub byte [rsp + 0x2c], 0x51
add byte [rsp + 0x2c], 0x3f
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x291dcd42
sub edx, 0x1f91002f
xor edx, 0x58637920
add edx, 0x1fc8ab3a
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x140072c13
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x140072c94
lea rcx, [rcx + 1]
cmp dil, al
je 0x140072d5c
movzx eax, byte [rcx]
test al, al
jne 0x140072c7c
mov word [rsp + 0x20], 0x1f2d
xor word [rsp + 0x20], 0x4f0d
sub word [rsp + 0x20], 0x1e09
xor word [rsp + 0x20], 0x3007
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x77285930
sub edx, 0x4d67cf45
xor edx, 0x5878d686
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x140072cc5
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x140072d41
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x140072dcc
movzx eax, byte [rcx]
test al, al
jne 0x140072d29
xor dl, dl
mov r8d, 0x67b51524
sub r8d, 0x51f96ef6
xor r8d, 0x15bba62d
jmp 0x140072d78
mov r8d, 0x5408dcd8
sub r8d, 0x29e9760a
xor r8d, 0x2a1f66cf
mov dl, 0x12
add dl, 0x60
sub dl, 0x71
test r8b, 2
je 0x140072d9f
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x3fe878de
sub ecx, 0x2ca3e297
xor ecx, 0x13449645
rep stosb byte [rdi], al
test r8b, 1
je 0x140072dc3
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x38460b08
sub ecx, 0x26a3e044
xor ecx, 0x11a22ac1
rep stosb byte [rdi], al
movzx eax, dl
add rsp, 0x10
pop rdi
ret
mov r8d, 0x67bd0525
sub r8d, 0xc06f54e
add r8d, 0x205679c0
sub r8d, 0x7c0c8994
jmp 0x140072d70
Function at 0x140073a10
Capabilities:
Encode data using xor

Disassembly:
push rdi
add rsp, 0xfffffffffffffff0
mov word [rsp + 0x20], 0x365c
xor word [rsp + 0x20], 0x4e85
sub word [rsp + 0x20], 0x76c9
mov r8, rcx
mov qword [rsp + 0x28], 0x41f0f064
add qword [rsp + 0x28], 0x1ef063a1
sub qword [rsp + 0x28], 0x60e15405
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x378311f1
xor edx, 0x2bee0bfe
add edx, 0x554b455e
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x140073a50
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x3a
add byte [rsp + 2], 0x12
sub byte [rsp + 2], 0x4c
test al, al
je 0x140073ad5
lea rcx, [rcx + 1]
cmp dl, al
je 0x140073b0b
movzx eax, byte [rcx]
test al, al
jne 0x140073abe
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x13b7e35
add ecx, 0x63f4e6fe
sub ecx, 0x65306531
rep stosb byte [rdi], al
test dl, dl
jne 0x140073b18
mov byte [r8], al
lea rax, [r8 + 1]
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov dl, 0x6b
xor dl, 0x20
sub dl, 0x4a
jmp 0x140073ad7
mov rax, r8
nop
sub rsp, 0x63e1f49f
add rsp, 0x63e1f4af
pop rdi
ret
Function at 0x140073c20
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg rbp, r12
mov qword [rsp + 0x18], rsi
mov rdx, rdx
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffe0
movsxd rbx, dword [rcx + 0x3c]
xchg r14, r14
xchg r8, rdi
mov r8, rdx
xchg r8, rdi
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x2c], ebx
call fcn.140075600
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x40], edi
mov ebp, dword [rbx + rsi + 0xb4]
mov r10, rax
mov ebx, r14d
mov dword [rsp - 0x30], 0x4ed8de47
test ebp, ebp
je 0x140073df4
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov dword [rsp - 0x30], ebp
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov r10, r10
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
xchg rdi, rdi
cmp r14w, cx
jae 0x140073d30
mov eax, dword [rdx + 8]
test eax, eax
mov dword [rsp - 0x14], 0x64c6815f
jne 0x140073cef
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x40], edx
cmp r11d, r9d
jb 0x140073d10
add eax, r9d
cmp r11d, eax
mov dword [rsp - 0x3c], esi
jb 0x140073dae
inc r8w
nop
sub rdx, 0x12b16d62
add rdx, 0x12b16d8a
cmp r8w, cx
mov rbx, rbx
jb 0x140073cd9
xchg r12, r14
mov r8, r12
xchg r12, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
nop
add rax, 0xfc13620
sub rax, 0xfc13628
nop
sub r10, 0x6f8a0f11
add r10, 0x6f8a0f19
shr rax, 1
test eax, eax
mov dword [rsp - 0xc], esi
je 0x140073de1
mov edx, eax
nop word [rax + rax]
mov rsi, rsi
movzx eax, word [r10]
mov ecx, eax
shr ecx, 5
shr ecx, 1
shr ecx, 1
shr ecx, 3
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140073dc3
cmp ecx, 0xa
mov r14, r14
jne 0x140073dcf
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140073dcf
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
xchg r14, r14
add r8, r11
jmp 0x140073d39
and eax, 0xfff
add dword [rax + r8], edi
mov rdx, rdx
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x140073d77
mov dword [rsp - 0x38], esi
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140073ca6
mov dword [rsp - 0x38], 0x2d188cc1
mov rbx, qword [rsp + 0x30]
xchg rbp, rcx
mov rcx, qword [rsp + 0x38]
xchg rbp, rcx
mov rsi, qword [rsp + 0x40]
xchg rdi, r8
mov r8, qword [rsp + 0x48]
xchg r8, rdi
nop
add rsp, 0x1fe562ad
sub rsp, 0x1fe5628d
pop r14
ret
Function at 0x1400756e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg rbx, r13
push rdx
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov dword [rsp - 0x1c], ecx
push r13
push r13
mov qword [rsp], r14
push r10
mov qword [rsp], r15
nop
sub rsp, 0xde4e947
add rsp, 0xde4e927
movzx eax, word [rcx]
mov rdx, rdx
mov r15d, edx
xor eax, 0xa0b4447
xchg rsi, rdi
mov rdi, rcx
xchg rsi, rdi
cmp eax, 0xa0b1e0a
mov dword [rsp - 0xc], edi
jne 0x140075896
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xchg r15, r15
xor eax, 0xa0b4447
cmp eax, 0xa0b0117
jne 0x140075896
mov dword [rsp - 0x14], edi
mov edx, dword [rdx + rcx + 0x88]
call fcn.140075600
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r14, rax
mov dword [rsp - 0x2c], esp
mov edx, dword [rax + 0x20]
call fcn.140075600
mov edx, dword [r14 + 0x24]
xchg r13, r13
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
xchg r8, rax
mov r12, r8
xchg r8, rax
call fcn.140075600
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x44], esp
mov rcx, rsi
xchg r13, r10
mov r10, rax
xchg r13, r10
call fcn.140075600
xor edi, edi
mov dword [rsp - 0x24], edx
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140075896
mov r8, r8
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140075600
mov ecx, 0x4ebbaf66
sub ecx, 0x1be43dfc
sub ecx, 0x21b0ba6b
add ecx, 0x37712e08
add ecx, 0xb7681af8
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140075877
mov rdx, rdx
nop dword [rax]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x7ccc52ed
sub r8d, 0x61c4b69b
add r8d, 0x17a2cc3c
sub r8d, 0x35900d4
sub r8d, 0x2f5167b9
inc rbx
mov r9, r9
call fcn.140081bf0
cmp byte [rbx], 0
jne 0x14007582b
mov dword [rsp - 0x20], ebp
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
je 0x1400758f5
mov dword [rsp - 0x20], esp
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400757e2
mov dword [rsp - 0x44], ebx
xor eax, eax
xchg r14, rbx
mov r14, qword [rsp + 0x68]
xchg r14, rbx
nop
add rsp, 0x2bca67a8
sub rsp, 0x2bca6788
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x14], 0x6574e88d
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg rbp, rax
mov rbp, qword [rsp + 0x70]
xchg rbp, rax
mov edx, dword [rax + rdx*4]
call fcn.140075600
jmp 0x140075898
Function at 0x140079973
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
xchg rbp, rbx
mov rbp, qword [rcx]
xchg rbx, rbp
lea rax, [rsp + 0x28]
xchg rcx, rcx
xorps xmm0, xmm0
xchg r8, rsi
mov qword [rsp + 0x70], r8
xchg rsi, r8
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x38], esi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg r15, rsp
movups xmmword [r15 + 0x28], xmm0
xchg rsp, r15
lea rdx, [rsi + 1]
xchg rdi, rsp
movups xmmword [rdi + 0x38], xmm0
xchg rdi, rsp
xchg rsp, r13
movups xmmword [r13 + 0x48], xmm0
xchg rsp, r13
call fcn.14000ed40
mov rsi, rsi
mov edx, 0xa212001
add edx, 0x35243e74
add edx, 0x4831988
add edx, 0x2defe770
test rsi, rsi
mov dword [rsp - 0x24], edi
je 0x1400799d5
xchg rdi, rcx
mov rcx, rax
xchg rcx, rdi
sub rbx, rax
xchg r15, rsi
mov r8, r15
xchg rsi, r15
mov r9d, 0xec1ae40
add r9d, 0x306008b7
add r9d, 0xa38c747
add r9d, 0x3548392f
xor r9d, 0x7ea2b792
nop dword [rax]
movzx ecx, dx
mov rbx, rbx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 2
ror edx, 5
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov dword [rsp - 0x3c], esi
jne 0x1400799a8
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x20], edi
call fcn.140079a80
xchg rcx, r10
mov r10, qword [rsp + 0x20]
xchg rcx, r10
mov ebx, eax
mov dword [rsp - 0x18], ecx
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140079a51
mov r10, r10
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x62f33080
sub ecx, 0x562e5831
add ecx, 0x1de8d767
sub ecx, 0x2aadaf86
rep stosb byte [rdi], al
mov r15, r15
mov eax, ebx
xchg r12, rbx
mov r12, qword [rsp + 0x78]
xchg r12, rbx
nop
add rsp, 0x19e9acf1
sub rsp, 0x19e9ac91
pop rdi
ret
call fcn.1400966a0
mov eax, ebx
mov dword [rsp - 0x14], ebx
xchg r12, rbx
mov r12, qword [rsp + 0x78]
xchg rbx, r12
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140080dc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov dword [rsp - 0x28], esp
mov r10, qword [0x1404a03e0]
lea rdx, [rsp + 0x20]
mov rbx, rcx
xor r9d, r9d
xchg r9, r9
movabs rcx, 0x727229675879bca7
xor rcx, 0x6f827d52
add rcx, 0x3be5a249
sub rcx, 0x5c608da9
add rcx, 0x7fffffff
add rcx, 0x132217a8
xor r10, rcx
mov dword [rsp - 0x18], esp
movabs rcx, 0x431c83860e2419de
add rcx, 0x134b5519
add rcx, 0x56ece894
xor rcx, 0x71c7d568
rol r10, 7
rol r10, 2
rol r10, 1
rol r10, 7
add r10, rcx
mov dword [rsp - 0x30], ebp
lea r8d, [r9 + 8]
not r10
xor ecx, ecx
mov r14, r14
rol r10, 0x2e
rol r10, 6
rol r10, 1
rol r10, 2
rol r10, 1
call r10
lea rcx, [rbx + 8]
xchg r11, r11
xorps xmm0, xmm0
mov qword [rbx], rcx
xchg rcx, rsi
movups xmmword [rsi], xmm0
xchg rcx, rsi
xchg rsi, rcx
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rcx
xchg rdx, rcx
movups xmmword [rdx + 0x20], xmm0
xchg rdx, rcx
test eax, eax
je 0x140080fba
mov r10, r10
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff19e5d31b
xor rdx, 0x44462b1b
xor rdx, 0x4833133a
add rdx, 0x580d545
add rdx, 0x7fffffff
add rdx, 0x64ee3f81
nop
mov dword [rsp - 0x24], esp
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140080eda
xchg rbx, rdi
mov rcx, rdi
xchg rdi, rbx
xchg rdx, r9
mov qword [rbx + 0x38], r9
xchg rdx, r9
call fcn.14000ed40
mov r12, r12
xor r8d, r8d
mov rdx, rax
mov ecx, 0x6491358e
sub ecx, 0x4367fcfc
add ecx, 0x5bc229f8
sub ecx, 0x56f47ec6
add ecx, 0x4bc17ba9
cmp qword [rbx + 0x38], r8
jbe 0x140080fc7
mov dword [rsp - 0x28], edi
lea r9, [rsp + 0x20]
mov r10d, 0x47c98ca1
xor r10d, 0x2e1c50c8
sub r10d, 0x5b410cf5
sub r10d, 0xe94ce75
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0x34], 0x2aff014f
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg r12, r12
ror ecx, 2
ror ecx, 4
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
mov rsp, rsp
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x140080f6a
mov r12, r12
mov rax, rbx
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
xchg r8, rdi
mov qword [rbx + 0x38], rdi
xchg r8, rdi
mov rax, rbx
add rsp, 0x230
mov dword [rsp - 0x30], edx
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1400815df
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rsp
mov r11, r9
xchg rsp, r9
nop
sub rsp, 8
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
neg rsp
sub rsp, 0xffffffffffffff58
neg rsp
xorps xmm0, xmm0
xchg rbp, rcx
mov qword [r11 + 8], rcx
xchg rcx, rbp
mov eax, 0x7e77ed6c
sub eax, 0x3c508d3c
xor eax, 0x2fcf56e1
sub eax, 0x6de83692
mov qword [r11 + 0x20], r14
mov r15, r15
cmp r9d, eax
mov qword [r11 - 0x18], r15
movups xmmword [rsp + 0x20], xmm0
cmovbe eax, r9d
mov r12, r12
xchg r8, rbp
mov r8, rbp
xchg rbp, r8
xchg rsp, rbx
movups xmmword [rbx + 0x30], xmm0
xchg rbx, rsp
xor ebx, ebx
mov dword [rsp - 0x2c], edx
mov rsi, rdx
movsxd r14, eax
xchg r9, r15
mov r9, rcx
xchg r9, r15
xchg rsi, rsp
movups xmmword [rsi + 0x40], xmm0
xchg rsp, rsi
xchg rsp, r12
movups xmmword [r12 + 0x50], xmm0
xchg r12, rsp
movups xmmword [rsp + 0x60], xmm0
xchg r13, rsp
movups xmmword [r13 + 0x70], xmm0
xchg r13, rsp
movups xmmword [r11 - 0x38], xmm0
xchg r9, r9
xchg r14, r11
movups xmmword [r14 - 0x28], xmm0
xchg r14, r11
test eax, eax
jle 0x140081754
mov qword [r11 + 0x10], rdi
mov r8, r8
mov edi, ebx
mov qword [r11 + 0x18], r12
movabs r12, 0x525c5e811
sub r12, 0xf185b3b
add r12, 0x2118955c
add r12, 0x7fffffff
add r12, 0x2726c43c
mov ecx, dword [rbp + 0x38]
test ecx, ecx
xchg r14, r14
jg 0x1400816e4
mov edx, ebx
jmp 0x140081715
xchg r8, rax
mov r8, qword [r15]
xchg r8, rax
imul rax, r12
neg rax
add rax, 0xfffffffffffffff5
neg rax
mov qword [r15], rax
shr rax, 5
shr rax, 9
shr rax, 1
shr rax, 1
and eax, 0x7fff
cdq
idiv ecx
mov rbp, rbp
movsxd rdx, edx
xchg rcx, rdi
mov rdi, rbp
xchg rdi, rcx
call fcn.1400536d0
xchg rdi, rdi
mov word [rsp + rdi*2 + 0x20], ax
inc rdi
cmp rdi, r14
mov dword [rsp - 0x24], ebx
jl 0x1400816cf
mov r12, qword [rsp + 0xd0]
xchg rsi, rdi
mov rsi, qword [rsp + 0xc8]
xchg rsi, rdi
mov r15, qword [rsp + 0xa0]
lea rax, [rsi + 8]
mov dword [rsp - 0x40], esp
xchg r11, r14
mov r11, qword [rsp + 0xd8]
xchg r14, r11
xorps xmm0, xmm0
mov rbp, qword [rsp + 0xc0]
nop
movabs rdx, 0xffffffff5cbfedf5
xor rdx, 0x7e27c5c
sub rdx, 0x630205f
sub rdx, 0x38fbb71e
add rdx, 0x7fffffff
xor rdx, 0x63ce45d4
xchg r9, rax
mov qword [rsi], r9
xchg r9, rax
movups xmmword [rax], xmm0
xchg r13, r13
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
movups xmmword [rax + 0x20], xmm0
xchg r11, r11
lea rax, [rsp + 0x20]
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], bx
xchg r14, r14
jne 0x1400817d1
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
mov qword [rsi + 0x38], rdx
call fcn.14000ed40
mov dword [rsp - 0x40], edx
mov edx, 0x331f523d
add edx, 0x44efea0c
sub edx, 0x77ee9778
xor edx, 0x4923e37b
add edx, 0x28b517c3
cmp qword [rsi + 0x38], rbx
jbe 0x140081879
mov rsp, rsp
lea r8, [rsp + 0x20]
mov r9d, 0x5945126d
sub r9d, 0x54bdb97
sub r9d, 0xcbf8927
sub r9d, 0x4739acb0
sub r8, rax
nop
movzx ecx, dx
xchg rbp, rbp
lea rax, [rax + 2]
and cx, r9w
ror edx, 8
mov dword [rsp - 0x34], 0x731341ae
xor cx, word [r8 + rax - 2]
inc rbx
mov word [rax - 2], cx
mov rsi, rsi
cmp rbx, qword [rsi + 0x38]
jb 0x140081846
mov rax, rsi
mov dword [rsp - 0x10], esp
neg rsp
add rsp, 0xffffffffffffff58
neg rsp
pop rsi
pop rbx
xchg r8, r8
ret
Function at 0x140081f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a10c4], 0
jne 0x140082044
xor edx, edx
xchg r10, r10
lea r8, [0x1404a10c0]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x18], 0x665fee3e
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0xc], esi
and ecx, 0xedb88320
inc edx
xor ecx, eax
xchg rsi, rsi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x38], edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rbx, rbx
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x34], ecx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0xc], 0x7c28cd84
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x24], ebx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r13, r13
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov rbp, rbp
shr ecx, 1
and eax, 1
neg eax
xchg rdi, rdi
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x18], 0x7b0c4273
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x20], 0x64a01749
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov r10, r10
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r15, r15
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140081f63
ret