joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
test rax, rax
je 0x14007f4aa
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r9, qword [rbx]
cmp r9, rbx
je 0x14007f4aa
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
mov r10d, 0x811c9dc5
movzx ecx, word [r9 + 0x58]
shr rcx, 1
lea r11, [rax + rcx*2]
cmp rax, r11
je 0x14007f4a2
nop dword [rax + rax]
movsx ecx, byte [rax]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add rax, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp rax, r11
jne 0x14007f470
cmp r10d, 0xa62a3b3b
je 0x14007f4b2
mov r9, qword [r9]
cmp r9, rbx
jne 0x14007f450
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rax, qword [r9 + 0x30]
mov rbx, qword [rsp + 8]
ret

Function at 0x14007f710
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007f7ed
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007f7ed
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007f75a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007f762
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007f7ed
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007f7e5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007f7b0
cmp r10d, 0xbf21a4fa
je 0x14007f804
inc r9
cmp r9, rbx
jb 0x14007f790
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007f7ef
Function at 0x14007f820
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007f8fd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007f8fd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007f86a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007f872
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007f8fd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007f8f5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007f8c0
cmp r10d, 0x97085561
je 0x14007f914
inc r9
cmp r9, rbx
jb 0x14007f8a0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007f8ff

Function at 0x14007f930
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007fa0d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007fa0d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007f97a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007f982
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007fa0d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007fa05
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007f9d0
cmp r10d, 0x3d71f40a
je 0x14007fa24
inc r9
cmp r9, rbx
jb 0x14007f9b0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007fa0f
Function at 0x14007fa40
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007fb1d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007fb1d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007fa8a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007fa92
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007fb1d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007fb15
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007fae0
cmp r10d, 0xe054604a
je 0x14007fb34
inc r9
cmp r9, rbx
jb 0x14007fac0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007fb1f

Function at 0x14007fb50
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007fc2d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007fc2d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007fb9a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007fba2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007fc2d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007fc25
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007fbf0
cmp r10d, 0xddeaabca
je 0x14007fc44
inc r9
cmp r9, rbx
jb 0x14007fbd0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007fc2f
Function at 0x14007fc60
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007fd3d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007fd3d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007fcaa
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007fcb2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007fd3d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007fd35
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007fd00
cmp r10d, 0x4ecb007a
je 0x14007fd54
inc r9
cmp r9, rbx
jb 0x14007fce0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007fd3f

Function at 0x14007fd70
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007fe4d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007fe4d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007fdba
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007fdc2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007fe4d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007fe45
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007fe10
cmp r10d, 0xde10f3da
je 0x14007fe64
inc r9
cmp r9, rbx
jb 0x14007fdf0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007fe4f
Function at 0x14007fe80
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14007ff5d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14007ff5d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007feca
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007fed2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14007ff5d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14007ff55
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14007ff20
cmp r10d, 0xd07708df
je 0x14007ff74
inc r9
cmp r9, rbx
jb 0x14007ff00
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14007ff5f

Function at 0x14007ff90
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14008006d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14008006d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14007ffda
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14007ffe2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14008006d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140080065
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140080030
cmp r10d, 0xe049c205
je 0x140080084
inc r9
cmp r9, rbx
jb 0x140080010
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14008006f
Function at 0x1400800a0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14008017d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14008017d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x1400800ea
mov ecx, dword [rax + r11 + 0x78]
jmp 0x1400800f2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14008017d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140080175
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140080140
cmp r10d, 0xe082843
je 0x140080194
inc r9
cmp r9, rbx
jb 0x140080120
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14008017f

Function at 0x1400801b0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14008028d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14008028d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x1400801fa
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140080202
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14008028d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140080285
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140080250
cmp r10d, 0x1a946df0
je 0x1400802a4
inc r9
cmp r9, rbx
jb 0x140080230
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14008028f
Function at 0x1400802c0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14008039d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14008039d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14008030a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140080312
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14008039d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140080395
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140080360
cmp r10d, 0x3546aa24
je 0x1400803b4
inc r9
cmp r9, rbx
jb 0x140080340
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14008039f

Function at 0x1400803d0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x1400804ad
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400804ad
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14008041a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140080422
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x1400804ad
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400804a5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140080470
cmp r10d, 0xd8133d9d
je 0x1400804c4
inc r9
cmp r9, rbx
jb 0x140080450
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x1400804af
Function at 0x140080710
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x1400807ed
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400807ed
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14008075a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140080762
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x1400807ed
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400807e5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400807b0
cmp r10d, 0xa623a735
je 0x140080804
inc r9
cmp r9, rbx
jb 0x140080790
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x1400807ef

Function at 0x140080820
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x1400808fd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400808fd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14008086a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140080872
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x1400808fd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400808f5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400808c0
cmp r10d, 0xb63ca8f7
je 0x140080914
inc r9
cmp r9, rbx
jb 0x1400808a0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x1400808ff