joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046af0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140046b6b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140046b6b
cmp dword [rsp + 0x38], 4
jne 0x140046b6b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a5a90
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140048720
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs r10, 0x8000000000000000
mov r11d, 0xffffffff
cmp rdx, r9
mov r14, r9
cmovb r14, rdx
xor eax, eax
test r14, r14
je 0x14004879e
xor edi, edi
mov r15, qword [r8 + rdi*8]
mov r13, qword [rcx + rdi*8]
mov rsi, r13
xor rsi, r15
mov r12d, eax
lea rax, [rsi - 1]
mov rbx, r13
sub rbx, r15
xor rbx, r13
or rbx, rsi
xor rsi, r10
and rax, rsi
sar rax, 0x3f
and r12d, eax
xor rbx, r13
sar rbx, 0x3f
mov esi, ebx
not esi
and esi, 1
or rsi, rbx
xor rax, r11
and rax, rsi
or rax, r12
inc rdi
cmp rdi, r14
jb 0x14004874e
cmp rdx, r9
jae 0x1400487cb
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1400487a5
xor r10, rcx
dec rcx
and rcx, r10
sar rcx, 0x3f
and eax, ecx
xor r11d, ecx
or r11d, eax
mov eax, r11d
jmp 0x1400487f6
cmp r9, rdx
jae 0x1400487f6
xor edi, edi
or rdi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x1400487d2
xor r10, rdi
dec rdi
and rdi, r10
sar rdi, 0x3f
and eax, edi
not edi
and edi, 1
or edi, eax
mov eax, edi
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140048930
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x140048955
mov rax, qword [rdx]
xor r8d, r8d
mov rsi, r9
or r8, qword [rax + rsi*8]
inc rsi
cmp rsi, r10
jl 0x140048947
jmp 0x140048958
xor r8d, r8d
cmp r10d, r9d
jge 0x14004897c
lea r11, [r10*8]
add r11, qword [rcx]
mov rax, r9
sub rax, r10
xor esi, esi
or r8, qword [r11 + rsi*8]
inc rsi
cmp rax, rsi
jne 0x140048970
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x1400489a6
mov r9, qword [rcx]
mov r11, qword [rdx]
movsxd r10, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp rax, r10
jl 0x140048993
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x14004dea0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14004def6
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rdi, rax
jb 0x14004debc
test rsi, rsi
je 0x14004def6
test eax, eax
jle 0x14004ded6
test byte [rcx], 1
jne 0x14004df25
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14004df14
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.14007efd0
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rdx + 0x10], 0
je 0x14004df4b
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14004df14
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.1400482a0
test rax, rax
je 0x14004dfeb
movsxd rcx, dword [r14 + 0x20]
mov rax, rcx
test rcx, rcx
jle 0x14004df7b
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
je 0x14004df64
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14004df8b
mov dword [r14 + 0x28], 0
mov rax, qword [rdi]
mov r9, qword [rax]
mov esi, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov edi, esi
and edi, 1
neg rdi
mov rax, r9
and rax, rdi
mov rbx, rax
xor rbx, rsi
shr rbx, 1
and rax, rsi
add rax, rbx
and rdi, r8
shr rcx, 1
or rcx, rdi
mov rsi, rax
dec rdx
jne 0x14004dfa7
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
jmp 0x14004df19
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14004df14
Function at 0x14004f5c0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd r8, dword [rcx + 8]
test r8, r8
jle 0x14004f721
movabs r10, 0x8000000000000000
mov r9, qword [rcx]
xor r11d, r11d
xor edx, edx
xor eax, eax
xor r14d, r14d
mov rcx, qword [r9 + rdx*8]
mov rsi, rcx
xor rsi, r10
lea rbx, [rcx - 1]
and rbx, rsi
sar rbx, 0x3f
not rbx
mov ebp, r14d
not ebp
or r14, rbx
mov r15d, ebx
and r15d, ebp
mov rbx, rcx
shl rbx, 0x20
mov rbp, rbx
xor rbp, r10
dec rbx
and rbx, rbp
mov rbp, rbx
shr rbp, 0x3a
and ebp, 0xffffffe0
mov rdi, rcx
shr rdi, 0x20
test rbx, rbx
cmovns rdi, rcx
mov rcx, rdi
shl rcx, 0x30
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3b
and ebx, 0xfffffff0
or ebx, ebp
mov rbp, rdi
shr rbp, 0x10
test rcx, rcx
cmovns rbp, rdi
mov rcx, rbp
shl rcx, 0x38
mov rdi, rcx
xor rdi, r10
dec rcx
and rcx, rdi
mov rdi, rcx
shr rdi, 0x3c
and edi, 0xfffffff8
or edi, ebx
mov rbx, rbp
shr rbx, 8
test rcx, rcx
cmovns rbx, rbp
mov rcx, rbx
shl rcx, 0x3c
mov rbp, rcx
xor rbp, r10
dec rcx
and rcx, rbp
mov rbp, rcx
shr rbp, 0x3d
and ebp, 0xfffffffc
or ebp, edi
mov rsi, rbx
shr rsi, 4
test rcx, rcx
cmovns rsi, rbx
mov rcx, rsi
shl rcx, 0x3e
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3e
and ebx, 0xfffffffe
or ebx, ebp
mov rdi, rsi
shr rdi, 2
test rcx, rcx
cmovns rdi, rsi
shl rdi, 0x3f
mov rcx, rdi
xor rcx, r10
dec rdi
and rdi, rcx
shr rdi, 0x3f
or edi, ebx
add edi, r11d
and edi, r15d
or eax, edi
inc rdx
add r11d, 0x40
cmp rdx, r8
jl 0x14004f5ec
jmp 0x14004f723
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14004fc30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c0
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
test rdx, rdx
je 0x14004fe13
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test byte [0x14012bea7], 0x40
je 0x14004fc85
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.140085f10
test eax, eax
jne 0x14004fcb5
call fcn.140085f50
test eax, eax
je 0x14004fca3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
jmp 0x14004fcb5
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.140085f80
xor eax, eax
movups xmm0, xmmword [rbx + rax]
xorps xmm0, xmmword [rsp + rax + 0x190]
movaps xmmword [rsp + rax + 0x190], xmm0
add rax, 0x10
cmp rax, 0x20
jne 0x14004fcb7
mov ecx, 1
call fcn.14007f330
test rax, rax
je 0x14004fd39
mov r14, rax
mov r12, rax
add r12, 0x120
cmp dword [rax + 0x120], 0x1000
jb 0x14004fdb0
lea rbx, [rsp + 0x60]
mov edx, 0x30
mov rcx, rbx
call fcn.140085f80
mov r8d, 0x30
mov rcx, r14
mov rdx, rbx
call fcn.1400561e0
test eax, eax
je 0x14004fe37
mov qword [r14 + 0x118], 1
jmp 0x14004fda5
mov ecx, 0x128
call fcn.14005ee00
test rax, rax
je 0x14004fd63
mov r14, rax
lea r8, [0x1400564d0]
mov ecx, 1
mov rdx, rax
call fcn.14007f3d0
test eax, eax
jne 0x14004fd68
lea r14, [rsp + 0x60]
mov dword [r14 + 0x124], 0
lea rbx, [rsp + 0x30]
mov edx, 0x30
mov rcx, rbx
call fcn.140085f80
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call fcn.140056100
test eax, eax
je 0x14004fe37
lea r12, [r14 + 0x120]
mov dword [r14 + 0x120], 0
mov eax, 0x20
mov r13d, 0x10000
lea r15, [rsp + 0x190]
cmp rsi, r13
mov ebx, 0x10000
cmovb rbx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.1400562d0
test eax, eax
je 0x14004fe37
inc dword [r12]
add rdi, rbx
mov eax, 0
sub rsi, rbx
jne 0x14004fdc3
lea rax, [rsp + 0x60]
cmp r14, rax
jne 0x14004fe13
lea rcx, [rsp + 0x60]
mov edx, 0x120
call fcn.14005ee80
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400a5a90
nop
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400d7aa0
ud2

Function at 0x140051120
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1400fab70]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x1400fab80]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x1400fab90]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x1400faba0]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14005ab00
mov rcx, rsi
mov rdx, rdi
call fcn.14005ac10
mov edx, 0xd8
mov rcx, rdi
call fcn.14005ee80
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400a5a90
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140056100
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r9, 0x30
ja 0x1400561c2
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
je 0x140056155
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
jne 0x140056145
xor eax, eax
lea rcx, [0x1400fb190]
movaps xmm0, xmmword [rsp + rax + 0x30]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x14005615e
lea r8, [rsi + 0xf8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.1400507d0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a5a90
mov eax, edi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400561e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r8, 0x30
ja 0x1400562a8
mov r12, r8
mov r14, rdx
mov rsi, rcx
lea r15, [rcx + 0xf8]
lea rdi, [rcx + 0x108]
xor ebx, ebx
mov ecx, dword [rsi + 0x114]
call fcn.1400d2640
lea ecx, [rax + 1]
call fcn.1400d2640
mov dword [rsi + 0x114], eax
lea rdx, [rsp + rbx]
add rdx, 0x30
mov rcx, rdi
mov r8, rsi
call qword [rsi + 0xf8]
add rbx, 0x10
cmp rbx, 0x30
jb 0x140056221
test r12, r12
je 0x14005626f
xor eax, eax
mov cl, byte [r14 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r12, rax
jne 0x14005625f
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x20
lea rbx, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9, rbx
call fcn.1400507d0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi], xmm0
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a5a90
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140056be0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x140124058]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x140056c40
lea rcx, [0x14012b908]
lea rdx, [0x140050de0]
call fcn.14007f1c0
lea rax, [0x14012b910]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x140056c77
mov dword [rsp + 0x20], 0x14a
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
jmp 0x140056cac
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffff
cmp rdx, r12
jae 0x140056cd7
mov dword [rsp + 0x20], 0x150
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
call fcn.14007efd0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a5a90
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x140056cf0
mov dword [rsp + 0x20], 0x155
jmp 0x140056c5f
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
add r8, 1
mov qword [rsp + 0x20], rax
xor esi, esi
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.140050d00
test eax, eax
je 0x140056cb1
mov rsi, rdi
sub rsi, r12
add rbp, rsi
mov rcx, qword [rsp + 0x38]
je 0x140056d4c
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1400c9890
mov rcx, qword [rsp + 0x38]
inc r14
mov rax, rbx
not rax
add rsi, rax
mov byte [rcx + rsi], 1
test r12, r12
mov rbp, rcx
je 0x140056d79
lea rcx, [rdi + rbp]
sub rcx, r12
sub rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.1400c9420
lea r8, [0x1400fb1c0]
mov rcx, r14
mov rdx, rbx
call fcn.14004fc30
sub rdi, rbx
mov rcx, rdi
call fcn.14005ee00
test rax, rax
je 0x140056e15
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.140056e40
xor esi, esi
test eax, eax
je 0x140056e08
test rdi, rdi
je 0x140056dd1
xor eax, eax
mov cl, byte [r12 + rax]
xor byte [rbp + rax], cl
inc rax
cmp rdi, rax
jne 0x140056dc1
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rbp
mov r9, rdi
call fcn.140056e40
test eax, eax
je 0x140056e08
mov esi, 1
test ebx, ebx
je 0x140056e08
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x140056df8
mov rcx, r12
call fcn.14005ee30
jmp 0x140056cb1
mov dword [rsp + 0x20], 0x169
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x41
jmp 0x140056cac
Function at 0x14005ef30
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005ef52
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x14005ef3a
ret
xor eax, eax
ret
Function at 0x140064b80
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x28]
call fcn.1400d2640
mov dword [rsi + 0x28], eax
mov ecx, dword [rsi + 0x2c]
call fcn.1400d2640
mov dword [rsi + 0x2c], eax
mov ecx, dword [rsi + 0x30]
call fcn.1400d2640
mov dword [rsi + 0x30], eax
mov ecx, dword [rsi + 0x34]
call fcn.1400d2640
mov dword [rsi + 0x34], eax
mov ecx, dword [rsi + 0x38]
call fcn.1400d2640
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x3c]
call fcn.1400d2640
mov dword [rsi + 0x3c], eax
mov ecx, dword [rsi + 0x40]
call fcn.1400d2640
mov dword [rsi + 0x40], eax
mov ecx, dword [rsi + 0x44]
call fcn.1400d2640
mov dword [rsi + 0x44], eax
mov ecx, dword [rsi + 0x48]
call fcn.1400d2640
mov dword [rsi + 0x48], eax
mov ecx, dword [rsi + 0x4c]
call fcn.1400d2640
mov dword [rsi + 0x4c], eax
mov ecx, dword [rsi + 0x50]
call fcn.1400d2640
mov dword [rsi + 0x50], eax
mov ecx, dword [rsi + 0x54]
call fcn.1400d2640
mov dword [rsi + 0x54], eax
mov ecx, dword [rsi + 0x58]
call fcn.1400d2640
mov dword [rsi + 0x58], eax
mov ecx, dword [rsi + 0x5c]
call fcn.1400d2640
mov dword [rsi + 0x5c], eax
mov ecx, dword [rsi + 0x60]
call fcn.1400d2640
mov dword [rsi + 0x60], eax
mov ecx, dword [rsi + 0x64]
call fcn.1400d2640
mov dword [rsi + 0x64], eax
xor eax, eax
nop
mov ecx, dword [rsi + rax*4 + 0x48]
xor ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, dword [rsi + rax*4 + 0x30]
xor ecx, dword [rsi + rax*4 + 0x28]
rol ecx, 1
mov dword [rsi + rax*4 + 0x68], ecx
add rax, 1
cmp rax, 0x40
jne 0x140064c40
movdqu xmm0, xmmword [rsi + 0x14]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rsi + 0x24]
mov dword [rsi + 0x10], r8d
movd edi, xmm0
pshufd xmm1, xmm0, 0xe5
movd ebp, xmm1
pshufd xmm1, xmm0, 0x4e
movd ecx, xmm1
pshufd xmm1, xmm0, 0xe7
movd r10d, xmm1
xor eax, eax
mov r11d, 0x8f1bbcdc
mov ebx, r8d
nop dword [rax]
mov r14d, edi
mov r9d, r10d
mov r10d, ecx
mov ecx, ebp
mov ebp, edi
rol ebp, 5
cmp rax, 0x14
jae 0x140064ce0
mov edx, ecx
and edx, r10d
mov edi, ecx
not edi
and edi, r9d
or edi, edx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x5a827999
jmp 0x140064d35
cmp rax, 0x28
jae 0x140064d00
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x6ed9eba1
jmp 0x140064d35
cmp rax, 0x3b
ja 0x140064d18
mov edx, r10d
or edx, r9d
and edx, ecx
mov edi, r10d
and edi, r9d
or edi, edx
jmp 0x140064d20
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
cmp rax, 0x3c
mov ebx, 0xca62c1d6
cmovb ebx, r11d
add edi, ebx
rol ecx, 0x1e
add rax, 1
mov ebx, r9d
mov ebp, r14d
cmp rax, 0x50
jne 0x140064ca0
mov dword [rsi + 0x10], r9d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 8], ecx
mov dword [rsi + 4], r14d
mov dword [rsi], edi
movd xmm1, r10d
movd xmm2, ecx
punpckldq xmm2, xmm1
movd xmm1, r14d
movd xmm3, edi
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rsi + 0x14], xmm3
add r8d, r9d
mov dword [rsi + 0x24], r8d
mov dword [rsi + 0x168], 0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140068b10
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140068b29
mov dword [rsi], eax
mov al, 1
jmp 0x140068b2b
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14006c0f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r12, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rbx, r8
jbe 0x14006c114
mov rbx, qword [r8]
movabs rdi, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
jae 0x14006c139
mov rbp, rdi
jmp 0x14006c1c7
movabs rax, 0x100000001b3
mov ecx, r15d
and ecx, 3
cmp rbp, 3
jae 0x14006c153
xor edx, edx
jmp 0x14006c198
mov rsi, r15
sub rsi, rcx
xor edx, edx
nop dword [rax + rax]
movzx ebp, byte [rbx + rdx]
xor rbp, rdi
imul rbp, rax
movzx edi, byte [rbx + rdx + 1]
xor rdi, rbp
imul rdi, rax
movzx ebp, byte [rbx + rdx + 2]
xor rbp, rdi
imul rbp, rax
movzx edi, byte [rbx + rdx + 3]
xor rdi, rbp
imul rdi, rax
add rdx, 4
cmp rsi, rdx
jne 0x14006c160
mov rbp, rdi
test rcx, rcx
je 0x14006c1c7
add rdx, rbx
xor esi, esi
nop word cs:[rax + rax]
nop
movzx ebp, byte [rdx + rsi]
xor rbp, rdi
imul rbp, rax
add rsi, 1
mov rdi, rbp
cmp rcx, rsi
jne 0x14006c1b0
and rbp, qword [r12 + 0x30]
mov r14, qword [r12 + 8]
mov rax, qword [r12 + 0x18]
mov rcx, rbp
shl rcx, 4
mov r13, rbp
add r13, rbp
mov rbp, qword [rax + rcx]
mov rdi, r14
cmp rbp, r14
je 0x14006c210
lea rcx, [r13*8]
or rcx, 8
mov rax, qword [rax + rcx]
mov rdi, qword [rax]
nop word cs:[rax + rax]
nop dword [rax]
cmp rbp, rdi
je 0x14006c24f
mov rdi, qword [rdi + 8]
cmp r15, qword [rdi + 0x20]
jne 0x14006c210
cmp qword [rdi + 0x28], 0xf
jbe 0x14006c230
mov rdx, qword [rdi + 0x10]
jmp 0x14006c234
lea rdx, [rdi + 0x10]
mov rcx, rbx
mov r8, r15
call fcn.1400c9320
test eax, eax
jne 0x14006c210
xor eax, eax
mov rsi, qword [rsp + 0x28]
jmp 0x14006c30d
lea rsi, [r12 + 8]
mov rdx, qword [r14]
mov rcx, rsi
mov r8, qword [rsp + 0x30]
call fcn.14006c490
mov rdx, qword [rsi]
mov rdi, qword [rdx]
mov rax, qword [rdi]
cmp rax, rbp
je 0x14006c2a4
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbp
mov rcx, qword [rbp + 8]
mov qword [rcx], rdi
mov rcx, qword [rbp + 8]
mov rdx, qword [rax + 8]
mov qword [rbp + 8], rdx
mov rdx, qword [rdi + 8]
mov qword [rax + 8], rdx
mov qword [rdi + 8], rcx
mov rdx, qword [r12 + 8]
mov rsi, qword [rsp + 0x28]
mov rcx, qword [r12 + 0x18]
lea rax, [rcx + r13*8]
mov rbx, qword [rcx + r13*8]
cmp rbx, rdx
je 0x14006c2ea
mov rdx, rdi
cmp rbx, rbp
je 0x14006c300
or r13, 1
mov rax, qword [rcx + r13*8]
mov rax, qword [rax]
mov qword [rcx + r13*8], rax
cmp rdi, rax
je 0x14006c303
mov rcx, qword [r12 + 0x18]
lea rax, [rcx + r13*8]
mov rcx, qword [rcx + r13*8]
mov rdx, qword [rcx + 8]
jmp 0x14006c300
mov qword [rax], rdi
shl r13, 3
or r13, 8
add r13, qword [r12 + 0x18]
mov rax, r13
mov rdx, rdi
mov qword [rax], rdx
mov rcx, r12
call fcn.14006c330
mov al, 1
mov qword [rsi], rdi
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14006f5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r13, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x14006f5c7
mov r13, qword [r13]
movabs rsi, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
jae 0x14006f5e2
mov rbx, rsi
jmp 0x14006f678
movabs rax, 0x100000001b3
mov edx, r15d
and edx, 3
cmp rbp, 3
jae 0x14006f5fc
xor ebp, ebp
jmp 0x14006f64d
mov rdi, r15
sub rdi, rdx
xor ebp, ebp
nop word cs:[rax + rax]
nop
movzx ebx, byte [r13 + rbp]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 1]
xor rsi, rbx
imul rsi, rax
movzx ebx, byte [r13 + rbp + 2]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 3]
xor rsi, rbx
imul rsi, rax
add rbp, 4
cmp rdi, rbp
jne 0x14006f610
mov rbx, rsi
test rdx, rdx
je 0x14006f678
add rbp, r13
xor edi, edi
nop word [rax + rax]
movzx ebx, byte [rbp + rdi]
xor rbx, rsi
imul rbx, rax
add rdi, 1
mov rsi, rbx
cmp rdx, rdi
jne 0x14006f660
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov rdi, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, rdi
cmp rdi, r14
jne 0x14006f6b8
jmp 0x14006f6e0
mov rsi, qword [rsi]
cmp rdi, r14
je 0x14006f6e0
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x14006f76d
cmp qword [rsi + 0x20], r15
jne 0x14006f6b0
cmp qword [rsi + 0x28], 0xf
jbe 0x14006f6f0
mov rcx, qword [rsi + 0x10]
jmp 0x14006f6f4
mov rax, r14
cmp rax, rsi
jne 0x14006f6c8
jmp 0x14006f76d
lea rcx, [rsi + 0x10]
mov rdx, r13
mov r8, r15
call fcn.1400c9320
test eax, eax
jne 0x14006f6b0
mov rbx, rsi
cmp rdi, r14
jne 0x14006f718
jmp 0x14006f760
mov rbx, qword [rbx]
cmp rdi, r14
je 0x14006f760
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x14006f768
cmp r15, qword [rbx + 0x20]
jne 0x14006f768
cmp qword [rbx + 0x28], 0xf
jbe 0x14006f740
mov rdx, qword [rbx + 0x10]
jmp 0x14006f744
lea rdx, [rbx + 0x10]
mov rcx, r13
mov r8, r15
call fcn.1400c9320
test eax, eax
je 0x14006f710
jmp 0x14006f768
mov rax, r14
cmp rax, rbx
jne 0x14006f724
cmp rsi, rbx
jne 0x14006f773
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140074630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x1400746b1
xor r11d, r11d
lea r10, [0x140102040]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x140074660
jmp 0x1400746b4
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret