joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e648
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push rbx
mov qword [rsp], r14
push r15
add rsp, 0xffffffffffffffe0
mov rbx, rcx
mov dword [rsp - 0x18], ebx
mov r13d, r8d
mov r9d, 0x5593770a
xor r9d, 0xa61ff39
sub r9d, 0x425c92cf
xor r9d, 0x1f83442d
sub r9d, 0x212b149
xchg rdx, rbx
mov r12, rbx
xchg rbx, rdx
cmp r8d, r9d
xchg r12, r12
pushf
movabs rcx, 0xffffffff6956e642
xor rcx, 0x27bf9e3c
sub rcx, 0x21f53c0c
add rcx, 0x7fffffff
add rcx, 0x530bc38e
popf
pushf
mov eax, 0x69b4d84e
xor eax, 0x42117b15
sub eax, 0x5fc1a3c
xor eax, 0x25a9891b
popf
cmovb r9d, r13d
mov r12, r12
mul r9
cmovo rax, rcx
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.140097bc0
lea r15d, [r13 + 0xfffff]
mov dword [rsp - 0xc], ebp
xor esi, esi
shr r15d, 0xf
shr r15d, 3
shr r15d, 1
shr r15d, 1
xchg rsp, rax
mov rbp, rsp
xchg rsp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x4983dc35
xor ebx, 0x52c2f58c
sub ebx, 0xb7ac35b
xor ebx, 0x148c99fd
sub ebx, 0x1b4affa2
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
test r15d, r15d
mov rcx, rcx
je 0x14007e863
mov eax, 0x29da1766
sub eax, 0xa6729cc
add eax, 0x17e7ce17
xor eax, 0x6f7bb9be
xor eax, 0x5831020f
mov rcx, qword [rsp + 0x60]
mov r14d, esi
shl r14d, 2
shl r14d, 0x12
mov edi, r13d
sub edi, r14d
mov dword [rsp - 0x28], esi
xchg rdx, r14
mov r14, rbp
xchg rdx, r14
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov dword [rsp - 0x20], ecx
call fcn.140091f40
test al, al
je 0x14007e859
mov dword [rsp - 0x20], edx
shr edi, 1
shr edi, 1
xor r8d, r8d
mov r8, r8
shr r14d, 1
shr r14d, 1
test edi, edi
mov rdx, rdx
je 0x14007e828
mov r15d, dword [rsp + 0x70]
xchg r9, r10
mov r10, rbp
xchg r10, r9
lea eax, [r14 + r8]
xchg r13, r13
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov dword [rsp - 0x24], ecx
xor edx, 0x26f16147
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg r8, r8
jb 0x14007e7f5
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x3343082e
add eax, 0x3577d9aa
sub eax, 0xeb5bb63
xor eax, 0x1bfe4128
sub eax, 0x41eb675d
cmp esi, r15d
mov dword [rsp - 0x24], 0x32546530
jb 0x14007e78c
jmp 0x14007e863
xor bl, bl
mov dword [rsp - 0x28], 0x65effb2b
mov rcx, rbp
call fcn.140097bd0
mov al, bl
mov r13, r13
xchg r14, rbx
mov r14, qword [rsp + 0x68]
xchg rbx, r14
nop
add rsp, 0x6df862ba
sub rsp, 0x6df8629a
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0x3c], ebp
ret
Function at 0x14007f290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rbp
mov qword [rsp + 0x10], r14
xchg rbp, r14
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x28], edi
push rdi
nop
push 0x59703970
mov qword [rsp], r12
push r13
mov dword [rsp - 0x20], 0x31bf1c38
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov dword [rsp - 0x20], esi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r15, rsi
mov rsi, rcx
xchg r15, rsi
mov r14d, r8d
mov dword [rsp - 0x44], ecx
mov r9d, 0x4984d49a
xor r9d, 0x235f480e
sub r9d, 0x476b5c6b
add r9d, 0x48bdcc16
xor r9d, 0x6c2a0c3f
mov r12, rdx
mov dword [rsp - 0x14], ecx
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff6ff9130b
xor rcx, 0x25a071bd
add rcx, 0x2550d656
add rcx, 0x7fffffff
add rcx, 0x1055c6f4
popf
pushf
mov eax, 0x7c31d751
sub eax, 0x6256b3a7
xor eax, 0x665c7c37
sub eax, 0x3b68c758
sub eax, 0x441e9841
popf
cmovb r9d, r14d
mov r9, r9
mul r9
cmovo rax, rcx
mov rcx, rax
xchg r15, r15
call fcn.140097bc0
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
xchg rsp, rsp
shr ebp, 4
shr ebp, 6
shr ebp, 7
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor edi, edi
mov rsi, rax
mov ebx, 0x32c0b509
xor ebx, 0x7a7f80f1
xor ebx, 0x419493e9
xor ebx, 0x2de576d1
sub ebx, 0x24ced0bf
test ebp, ebp
mov dword [rsp - 0x1c], esp
je 0x14007f491
mov eax, 0x1f598ef5
add eax, 0x17be75f5
xor eax, 0x6e022d77
sub eax, 0x590a299d
mov r9d, edi
mov r8d, r14d
shl r9d, 7
shl r9d, 0xd
sub r8d, r9d
cmp r8d, eax
mov r8, r8
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov r13, r13
xor r10d, r10d
shr r11d, 2
test r11d, r11d
je 0x14007f447
mov dword [rsp - 0x28], ebx
xchg r15, rdx
mov r15, rsi
xchg rdx, r15
lea ecx, [r9 + r10]
mov eax, r13d
mov r11, r11
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x26f16147
mov dword [rsp - 0x2c], 0x48ef0fa9
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14007f417
mov r14, r14
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
mov rcx, r15
mov r15, r15
call fcn.140092320
test al, al
je 0x14007f48c
xchg r15, r15
add edi, ebx
mov eax, 0x1e4d8e5d
xor eax, 0x65b4ab2b
sub eax, 0x3fbef72f
sub eax, 0x3c2a2e47
cmp edi, ebp
mov r9, r9
jb 0x14007f3d3
jmp 0x14007f491
xor bl, bl
xchg r9, r9
mov rcx, rsi
call fcn.140097bd0
mov rbp, qword [rsp + 0x58]
mov dword [rsp - 0x2c], ecx
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
xchg rbx, rbx
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
mov dword [rsp - 0x30], ebx
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400820d0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x10], 0x1144483
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x20
mov dword [rsp - 0x3c], ebp
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, r9
mov r9, rdx
xchg r9, rdi
xchg rcx, r10
mov rsi, r10
xchg rcx, r10
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140083e90
mov dword [rsp - 0x38], ecx
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov dword [rsp - 0x3c], 0x66de6143
xchg rbx, rax
mov r10, rbx
xchg rbx, rax
mov ebx, r14d
mov dword [rsp - 0x18], edx
test ebp, ebp
je 0x1400822b3
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov r11, r11
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
xchg r12, r12
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
mov dword [rsp - 0x34], esp
add rdx, rax
cmp r14w, cx
jae 0x1400821f1
mov eax, dword [rdx + 8]
xchg rbp, rbp
test eax, eax
jne 0x1400821ac
mov eax, dword [rdx + 0x10]
mov dword [rsp - 0x28], 0xe0b4ef9
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x1400821c9
mov dword [rsp - 0x20], edi
add eax, r9d
cmp r11d, eax
jb 0x14008226d
inc r8w
xchg rbx, rbx
nop
sub rdx, 0x6c5efece
add rdx, 0x6c5efef6
cmp r8w, cx
mov dword [rsp - 0xc], 0x5c1bb2d0
jb 0x140082193
xchg r14, r9
mov r8, r9
xchg r9, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
nop
sub rax, 0x13b4fd72
add rax, 0x13b4fd6a
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
mov rbp, rbp
je 0x1400822a5
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x44], 0x247c7b9a
movzx eax, word [r10]
mov ecx, eax
shr ecx, 3
shr ecx, 5
shr ecx, 2
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140082282
cmp ecx, 0xa
mov rbx, rbx
jne 0x14008228e
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x14008228e
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov r11, r11
add r8, r11
jmp 0x1400821fa
and eax, 0xfff
xchg rsp, rsp
add dword [rax + r8], edi
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
xchg r11, r11
jne 0x140082237
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140082160
xchg rbp, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x34], 0x18a7a344
nop
add rsp, 0x227c4836
sub rsp, 0x227c4816
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140083f40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rdi, rbx
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov dword [rsp - 0x14], 0x18ca6edf
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0xd1e27e5
mov qword [rsp], r15
nop
add rsp, 0x7321c152
sub rsp, 0x7321c172
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x26f16147
xchg r9, r9
mov rsi, rcx
cmp eax, 0x26f13b0a
jne 0x140084108
mov r13, r13
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x26f16147
cmp eax, 0x26f12417
mov rdi, rdi
jne 0x140084108
mov edx, dword [rdx + rcx + 0x88]
call fcn.140083e90
mov rcx, rsi
xchg rcx, rcx
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
mov dword [rsp - 0x40], edx
call fcn.140083e90
mov edx, dword [r14 + 0x24]
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
mov r12, rax
call fcn.140083e90
mov dword [rsp - 0x28], esi
mov edx, dword [r14 + 0x1c]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r13, rax
call fcn.140083e90
xor edi, edi
mov dword [rsp - 0x40], 0x4d437b76
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140084108
nop dword [rax]
mov dword [rsp - 0x10], esp
mov edx, dword [r12 + rdi*4]
xchg rsi, r12
mov rcx, r12
xchg rsi, r12
call fcn.140083e90
mov ecx, 0x6b998982
xor ecx, 0xf7d64d2
add ecx, 0x6a4312f
add ecx, 0x94ac0fb
xor ecx, 0x8b2c2085
xchg rdx, rbx
mov rdx, rax
xchg rdx, rbx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x1400840e6
mov dword [rsp - 0x40], ecx
nop dword [rax]
xchg rdi, rbx
mov rdx, rdi
xchg rbx, rdi
lea rcx, [rsp + 0x60]
mov r8d, 0x4364a451
add r8d, 0x66832c6
add r8d, 0x2360644
xor r8d, 0x2af27be2
sub r8d, 0x66f0a6b8
inc rbx
mov rdi, rdi
call fcn.14008d1e0
cmp byte [rbx], 0
jne 0x14008409a
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x3c], esi
not ecx
cmp ecx, r15d
je 0x14008414a
mov dword [rsp - 0x44], 0x4be0d7f6
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14008404e
xchg r8, r8
xor eax, eax
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x67ecb29d
sub rsp, 0x67ecb27d
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
pop rsi
mov r10, r10
pop rbp
ret
movzx edx, word [r13 + rdi*2]
xchg r8, rsi
mov rcx, r8
xchg r8, rsi
xchg r12, rax
mov r12, qword [rsp + 0x70]
xchg r12, rax
mov edx, dword [rax + rdx*4]
call fcn.140083e90
jmp 0x14008410a
Function at 0x1400884f5
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov dword [rsp - 0x14], ecx
nop
add rsp, 0x10d73e63
sub rsp, 0x10d73ec3
mov rbx, qword [rcx]
xchg rdx, rdx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, r10
mov qword [rsp + 0x70], r10
xchg r10, rsi
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x24], 0x1eda6ea5
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rsp, r14
movups xmmword [r14 + 0x28], xmm0
xchg rsp, r14
lea rdx, [rsi + 1]
xchg rsp, rsp
xchg rsi, rsp
movups xmmword [rsi + 0x38], xmm0
xchg rsi, rsp
xchg rsp, rdx
movups xmmword [rdx + 0x48], xmm0
xchg rdx, rsp
call fcn.140017bec
mov edx, 0x20380621
xor edx, 0x4f896c4b
xor edx, 0x7a1443e7
add edx, 0x582eaffd
sub edx, 0x1050a7d2
test rsi, rsi
je 0x1400885dd
mov dword [rsp - 0x40], edx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x38], 0x1c9990c6
mov r8, rsi
mov r9d, 0x114a9e92
xor r9d, 0x313aa60b
xor r9d, 0x9dbe519
xor r9d, 0x29abdd7f
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg rsi, rsi
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r12, r12
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400885b4
xor ecx, ecx
xchg rbp, rbp
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.140088680
mov r9, r9
xchg r14, rcx
mov r14, qword [rsp + 0x20]
xchg r14, rcx
mov ebx, eax
mov rsi, qword [rsp + 0x70]
xchg rbp, rbp
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140088662
xor eax, eax
mov dword [rsp - 0x40], 0x4e2ab67b
lea rdi, [rsp + 0x28]
mov ecx, 0x69fc7a14
add ecx, 0x3c139b0
sub ecx, 0x4d23e351
add ecx, 0x32776ea0
xor ecx, 0x53113f23
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x78]
xchg rbp, rbp
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x28], 0x60e99d95
ret
call fcn.140097d00
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov rdx, rdx
add rsp, 0x60
pop rdi
ret
Function at 0x140089b16
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r14
mov r11, r14
xchg r14, rsp
xchg rsi, rbx
mov qword [r11 + 0x20], rsi
xchg rsi, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0xf4f46b1
sub rsp, 0xf4f4711
xchg r14, rbx
mov r14, qword [rcx]
xchg r14, rbx
lea rax, [r11 - 0x40]
mov dword [rsp - 0x30], edi
xchg rsp, rbp
mov qword [r11 + 8], rsp
xchg rbp, rsp
xorps xmm0, xmm0
mov dword [rsp - 0x44], ecx
xchg r10, rax
mov qword [r11 - 0x48], r10
xchg r10, rax
mov ebp, r8d
mov dword [rsp - 0x44], esp
xchg r10, rsi
mov qword [r11 + 0x10], r10
xchg r10, rsi
xchg r11, rsi
mov r11, qword [rcx + 0x38]
xchg rsi, r11
lea rcx, [r11 - 0x48]
mov dword [rsp - 0x2c], 0x8f4805b
xchg r9, r14
mov qword [r11 + 0x18], r9
xchg r9, r14
mov r14, rdx
xchg rdi, rdi
xchg rsi, rsp
movups xmmword [rsi + 0x28], xmm0
xchg rsi, rsp
lea rdx, [rsi + 1]
mov r13, r13
xchg r9, rsp
movups xmmword [r9 + 0x38], xmm0
xchg r9, rsp
xchg rsp, r15
movups xmmword [r15 + 0x48], xmm0
xchg r15, rsp
call fcn.140017bec
mov edx, 0xbf6999d
xor edx, 0x1f37b042
xor edx, 0x191a3d46
add edx, 0x21c3f1fe
add edx, 0x2de42b21
test rsi, rsi
je 0x140089ba7
mov r13, r13
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r14, r14
xchg r11, rsi
mov r8, r11
xchg rsi, r11
mov r9d, 0x1167098c
add r9d, 0x3274112b
add r9d, 0x15c70eae
add r9d, 0xc411e15
xor r9d, 0x65e34785
nop word [rax + rax]
mov dword [rsp - 0x10], 0x22a64b82
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 2
ror edx, 4
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r13, r13
mov word [rdi - 2], cx
sub r8, 1
jne 0x140089b7c
xor ecx, ecx
mov dword [rsp - 0x24], 0x7c251694
mov r8d, ebp
mov word [rax + rsi*2], cx
mov rdx, r14
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x18], ebx
call fcn.140089c80
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov dword [rsp - 0x34], 0x6c63d60d
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rcx, rsi
mov rcx, qword [rsp + 0x78]
xchg rcx, rsi
xchg rbp, rsi
mov rsi, qword [rsp + 0x70]
xchg rsi, rbp
cmp rcx, rax
jne 0x140089c48
xor eax, eax
mov r14, r14
lea rdi, [rsp + 0x28]
mov ecx, 0x6a002e44
sub ecx, 0x42086126
add ecx, 0x27ed66ed
sub ecx, 0x4fe533db
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov r11, r11
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140097d00
mov rbx, rbx
mov eax, ebx
xchg rbx, r15
mov r15, qword [rsp + 0x88]
xchg rbx, r15
nop
add rsp, 0x4b50c43b
sub rsp, 0x4b50c3db
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008d520
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142084], 0
jne 0x14008d630
xchg rbp, rbp
xor edx, edx
lea r8, [0x140142080]
nop word [rax + rax]
mov rsi, rsi
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov r15, r15
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x40], 0x3bd31d41
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x38], ebp
shr ecx, 1
and eax, 1
neg eax
mov rsp, rsp
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x38], 0x26851c6f
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg rbp, rbp
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x34], 0x2e1696ce
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x44], 0x6cd1c593
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x18], ebx
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov rdx, rdx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov rbx, rbx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x30], 0x16bf9fef
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x24], 0x1eb6c5c9
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x2c], esi
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov rbx, rbx
cmp edx, 0x100
jb 0x14008d546
ret
Function at 0x140092ad4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rbp
mov qword [rsp + 0x10], rdi
xchg rdi, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0xc], edi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x274ae8a3
add rsp, 0x274ae883
movzx eax, byte [rdx + 1]
xchg r10, r10
xchg r8, r15
mov r8, r15
xchg r8, r15
movzx ebx, byte [rdx]
mov r14, r14
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 3
shl ebx, 1
shl ebx, 1
shl ebx, 2
shl ebx, 1
dec r8d
mov dword [rsp - 0x3c], 0x2a3a552f
or ebx, eax
shl edi, 4
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 5
shl ebx, 3
or ebx, eax
movzx eax, byte [rdx + 3]
mov rbp, rbp
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x18], 0x47dd485b
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 3
shl edi, 1
shl edi, 4
or edi, eax
mov r13, r13
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 1
shl edi, 3
or edi, eax
test r8d, r8d
mov dword [rsp - 0x10], 0x385d85af
jle 0x140092c32
xchg rdx, r8
mov r8, qword [rcx + 8]
xchg rdx, r8
lea r14d, [r8 - 1]
movsxd rax, r8d
xchg r15, r15
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
mov r15, r15
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov r11, r11
mov rdx, rsi
mov ecx, edi
call fcn.140093350
xor ebx, eax
mov dword [rsp - 0xc], 0x57f27ca
mov rdx, rbp
mov ecx, ebx
call fcn.140093350
mov dword [rsp - 0x20], 0x2a3ee026
xor edi, eax
sub rsi, 0x18
nop
sub rbp, 0x6b43f033
add rbp, 0x6b43f01b
sub r14, 1
xchg rbp, rbp
jne 0x140092bea
lea rax, [r15 + 7]
mov ecx, 0xf271846
add ecx, 0x62c8399e
sub ecx, 0x16b1e6ac
xor ecx, 0xb36df8b
sub ecx, 0x500bb4af
mov byte [rax - 4], dil
mov dword [rsp - 0x30], edx
mov byte [rax], bl
dec rax
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 8
xchg rbp, rbp
sub rcx, 1
jne 0x140092c53
mov rbx, qword [rsp + 0x40]
xchg r12, rbp
mov r12, qword [rsp + 0x48]
xchg r12, rbp
xchg rsi, r14
mov r14, qword [rsp + 0x50]
xchg rsi, r14
nop
add rsp, 0xedd5136
sub rsp, 0xedd5116
pop r15
xchg rcx, rcx
pop r14
pop rdi
ret
Function at 0x140092cac
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r14
mov rax, r14
xchg rsp, r14
xchg rbx, rdi
mov qword [rax + 8], rdi
xchg rdi, rbx
xchg rbp, r15
mov qword [rax + 0x10], r15
xchg r15, rbp
xchg r13, rsi
mov qword [rax + 0x18], r13
xchg r13, rsi
xchg rdi, r11
mov qword [rax + 0x20], r11
xchg r11, rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x20
mov dword [rsp - 0x10], 0x396df906
movzx eax, byte [rdx + 1]
xchg r8, r14
mov r8, r14
xchg r14, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x24], ebx
shl ebx, 2
shl ebx, 1
shl ebx, 4
shl ebx, 1
or ebx, eax
xchg r15, r15
shl edi, 1
shl edi, 1
shl edi, 2
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
mov rsi, rsi
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
mov r9, r9
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov r12, r12
shl edi, 8
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x44], edx
test eax, eax
jle 0x140092dcc
mov rsi, qword [rcx + 8]
lea ebp, [rax - 1]
mov dword [rsp - 0xc], 0xf110ba3
shr ebp, 1
inc ebp
mov rdx, rsi
xchg r11, r11
mov ecx, edi
call fcn.140093350
xor ebx, eax
xchg r10, r10
lea rdx, [rsi + 0xc]
mov ecx, ebx
call fcn.140093350
mov dword [rsp - 0x14], 0x64d42743
xor edi, eax
nop
sub rsi, 0x67926156
add rsi, 0x6792616e
sub rbp, 1
jne 0x140092d84
mov dword [rsp - 0x20], 0x6dffeb67
lea rax, [r14 + 7]
mov ecx, 0x21c6981b
xor ecx, 0x6b180797
sub ecx, 0x1e94a9b4
sub ecx, 0x2c49f5d4
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x40], edx
dec rax
shr ebx, 8
shr edi, 4
shr edi, 2
shr edi, 1
shr edi, 1
sub rcx, 1
xchg r15, r15
jne 0x140092de7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, r13
mov r13, qword [rsp + 0x40]
xchg rsi, r13
xchg rdi, r12
mov r12, qword [rsp + 0x48]
xchg r12, rdi
nop
sub rsp, 0x53fe7749
add rsp, 0x53fe7769
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140093024
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001dd0]
mov rcx, rcx
xor edi, edi
movdqa xmm1, xmmword [0x140001e40]
xchg rdx, rbp
mov rbx, rbp
xchg rbp, rdx
xchg rbp, r14
movdqu xmmword [r14 - 0x39], xmm0
xchg r14, rbp
mov rsi, rcx
mov dword [rsp - 0x2c], edi
mov edx, edi
movdqa xmm0, xmmword [0x140001e50]
mov r8d, edi
movdqu xmmword [rbp - 0x29], xmm1
xchg r13, r13
movdqa xmm1, xmmword [0x140001e60]
xchg r9, rbp
movdqu xmmword [r9 - 0x19], xmm0
xchg rbp, r9
xchg rbp, rbx
movdqu xmmword [rbx - 9], xmm1
xchg rbp, rbx
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0x28df87e2
add eax, 0x2e4c9dc6
sub eax, 0x47cd5e57
add eax, 0x110aa004
inc rdx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
xchg r14, r14
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x1400930c7
cmp dword [rsi + 4], 8
mov dword [rsp - 0x28], 0x6633b3a0
jne 0x140093173
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
mov dword [rsp - 0x38], 0x3e554ee
inc rdi
shl cx, 8
or cx, ax
mov r12, r12
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
mov rdx, rdx
jl 0x140093113
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x38], 0xa42dd44
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
call fcn.140092e48
mov dword [rsp - 0x34], 0x296b7d15
jmp 0x140093234
cmp dword [rsi], edi
jle 0x140093234
mov r14d, edi
xchg r12, r12
lea rdx, [rbp + 0x6d]
mov r8d, 0x3f25fff4
xor r8d, 0x22456e35
add r8d, 0x4e92f31d
sub r8d, 0x6bf384da
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov dword [rsp - 0x38], 0x6d2a9b7a
nop
add rbx, 0x33193c13
sub rbx, 0x33193c11
shl ax, 8
mov dword [rsp - 0xc], ecx
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
mov dword [rsp - 0x44], esp
jne 0x1400931a0
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0xc], 0x3054493
mov rcx, rsi
call fcn.140092e48
mov r8d, dword [rsi + 4]
mov rcx, rcx
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
neg r8d
sub r8d, 0xfffffff8
neg r8d
xchg rcx, r8
mov r8, rsi
xchg rcx, r8
call fcn.140092e48
inc edi
sub r14d, 0xfffffff8
mov rbx, rbx
cmp edi, dword [rsi]
jl 0x140093181
xor eax, eax
lea r11, [rsp + 0xa0]
mov dword [rsp - 0x3c], 0x2f045005
mov rbx, qword [r11 + 0x28]
lea rdi, [rbp + 7]
xchg rbx, rsi
mov rbx, qword [r11 + 0x30]
xchg rbx, rsi
lea ecx, [rax + 0x40]
xchg r14, r14
rep stosb byte [rdi], al
xchg rsp, rbp
mov rbp, r11
xchg rbp, rsp
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret

Function at 0x140093308
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov rbx, rbx
test edx, edx
je 0x14009334a
lea ecx, [r11 + r11]
mov r9d, r10d
mov r9, r9
xor r9d, r11d
mov r11d, ecx
test dl, 1
mov r10, r10
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov rdi, rdi
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
jne 0x140093315
mov dword [rsp - 0x24], esi
mov eax, r10d
ret