joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r10, qword [rdx + 0x10]
jb 0x14005893e
mov rdx, qword [rdx]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x140058974
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
inc r9
xor r8, rax
imul r8, r11
cmp r9, r10
jb 0x140058960
mov rax, qword [rcx + 0x30]
and rax, r8
ret

Function at 0x14005b630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, rdx
mov r14, rcx
mov rdi, qword [rcx + 0x20]
cmp rdi, qword [rcx + 0x10]
je 0x14005b7c5
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, qword [r14]
mov r12, qword [rdi + 0x10]
mov r8, rdi
mov r9, qword [rdi + 0x18]
cmp r9, 0x10
jb 0x14005b694
mov r8, qword [rdi]
mov rdx, rax
xor eax, eax
test r12, r12
je 0x14005b6b4
nop
movzx ecx, byte [rax + r8]
xor rdx, rcx
imul rdx, r11
inc rax
cmp rax, r12
jb 0x14005b6a0
mov rax, qword [r10 + 0x30]
and rax, rdx
shl rax, 4
mov rcx, qword [r10 + 0x18]
mov qword [rsp + 0x80], rcx
mov r13, qword [rcx + rax]
mov rbx, r13
add rax, 8
mov qword [rsp + 0x90], rax
mov rbp, qword [r10 + 8]
cmp r13, rbp
jne 0x14005b6ec
mov rax, rbp
jmp 0x14005b6f3
mov rax, qword [rax + rcx]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005b76e
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r9, 0x10
jb 0x14005b708
mov rdx, qword [rdi]
mov rsi, qword [rcx + 0x10]
mov r15, qword [rcx + 0x18]
cmp r15, 0x10
jb 0x14005b719
mov rcx, qword [rcx]
cmp rsi, r12
jne 0x14005b72e
mov r8, rsi
call fcn.14016dc00
test eax, eax
je 0x14005b743
mov r9, qword [rdi + 0x18]
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
jmp 0x14005b6e2
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14005b750
mov rdx, qword [rdx]
cmp qword [rdi + 0x18], 0x10
jb 0x14005b75a
mov rdi, qword [rdi]
cmp r12, rsi
jne 0x14005b76e
mov r8, r12
mov rcx, rdi
call fcn.14016dc00
test eax, eax
je 0x14005b771
mov rbx, rbp
mov rax, qword [r14]
cmp rbx, qword [rax + 8]
je 0x14005b7aa
lea rcx, [r14 + 0x68]
lea r8, [rbx + 0x30]
lea rdx, [rsp + 0x28]
call fcn.14004cd20
mov rdi, qword [rsp + 0x28]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
test al, al
jne 0x14005b811
cmp qword [rdi + 0x30], 0
je 0x14005b7e7
add qword [r14 + 0x20], 0x20
mov rdi, qword [r14 + 0x20]
cmp rdi, qword [r14 + 0x10]
jne 0x14005b669
mov rax, qword [rsp + 0x88]
mov rcx, rax
call fcn.14001d000
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsp + 0x88]
mov rdx, qword [r14 + 0x20]
mov rcx, r14
call fcn.14005a5c0
add qword [r14 + 0x20], 0x20
mov rcx, qword [rsp + 0x88]
call fcn.14001d000
mov al, 1
jmp 0x14005b7cf
mov r8, qword [rsp + 0x88]
mov rdx, qword [r14 + 0x20]
mov rcx, r14
call fcn.14005a5c0
nop
mov rcx, qword [rsp + 0x88]
call fcn.14001d000
mov al, 1
jmp 0x14005b7cf
Function at 0x14005bad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14005bb04
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14005baf0
ret

Function at 0x14005c1b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r11, qword [r8 + 0x18]
mov rdi, r8
mov r14, qword [r8 + 0x10]
mov r12, rdx
mov rsi, rcx
mov r10, r8
cmp r11, 0x10
jb 0x14005c1de
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x14005c214
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x14005c200
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x30]
mov rsi, qword [rsi + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r15
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x50], rax
cmp r13, rsi
jne 0x14005c24e
mov rax, rsi
jmp 0x14005c254
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005c2cd
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r11, 0x10
jb 0x14005c269
mov rdx, qword [rdi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x14005c27a
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x14005c28f
mov r8, rbp
call fcn.14016dc00
test eax, eax
je 0x14005c299
mov r11, qword [rdi + 0x18]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x14005c244
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14005c2a6
mov rdx, qword [rdx]
cmp qword [rdi + 0x18], 0x10
jb 0x14005c2b0
mov rdi, qword [rdi]
cmp r14, rbp
jne 0x14005c2c4
mov r8, r14
mov rcx, rdi
call fcn.14016dc00
test eax, eax
je 0x14005c2c7
mov rbx, rsi
mov qword [r12], rbx
jmp 0x14005c2d1
mov qword [r12], rsi
mov r15, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14005c2f0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, qword [r8]
mov r11, rdx
mov rdx, rcx
movabs r8, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
mov rax, r10
shr rax, 8
movzx r9d, al
movzx eax, r10b
xor rax, rcx
imul rax, r8
xor r9, rax
mov rax, r10
imul r9, r8
shr rax, 0x10
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x18
imul r9, r8
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x20
imul r9, r8
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x28
imul r9, r8
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x30
imul r9, r8
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x38
mov rcx, qword [rdx + 0x18]
imul r9, r8
xor r9, rax
imul r9, r8
mov r8, qword [rdx + 0x30]
mov rdx, qword [rdx + 8]
and r8, r9
shl r8, 4
mov r9, qword [rcx + r8]
add r8, rcx
mov rax, r9
nop word [rax + rax]
cmp r9, rdx
jne 0x14005c3ba
mov rcx, rdx
jmp 0x14005c3c1
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14005c3d8
cmp qword [rax + 0x10], r10
je 0x14005c3d1
mov rax, qword [rax]
jmp 0x14005c3b0
mov qword [r11], rax
mov rax, r11
ret
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x14006ef70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x14006f080
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14006f080
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
cmp qword [r10], rcx
jne 0x14006f038
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.14014f740
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14006f1ab
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14006f0ba
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14006f0d7
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x14006f106
cmp rax, rbx
jne 0x14006f0e2
mov qword [rdx + r8*8], rdi
jmp 0x14006f106
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x14006f106
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1401b6b20]
test rax, rax
jns 0x14006f127
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14006f138
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14006f1a0
cmp rdx, 0x200
jae 0x14006f154
lea rdx, [rdx*8]
jmp 0x14006f166
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14006f166
add rdx, rdx
mov rcx, rsi
call fcn.14001ddb0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14006f1a0
mov r15, qword [rax + 8]
nop dword [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14006ef70
cmp rbx, r15
jne 0x14006f180
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400725e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r12, qword [r8 + 0x18]
mov rsi, r8
mov r14, qword [r8 + 0x10]
mov rbp, rcx
mov r10, r8
cmp r12, 0x10
jb 0x140072614
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x140072644
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x140072630
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rdi, qword [rbp + 8]
and rcx, r9
shl rcx, 4
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x90], rax
nop dword [rax]
cmp r13, rdi
jne 0x14007267a
mov rax, rdi
jmp 0x140072680
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400726f6
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r12, 0x10
jb 0x140072695
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x1400726a6
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x1400726b7
mov r8, rbp
call fcn.14016dc00
test eax, eax
je 0x1400726c4
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x90]
jmp 0x140072670
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x1400726d1
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0x10
jb 0x1400726dd
mov rcx, qword [rsi]
cmp r14, rbp
jne 0x1400726ee
mov r8, r14
call fcn.14016dc00
test eax, eax
je 0x1400726f1
mov rbx, rdi
mov rax, rbx
jmp 0x1400726fc
mov rbx, rdi
mov rax, rdi
cmp rax, rdi
jne 0x140072799
mov rbx, qword [rdi]
lea rax, [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
lea r9, [0x1401bcee0]
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], rsi
mov rdi, qword [rbx + 8]
mov r8, rdi
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 8]
call fcn.14006c520
mov rdx, rax
movabs rcx, 0x3fffffffffffffe
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400727bd
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [rbp + 8]
mov rdx, qword [rsp + 0x88]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14006ed10
mov rax, qword [rsp + 0x88]
jmp 0x1400727ac
mov r15, qword [rsp + 0x88]
mov rax, r15
mov qword [r15], rbx
mov byte [r15 + 8], 0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.14012eba0
int3
Function at 0x140076340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r11, [r8 + 0x10]
mov rbx, qword [r11 + 0x10]
mov rsi, rdx
mov rdi, rcx
jb 0x140076367
mov r11, qword [r11]
xor r9d, r9d
movabs r10, 0xcbf29ce484222325
test rbx, rbx
je 0x1400763a4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + r11]
inc r9
xor r10, rax
imul r10, rcx
cmp r9, rbx
jb 0x140076390
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x18]
and rdx, r10
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x1400763e4
cmp rax, r8
jne 0x1400763da
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400763ef
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1400763ef
cmp rax, r8
jne 0x1400763ef
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
lea rcx, [rdi + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rdx, r8
dec qword [rcx + 8]
call fcn.14007f080
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140076430
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x1400764f4
cmp rax, r8
jne 0x1400764ea
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400764ff
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1400764ff
cmp rax, r8
jne 0x1400764ff
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.14014f740
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007c500
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14007c70a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14007c5c4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14007c580
mov ecx, dword [r10]
jmp 0x14007c6a7
cmp ecx, 0x4e0
jb 0x14007c6a7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007c5e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007c630
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14007c560
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14007c550
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14007c72a
cmp r8d, r14d
jne 0x14007c530
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x14007c750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rsi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rdi, r12
mov rbp, r12
test r14, r14
je 0x14007c966
mov rdx, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14007c814
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14007c7d0
mov ecx, dword [r10]
jmp 0x14007c8f7
cmp ecx, 0x4e0
jb 0x14007c8f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007c830
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007c880
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rsi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14007c7b0
mov rdx, qword [rsi + 8]
or rdi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14007c7a0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rdi
div r15
cmp rax, rcx
jb 0x14007c98a
cmp r8, r14
jne 0x14007c780
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14007f0f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14007f194
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14007f150
mov ecx, dword [r10]
jmp 0x14007f277
cmp ecx, 0x4e0
jb 0x14007f277
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007f1b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007f200
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x14007f130
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x14007f120
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret