joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094c70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rbp
mov qword [rsp + 0x10], r15
xchg rbp, r15
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
mov qword [rsp + 0x20], rdi
xchg r11, r11
push r14
nop
sub rsp, 0x63a0bb6b
add rsp, 0x63a0bb4b
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x2c], edi
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140096a90
mov dword [rsp - 0x28], ecx
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov dword [rsp - 0x20], esi
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
xchg rcx, rcx
test ebp, ebp
je 0x140094e4c
nop dword [rax]
mov rdx, rdx
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov dword [rsp - 0xc], 0x76e11398
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
mov dword [rsp - 0x24], 0x75db8f73
add rdx, rax
cmp r14w, cx
jae 0x140094d89
mov eax, dword [rdx + 8]
mov dword [rsp - 0x28], 0x78bc4ed2
test eax, eax
jne 0x140094d4b
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov rsp, rsp
cmp r11d, r9d
jb 0x140094d6f
add eax, r9d
mov dword [rsp - 0x10], 0x4ac57840
cmp r11d, eax
jb 0x140094e0e
inc r8w
sub rdx, 0xffffffffffffffd8
mov dword [rsp - 0x34], 0x2997da12
cmp r8w, cx
jb 0x140094d35
xchg r14, r15
mov r8, r15
xchg r15, r14
mov eax, dword [r10 + 4]
mov dword [rsp - 0x44], 0x1fc6e221
lea r9, [r10 + 4]
nop
add rax, 0x3b7bc35d
sub rax, 0x3b7bc365
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
mov r9, r9
test eax, eax
je 0x140094e41
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x1c], 0x4f7b7ddd
movzx eax, word [r10]
mov ecx, eax
shr ecx, 4
shr ecx, 8
cmp ecx, 3
mov dword [rsp - 0x3c], 0x53c69718
je 0x140094e24
cmp ecx, 0xa
jne 0x140094e30
xchg r11, r11
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140094e30
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov dword [rsp - 0x18], ecx
add r8, rsi
add r8, r11
jmp 0x140094d92
and eax, 0xfff
xchg r8, r8
add dword [rax + r8], edi
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x140094dd7
xchg r13, r13
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140094cfc
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x38], ebx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
nop
add rsp, 0x8f447e5
sub rsp, 0x8f447c5
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140096b40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
push rbp
mov dword [rsp - 0x40], edx
push rsi
push rdi
push r12
mov rbx, rbx
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x42e9726
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x28], 0x18c2f902
xor eax, 0x5d8d086a
xchg r8, rsi
mov r8, rcx
xchg rsi, r8
cmp eax, 0x5d8d5227
jne 0x140096cfc
mov dword [rsp - 0x28], 0x77169089
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x5d8d086a
mov dword [rsp - 0x34], ecx
cmp eax, 0x5d8d4d3a
jne 0x140096cfc
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x14], 0x4af96a1c
call fcn.140096a90
xchg rsi, rdx
mov rcx, rdx
xchg rdx, rsi
xchg r9, r14
mov r9, rax
xchg r9, r14
mov edx, dword [rax + 0x20]
call fcn.140096a90
mov edx, dword [r14 + 0x24]
xchg r11, r11
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
mov r12, rax
mov dword [rsp - 0x24], 0x692928f7
call fcn.140096a90
mov edx, dword [r14 + 0x1c]
xchg rcx, rsp
mov rsp, rsi
xchg rsp, rcx
xchg rcx, rax
mov r13, rcx
xchg rcx, rax
call fcn.140096a90
mov dword [rsp - 0x2c], 0x7e75c8b4
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x2c], ecx
jbe 0x140096cfc
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, r15
mov r15, rsi
xchg r15, rcx
call fcn.140096a90
mov ecx, 0x29dac95e
sub ecx, 0xfb61cd3
add ecx, 0x32cd82fe
add ecx, 0xb30dd076
xchg rbp, rax
mov rbx, rbp
xchg rbp, rax
mov dword [rsp + 0x60], ecx
xchg rdi, rdi
cmp byte [rax], 0
je 0x140096cda
nop dword [rax]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov rcx, rcx
mov r8d, 0x2f79e4bb
add r8d, 0x4cbc1e1e
sub r8d, 0x313d9fc
xor r8d, 0x3dc4b549
xor r8d, 0x44e69d95
inc rbx
call fcn.1400a03c0
cmp byte [rbx], 0
mov r10, r10
jne 0x140096c8f
mov ecx, dword [rsp + 0x60]
not ecx
xchg rsp, rsp
cmp ecx, r15d
je 0x140096d58
inc edi
mov dword [rsp - 0x18], 0x672403df
cmp edi, dword [r14 + 0x18]
jb 0x140096c4c
xor eax, eax
mov r10, r10
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
nop
add rsp, 0x2c62ddaf
sub rsp, 0x2c62dd8f
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, r15
mov rcx, r15
xchg r15, rsi
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x44], ebp
call fcn.140096a90
jmp 0x140096d01
Function at 0x14009afe0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg r11, rbx
push rdi
mov dword [rsp - 0x2c], edi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rsi, rbx
mov rsi, qword [rcx]
xchg rbx, rsi
lea rax, [rsp + 0x28]
xchg r15, r15
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
xchg r9, rsi
mov r9, qword [rcx + 0x38]
xchg r9, rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rsp, rdi
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rsi + 1]
xchg r15, rsp
movups xmmword [r15 + 0x38], xmm0
xchg rsp, r15
xchg rsp, r11
movups xmmword [r11 + 0x48], xmm0
xchg r11, rsp
call fcn.1400189f0
mov edx, 0x3d5dbc7f
sub edx, 0x39496ac
xor edx, 0x4e3e1d2e
add edx, 0x2a123ba
test rsi, rsi
mov rdx, rdx
je 0x14009b0da
xchg rdi, r13
mov r13, rax
xchg r13, rdi
sub rbx, rax
xchg rdx, r8
mov rdx, rsi
xchg rdx, r8
mov r9d, 0x59253f50
xor r9d, 0x1d95bc3d
sub r9d, 0x3c26da23
xor r9d, 0x889a9b5
nop dword [rax]
mov dword [rsp - 0x3c], 0x79c675c2
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
xchg r10, r10
sub r8, 1
jne 0x14009b0b2
xor ecx, ecx
mov word [rax + rsi*2], cx
mov dword [rsp - 0x24], ecx
xchg rcx, r15
mov r15, qword [rsp + 0x20]
xchg r15, rcx
call fcn.14009b190
xchg r9, r9
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x1c], esp
cmp rcx, rax
jne 0x14009b162
xor eax, eax
lea rdi, [rsp + 0x28]
xchg rbp, rbp
mov ecx, 0x6f3bcdd
add ecx, 0x18748694
xor ecx, 0x1357287
sub ecx, 0xbf8b833
sub ecx, 0x12647993
rep stosb byte [rdi], al
mov rbx, rbx
mov eax, ebx
xchg rbx, r9
mov r9, qword [rsp + 0x78]
xchg r9, rbx
nop
sub rsp, 0x7a79ae23
add rsp, 0x7a79ae83
pop rdi
xchg rbp, rbp
ret
call fcn.1400bbca0
mov eax, ebx
mov dword [rsp - 0x10], 0x73ceac2f
xchg rdi, rbx
mov rdi, qword [rsp + 0x78]
xchg rdi, rbx
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14009c5c3
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rbx
mov r11, rbx
xchg rsp, rbx
xchg rsi, rbx
mov qword [r11 + 0x20], rsi
xchg rbx, rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rbx, r15
mov r15, qword [rcx]
xchg r15, rbx
lea rax, [r11 - 0x40]
xchg r15, r15
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
xchg rsp, rax
mov qword [r11 - 0x48], rsp
xchg rsp, rax
mov ebp, r8d
mov r12, r12
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
xchg r10, r10
xchg r14, rbx
mov rbx, rdx
xchg r14, rbx
xchg r15, rsp
movups xmmword [r15 + 0x28], xmm0
xchg rsp, r15
lea rdx, [rsi + 1]
mov r10, r10
movups xmmword [rsp + 0x38], xmm0
xchg r12, rsp
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.1400189f0
mov r15, r15
mov edx, 0x3f6a9b21
sub edx, 0x1b6f6edb
add edx, 0x4bfad454
xor edx, 0x156e5c2d
test rsi, rsi
mov dword [rsp - 0x40], 0x5016efb8
je 0x14009c6cc
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x7542b813
xor r9d, 0x399bad3f
xor r9d, 0x1666166e
sub r9d, 0x5abf0243
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x30], 0x2f2661cb
and cx, r9w
ror edx, 2
ror edx, 5
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r14, r14
mov word [rdi - 2], cx
sub r8, 1
jne 0x14009c69b
xor ecx, ecx
xchg r12, r12
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rdx, rbp
mov rbp, r14
xchg rbp, rdx
xchg rcx, r9
mov r9, qword [rsp + 0x20]
xchg r9, rcx
call fcn.14009c7b0
xchg rcx, r13
mov r13, qword [rsp + 0x20]
xchg rcx, r13
mov ebx, eax
mov dword [rsp - 0x24], 0x2682c090
xchg rdx, r14
mov rdx, qword [rsp + 0x80]
xchg r14, rdx
lea rax, [rsp + 0x28]
xchg r12, r12
xchg rsi, r11
mov r11, qword [rsp + 0x78]
xchg rsi, r11
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14009c77e
mov dword [rsp - 0x40], esi
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x436562b1
sub ecx, 0x3b7cba47
add ecx, 0x58086bec
sub ecx, 0x5ff11426
rep stosb byte [rdi], al
mov dword [rsp - 0x2c], edx
mov eax, ebx
xchg r14, rbx
mov r14, qword [rsp + 0x88]
xchg r14, rbx
nop
add rsp, 0x782d1e3a
sub rsp, 0x782d1dda
pop rdi
ret
call fcn.1400bbca0
mov dword [rsp - 0x40], ebp
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x2460db29
sub rsp, 0x2460dac9
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009c7b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0x40a23552
sub rsp, 0x40a23792
xchg rbx, r9
mov r9, rdx
xchg r9, rbx
mov rdi, rcx
xor edx, edx
mov r13, r13
lea rcx, [rsp + 0x30]
mov r8d, 0x5d3cd13d
sub r8d, 0x4646e047
xor r8d, 0x6af1052c
xor r8d, 0x7c04f7d2
call fcn.1400bc290
mov rax, qword gs:[0x60]
mov rbx, rbx
mov r8, qword [rax + 0x18]
xchg r9, rax
mov r9, qword [r8 + 0x10]
xchg r9, rax
xchg r10, r8
mov r10, qword [rax]
xchg r10, r8
test r8, r8
je 0x14009ca7c
xchg r15, r15
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14009ca7c
mov edx, 0x3f5bb812
add edx, 0xa1e171
add edx, 0x1ab3ded8
xor edx, 0x5ab1795f
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.1400bce40
mov dword [rsp - 0x28], edi
mov edx, 0x33b7bf7a
xor edx, 0x1be798c
xor edx, 0x526e944d
xor edx, 0x50047bd7
sub edx, 0x30632910
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x24], esp
call fcn.1400bcf60
test rax, rax
je 0x14009ca4a
mov rbp, rbp
xor ecx, ecx
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
movabs rcx, 0x5d6f87994fef0956
xor rcx, 0x12e1c3c5
sub rcx, 0x40879a9a
xor rcx, 0x3f5028c9
mov rax, qword [0x1404df6b0]
xor rax, rcx
movabs rcx, 0x68acfbd20b467821
xor rcx, 0x6202e3da
xor rcx, 0x628e8e30
add rcx, 0x6c130321
add rcx, 0x7fffffff
add rcx, 0x4474066
add rax, rcx
mov dword [rsp - 0xc], ecx
movabs rcx, 0x7ce9fe8d207eb0c2
add rcx, 0x35376f2f
sub rcx, 0x3e14bab1
add rcx, 0x7fffffff
xor rcx, 0x46d7aa85
not rax
add rax, rcx
movabs rcx, 0x59c199456526e224
sub rcx, 0x39a98629
add rcx, 0x382c5741
add rcx, 0x149a3802
xor rcx, 0x6ca12513
xor rax, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x30], 0xee81a69
call rax
movabs rax, 0x5ec4f0ac1752ffbd
add rax, 0x26d748a5
xor rax, 0x4620f6be
sub rax, 0x4f997783
add rax, 0x3f3a8003
lea r8, [rsp + 0x20]
mov dword [rsp - 0x2c], edx
movabs rcx, 0xf934f636c77c73f
sub rcx, 0x33f1b6c0
add rcx, 0x8a3832b
xor rcx, 0x2370300f
add rcx, 0x63b96713
lea rdx, [rsp + 0x260]
add rcx, qword [0x1404df6a0]
mov dword [rsp - 0xc], esp
xchg rsp, r9
mov rsp, rbx
xchg r9, rsp
rol rcx, 0x35
rol rcx, 4
rol rcx, 1
xor rcx, rax
xchg r14, r14
movabs rax, 0xd3fd6df006f1e883
xor rax, 0x41d60713
add rax, 0x2ad14b8f
xor rax, 0x61e465f7
rol rcx, 0xe
rol rcx, 1
rol rcx, 1
rol rcx, 1
add rax, rcx
mov dword [rsp - 0x30], edi
lea rcx, [rsp + 0x30]
call rax
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x3c], 0x44f2f4fe
add rsp, 0x25af90c3
sub rsp, 0x25af8e83
pop rdi
mov dword [rsp - 0x28], esp
ret
mov eax, 0x29a7bef5
sub eax, 0x257beb12
add eax, 0x13834189
xor eax, 0xd7af156d
xchg rbx, rbp
mov rbp, qword [rsp + 0x250]
xchg rbp, rbx
sub rsp, 0x67674dfa
add rsp, 0x6767503a
pop rdi
ret
xchg rbx, r12
mov r12, qword [rsp + 0x250]
xchg r12, rbx
mov eax, 0x5e19de33
sub eax, 0x323464de
sub eax, 0x1e2db2b6
sub eax, 0xac10445
xor eax, 0xc2f6c36f
add rsp, 0xa47f800
sub rsp, 0xa47f5c0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14009f710
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0x7989efac
sub rsp, 0x7989f1dc
mov r10, qword [str.3_:R]
mov rbx, rbx
lea rdx, [rsp + 0x20]
mov rbx, rcx
movabs rax, 0x7dfd9eb0328c3160
add rax, 0x4644753d
xor rax, 0x9c986ac
add rax, 0x7311b558
movabs rcx, 0x682c6e5538a794f5
xor rcx, 0xe8c6440
xor rcx, 0x449ffda
add rcx, 0xbd9157d
add rcx, 0x7fffffff
xor rcx, 0x217f6a
xor r9d, r9d
mov r15, r15
add r10, rcx
xor ecx, ecx
xor r10, rax
movabs rax, 0x581df7000ba73079
xor rax, 0x5428b5ce
xor rax, 0x521a3021
xor rax, 0x6bcf0638
sub rax, 0xd847678
ror r10, 6
ror r10, 0xb
ror r10, 1
xor r10, rax
xchg r13, r13
lea r8d, [r9 + 0x1a]
movabs rax, 0x639775c54547b761
sub rax, 0x21bc83bd
xor rax, 0x147b6e5c
add rax, 0x7fffffff
add rax, 0x190cd4fd
add r10, rax
mov dword [rsp - 0xc], esi
movabs rax, 0xfd056a8282b12dd
sub rax, 0x1dfa986c
sub rax, 0x2f55138
add rax, 0x7fffffff
add rax, 0x2ed15835
ror r10, 9
ror r10, 5
xor r10, rax
mov r14, r14
call r10
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x28], 0x361e3cbc
xchg rcx, rdx
mov qword [rbx], rdx
xchg rcx, rdx
movups xmmword [rcx], xmm0
mov r14, r14
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
test eax, eax
mov dword [rsp - 0xc], 0x12f487f8
je 0x14009f970
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff1212d5c8
xor rdx, 0x5379e6fb
add rdx, 0x2baf24da
add rdx, 0x7fffffff
xor rdx, 0x12e5a7f3
inc rdx
cmp word [rax + rdx*2], 0
mov dword [rsp - 0x1c], ebx
jne 0x14009f87e
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
xchg r13, rdx
mov qword [rbx + 0x38], r13
xchg r13, rdx
call fcn.1400189f0
xchg rsi, rsi
xor r8d, r8d
xchg rsp, rdx
mov rsp, rax
xchg rdx, rsp
mov ecx, 0x40a9ee30
add ecx, 0x1b00e039
sub ecx, 0x52f8d3a3
xor ecx, 0x1a4818e8
add ecx, 0x679e7a89
cmp qword [rbx + 0x38], r8
jbe 0x14009f97d
mov dword [rsp - 0x28], esp
lea r9, [rsp + 0x20]
mov r10d, 0x1dde7030
xor r10d, 0x3e3e7979
xor r10d, 0x5bfdade1
sub r10d, 0x5a8c01f0
xor r10d, 0x1d91a247
sub r9, rax
mov dword [rsp - 0x24], 0x2ad4c551
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg rsp, rsp
ror ecx, 4
ror ecx, 3
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
mov word [rdx - 2], ax
mov rbx, rbx
cmp r8, qword [rbx + 0x38]
jb 0x14009f91d
mov rax, rbx
mov dword [rsp - 0x30], 0x12fe1f1d
add rsp, 0x41a2d91f
sub rsp, 0x41a2d6ef
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
xchg r10, r8
mov qword [rbx + 0x38], r10
xchg r10, r8
xchg rbx, r12
mov rax, r12
xchg rbx, r12
sub rsp, 0x3833d045
add rsp, 0x3833d275
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14009fd00
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x44], 0x70a67ed6
sub rsp, 0x230
mov r10, qword [str.3_:R]
lea rdx, [rsp + 0x20]
mov rcx, rcx
xchg rcx, rsi
mov rbx, rsi
xchg rsi, rcx
movabs rax, 0x7dfd9eb066a10f8c
sub rax, 0x44b4ddcf
add rax, 0x14b95fef
add rax, 0x7fffffff
add rax, 0x2d8543de
movabs rcx, 0x682c6e5568fc4178
sub rcx, 0x3e71967f
sub rcx, 0x25aa9f1c
add rcx, 0x7fffffff
xor rcx, 0x3afa505d
xor r9d, r9d
add r10, rcx
mov dword [rsp - 0x14], 0xa1e90cb
xor ecx, ecx
xor r10, rax
movabs rax, 0x581df70024e98545
add rax, 0x1c1b87d3
xor rax, 0x70c1ffa6
add rax, 0x27114a78
ror r10, 6
ror r10, 9
ror r10, 1
ror r10, 1
ror r10, 1
xor r10, rax
mov dword [rsp - 0x44], esi
lea r8d, [r9 + 8]
movabs rax, 0x639775c53d6829e1
sub rax, 0x190e363e
add rax, 0xa1846bb
add rax, 0xb44a582
add rax, 0x7fffffff
add rax, 0x17465315
add r10, rax
movabs rax, 0xfd056a83fc56759
sub rax, 0x5241a68
add rax, 0xf0c7465
sub rax, 0xbc6b571
add rax, 0x78257588
ror r10, 0xd
ror r10, 1
xor r10, rax
call r10
mov r14, r14
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rcx
mov dword [rsp - 0x20], edx
xchg rbx, rcx
movups xmmword [rbx], xmm0
xchg rcx, rbx
movups xmmword [rcx + 0x10], xmm0
xchg r11, rcx
movups xmmword [r11 + 0x20], xmm0
xchg rcx, r11
test eax, eax
mov dword [rsp - 0x40], 0x63b50703
je 0x14009ff57
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff36c3a824
add rdx, 0x14529a4f
xor rdx, 0x14d62987
add rdx, 0x7fffffff
xor rdx, 0x203f940c
inc rdx
mov rsi, rsi
cmp word [rax + rdx*2], 0
jne 0x14009fe7b
xchg rdi, rcx
mov rdi, rbx
xchg rcx, rdi
mov qword [rbx + 0x38], rdx
call fcn.1400189f0
mov dword [rsp - 0x1c], ebp
xor r8d, r8d
xchg r15, rdx
mov r15, rax
xchg r15, rdx
mov ecx, 0x2f510fc2
sub ecx, 0x1d445992
xor ecx, 0x2ffe79cc
add ecx, 0x3ca58cbb
cmp qword [rbx + 0x38], r8
xchg rbp, rbp
jbe 0x14009ff64
lea r9, [rsp + 0x20]
mov r10d, 0x3a2ee3c0
sub r10d, 0x6260c2a
xor r10d, 0x7c72c9e3
sub r10d, 0x4428e2cd
xor r10d, 0x4513b57
sub r9, rax
nop word [rax + rax]
xchg rcx, rcx
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov dword [rsp - 0x34], ebp
ror ecx, 1
ror ecx, 7
xor ax, word [r9 + rdx - 2]
inc r8
mov dword [rsp - 0x20], esi
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14009ff08
xchg r9, rax
mov r9, rbx
xchg r9, rax
sub rsp, 0x44019322
add rsp, 0x44019552
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
xchg r15, r8
mov qword [rbx + 0x38], r15
xchg r15, r8
xchg rsi, rax
mov rsi, rbx
xchg rsi, rax
add rsp, 0x230
mov dword [rsp - 0x14], 0x4631e1f1
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1400a0740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404e00b4], 0
jne 0x1400a084b
mov dword [rsp - 0xc], 0x66948795
xor edx, edx
lea r8, [0x1404e00b0]
nop word [rax + rax]
xchg rsp, rsp
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov r12, r12
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
mov r12, r12
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], 0xada92a5
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x38], esp
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r14, r14
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x18], esp
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x1c], 0x1d32a37f
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x28], 0x357ba4a6
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg r9, r9
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x1c], 0xfe4a078
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x34], ebx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg rbx, rbx
mov eax, ecx
shr ecx, 1
and eax, 1
xchg rsp, rsp
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r9, r9
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400a076b
mov r14, r14
ret
Function at 0x1400a63b2
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r14
mov qword [rsp + 8], r14
xchg rcx, r14
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffd8
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
mov r13d, r8d
mov dword [rsp - 0x30], ebx
mov edx, 0x22748426
xor edx, 0x575f7962
sub edx, 0x15ddbe16
xor edx, 0x7a6b733f
sub edx, 0x25214c11
cmp r8d, edx
mov dword [rsp - 0x44], 0x314f170
jae 0x1400a635a
mov edx, r13d
nop
movabs rcx, 0xffffffff22fb8322
xor rcx, 0x47ecdf2c
sub rcx, 0x4f57a822
add rcx, 0x7fffffff
add rcx, 0x6a404c14
mov eax, 0x2f48b410
sub eax, 0x225e5cc0
sub eax, 0xc3d2165
sub eax, 0xad35e7
mul rdx
cmovo rax, rcx
xchg r12, r12
xchg rcx, r10
mov r10, rax
xchg r10, rcx
call fcn.1400bbad0
xchg r15, rax
mov rax, r15
xchg r15, rax
mov byte [rsp + 0x70], 0x2c
add byte [rsp + 0x70], 0x3c
add byte [rsp + 0x70], 9
sub byte [rsp + 0x70], 0x57
sub byte [rsp + 0x70], 0x19
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
lea r12d, [r13 + 0xfffff]
xor esi, esi
mov dword [rsp - 0x28], 0x5dc596b7
shr r12d, 0xb
shr r12d, 1
shr r12d, 5
shr r12d, 2
shr r12d, 1
mov ebp, dword [rax + 0x18]
mov rbp, rbp
test r12d, r12d
je 0x1400a652e
mov qword [rsp + 0x68], rbx
mov ecx, 0x22114c05
add ecx, 0x4a7ee389
add ecx, 0x45a396d
sub ecx, 0x3f2dffd
xor ecx, 0x6ce788fe
xchg r13, rdi
mov qword [rsp + 0x20], r13
xchg r13, rdi
mov edi, esi
mov ebx, r13d
mov dword [rsp - 0xc], 0x6cce37e
shl edi, 0xe
shl edi, 1
shl edi, 4
shl edi, 1
xchg r15, r11
mov rdx, r11
xchg r15, r11
sub ebx, edi
mov dword [rsp - 0x10], 0x780c0d44
cmp ebx, ecx
cmova ebx, ecx
xchg r8, rcx
mov r8, rax
xchg rcx, r8
mov r8d, ebx
call fcn.1400a3060
xchg r12, r12
test al, al
je 0x1400a6504
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 1
shr edi, 1
test ebx, ebx
je 0x1400a64c6
xchg r9, r15
mov r15, r9
xchg r9, r15
lea ecx, [rdi + rax]
xchg r13, r13
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
xor r8d, 0x5d8d086a
mov r14, r14
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
mov r14, r14
jb 0x1400a649b
mov rax, qword [rsp + 0x60]
inc esi
mov dword [rsp - 0x18], ebx
mov ecx, 0x59befc8
xor ecx, 0x6777dbf2
sub ecx, 0x24b3930a
add ecx, 0x3d20944f
xor ecx, 0x7b49357f
cmp esi, r12d
jb 0x1400a6435
mov dword [rsp - 0x24], 0x508201a7
jmp 0x1400a6518
mov byte [rsp + 0x70], 0x64
sub byte [rsp + 0x70], 0x30
sub byte [rsp + 0x70], 2
xor byte [rsp + 0x70], 0x32
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg rbx, r13
xchg rdi, rbx
mov rbx, qword [rsp + 0x20]
xchg rdi, rbx
xchg rcx, r15
mov r15, rcx
xchg r15, rcx
call fcn.1400bbae0
xchg rbp, rbp
movzx eax, byte [rsp + 0x70]
sub rsp, 0xffffffffffffffd8
pop r15
xchg rsp, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
mov dword [rsp - 0x1c], 0x53acfae1
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret