joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061d14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r8, r8
mov qword [rsp + 0x10], rsi
nop
push 0xc4a2f96
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r11, rcx
mov rbx, r11
xchg r11, rcx
xchg r8, r15
mov rdi, r15
xchg r8, r15
mov ecx, 0x17e937ff
add ecx, 0x2cd06a58
sub ecx, 0x1cf12eb6
xor ecx, 0x27c8734d
xchg rdi, rsi
mov rdi, rdx
xchg rsi, rdi
call fcn.140077b60
mov dword [rsp - 0x10], 0x1fb38897
xor r10d, r10d
lea r11, [rbx + 0x1060]
mov r9d, dword [r11]
lea r11, [r11 + 0x10]
mov rdx, rdx
xor r9d, 0x532032c0
sub r9d, dword [rbx]
mov dword [rax + r10*4], r9d
mov dword [rsp - 0x14], ebp
inc r10
cmp r10, 0x3b
jb 0x140061ca2
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x28], ecx
mov qword [rdi], 0x656d298c
sub qword [rdi], 0x2b649d97
add qword [rdi], 0x37663adc
sub qword [rdi], 0x716ec696
mov qword [rsi], rax
mov rsi, qword [rsp + 0x38]
nop
add rsp, 0x56b71f27
sub rsp, 0x56b71f07
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xchg r15, rbx
mov qword [rsp + 8], r15
jmp 0x140061d95
xchg rsi, r10
jmp 0x140061df7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
jmp 0x140061d38
mov rdx, rdx
xchg rsi, r10
jmp 0x140061d6b
mov rbp, rdx
jmp 0x140061e33
mov rdx, rax
xchg rcx, rdx
jmp 0x140061e8f
xchg rdx, r9
jmp 0x140061d43
xchg r9, r8
mov r9, qword [rsp + 0x50]
jmp 0x140061e87
mov r10, qword [rsp + 0x40]
jmp 0x140061d21
xchg r14, rdx
jmp 0x140061e4c
nop
sub rsp, 0x5f0f25b4
jmp 0x140061da2
mov rdx, rdx
mov rdi, r8
jmp 0x140061d75
xchg rbx, r15
mov qword [rsp + 0x10], rbp
jmp 0x140061e2b
add rsp, 0x5f0f2594
jmp 0x140061e13
mov rbp, rsi
xchg rcx, rbp
jmp 0x140061db9
mov qword [rdi], rax
jmp 0x140061d29
push rdi
mov rdx, rdx
jmp 0x140061d7d
xchg rdx, r9
call fcn.140077ff0
jmp 0x140061e68
xchg rsi, rdx
jmp 0x140061e1e
xchg rbp, rcx
jmp 0x140061dae
xchg rsi, rdx
mov rsi, rbp
jmp 0x140061e7f
jmp 0x140061c38
add rsp, 0x20
jmp 0x140061e75
xchg r13, r8
xchg rdx, r9
jmp 0x140061e0b
mov r9, qword [rsi]
jmp 0x140061dca
mov rsi, rcx
mov r10, r10
jmp 0x140061d56
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
jmp 0x140061dc1
mov rbp, rbp
jmp 0x140061dd7
xchg r9, rdx
mov rcx, qword [rcx + 8]
jmp 0x140061d8a
xchg r14, rdx
call fcn.140077b60
jmp 0x140061e5e
mov rbx, r14
jmp 0x140061e3f
xchg r9, rax
xchg rcx, rdx
jmp 0x140061d4b
xchg r9, rax
mov qword [rbx], r9
jmp 0x140061e54
mov dword [rsp - 0x38], edx
mov rax, qword [rsi + 8]
jmp 0x140061de7
mov dword [rsp - 0x40], edi
pop rdi
jmp 0x140061df2
xchg rsi, rdx
jmp 0x140061d5e
xchg r8, r9
jmp 0x140061ddf
xchg r13, r8
mov r13, qword [rsi + 8]
jmp 0x140061e00
Function at 0x140063520
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
mov dword [rsp - 0x2c], ecx
lea r10, [0x14000b4c8]
sub r10, rcx
xchg rsp, r8
mov rsp, rcx
xchg r8, rsp
lea rax, [r9 + r8]
mov ecx, r9d
xchg r13, r13
mov edx, 0x11bcd707
add edx, 0x383b8981
sub edx, 0x23a6c3d1
xor edx, 0x7f39a3c9
inc r9
xchg r13, r13
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
mov dword [rsp - 0x24], 0x6f6153a3
cmp r9, 0x10
jb 0x14006353a
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x1400643ec
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
push 0x3cb599aa
mov qword [rsp], rbx
push rbp
xchg r12, r12
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
xchg r9, r9
neg rsp
sub rsp, 0xffffffffffffffd8
neg rsp
mov rdi, rcx
xchg rsi, rsi
mov r13d, r8d
mov r9d, 0x6bed739e
xor r9d, 0x620f1da8
add r9d, 0x195a8c32
sub r9d, 0x2338fa68
nop
movabs rcx, 0xffffffff64eaf06a
sub rcx, 0x37d7abce
add rcx, 0x3e5afb9d
add rcx, 0x7fffffff
xor rcx, 0x1491bfc7
cmp r8d, r9d
xchg r12, r12
pushf
mov eax, 0x69a8eaca
sub eax, 0x6186a0f8
xor eax, 0x312c6d62
sub eax, 0x2164fd9b
sub eax, 0x17a92711
popf
cmovb r9d, r13d
mov dword [rsp - 0x34], esi
mul r9
cmovo rax, rcx
xchg rcx, r14
mov r14, rax
xchg rcx, r14
call fcn.140077b60
xchg rcx, rcx
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0x13
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rdi]
mov ebx, 0x25901b65
xor ebx, 0x64680e0c
xor ebx, 0x45c0bfbb
add ebx, 0x649fc5d7
sub ebx, 0x68d870a8
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x88], r15d
xchg r13, r13
test r15d, r15d
je 0x14006461d
lea r12, [rdi + 8]
mov eax, 0x4df07f5c
xor eax, 0x54d11be3
add eax, 0x276c4c31
sub eax, 0x2e21de57
sub eax, 0x125bd299
mov r14d, esi
mov edi, r13d
mov dword [rsp - 0x38], 0x12436621
shl r14d, 0x14
xchg r15, rbp
mov rdx, r15
xchg rbp, r15
sub edi, r14d
xchg rcx, rdx
mov rdx, r12
xchg rcx, rdx
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x18], 0x25020d57
mov r8d, edi
call fcn.140071040
test al, al
mov r15, r15
je 0x14006461b
shr edi, 2
xor r8d, r8d
shr r14d, 2
mov dword [rsp - 0x44], 0x5fdbd987
test edi, edi
je 0x1400645eb
mov r15, qword [rsp + 0x78]
xchg rbp, r9
mov rbp, r9
xchg rbp, r9
mov r13d, dword [rsp + 0x70]
xchg r10, r10
lea eax, [r14 + r8]
mov edx, r13d
xor edx, dword [r9]
add r8d, ebx
mov dword [rsp - 0x40], esp
xor edx, 0x7ee01212
lea r9, [r9 + 4]
mov dword [r15 + rax*4], edx
cmp r8d, edi
mov dword [rsp - 0x18], edi
jb 0x1400645af
mov r15d, dword [rsp + 0x88]
mov r13d, dword [rsp + 0x80]
add esi, ebx
mov dword [rsp - 0x40], edi
mov eax, 0x54d21905
xor eax, 0x2f2af944
xor eax, 0x473b601f
sub eax, 0x3cb3805e
cmp esi, r15d
jb 0x140064538
mov dword [rsp - 0x1c], 0x40d19b02
jmp 0x14006461d
xor bl, bl
xchg rsp, rcx
mov rsp, rbp
xchg rsp, rcx
call fcn.140077b70
mov al, bl
mov dword [rsp - 0x40], 0x635f1808
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
pop rbx
mov dword [rsp - 0x14], ebx
ret
Function at 0x140064a14
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
xchg rbp, r14
mov qword [rsp + 0x10], r14
xchg r14, rbp
xchg rsi, r11
mov qword [rsp + 0x18], r11
xchg rsi, r11
nop
push r15
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r12
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
mov rsi, rsi
xchg r14, r12
mov r12, rcx
xchg r12, r14
mov r15d, r8d
mov r13, r13
mov r9d, 0x10643e9b
add r9d, 0x6f956a64
sub r9d, 0x484e5e97
xor r9d, 0x37af4a68
xchg r12, r15
mov r15, rdx
xchg r15, r12
cmp r8d, r9d
mov dword [rsp - 0x34], 0xa947035
pushf
movabs rcx, 0xffffffff7bd6bc35
xor rcx, 0x65d53c4
sub rcx, 0x45558d96
add rcx, 0x7fffffff
xor rcx, 0x47c99da5
popf
pushf
mov eax, 0x29f94d37
add eax, 0x1df134b1
sub eax, 0x1eb10a88
add eax, 0x2e68b6f6
sub eax, 0x57a22e52
popf
cmovb r9d, r15d
mul r9
mov dword [rsp - 0x30], edx
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140077b60
mov dword [rsp - 0x24], ebx
mov r13d, dword [r14]
lea ebp, [r15 + 0xfffff]
shr ebp, 9
shr ebp, 0xa
shr ebp, 1
xor edi, edi
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x7cd741f
add ebx, 0x72696718
sub ebx, 0x35af05f8
xor ebx, 0x4487d53e
test ebp, ebp
je 0x140064c31
mov dword [rsp - 0x28], 0xd4e2bd4
mov eax, 0x188ec825
add eax, 0x4c31e8c4
add eax, 0x13f3ed25
sub eax, 0x146302e
xor eax, 0x777e6de0
mov r9d, edi
mov r8d, r15d
mov dword [rsp - 0x34], ebx
shl r9d, 5
shl r9d, 4
shl r9d, 0xa
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
cmova r8d, eax
mov r10, r10
shr r9d, 2
mov r11d, r8d
xor r10d, r10d
mov r13, r13
shr r11d, 2
test r11d, r11d
je 0x140064bde
mov dword [rsp - 0x44], edx
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
lea ecx, [r9 + r10]
mov dword [rsp - 0x1c], esi
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xchg r10, r10
xor eax, 0x7ee01212
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0x24], esi
jb 0x140064bb1
xchg rdx, rcx
mov rcx, rsi
xchg rdx, rcx
lea rcx, [r14 + 8]
mov dword [rsp - 0x28], 0x2d196a35
call fcn.140071330
test al, al
je 0x140064c2f
mov dword [rsp - 0xc], esi
add edi, ebx
mov eax, 0x40148ec0
add eax, 0x3a3894d6
sub eax, 0xb14ec76
sub eax, 0x6f283720
cmp edi, ebp
jb 0x140064b64
mov dword [rsp - 0x34], 0x1af9ba6c
jmp 0x140064c31
xor bl, bl
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140077b70
mov dword [rsp - 0x20], 0x2f54343e
mov rbp, qword [rsp + 0x58]
mov al, bl
xchg rbx, r8
mov r8, qword [rsp + 0x50]
xchg rbx, r8
mov rsi, qword [rsp + 0x60]
nop
sub rsp, 0x12cc93d8
add rsp, 0x12cc93f8
pop r15
mov dword [rsp - 0xc], esp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x18], edi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140064da0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r10, r10
mov qword [rsp + 0x10], rbp
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg r9, rsi
xchg rdi, r14
mov qword [rsp + 0x20], r14
xchg r14, rdi
push r14
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x28], 0x48f64973
xor ebp, ebp
add rbx, rcx
mov rdi, rdx
xchg rdi, r14
mov rdi, rcx
xchg rdi, r14
movzx r9d, bp
movzx eax, word [rbx + 0x14]
xchg rsp, rsp
lea r8, [rbx + 0x18]
movzx r11d, word [rbx + 6]
add r8, rax
mov rsi, rsi
mov r10d, dword [rbx + 0xb0]
cmp bp, r11w
jae 0x140064e5d
mov r9, r9
mov eax, dword [r8 + 8]
test eax, eax
jne 0x140064e28
mov eax, dword [r8 + 0x10]
mov dword [rsp - 0x2c], 0x58027277
mov edx, dword [r8 + 0xc]
cmp r10d, edx
jb 0x140064e43
add eax, edx
mov r15, r15
cmp r10d, eax
jb 0x140064f8f
inc r9w
add r8, 0x28
mov dword [rsp - 0x2c], 0x5bf81cb0
cmp r9w, r11w
jb 0x140064e10
mov r10, rbp
sub rdi, qword [rbx + 0x30]
mov dword [rsp - 0xc], edx
mov esi, dword [rbx + 0xb4]
mov ebx, ebp
test esi, esi
mov dword [rsp - 0x3c], 0x15255ce3
je 0x140064ff4
nop dword [rax + rax]
movsxd rcx, dword [r14 + 0x3c]
xchg rsp, rsp
lea rdx, [r14 + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov dword [rsp - 0xc], ecx
movzx r8d, bp
movzx eax, word [rcx + r14 + 0x14]
movzx ecx, word [rcx + r14 + 6]
add rdx, rax
mov dword [rsp - 0x40], 0x3c5d7f8
cmp bp, cx
jae 0x140064f0f
mov eax, dword [rdx + 8]
mov dword [rsp - 0x1c], edi
test eax, eax
jne 0x140064ed0
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov r15, r15
cmp r11d, r9d
jb 0x140064eef
add eax, r9d
cmp r11d, eax
xchg r13, r13
jb 0x140064fa9
inc r8w
nop
sub rdx, 0x1d4515cb
add rdx, 0x1d4515f3
cmp r8w, cx
jb 0x140064ebe
xchg rsi, rsi
xchg rdx, rbp
mov rbp, rdx
xchg rdx, rbp
mov eax, dword [r10 + 4]
xchg r15, r15
lea r9, [r10 + 4]
nop
add rax, 0x23f775bc
sub rax, 0x23f775c4
sub r10, 0xfffffffffffffff8
mov rdx, rdx
shr rax, 1
test eax, eax
je 0x140064fe6
mov dword [rsp - 0x34], 0x73ea9916
mov r8d, eax
nop dword [rax]
movzx eax, word [r10]
mov ecx, eax
mov dword [rsp - 0x28], 0x678e2353
shr ecx, 1
shr ecx, 0xb
cmp ecx, 3
mov rcx, rcx
je 0x140064fc2
cmp ecx, 0xa
jne 0x140064fca
and eax, 0xfff
mov dword [rsp - 0x1c], 0x63313ae9
add qword [rax + rdx], rdi
jmp 0x140064fca
mov eax, dword [r8 + 0x14]
sub rax, rdx
mov dword [rsp - 0x24], 0x314799ba
add rax, r14
add r10, rax
jmp 0x140064e60
mov edx, dword [rdx + 0x14]
mov dword [rsp - 0x40], 0x4574ccda
sub rdx, r9
add rdx, r14
add rdx, r11
jmp 0x140064f18
and eax, 0xfff
add dword [rax + rdx], edi
nop
add r10, 0x133de2c
sub r10, 0x133de2a
sub r8, 1
xchg rcx, rcx
jne 0x140064f51
add ebx, dword [r9]
cmp ebx, esi
jb 0x140064e85
xchg rsi, rsi
xchg rdx, rbx
mov rdx, qword [rsp + 0x10]
xchg rdx, rbx
mov rbp, qword [rsp + 0x18]
mov dword [rsp - 0xc], esp
xchg r14, rsi
mov r14, qword [rsp + 0x20]
xchg r14, rsi
xchg r13, rdi
mov r13, qword [rsp + 0x28]
xchg r13, rdi
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400668c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg r10, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
push r12
xchg r13, r13
nop
push 0x4dc08c8e
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
nop
sub rsp, 0x675d90c4
add rsp, 0x675d90a4
movzx eax, word [rcx]
xchg rsi, rsi
mov r15d, edx
xor eax, 0x7ee01212
xchg rbp, rcx
mov rsi, rbp
xchg rcx, rbp
cmp eax, 0x7ee0485f
mov rcx, rcx
jne 0x140066a69
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rcx + rsi]
xor eax, 0x7ee01212
xchg r10, r10
cmp eax, 0x7ee05742
jne 0x140066a69
mov edx, dword [rcx + rsi + 0x88]
xchg rbx, rcx
mov rbx, rsi
xchg rbx, rcx
call fcn.140066810
mov r11, r11
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg rbx, rax
mov r14, rbx
xchg rbx, rax
mov edx, dword [rax + 0x20]
call fcn.140066810
mov dword [rsp - 0x24], esi
mov edx, dword [r14 + 0x24]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r12, rax
call fcn.140066810
xchg rbx, rbx
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
mov r13, rax
mov dword [rsp - 0x10], 0x60b6f946
call fcn.140066810
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
xchg r8, r8
jbe 0x140066a69
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
mov r12, r12
call fcn.140066810
mov ecx, 0x26369c28
add ecx, 0x52c19947
xor ecx, 0x5b9f8c26
xor ecx, 0x3ba92475
add ecx, 0xe73162c3
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x10], edx
cmp byte [rax], 0
je 0x140066a4b
nop dword [rax]
mov rdx, rbx
xchg r11, r11
lea rcx, [rsp + 0x60]
mov r8d, 0x7075907
xor r8d, 0x40548605
sub r8d, 0x2fe06491
sub r8d, 0x17737a70
inc rbx
xchg r9, r9
call fcn.14006f850
cmp byte [rbx], 0
jne 0x140066a0a
mov rbp, rbp
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov rbx, rbx
je 0x140066aac
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x28], esp
jb 0x1400669c3
xor eax, eax
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rcx, rbx
sub rsp, 0xffffffffffffffe0
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x44], 0x4e9dd8ac
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx eax, word [r13 + rdi*2]
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + rax*4]
mov dword [rsp - 0x20], 0x185e0da3
xchg rsi, r10
mov rcx, r10
xchg r10, rsi
call fcn.140066810
jmp 0x140066a6b
Function at 0x14006ad00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov rsi, rsi
push rdi
sub rsp, 0x240
mov rbx, rdx
mov dword [rsp - 0x10], 0x4f26df76
xchg r10, rcx
mov rdi, r10
xchg rcx, r10
xor edx, edx
mov rcx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x1e6376f4
xor r8d, 0x7b852f6d
sub r8d, 0x479b9a73
xor r8d, 0x1e4abd2e
call fcn.140078110
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rcx, rcx
xchg r13, rax
mov r13, qword [r8 + 0x10]
xchg r13, rax
xchg r8, rbx
mov rbx, qword [rax]
xchg r8, rbx
test r8, r8
je 0x14006aed7
mov dword [rsp - 0x28], 0x50c2aa09
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14006aed7
mov dword [rsp - 0x24], 0x7fd77850
mov edx, 0x1d0b940
xor edx, 0x115da14a
xor edx, 0x1f1d8367
sub edx, 0xf909a69
lea rcx, [rsp + 0x30]
xchg rcx, rcx
lea r9d, [rdx - 1]
call fcn.140078a90
mov edx, 0x47d437ca
sub edx, 0xf4a0edf
add edx, 0x14d19201
add edx, 0xefc4adc
sub edx, 0x5c58056c
lea rcx, [rsp + 0x30]
call fcn.140078b50
mov dword [rsp - 0x28], ebx
test rax, rax
je 0x14006aeac
xor ecx, ecx
mov dword [rsp - 0xc], 0x7dd1db6
mov qword [rsp + 0x250], rsi
mov word [rax], cx
movabs rsi, 0x5073338f39dbaa24
xor rsi, 0x701f16bc
xor rsi, 0x671df060
add rsi, 0x2446e5c8
mov rax, qword [0x1400c86d0]
mov dword [rsp - 0x1c], 0x329db3ef
lea rcx, [rsp + 0x20]
xor rax, rsi
xchg rsi, rdi
mov rdx, rsi
xchg rdi, rsi
call rax
mov rax, qword [0x1400c86b0]
lea r8, [rsp + 0x20]
xchg r15, r15
xor rax, rsi
lea rdx, [rsp + 0x260]
xchg r9, r14
mov r14, rbx
xchg r9, r14
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x30], 0x75d4c463
call rax
xchg rcx, rsi
mov rcx, qword [rsp + 0x250]
xchg rsi, rcx
mov rbx, qword [rsp + 0x258]
add rsp, 0x3c5c00fe
sub rsp, 0x3c5bfebe
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x458b7d3a
add eax, 0x33a9f811
xor eax, 0x685c511c
add eax, 0xae96dbaa
xchg rcx, rbx
mov rcx, qword [rsp + 0x258]
xchg rcx, rbx
sub rsp, 0xfffffffffffffdc0
pop rdi
ret
xchg r11, rbx
mov r11, qword [rsp + 0x258]
xchg rbx, r11
mov eax, 0x5d1ec8f7
xor eax, 0x485a76fa
add eax, 0x26578d3e
sub eax, 0x1a6e9396
add eax, 0x9ed24980
sub rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x20], 0x64eebb1
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14006d360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rcx, rcx
mov qword [rsp + 0x20], rsi
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x20], ebp
xchg rdx, rbx
mov rdx, rcx
xchg rbx, rdx
xchg rdx, rsp
mov rsi, rsp
xchg rsp, rdx
nop
add rcx, 0x764fffa7
sub rcx, 0x764fff9f
xor edx, edx
mov r8d, 0x4529a491
sub r8d, 0x3c5b167b
xor r8d, 0x1afac97d
sub r8d, 0x1234466b
mov qword [rbx], rcx
mov dword [rsp - 0x30], 0x63a38a15
call fcn.140078110
xchg r8, rdx
mov r8, qword [rsi + 0x38]
xchg rdx, r8
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
xchg rdx, r8
mov qword [rbx + 0x108], r8
xchg r8, rdx
inc rdx
call fcn.1400401a0
mov r11, r11
mov r14, rax
test rax, rax
je 0x14006d583
xorps xmm0, xmm0
xchg r14, r14
xchg rbp, r10
mov qword [rsp + 0x70], r10
xchg r10, rbp
mov rbp, qword [rsi + 0x38]
mov dword [rsp - 0x24], 0xdeb996b
lea rax, [rsp + 0x28]
mov rsi, qword [rsi]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rdi
xchg r8, r8
xchg rbx, rax
mov qword [rsp + 0x20], rbx
xchg rbx, rax
lea rdx, [rbp + 1]
xchg r8, rsp
movups xmmword [r8 + 0x28], xmm0
xchg r8, rsp
xchg rsp, rcx
movups xmmword [rcx + 0x38], xmm0
xchg rsp, rcx
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0xc], 0x4fbc285c
call fcn.14001653c
mov edx, 0x229ac4ee
xor edx, 0x61288cda
add edx, 0x1451c5fc
sub edx, 0xbf94f22
xor edx, 0x5a62f5d5
test rbp, rbp
xchg r12, r12
je 0x14006d4f5
xchg r12, rax
mov rdi, r12
xchg r12, rax
sub rsi, rax
mov r12, r12
xchg r14, r8
mov r14, rbp
xchg r8, r14
mov r9d, 0x4acd7ecf
xor r9d, 0x166979a2
sub r9d, 0x5296ba2
sub r9d, 0x3f3d6f92
sub r9d, 0x183d2b3a
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x10], edi
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rsi + rdi - 2]
mov dword [rsp - 0x24], esi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14006d4ca
xor ecx, ecx
mov dword [rsp - 0x18], 0x5958ac16
mov word [rax + rbp*2], cx
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
xchg rdi, rdx
mov rdi, qword [rbx + 0x108]
xchg rdi, rdx
mov r8, qword [rsp + 0x20]
inc rdx
call fcn.1400789e0
xchg rsi, rsi
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg r11, rcx
lea rax, [rsp + 0x28]
mov dword [rsp - 0x24], edx
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14006d573
lea rdi, [rsp + 0x28]
mov rdi, rdi
xor eax, eax
mov ecx, 0x2571d99c
sub ecx, 0x943a3b4
add ecx, 0x375f7b18
sub ecx, 0x538db0d0
rep stosb byte [rdi], al
jmp 0x14006d578
call fcn.140077cf0
xchg rsi, rdi
mov rsi, qword [rsp + 0x78]
xchg rsi, rdi
lea r11, [rsp + 0x60]
xchg rbx, rsi
mov rax, rsi
xchg rbx, rsi
mov rbx, qword [r11 + 0x20]
xchg r15, r15
mov rsi, qword [r11 + 0x28]
xchg r12, rsp
mov r12, r11
xchg rsp, r12
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x14006e230
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1400c9530]
mov rdi, rdi
lea rdx, [rsp + 0x20]
xchg rdi, rcx
mov rbx, rdi
xchg rdi, rcx
xor r9d, r9d
movabs rcx, 0x5073338f2a2aa691
add rcx, 0x330dedec
xor rcx, 0x7dad875c
add rcx, 0x328b1f9f
xor rax, rcx
mov dword [rsp - 0x1c], 0x14d7ab15
xor ecx, ecx
lea r8d, [r9 + 8]
call rax
lea rcx, [rbx + 8]
mov dword [rsp - 0x2c], 0x5f43300f
xorps xmm0, xmm0
xchg rcx, rsp
mov qword [rbx], rsp
xchg rcx, rsp
xchg rcx, rdx
movups xmmword [rdx], xmm0
xchg rcx, rdx
xchg r13, rcx
movups xmmword [r13 + 0x10], xmm0
xchg rcx, r13
movups xmmword [rcx + 0x20], xmm0
mov dword [rsp - 0x40], ebx
test eax, eax
je 0x14006e3cf
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff34270127
add rdx, 0x4aa97ff9
sub rdx, 0x33ddde53
add rdx, 0x7fffffff
xor rdx, 0x350d5d33
inc rdx
mov dword [rsp - 0x24], edi
cmp word [rax + rdx*2], 0
jne 0x14006e2ee
mov rcx, rbx
xchg r12, r12
xchg rdx, r10
mov qword [rbx + 0x38], r10
xchg rdx, r10
call fcn.14001653c
mov rdx, rdx
xor r8d, r8d
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov ecx, 0x53244ed3
xor ecx, 0x161368bf
sub ecx, 0x1ffa7a14
add ecx, 0x304b4031
sub ecx, 0x3f1fa1ae
cmp qword [rbx + 0x38], r8
jbe 0x14006e3d9
lea r9, [rsp + 0x20]
xchg rbp, rbp
mov r10d, 0x67388b94
sub r10d, 0x62b7fd03
add r10d, 0x2b1ec117
sub r10d, 0x2f9f4ea9
sub r9, rax
xchg r11, r11
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg rbx, rbx
ror ecx, 5
ror ecx, 3
xor ax, word [r9 + rdx - 2]
mov rdx, rdx
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14006e378
mov dword [rsp - 0x38], 0x14cfbe6e
xchg rbx, r10
mov rax, r10
xchg r10, rbx
sub rsp, 0x2e6405b4
add rsp, 0x2e6407e4
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
xchg r11, r11
mov qword [rbx + 0x38], r8
mov rax, rbx
sub rsp, 0xfffffffffffffdd0
xchg rbp, rbp
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x14006e400
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1400c89e0]
mov rcx, rcx
mov rbx, rcx
movabs rcx, 0x5073338f68d040b8
xor rcx, 0x2c9245e1
sub rcx, 0x42675441
add rcx, 0x514581a8
mov edx, 0x496897a7
sub edx, 0x368ef5d0
add edx, 0x2c1e5db4
sub edx, 0x3ef7fe87
xor rax, rcx
lea rcx, [rsp + 0x20]
xchg rdx, rdx
call rax
lea rax, [rbx + 8]
xorps xmm0, xmm0
xchg rcx, rcx
xchg rdx, rax
mov qword [rbx], rdx
xchg rdx, rax
nop
movabs rdx, 0xffffffff461b8455
add rdx, 0x3953b5f2
xor rdx, 0x2fdb9ba
xor rdx, 0x1a138206
add rdx, 0x7fffffff
add rdx, 0x187efe05
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
lea rax, [rsp + 0x20]
nop dword [rax]
inc rdx
mov rbp, rbp
cmp word [rax + rdx*2], 0
jne 0x14006e4b9
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
mov qword [rbx + 0x38], rdx
mov dword [rsp - 0x18], 0x72ac9607
call fcn.14001653c
xor r8d, r8d
mov edx, 0x11192dc2
sub edx, 0x6fca204
xor edx, 0x1b25ae3e
add edx, 0x52f255b
cmp qword [rbx + 0x38], r8
jbe 0x14006e569
xchg r15, r15
lea r9, [rsp + 0x20]
mov r10d, 0x1a59af1c
sub r10d, 0x80affba
add r10d, 0x6aad5745
sub r10d, 0x7cfc05a8
sub r9, rax
mov dword [rsp - 0x14], 0x3fec9f8c
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
mov dword [rsp - 0x24], 0x1294f414
ror edx, 8
xor cx, word [r9 + rax - 2]
inc r8
xchg r14, r14
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14006e536
mov r13, r13
mov rax, rbx
add rsp, 0x1e6c9964
sub rsp, 0x1e6c9734
pop rbx
xchg r10, r10
ret
Function at 0x14006fba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400c9b74], 0
jne 0x14006fcac
mov dword [rsp - 0xc], 0x34b7b1a0
xor edx, edx
lea r8, [0x1400c9b70]
nop word [rax + rax]
xchg rsp, rsp
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov dword [rsp - 0x38], esp
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x2c], 0x34842d1d
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg r9, r9
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x44], esi
mov ecx, eax
shr eax, 1
and ecx, 1
mov rsp, rsp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg r13, r13
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg rsp, rsp
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x28], 0x7a5f83ae
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x3c], edx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x1c], 0x1184f2c
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x30], ebx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0xc], 0x324eee79
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov r9, r9
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov rdx, rdx
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14006fbcb
mov r14, r14
ret