joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400adb80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400adbda

Function at 0x1400adbfa
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400adbd0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x1400adc90
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400adcea
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400adce0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x1400b05a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1400b06c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b06c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x1400b0780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400b0840
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b0840
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x1400b08c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400b0900
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b0900
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x1400b0d20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1400b0e20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b0e20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x1400b0ee0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400b0f80
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b0f80
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x1400b1000
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400b1040
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b1040
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x1400b3650
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x1400b5400]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x1400b36a0
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x1400b36a0
movdqa xmm7, xmmword [r11 + 0x50]
repz ret
Function at 0x1400b8900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400b8a20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400b8960
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400b8960
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400b8960
Function at 0x1400d03d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
xor ecx, ecx
lea r8, [0x140181ca0]
mov edx, 8
mov eax, ecx
mov esi, eax
shr esi, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, esi
dec edx
jne 0x1400d03e5
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x100
jne 0x1400d03de
mov ecx, 0x100
mov eax, dword [r8 + rcx*4 - 0x400]
movzx edx, al
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [r8 + rcx*4], eax
inc rcx
cmp rcx, 0x800
jne 0x1400d040e
lea rax, [0x1400d37e0]
mov qword [0x140181c80], rax
mov qword [0x140183ca0], rax
lea rsi, [0x1400d38b0]
mov qword [0x140181c78], rsi
call fcn.1400d39e0
test eax, eax
jne 0x1400d0463
mov qword [0x140183ca0], rsi
add rsp, 0x20
pop rsi
ret

Function at 0x1400e2a20
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x48], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x4c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x50], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x54], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x58], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x5c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x60], eax
lea rdx, [rcx + 0x64]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.14010f6b0
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0xd4], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0xd8], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0xdc], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0xe0], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0xe4], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0xe8], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0xec], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0xf0], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0xf4], eax
mov eax, dword [rdi]
mov dword [rsi + 0xf8], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0xfc], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x100], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x104], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x108], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x110], eax
add rsi, 0x114
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14011d3a0
Function at 0x1400e8200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rdx]
mov rcx, rdi
call fcn.140120c40
test rax, rax
je 0x1400e8247
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r8, 0x100000001b3
movzx esi, byte [rdi + rdx]
xor rcx, rsi
imul rcx, r8
inc rdx
cmp rax, rdx
jne 0x1400e822c
and ecx, 0x7fffffff
jmp 0x1400e824c
mov ecx, 0x4222325
mov edx, 0x1f31d
call fcn.14012ede0
imul ecx, eax, 0xfffff4ec
shr rax, 0x20
imul eax, eax, 0x41a7
lea edx, [rax + rcx]
add edx, 0x7fffffff
add eax, ecx
cmovns edx, eax
movsxd rax, edx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140104110
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x150
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1401041b0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x140104175
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14011a370
nop
add rsp, 0x150
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov r8d, 0x19
mov r9d, 3
mov rcx, rsi
call fcn.14002d860
mov rcx, rsi
call fcn.14002d9a0
jmp 0x14010415b
Function at 0x140110d00
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x160
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140110d78
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140110d78
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x50]
mov r8d, 0xa1
mov r9d, 1
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x58]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140002bb0
mov rcx, rsi
call fcn.14002c830
mov esi, dword [rsp + 0x40]
cmp esi, 0x100
jb 0x140110d87
mov sil, 0xff
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x160
pop rsi
ret
Function at 0x140117290
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rcx + 0x20]
mov rcx, rdi
call fcn.140119db0
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.140118f40
test al, al
je 0x140117342
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x140117385
mov rcx, rdi
call fcn.140119db0
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140118f40
test al, al
je 0x1401173c5
cmp dword [rbx], 0x4550
jne 0x140117405
mov sil, 1
test r14, r14
je 0x140117467
mov qword [r14], rdi
jmp 0x140117467
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117465
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x12e
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
jmp 0x14011743f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117465
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x134
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14011743f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117465
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x13c
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14011743f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117465
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x142
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140002bb0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x140117452
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140009960
mov rcx, rdi
call fcn.14002c830
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140117490
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdi, [rcx + 0x20]
mov rcx, rdi
call fcn.140119db0
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.140118f40
test al, al
je 0x140117542
movzx eax, word [rsp + 0x130]
cmp eax, 0x5a4d
jne 0x140117585
mov rcx, rdi
call fcn.140119db0
movsxd rdi, dword [rsp + 0x16c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140118f40
test al, al
je 0x1401175c5
cmp dword [rbx], 0x4550
jne 0x140117605
mov sil, 1
test r14, r14
je 0x140117667
mov qword [r14], rdi
jmp 0x140117667
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117665
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x12e
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
jmp 0x14011763f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117665
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x134
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14011763f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117665
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x13c
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14011763f
mov ecx, 1
call fcn.14002c2f0
test al, al
je 0x140117665
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov r8d, 0x142
mov r9d, 1
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
call fcn.140002bb0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x140117652
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140009960
mov rcx, rdi
call fcn.14002c830
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14011e458
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x1401634a0]
xor ecx, ecx
lea r8, [0x140163498]
lea rdx, str.FlsAlloc
call fcn.14011e280
mov rbx, rax
test rax, rax
je 0x14011e498
mov rcx, rax
call fcn.14011b338
mov rcx, rdi
call rbx
jmp 0x14011e49e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14011e500
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1401634b0]
mov ecx, 2
lea r8, [0x1401634a8]
lea rdx, str.FlsGetValue
call fcn.14011e280
mov rdi, rax
test rax, rax
je 0x14011e541
mov rcx, rax
call fcn.14011b338
mov ecx, ebx
call rdi
jmp 0x14011e549
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14011e554
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1401634b8]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x1401634b0]
call fcn.14011e280
mov rsi, rax
test rax, rax
je 0x14011e5a0
mov rcx, rax
call fcn.14011b338
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14011e5ab
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret