joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031548
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x470], rax
cmp dword [rcx + 0x148], 1
mov rsi, rcx
mov r12, qword [rsp + 0x4e8]
mov r9, qword [rsp + 0x4f0]
mov r13, qword [rsp + 0x4f8]
jne 0x140031752
mov rbx, qword [rcx + 8]
lea rax, [rbx - 0x10]
cmp rax, 0x3f0
ja 0x140031752
lea rax, [0x14018ed90]
mov ecx, 1
cmp ecx, dword [rsi + 0x14c]
je 0x1400315cc
mov ecx, dword [rax + 0x10]
add rax, 0xc
test ecx, ecx
jne 0x1400315b9
movzx edi, byte [rax + 8]
test edi, edi
je 0x140031752
lea r15d, [rdi + rdi]
lea ecx, [r15 + 2]
cmp rcx, rbx
ja 0x140031752
lea rax, [rsp + 0x70]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400309cc
mov edx, eax
test eax, eax
jne 0x140031736
mov eax, dword [rsi + 0x14c]
lea rcx, [rsp + 0x71]
mov ebp, edi
mov dword [rsp + 0x20], eax
mov r14, rbx
mov edx, ebp
sub r14, rdi
lea rdi, [rsp + 0x71]
add rdi, rbp
mov r8, rdi
lea r9, [r14 - 1]
call fcn.140031044
mov edx, eax
test eax, eax
jne 0x140031736
mov eax, dword [rsi + 0x14c]
lea r8, [rsp + 0x71]
mov r9d, ebp
mov dword [rsp + 0x20], eax
lea rdx, [r14 - 1]
mov rcx, rdi
call fcn.140031044
mov edx, eax
test eax, eax
jne 0x140031736
mov ecx, dword [rsi + 0x14c]
call fcn.14002a354
test rax, rax
jne 0x14003167e
mov edx, 0xffffbf80
jmp 0x140031736
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14002a910
mov edx, eax
test eax, eax
jne 0x140031736
mov dl, byte [rsp + 0x70]
xor ecx, ecx
test rbp, rbp
je 0x1400316b8
mov al, byte [rsp + rcx + 0x30]
inc rcx
xor al, byte [rdi]
inc rdi
or dl, al
cmp rcx, rbp
jb 0x1400316a5
mov eax, r15d
mov r10, rbx
sub r10, rax
xor r9d, r9d
xor r8b, r8b
xor ecx, ecx
add r10, 0xfffffffffffffffe
je 0x1400316ef
or r8b, byte [rdi + rcx]
inc rcx
mov al, r8b
neg al
or al, r8b
not al
movzx eax, al
shr rax, 7
add r9, rax
cmp rcx, r10
jb 0x1400316cf
add rdi, r9
mov al, byte [rdi]
inc rdi
xor al, 1
or dl, al
je 0x140031704
mov edx, 0xffffbf00
jmp 0x140031736
sub rbx, rdi
lea r8, [rsp + 0x70]
add r8, rbx
cmp r8, qword [rsp + 0x500]
jbe 0x140031720
mov edx, 0xffffbc00
jmp 0x140031736
mov qword [r12], r8
test r8, r8
je 0x140031734
mov rdx, rdi
mov rcx, r13
call fcn.140150d9b
xor edx, edx
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x400
rep stosb byte [rdi], al
lea ecx, [rax + 0x40]
lea rdi, [rsp + 0x30]
rep stosb byte [rdi], al
mov eax, edx
jmp 0x140031757
mov eax, 0xffffbf80
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14014f050
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400356fc
Capabilities:
Hash data using sha512

Disassembly:
mov r8, rcx
cmp edx, 1
jbe 0x14003570a
mov eax, 0xffffff8b
ret
mov eax, edx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
neg eax
movabs rax, 0x61b1b6f5cd48d5d0
sbb rcx, rcx
and rcx, rax
movabs rax, 0x6a09e667f3bcc908
add rcx, rax
mov eax, edx
mov qword [r8 + 0x10], rcx
neg eax
movabs rax, 0xa7327aa4b1b22dcc
sbb rcx, rcx
and rcx, rax
movabs rax, 0xbb67ae8584caa73b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x18], rcx
neg eax
movabs rax, 0x54ea0de731dbe4ec
sbb rcx, rcx
and rcx, rax
movabs rax, 0x3c6ef372fe94f82b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x20], rcx
neg eax
movabs rax, 0x6fdff79e97f12248
sbb rcx, rcx
and rcx, rax
movabs rax, 0xa54ff53a5f1d36f1
add rcx, rax
mov eax, edx
mov qword [r8 + 0x28], rcx
neg eax
movabs rax, 0x1624d3e851d98860
sbb rcx, rcx
and rcx, rax
movabs rax, 0x510e527fade682d1
add rcx, rax
mov eax, edx
mov qword [r8 + 0x30], rcx
neg eax
movabs rax, 0xf3aee1fb3d19a8f2
sbb rcx, rcx
and rcx, rax
movabs rax, 0x9b05688c2b3e6c1f
add rcx, rax
mov eax, edx
mov qword [r8 + 0x38], rcx
neg eax
movabs rax, 0xbb88546169b7d23c
sbb rcx, rcx
and rcx, rax
movabs rax, 0x1f83d9abfb41bd6b
add rcx, rax
mov eax, edx
mov qword [r8 + 0x40], rcx
neg eax
movabs rax, 0xebd47b04ab7c2e2b
sbb rcx, rcx
and rcx, rax
movabs rax, 0x5be0cd19137e2179
add rcx, rax
xor eax, eax
mov qword [r8 + 0x48], rcx
mov dword [r8 + 0xd0], edx
ret
Function at 0x14004f9e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x14022a410]
mov rbx, rdx
xor edx, edx
mov dword [rbp - 0x18], 0x67613f69
mov eax, edx
mov dword [rbp - 0x14], 0x3873677b
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x10], 0x100
xor byte [rbp + rax - 0x28], al
inc rax
cmp rax, 0x18
jb 0x14004fa19
mov byte [rbp - 0xf], dl
lea rax, [rbp - 0x28]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], dl
jne 0x14004fa31
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14004fa85
cmp qword [r8 + 0x18], 0xf
jbe 0x14004fa59
mov r8, qword [r8]
mov qword [rsp + 0x30], rdx
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1400136d0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140010914
int3

Function at 0x140055b98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
movdqa xmm0, xmmword [0x14022a190]
xor ecx, ecx
movdqa xmm1, xmmword [0x14022a4c0]
mov eax, ecx
movdqu xmmword [rsp + 0x30], xmm0
mov rbx, rdx
mov word [rsp + 0x50], 0x100
movdqu xmmword [rsp + 0x40], xmm1
xor byte [rsp + rax + 0x30], al
inc rax
cmp rax, 0x20
jb 0x140055bed
xorps xmm0, xmm0
mov byte [rsp + 0x51], cl
xorps xmm1, xmm1
lea rax, [rsp + 0x30]
movups xmmword [rsp + 0x60], xmm0
or r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x70], xmm1
inc r8
cmp byte [rax + r8], cl
jne 0x140055c18
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400128ec
mov rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
cmp rdx, 0xf
cmova rax, rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
jbe 0x140055c8a
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055c85
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055c85
call fcn.140aba799
int3
call fcn.14014f0b4
mov rax, qword [0x14026f760]
lea rdx, [rsp + 0x30]
mov r8d, 0x100
lea rcx, [rbp - 0x80]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140015e58
mov edi, dword [rbx + 0x54]
lea r9, [rsp + 0x60]
mov rdx, qword [rbx + 0x70]
mov rcx, qword [0x14026f760]
add rdx, 0xfffffffffffffff0
mov r8d, dword [rbx + 0x58]
add rdx, rdi
add rcx, rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
sub r8d, edi
lea rcx, [rbp - 0x80]
xor edx, edx
call fcn.140016cc0
xor eax, eax
lea rdi, [rbp - 0x80]
mov ecx, 0x120
movabs rdx, 0x7ff000000
xor qword [rbx + 0x70], rdx
rep stosb byte [rdi], al
mov rcx, qword [0x14026f760]
cmp rcx, qword [0x14026f768]
je 0x140055d19
mov qword [0x14026f768], rcx
mov al, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14014f050
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005682c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov r8d, 6
cmp byte [r9 + 7], 0
je 0x140056869
xor eax, eax
xor byte [r9 + rax], al
inc rax
cmp rax, r8
jb 0x140056858
mov byte [r9 + 7], 0
lea rax, [r9 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
cmp r9, rax
jne 0x140056898
movdqa xmm0, xmmword [0x140229da0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
jmp 0x1400568a6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400128ec
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400568b4
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14005bb68
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140056931
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005692c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005692c
call 0x140a46b0c
int3
call fcn.14014f0b4
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140073c94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
test rdx, rdx
jne 0x140073cbc
xor eax, eax
jmp 0x140073d01
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov edi, dword [rbp + rdx + 0x20]
mov esi, dword [rbp + rdx + 0x24]
add rdi, rbx
add rsi, rbx
jmp 0x140073cdf
lea rdi, [rdi + 4]
add rsi, 2
mov ecx, dword [rdi]
mov rdx, r14
add rcx, rbx
push rcx
call 0x1407b7260
test eax, eax
jne 0x140073cd7
mov ecx, dword [rbp + rbx + 0x1c]
movzx edx, word [rsi]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140081460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rcx, qword [rdx + 8]
mov rbx, rdx
mov rsi, r9
movabs rax, 0x99d722dabde58f07
mov r9, qword [rdx]
xor edi, edi
sub rcx, r9
mov r15b, r8b
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140081645
xor r14d, r14d
cmp byte [r14 + r9 + 0x6a0], 0
je 0x140081608
cmp byte [0x14026f7a9], 0
jne 0x140081684
test r15b, r15b
je 0x140081684
mov rax, qword [0x14026ce68]
lea rdx, str.Delete_row_
mov rcx, qword [rax + 0x3ed0]
call fcn.14008a7b4
xor edx, edx
mov ecx, eax
call fcn.14009647c
test al, al
jne 0x140081507
lea rcx, str.Delete_row_
call fcn.140096548
mov r8d, 0x40
lea rcx, str.Delete_row_
call fcn.140096aa4
test al, al
je 0x140081608
lea rcx, str.Row_will_be_deleted._nThis_operation_cannot_be_undone__n
call fcn.1400b5b28
call fcn.1400b8738
and dword [rbp - 0x18], 0
lea rdx, [rbp - 0x18]
and dword [rbp - 0x14], 0
mov ecx, 0xb
call fcn.1400884d8
lea rdx, [0x14026f7aa]
lea rcx, str.Dont_ask_me_next_time.
call fcn.1400b7bc8
mov ecx, 1
call fcn.140088564
and dword [rbp - 0xc], 0
xor eax, eax
mov dword [rbp - 0x10], 0x42f00000
mov dword [rbp - 0x30], 0x1004a4f
xor byte [rbp + rax - 0x30], al
inc rax
cmp rax, 2
jb 0x140081579
xor r8d, r8d
mov byte [rbp - 0x2d], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400b6304
test al, al
jne 0x14008165b
movss xmm1, dword [0x140229d30]
xorps xmm0, xmm0
call fcn.140095590
and dword [rbp - 0x1c], 0
xor eax, eax
mov dword [rbp - 0x20], 0x42f00000
mov dword [rbp - 0x28], 0x606c6043
mov dword [rbp - 0x24], 0x1006961
xor byte [rbp + rax - 0x28], al
inc rax
cmp rax, 6
jb 0x1400815cd
xor r8d, r8d
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call fcn.1400b6304
test al, al
je 0x140081603
call fcn.1400968ec
mov rax, qword [rbx]
mov byte [r14 + rax + 0x6a0], 0
call fcn.140096b88
mov r9, qword [rbx]
inc edi
mov rcx, qword [rbx + 8]
movabs rax, 0x99d722dabde58f07
sub rcx, r9
add r14, 0x6a8
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, edi
cmp rax, rdx
jb 0x1400814af
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov al, byte [0x14026f7aa]
mov byte [0x14026f7a9], al
call fcn.1400968ec
call fcn.140096b88
test rsi, rsi
je 0x140081678
mov dword [rsi], edi
movsxd rdx, edi
imul r8, rdx, 0x6a8
jmp 0x140081695
test rsi, rsi
je 0x14008168b
mov dword [rsi], edi
movsxd rax, edi
imul r8, rax, 0x6a8
add r8, qword [rbx]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140081a24
mov al, 1
jmp 0x140081647
Function at 0x140085680
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x18]
mov rbx, rdi
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1400856c2
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
push rdx
call 0x14053cece
test rax, rax
jne 0x1400856d9
cmp rdi, rbx
jne 0x1400856a6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x1400856c9

Function at 0x1400856e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebp, ecx
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x18]
mov rbx, rsi
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x30]
test rdi, rdi
je 0x140085727
movzx edx, word [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
call fcn.140013b8c
cmp eax, ebp
je 0x140085743
cmp rsi, rbx
jne 0x14008570a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, rdi
jmp 0x14008572e

Function at 0x1400857d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400857f8
xor eax, eax
jmp 0x14008584d
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [rax + rcx + 0x88]
mov esi, dword [rbp + rcx + 0x20]
mov edi, dword [rbp + rcx + 0x24]
add rsi, rbx
add rdi, rbx
mov ecx, dword [rsi]
xor edx, edx
add rcx, rbx
mov rax, rcx
cmp byte [rcx], dl
je 0x140085829
inc rax
inc edx
cmp byte [rax], 0
jne 0x14008581f
call fcn.140013b8c
cmp eax, r14d
je 0x14008583d
add rsi, 4
add rdi, 2
jmp 0x140085811
mov ecx, dword [rbp + rbx + 0x1c]
movzx edx, word [rdi]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400874dc
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140087536
mov r11b, 0x23
lea rbx, [0x1401f60f0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x140087520
cmp rdx, 2
jb 0x140087520
cmp byte [r10], r11b
jne 0x140087520
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x1400874fe
jmp 0x140087577
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140087577
mov r11b, 0x23
lea rbx, [0x1401f60f0]
cmp dl, r11b
jne 0x14008755b
cmp byte [r10], r11b
jne 0x14008755b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x140087549
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x14008a814
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0xf8]
mov r8, rdx
mov qword [rsp + 0x20], rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0xf0]
mov r10d, 8
mov ebx, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x20]
not ebx
movzx eax, byte [rdx]
inc rdx
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1401f60f0]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x14008a853
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14008a88a
lea edx, [r10 + 0xc]
mov ecx, ebx
call fcn.14009bdf4
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014f050
add rsp, 0x30
pop rbx
ret

Function at 0x14008a8a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1401f60f0]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x14008a8df
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14008a919
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.14009bdf4
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014f050
add rsp, 0x30
pop rbx
ret

Function at 0x14008a930
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x110]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x114]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf8]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf0]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x1401f60f0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14008a9ad
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14014f050
add rsp, 0x28
ret
Function at 0x1400c9b5c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea rbp, [r8 - 1]
mov qword [rsp + 0x20], rdx
sar rbp, 1
mov r15, r9
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov r14, rdx
cmp rdx, rbp
jge 0x1400c9bf4
lea rbx, [r14 + r14]
lea rax, [rbx + 2]
imul rdx, rax, 0x68
add rdx, rsi
lea r8, [rdx - 0x68]
call fcn.1400c7180
movzx eax, al
lea r14, [rbx + 1]
xor rax, 1
add r14, rax
imul rdi, r14, 0x68
imul rbx, r12, 0x68
add rdi, rsi
mov al, byte [rdi]
lea rdx, [rdi + 8]
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.140011554
lea rdx, [rdi + 0x28]
lea rcx, [rbx + 0x28]
call fcn.140011554
lea rdx, [rdi + 0x48]
lea rcx, [rbx + 0x48]
call fcn.140011554
mov r12, r14
cmp r14, rbp
jl 0x1400c9b8d
mov rbx, r14
cmp r14, rbp
jne 0x1400c9c47
test r13b, 1
jne 0x1400c9c47
imul rdi, r13, 0x68
imul rbx, r14, 0x68
mov al, byte [rdi + rsi - 0x68]
lea rdx, [rsi - 0x60]
add rdx, rdi
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.140011554
lea rdx, [rsi - 0x40]
add rdx, rdi
lea rcx, [rbx + 0x28]
call fcn.140011554
lea rdx, [rsi - 0x20]
add rdx, rdi
lea rcx, [rbx + 0x48]
call fcn.140011554
lea rbx, [r13 - 1]
mov rbp, qword [rsp + 0x20]
cmp rbp, rbx
jge 0x1400c9ca9
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
imul r14, rdi, 0x68
add r14, rsi
mov rdx, r14
call fcn.1400c7180
test al, al
je 0x1400c9ca9
mov al, byte [r14]
lea rdx, [r14 + 8]
imul rbx, rbx, 0x68
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.140011554
lea rdx, [r14 + 0x28]
lea rcx, [rbx + 0x28]
call fcn.140011554
lea rdx, [r14 + 0x48]
lea rcx, [rbx + 0x48]
call fcn.140011554
mov rbx, rdi
cmp rbp, rdi
jl 0x1400c9c51
mov al, byte [r15]
lea rdx, [r15 + 8]
imul rbx, rbx, 0x68
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.140011554
lea rdx, [r15 + 0x28]
lea rcx, [rbx + 0x28]
call fcn.140011554
lea rdx, [r15 + 0x48]
lea rcx, [rbx + 0x48]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140011554
Function at 0x1400cbbcc
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 0x47], rcx
mov qword [rbp - 0x31], rdx
mov byte [rbp - 0x29], 0
and dword [rbp + 0x1b], 0
and dword [rbp + 0x1f], 0
mov dword [rbp + 0x23], 0x67452301
mov dword [rbp + 0x27], 0xefcdab89
mov dword [rbp + 0x2b], 0x98badcfe
mov dword [rbp + 0x2f], 0x10325476
cmp qword [rdx + 0x18], 0xf
jbe 0x1400cbc31
mov rdx, qword [rdx]
mov r8d, dword [rbx + 0x10]
lea rcx, [rbp - 0x29]
call fcn.1400cba44
cmp byte [rbp - 0x29], 0
jne 0x1400cbcc9
mov r8d, 8
lea rdx, [rbp + 0x1b]
lea rcx, [rbp + 0x47]
call fcn.1400cb14c
mov edx, dword [rbp + 0x1b]
shr edx, 3
and edx, 0x3f
lea eax, [r8 + 0x30]
sub eax, edx
mov r8d, 0x78
sub r8d, edx
cmp edx, 0x38
cmovb r8d, eax
lea rdx, [0x14026a620]
lea rcx, [rbp - 0x29]
call fcn.1400cba44
mov r8d, 8
lea rdx, [rbp + 0x47]
lea rcx, [rbp - 0x29]
call fcn.1400cba44
mov r8d, 0x10
lea rdx, [rbp + 0x23]
lea rcx, [rbp + 0x33]
call fcn.1400cb14c
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x28]
call fcn.140150b0c
xor eax, eax
mov qword [rbp + 0x1b], rax
mov byte [rbp - 0x29], 1
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400cbb04
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400cbd0c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400cbd07
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400cbd40
mov rcx, r8
call fcn.14014f0b4
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14014f050
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
push rcx
call 0x14063d154
int3
Function at 0x1400d04f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rsi, rcx
xor r14d, r14d
add rcx, 0x1b84
lea rax, [rcx + 0xc]
cmp rax, rcx
sbb r8, r8
not r8
and r8d, 0xc
cmp rcx, rax
ja 0x1400d0548
mov dl, 1
call fcn.140150b0c
mov dword [rbp + 0x80], 0x40674061
mov dword [rbp + 0x84], 0x4067407b
mov dword [rbp + 0x88], 0x40704077
mov dword [rbp + 0x8c], 0x407d
mov byte [rbp + 0x90], 1
lea rdi, [rsi + 0x1518]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdi + r8*2], r14w
jne 0x1400d0596
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14001098c
nop
cmp byte [rbp + 0x90], r14b
je 0x1400d05d9
mov rcx, r14
mov eax, 0x4012
add eax, ecx
xor word [rbp + rcx*2 + 0x80], ax
inc rcx
cmp rcx, 7
jb 0x1400d05ba
mov byte [rbp + 0x90], r14b
lea r8, [rbp + 0x8e]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140081380
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xc0]
call fcn.140080f4c
nop
lea rcx, [rsp + 0x48]
call fcn.140010928
nop
lea rcx, [rsp + 0x20]
call fcn.140010928
mov dword [rsp + 0x20], 0x3f823f9f
mov dword [rsp + 0x24], 0x3f913f98
mov dword [rsp + 0x28], 0x3f983f96
mov dword [rsp + 0x2c], 0x3f853f9c
mov dword [rsp + 0x30], 0x3f83
mov byte [rsp + 0x34], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400d065c
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.14001098c
nop
cmp byte [rsp + 0x34], r14b
je 0x1400d069b
mov rcx, r14
mov eax, 0x3fef
add eax, ecx
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 9
jb 0x1400d0681
mov byte [rsp + 0x34], r14b
lea r8, [rsp + 0x32]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.140081380
nop
lea r8, [rbp + 0x80]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xa0]
call fcn.140080f4c
nop
lea rcx, [rbp + 0x80]
call fcn.140010928
nop
lea rcx, [rsp + 0x48]
call fcn.140010928
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call fcn.140150b0c
lea rcx, [rsp + 0x70]
call fcn.1400db510
nop
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rdx, qword [rbp + 0xc0]
mov ebx, 2
mov r8d, ebx
lea rcx, [rsp + 0x78]
call fcn.1400151d4
xor r8d, r8d
test rax, rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
je 0x1400d074b
add rcx, rax
xor edx, edx
push rax
call 0x140a721e4
jmp 0x1400d0756
add rcx, rax
mov edx, ebx
call 0x1408b0ea5
int3
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
call 0x140840a89
int3