joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022c80
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x65
xor eax, eax
mov dword [rcx + 0x30], 0x2728302b
mov rbx, rcx
mov dword [rcx + 0x34], 0x2a3a3720
mov dword [rcx + 0x38], 0x37353a23
mov dword [rcx + 0x3c], 0x3620262a
mov dword [rcx + 0x40], 0x36372a36
mov byte [rcx + 0x44], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140022cd8
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140022ce7
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r10, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edi, ecx, 0x5bd1e995
xor r9d, r9d
lea r11d, [r9 + 8]
nop dword [rax + rax]
mov eax, r9d
lea r10, [r10 + 4]
xor eax, edi
add r9d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x140022d10
lea r9d, [r11 + 0x14]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140022d70
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0xe
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x617c5e04
mov dword [rcx + 0x34], 0x7d7d6b6d
mov dword [rcx + 0x38], 0x672e7c61
mov dword [rcx + 0x3c], 0x7a606b6a
mov dword [rcx + 0x40], 0x6b676867
mov dword [rcx + 0x44], 0x2e347c
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140022dca
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140022dd9
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r10, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edi, ecx, 0x5bd1e995
xor r9d, r9d
lea r11d, [r9 + 8]
nop word [rax + rax]
mov eax, r9d
lea r10, [r10 + 4]
xor eax, edi
add r9d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x140022e00
lea r9d, [r11 + 0x17]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140022e60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x37
xor eax, eax
mov dword [rcx + 0x30], 0x74786567
mov rbx, rcx
mov dword [rcx + 0x34], 0x78646472
mov dword [rcx + 0x38], 0x737e6865
mov dword [rcx + 0x3c], 0x7e637972
mov dword [rcx + 0x40], 0x65727e71
mov byte [rcx + 0x44], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140022eb8
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140022ec7
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r10, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edi, ecx, 0x5bd1e995
xor r9d, r9d
lea r11d, [r9 + 8]
nop dword [rax + rax]
mov eax, r9d
lea r10, [r10 + 4]
xor eax, edi
add r9d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x140022ef0
lea r9d, [r11 + 0x14]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140022f50
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x6a
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x5183a60
mov dword [rcx + 0x34], 0x19190f09
mov dword [rcx + 0x38], 0xb4a1805
mov dword [rcx + 0x3c], 0x3020918
mov dword [rcx + 0x40], 0x1e090f1e
mov dword [rcx + 0x44], 0x500f181f
mov word [rcx + 0x48], 0x4a
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140022fb0
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140022fbf
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r10, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edi, ecx, 0x5bd1e995
xor r9d, r9d
lea r11d, [r9 + 8]
mov eax, r9d
lea r10, [r10 + 4]
xor eax, edi
add r9d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x140022fe0
lea r9d, [r11 + 0x19]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140023040
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov byte [rcx], 0x5e
xor eax, eax
mov dword [rcx + 0x30], 0x1d110c0e
mov rbx, rcx
mov dword [rcx + 0x34], 0x110d0d1b
mov dword [rcx + 0x38], 0xc1f010c
mov dword [rcx + 0x3c], 0xa17161d
mov dword [rcx + 0x40], 0xb0a1d1b
mov word [rcx + 0x44], 0x1b0c
mov byte [rcx + 0x46], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x14002309e
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x1400230ad
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r10, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edi, ecx, 0x5bd1e995
xor r9d, r9d
lea r11d, [r9 + 8]
nop
mov eax, r9d
lea r10, [r10 + 4]
xor eax, edi
add r9d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x1400230d0
lea r9d, [r11 + 0x16]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140023130
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0xd
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x377e3d07
mov word [rcx + 0x34], 0x2d
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140023173
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140023182
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x1400231b0
lea r9d, [rdi + 5]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140023220
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x55
xor eax, eax
mov word [rcx + 0x30], 0x61a
mov rbx, rcx
mov byte [rcx + 0x32], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140023261
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140023270
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x1400232a0
lea r9d, [rdi + 2]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x140023310
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x61
xor eax, eax
mov dword [rcx + 0x30], 0xc0e296b
mov rbx, rcx
mov dword [rcx + 0x34], 0x8130504
mov dword [rcx + 0x38], 0x415b0417
mov byte [rcx + 0x3c], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140023360
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x14002336f
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x140023390
lea r9d, [rdi + 0xc]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140023400
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x14
mov rbx, rcx
movsx edi, byte [rcx]
mov dword [rcx + 0x30], 0x51595b5c
mov dword [rcx + 0x34], 0x425d4650
mov word [rcx + 0x38], 0x51
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x14002344a
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140023459
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop word [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x140023480
lea r9d, [rdi + 9]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1400234f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov dword [rcx + 0x30], 0x110037
mov eax, 0x62
mov word [rcx], ax
mov rdi, rcx
mov dword [rcx + 0x34], 0x100007
xor eax, eax
mov dword [rcx + 0x38], 0x30026
mov dword [rcx + 0x3c], 0x30016
mov dword [rcx + 0x40], 0x16004c
mov dword [rcx + 0x44], 0x16001a
mov word [rcx + 0x48], ax
movsx ebx, byte [rcx]
mov ecx, ebx
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14002355b
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x14002356a
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea ebx, [r10 + 8]
nop dword [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rbx, 1
jne 0x140023590
lea r9d, [rbx + 0x18]
lea rdx, [rdi + 0x30]
call fcn.14011c9b0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140026800
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x59
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0x59
mov byte [rcx + 0x30], al
movzx eax, byte [rdx + 1]
xor al, 0x59
mov byte [rcx + 0x31], al
movzx eax, byte [rdx + 2]
xor al, 0x59
mov byte [rcx + 0x32], al
movzx eax, byte [rdx + 3]
xor al, 0x59
mov byte [rcx + 0x33], al
movzx eax, byte [rdx + 4]
xor al, 0x59
mov byte [rcx + 0x34], al
movzx eax, byte [rdx + 5]
xor al, 0x59
mov byte [rcx + 0x35], al
movzx eax, byte [rdx + 6]
xor al, 0x59
mov byte [rcx + 0x36], al
movzx eax, byte [rdx + 7]
xor al, 0x59
mov byte [rcx + 0x37], al
movzx eax, byte [rdx + 8]
xor al, 0x59
mov byte [rcx + 0x38], al
xor eax, eax
mov byte [rcx + 0x39], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x14002688b
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x14002689a
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop dword [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x1400268c0
lea r9d, [rdi + 9]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140026930
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x26
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0x26
mov byte [rcx + 0x30], al
movzx eax, byte [rdx + 1]
xor al, 0x26
mov byte [rcx + 0x31], al
movzx eax, byte [rdx + 2]
xor al, 0x26
mov byte [rcx + 0x32], al
movzx eax, byte [rdx + 3]
xor al, 0x26
mov byte [rcx + 0x33], al
movzx eax, byte [rdx + 4]
xor al, 0x26
mov byte [rcx + 0x34], al
movzx eax, byte [rdx + 5]
xor al, 0x26
mov byte [rcx + 0x35], al
movzx eax, byte [rdx + 6]
xor al, 0x26
mov byte [rcx + 0x36], al
movzx eax, byte [rdx + 7]
xor al, 0x26
mov byte [rcx + 0x37], al
movzx eax, byte [rdx + 8]
xor al, 0x26
mov byte [rcx + 0x38], al
movzx eax, byte [rdx + 9]
xor al, 0x26
mov byte [rcx + 0x39], al
movzx eax, byte [rdx + 0xa]
xor al, 0x26
mov byte [rcx + 0x3a], al
xor eax, eax
mov byte [rcx + 0x3b], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x1400269cd
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x1400269dc
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop dword [rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x140026a00
lea r9d, [rdi + 0xb]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140026a70
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x6f
mov rbx, rcx
movzx eax, byte [rdx]
xor al, 0x6f
mov byte [rcx + 0x30], al
movzx eax, byte [rdx + 1]
xor al, 0x6f
mov byte [rcx + 0x31], al
movzx eax, byte [rdx + 2]
xor al, 0x6f
mov byte [rcx + 0x32], al
movzx eax, byte [rdx + 3]
xor al, 0x6f
mov byte [rcx + 0x33], al
movzx eax, byte [rdx + 4]
xor al, 0x6f
mov byte [rcx + 0x34], al
movzx eax, byte [rdx + 5]
xor al, 0x6f
mov byte [rcx + 0x35], al
movzx eax, byte [rdx + 6]
xor al, 0x6f
mov byte [rcx + 0x36], al
movzx eax, byte [rdx + 7]
xor al, 0x6f
mov byte [rcx + 0x37], al
movzx eax, byte [rdx + 8]
xor al, 0x6f
mov byte [rcx + 0x38], al
movzx eax, byte [rdx + 9]
xor al, 0x6f
mov byte [rcx + 0x39], al
movzx eax, byte [rdx + 0xa]
xor al, 0x6f
mov byte [rcx + 0x3a], al
xor eax, eax
mov byte [rcx + 0x3b], al
movsx edi, byte [rcx]
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x140026b0d
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x140026b1c
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea edi, [r10 + 8]
nop dword [rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rdi, 1
jne 0x140026b40
lea r9d, [rdi + 0xb]
lea rdx, [rbx + 0x30]
call fcn.14011c9b0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140066950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.14002bf00
mov rbx, rax
test rax, rax
jne 0x14006698e
lea eax, [rbx + 7]
jmp 0x140066a10
cmp byte [0x140188df4], 0
je 0x1400669e2
mov rax, qword [0x140188f80]
test rax, rax
je 0x1400669ae
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1400669e2
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x14002f990]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.140137418
mov qword [rbx], rax
test rax, rax
jne 0x1400669f2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x140066a0b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14009a900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0xa0]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x14009aaf8
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x14009a962
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x14009a972
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xe4]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14009a99f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.1400545c0
jmp 0x14009a9cd
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.140099be0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14009aa0c
mov rcx, rdi
call fcn.140054480
test eax, eax
jne 0x14009aae4
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x14009aad8
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14009aad8
mov dword [rbx + rax*4 + 0xe4], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14009a940
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f73f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movsx edi, byte [rcx]
mov rbx, rcx
mov ecx, edi
call fcn.140013f00
add edi, eax
cmp edi, 0xfffffff0
jg 0x1400f7418
mov edx, 0x84
call fcn.140128630
cmp edi, 0xffffffb7
jg 0x1400f7427
mov edx, 0x9d
call fcn.140128630
imul eax, edi, 0x5bd1e995
lea r8, [rbx + 4]
mov r9, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r11d, ecx, 0x5bd1e995
xor edx, edx
lea r10d, [rdx + 8]
nop dword [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
xor eax, r11d
add edx, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9 - 4], eax
sub r10, 1
jne 0x1400f7450
mov r9d, dword [0x140196874]
mov rdx, qword [rbx + 0x28]
call fcn.14011cb00
mov r8, rax
test rax, rax
jne 0x1400f74ac
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0xf
movzx ecx, byte [rbx]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400f74b1
mov rbx, qword [rsp + 0x38]
mov rax, r8
mov byte [r8 + 0xf], dl
add rsp, 0x20
pop rdi
ret

Function at 0x1400f74e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov byte [rcx], 0x7a
mov rdi, rcx
movzx eax, byte [rdx]
xor al, 0x7a
mov byte [rcx + 0x30], al
xor eax, eax
mov byte [rcx + 0x31], al
movsx ebx, byte [rcx]
mov ecx, ebx
call fcn.140013f00
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1400f7523
mov edx, 0x84
call fcn.140128630
cmp ebx, 0xffffffb7
jg 0x1400f7532
mov edx, 0x9d
call fcn.140128630
imul eax, ebx, 0x5bd1e995
lea r8, [rdi + 4]
mov r11, r8
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul esi, ecx, 0x5bd1e995
xor r10d, r10d
lea ebx, [r10 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, r10d
lea r11, [r11 + 4]
xor eax, esi
add r10d, 0x5bd1e995
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r9d, ecx
shr r9d, 0xf
xor r9d, ecx
mov dword [r11 - 4], r9d
sub rbx, 1
jne 0x1400f7560
lea r9d, [rbx + 1]
lea rdx, [rdi + 0x30]
call fcn.14011c9b0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret