joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c380
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c626
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42c61a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x013389e6], 0
jne 0x42c3e2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42c42a
xor edx, edx
jmp 0x42c40d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041dbc0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c3e6
add rax, 0x1260
call fcn.0042c240
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42c5b4
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42c427
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00413b80
test rax, rax
jne 0x42c482
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42c427
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42c4c9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c427
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42c60d
lea r10, [0x0130ae10]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42c54f
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42c585
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c427
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42c605
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42c427
cmp rbx, 0x200
ja 0x42c5f8
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00422d20
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042c240
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045bea0
mov rax, r8
call fcn.0045be20
mov rax, r8
mov ecx, 0x40
call fcn.0045be40
mov edx, 0x200
nop
call fcn.0045be80
nop
mov qword [rsp + 8], rax
call fcn.0045e3e0
mov rax, qword [rsp + 8]
jmp fcn.0042c380
Function at 0x42f9a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x42fc3e
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0x48], 0
mov rax, qword [0x0129d140]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.00430240
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
je 0x42fc15
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x80], rax
test byte [rax], al
lea rcx, [rax + 0x308]
mov qword [rsp + 0x88], rcx
nop
mov rax, rcx
call fcn.0040b000
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov qword [rdx + 0x310], rcx
cmp qword [rdx + 0x328], 0
jne 0x42fad5
cmp byte [0x013389dd], 0
je 0x42fad5
mov rax, qword [0x0129d148]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.004300c0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x328], rax
test rax, rax
je 0x42fbed
nop
nop
mov rax, qword [rsp + 0x88]
nop
call fcn.0040b220
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [0x0129d060]
lea rdx, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
call fcn.00430040
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x42fbc5
mov rcx, qword [rsp + 0x58]
lea rdx, [rcx + 0x4000]
mov qword [rsp + 0x90], r14
mov rsi, qword [r14 + 8]
cmp rsi, rdx
jb 0x42fba7
sub rsi, rcx
add rsi, 0xffffffffffffc000
cmp rsi, 0x4000000
ja 0x42fba7
mov qword [r14], rdx
lea rax, [rcx + 0x53a0]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
nop
call fcn.0045b7c0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rcx, qword [rsp + 0x90]
test byte [rcx], al
lea rax, [0x00e828ff]
mov ebx, 0xc
nop dword [rax]
call fcn.00432bc0
call fcn.0045d3e0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00e84cbe]
mov ebx, 0x22
call fcn.00432bc0
call fcn.0045d3e0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00e861c7]
mov ebx, 0x30
call fcn.00432bc0
call fcn.0045d3e0
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00e8523e]
mov ebx, 0x25
call fcn.00432bc0
nop
nop
call fcn.004597c0
jmp fcn.0042f9a0
Function at 0x43f160
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43f2ca
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43f178
cmp edx, ecx
jne 0x43f2b8
nop dword [rax]
test rsi, rsi
jne 0x43f2b8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43f1d4
nop
call fcn.0045d840
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043f060
mov rcx, qword [0x012e2e78]
mov rdx, qword [0x012e2e70]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x43f2b3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x43f2a8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x012e4c30]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x012e4c30], rbx
nop
mov edx, 1
lea rsi, [0x012e4c38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x43f297
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00e8570f]
mov ebx, 0x28
call fcn.00432bc0
mov rcx, rax
mov rax, rsi
call fcn.0045be20
call fcn.004314a0
lea rax, [0x00e84f28]
mov ebx, 0x23
call fcn.00432bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004597c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043f160
Function at 0x450ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450d59
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00450da0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00459680
xorps xmm15, xmm15
mov r14, qword [0x01338cd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004597c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00450ca0
Function at 0x45b8c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01339220]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x013389e5], 0
je 0x45b8f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01339740]
aesenc xmm0, xmmword [0x01339750]
aesenc xmm0, xmmword [0x01339760]
movq rax, xmm0
ret
jmp 0x4099a0

Function at 0x14002c5ed
Capabilities:
Encode data using xor

Disassembly:
call fcn.1400016e4
cmpsd dword [rsi], dword [rdi]
mov eax, 0x30902
add dword [rsi], edx
add byte [rsi], al
or dword [rdx + 0x3a560000], esp
mov dh, 0xa0
or edi, ebp
leave
lodsd eax, dword [rsi]
movabs al, byte [0x257a35fa30556f8]
xor dword [rdi - 0xe], ebx
pop rsi
mov dword [rbx], esp
movabs al, byte [0xd56583a0a5e4470b]
scasd eax, dword [rdi]
movabs al, byte [0x92ea785fc8575550]
pop rbx
movabs al, byte [0xe5e502a094a46f76]
lodsb al, byte [rsi]
movabs al, byte [0x7711275f8b0b7299]
pop rdx
pop rdi
lea edx, [rdx + 0x7fa054bb]
jnp 0x14002c604
invalid
Function at 0x100401080
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
nop
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rdx + 0x10]
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004010c1
mov eax, dword [rsi]
sub eax, dword [rbx]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x10000129c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1000036f8]
lea rdx, [0x100003700]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x1000012e6
mov dword [0x100003704], 1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp qword [0x1000036f8], 0
mov dword [0x10000370c], eax
je 0x1000012dd
call fcn.10000129c
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]
inc dword [0x100003714]
add rsp, 0x28
ret

Function at 0x1000014b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100003740], rdi
je 0x1000014fe
cmp rax, rdi
jne 0x1000014f1
mov edi, 1
mov r12d, edi
jmp 0x100001503
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1000014d5
mov edi, 1
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x100001519
mov ecx, 0x1f
call fcn.100173000
jmp 0x100001576
mov eax, dword [0x100003738]
test eax, eax
jne 0x100001570
mov dword [0x100003738], edi
lea r13, [0x1000011a0]
lea rsi, [0x100001188]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100001562
test eax, eax
jne 0x100001562
mov rcx, qword [rsi]
test rcx, rcx
je 0x100001557
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100001540
test eax, eax
je 0x100001576
mov eax, 0xff
jmp 0x100001648
mov dword [0x100003164], edi
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x10000159d
lea rdx, [0x100001180]
lea rcx, [0x100001170]
call sub.msvcrt.dll__initterm
mov dword [0x100003738], 2
test r12d, r12d
jne 0x1000015ab
xor eax, eax
xchg qword [0x100003740], rax
cmp qword [0x100003748], 0
je 0x1000015d4
lea rcx, [0x100003748]
call fcn.10000189c
test eax, eax
je 0x1000015d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100003748]
mov r8, qword [0x100003148]
mov rdx, qword [0x100003150]
mov ecx, dword [0x100003140]
call fcn.100001440
mov dword [0x100003160], eax
cmp dword [0x100003144], 0
jne 0x100001604
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100003164], 0
jne 0x100001619
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100003160]
jmp 0x100001648
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.1000019b0
add rsp, 0x28
jmp 0x1000014b0

Function at 0x100001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001955
cmp rcx, 0xffffffffffffffff
je 0x100001955
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000194d
cmp dword [rcx + 0x3c], edx
jl 0x10000194d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000194d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001955
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180003a00
Capabilities:
Access peb ldr_data
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebx, edx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x60]
mov r10d, 0x2f361700
movzx r9d, word [rax + 0x58]
shr r9, 1
lea r11, [r8 + r9*2]
cmp r8, r11
je 0x180003a83
nop dword [rax + rax]
movsx ecx, byte [r8]
mov edx, ecx
sub cl, 0x41
mov r9d, edx
or r9d, 0x20
cmp cl, 0x19
cmova r9d, edx
add r8, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp r8, r11
jne 0x180003a50
cmp r10d, 0xccd98a98
je 0x180003a88
mov rax, qword [rax]
jmp 0x180003a30
mov rdi, qword [rax + 0x30]
lea rcx, [rsp + 0x58]
mov edx, dword [r14 + 0x18]
mov eax, ebx
mov esi, ebx
add rdx, 0x10
and eax, 7
sar esi, 3
dec rax
movsxd rbp, esi
xor r15d, r15d
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rbx, [rax + rax*4]
shl rbx, 3
add rdx, rbx
add rdx, rdi
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
cmp rbp, rax
jae 0x180003bb4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, rbx
mov qword [rsp + 0x50], r15
add rdx, rdi
mov r8d, 8
call fcn.1800a2ee0
movabs rax, 0x1ffffffffffffffc
mov dword [rsp + 0x58], r15d
mov rdx, rbp
lea rcx, [rsp + 0x58]
shr rdx, 3
mov r8d, 4
and rdx, rax
add rdx, qword [rsp + 0x50]
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
and esi, 0x1f
bt eax, esi
jae 0x180003bb4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, 8
mov qword [rsp + 0x50], r15
add rdx, rbx
mov r8d, 8
add rdx, rdi
call fcn.1800a2ee0
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rbp*8]
mov eax, dword [r14 + 0x18]
add rax, rbx
cmp byte [rax + rdi + 0x14], 1
jbe 0x180003b99
mov r8d, 8
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.1800a2ee0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x58]
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
not eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
add rdx, 0x18
mov r8d, 0x10
movups xmmword [rsp + 0x20], xmm0
call fcn.1800a2ee0
mov eax, dword [rsp + 0x20]
mov rcx, rbx
mov edx, eax
xor eax, 0x282eafe9
shl edx, 0x17
sub eax, 0x644a84db
xor edx, 0xf4800000
shr eax, 9
sub edx, 0x6d800000
or edx, eax
sub edx, 0x2b5ebc7e
add rsp, 0x30
pop rbx
jmp 0x180003a00
Function at 0x180003bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebx, edx
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x60]
mov r10d, 0x2f361700
movzx r9d, word [rax + 0x58]
shr r9, 1
lea r11, [r8 + r9*2]
cmp r8, r11
je 0x180003a83
nop dword [rax + rax]
movsx ecx, byte [r8]
mov edx, ecx
sub cl, 0x41
mov r9d, edx
or r9d, 0x20
cmp cl, 0x19
cmova r9d, edx
add r8, 2
xor r9d, r10d
imul r10d, r9d, 0x1000193
cmp r8, r11
jne 0x180003a50
cmp r10d, 0xccd98a98
je 0x180003a88
mov rax, qword [rax]
jmp 0x180003a30
mov rdi, qword [rax + 0x30]
lea rcx, [rsp + 0x58]
mov edx, dword [r14 + 0x18]
mov eax, ebx
mov esi, ebx
add rdx, 0x10
and eax, 7
sar esi, 3
dec rax
movsxd rbp, esi
xor r15d, r15d
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rbx, [rax + rax*4]
shl rbx, 3
add rdx, rbx
add rdx, rdi
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
cmp rbp, rax
jae 0x180003bb4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, rbx
mov qword [rsp + 0x50], r15
add rdx, rdi
mov r8d, 8
call fcn.1800a2ee0
movabs rax, 0x1ffffffffffffffc
mov dword [rsp + 0x58], r15d
mov rdx, rbp
lea rcx, [rsp + 0x58]
shr rdx, 3
mov r8d, 4
and rdx, rax
add rdx, qword [rsp + 0x50]
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
and esi, 0x1f
bt eax, esi
jae 0x180003bb4
mov edx, dword [r14 + 0x18]
lea rcx, [rsp + 0x50]
add rdx, 8
mov qword [rsp + 0x50], r15
add rdx, rbx
mov r8d, 8
add rdx, rdi
call fcn.1800a2ee0
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rbp*8]
mov eax, dword [r14 + 0x18]
add rax, rbx
cmp byte [rax + rdi + 0x14], 1
jbe 0x180003b99
mov r8d, 8
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.1800a2ee0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r8d, 4
mov dword [rsp + 0x58], r15d
lea rcx, [rsp + 0x58]
call fcn.1800a2ee0
mov eax, dword [rsp + 0x58]
not eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
add rdx, 0x18
mov r8d, 0x10
movups xmmword [rsp + 0x20], xmm0
call fcn.1800a2ee0
mov eax, dword [rsp + 0x20]
mov rcx, rbx
mov edx, eax
xor eax, 0x282eafe9
shl edx, 0x17
sub eax, 0x644a84db
xor edx, 0xf4800000
shr eax, 9
sub edx, 0x6d800000
or edx, eax
sub edx, 0x2b5ebc7e
add rsp, 0x30
pop rbx
jmp 0x180003a00
Function at 0x180004ab0
Capabilities:
Encode data using xor

Disassembly:
push r14
sub rsp, 0x40
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
mov r10, rcx
mov r14, rdx
sar r14, 4
mov rax, r14
shr rax, 0x3f
add r14, rax
mov r11, r14
sar r11, 1
test r11, r11
jle 0x180004c83
mov qword [rsp + 0x50], rbx
lea rax, [r11 + r11*4]
mov qword [rsp + 0x58], rbp
lea rbp, [r14 - 1]
mov qword [rsp + 0x60], rsi
lea rsi, [rcx + rax*8]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], r12
mov r12d, 0x50
mov qword [rsp + 0x30], r15
movsxd rbx, r9d
sar rbp, 1
nop
movups xmm3, xmmword [rsi - 0x28]
lea rsi, [rsi - 0x28]
dec r11
movsd xmm5, qword [rsi + 0x20]
mov r9, r11
movsd qword [rsp + 0x20], xmm5
mov rdi, r11
movups xmm4, xmmword [rsi + 0x10]
movups xmmword [rsp], xmm3
movups xmmword [rsp + 0x10], xmm4
cmp r11, rbp
jge 0x180004bb4
nop
lea rdx, [rdi + rdi]
lea rax, [rdx + rdx*4]
lea r8, [r10 + rax*8]
movss xmm0, dword [r8 + rbx + 0x28]
lea rax, [r9 + r9*4]
comiss xmm0, dword [r8 + rbx + 0x50]
seta cl
movzx edi, cl
xor rdi, 1
inc rdi
add rdi, rdx
mov edx, 0x28
test cl, cl
mov r9, rdi
cmove rdx, r12
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [rdx + r8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [rdx + r8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp rdi, rbp
jl 0x180004b50
cmp r9, rbp
jne 0x180004bf0
test r14b, 1
jne 0x180004bf0
lea rax, [r9 + r9*4]
lea rcx, [r14 + r14*4]
movups xmm0, xmmword [r10 + rcx*8 - 0x28]
lea r9, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rcx*8 - 0x18]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, r9
jge 0x180004c46
movss xmm2, dword [rsp + rbx]
nop word [rax + rax]
lea rcx, [r9 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*4]
lea rax, [rbx + rdx*8]
comiss xmm2, dword [rax + r10]
jbe 0x180004c46
lea rax, [r9 + r9*4]
mov r9, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movups xmm1, xmmword [r10 + rdx*8 + 0x10]
movups xmmword [r10 + rax*8 + 0x10], xmm1
movsd xmm0, qword [r10 + rdx*8 + 0x20]
movsd qword [r10 + rax*8 + 0x20], xmm0
cmp r11, rcx
jl 0x180004c00
lea rax, [r9 + r9*4]
movups xmmword [r10 + rax*8], xmm3
movups xmmword [r10 + rax*8 + 0x10], xmm4
movsd qword [r10 + rax*8 + 0x20], xmm5
test r11, r11
jg 0x180004b20
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r14
ret
Function at 0x180005820
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
movsxd rsi, dword [rsp + 0x40]
mov r10, rdx
mov qword [rsp + 0x18], rbx
mov r11, rcx
mov qword [rsp + 0x20], rdi
mov rbx, r8
mov qword [rsp + 0x30], r15
mov rbp, rdx
lea r15, [r8 - 1]
mov rdi, r15
sar rdi, 1
cmp rdx, rdi
jge 0x1800058bf
mov qword [rsp + 0x28], r14
nop word [rax + rax]
add rdx, rdx
mov r8, rdx
shl r8, 5
add r8, r11
movss xmm0, dword [rsi + r8 + 0x20]
comiss xmm0, dword [rsi + r8 + 0x40]
seta cl
shl r10, 5
movzx eax, cl
xor rax, 1
inc rax
add rdx, rax
movzx eax, cl
xor rax, 1
inc rax
shl rax, 5
movups xmm0, xmmword [rax + r8]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rax + r8 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rdx
cmp rdx, rdi
jl 0x180005860
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jne 0x1800058ed
test bl, 1
jne 0x1800058ed
shl rbx, 5
shl r10, 5
movups xmm0, xmmword [rbx + r11 - 0x20]
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rbx + r11 - 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, r15
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x18]
cmp rbp, r10
jge 0x180005951
movsxd r8, dword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
movss xmm0, dword [r8 + r9]
lea rcx, [r10 - 1]
sar rcx, 1
mov rdx, rcx
shl rdx, 5
lea rax, [rdx + rsi]
comiss xmm0, dword [rax + r11]
jbe 0x180005951
movups xmm0, xmmword [rdx + r11]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [rdx + r11 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
mov r10, rcx
cmp rbp, rcx
jl 0x180005910
movups xmm0, xmmword [r9]
shl r10, 5
movups xmmword [r10 + r11], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [r10 + r11 + 0x10], xmm1
pop rsi
pop rbp
ret