joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x18], edi
nop
push 0x41b78786
mov qword [rsp], rdi
sub rsp, 0x50
mov dword [rsp - 0x28], esp
movabs rbx, 0x7be21755a787669
xor rbx, 0x4a9da8a4
xor rbx, 0x637c823
xor rbx, 0x65da4740
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
cmp qword [rcx + 0x20], rbx
mov dword [rsp - 0x18], ebx
jne 0x140058e19
mov eax, 0x255d079e
xor eax, 0x3ebf14c6
sub eax, 0x1bced6ba
xor eax, 0x5b569767
xor eax, 0x5b45ab56
mov dword [rsp + 0x20], 0x6a6dc505
add dword [rsp + 0x20], 0x605df77
sub dword [rsp + 0x20], 0x5251e2cc
sub dword [rsp + 0x20], 0x1dadc0d4
mov word [rsp + 0x34], ax
mov r10, r10
xor r8d, r8d
mov dword [rsp + 0x24], 0x60dad686
xor dword [rsp + 0x24], 0x14af43be
sub dword [rsp + 0x24], 0x56eda437
xor dword [rsp + 0x24], 0x46c3bf96
sub dword [rsp + 0x24], 0x5ac64df1
mov dword [rsp + 0x28], 0x3c7ca99c
xor dword [rsp + 0x28], 0x365986c5
add dword [rsp + 0x28], 0x5813344c
sub dword [rsp + 0x28], 0x2ac9a6c9
xor dword [rsp + 0x28], 0x3741bc3f
mov dword [rsp + 0x2c], 0x4e7d92a5
sub dword [rsp + 0x2c], 0x3b508557
xor dword [rsp + 0x2c], 0x42a197fa
xor dword [rsp + 0x2c], 0x51b09a45
mov dword [rsp + 0x30], 0x1949a7bf
add dword [rsp + 0x30], 0x56c109a4
xor dword [rsp + 0x30], 0x52f6f07d
xor dword [rsp + 0x30], 0x228c41f5
xchg r8, r13
mov qword [rsp + 0x60], r13
xchg r8, r13
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x1c], 0x7588ce9a
mov rax, qword [rsp + 0x60]
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rsp + rax*2 + 0x20]
xchg r10, r10
mov eax, 0x1ae43aa8
xor eax, 0x2f1caae5
add eax, 0x39f3769e
sub eax, 0x5d28ea5c
shr eax, cl
movzx ecx, al
xchg r12, r12
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
xor cx, dx
mov dword [rsp - 0x18], 0x166b06cd
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
inc rax
mov rbx, rbx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 0xb
jb 0x140058d09
mov r13, r13
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
call fcn.14007be20
mov dword [rsp - 0x38], 0x33509705
xchg rdx, r9
mov r9, rax
xchg rdx, r9
xchg r13, rax
mov r8, r13
xchg r13, rax
xor rdx, rbx
xor eax, eax
mov dword [rsp - 0x14], esi
mov qword [rdi + 0x20], rdx
lea rdi, [rsp + 0x36]
mov ecx, 0x676d52af
sub ecx, 0x5f554c39
sub ecx, 0x6e97c97
xor ecx, 0x12e89d4
rep stosb byte [rdi], al
cmp rdx, rbx
mov r8, r8
je 0x140058e21
lea rdx, [0x1404a23d0]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.14006bca0
test al, al
mov r11, r11
setne al
mov rbx, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x4d
add al, 0x25
sub al, 0x53
sub al, 0x1e
mov rbx, qword [rsp + 0x68]
nop
sub rsp, 0x32d64d6f
add rsp, 0x32d64dbf
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140073160
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp + 0x20], 0x242e133c
add dword [rsp + 0x20], 0x4ea388c1
sub dword [rsp + 0x20], 0x5703854e
mov r8, rcx
mov byte [rsp + 0x24], 0x61
sub byte [rsp + 0x24], 0x1d
xor byte [rsp + 0x24], 0xc7
mov qword [rsp + 0x28], 0x20e7102f
sub qword [rsp + 0x28], 0x9189711
sub qword [rsp + 0x28], 0x17ce791e
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x1447a473
add edx, 0x40f3551
add edx, 0xedcce11
sub edx, 0x14708b46
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x1400731bc
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x3f
sub byte [rsp + 7], 0x14
add byte [rsp + 7], 0x22
xor byte [rsp + 7], 0x4d
popf
je 0x140073277
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x14007327a
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007326a
movzx eax, byte [rcx]
test al, al
jne 0x14007324e
jmp 0x14007327a
inc r8
cmp byte [r8], 0
jne 0x140073239
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x3a63cfe1
sub ecx, 0x58e065b
xor ecx, 0x3495fd20
sub ecx, 0x4034a1
rep stosb byte [rdi], al
mov rax, r8
sub rsp, 0xfffffffffffffff0
pop rdi
ret
Function at 0x1400732b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x18cf6119
sub rsp, 0x18cf6129
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x14007345c
mov dword [rsp + 0x28], 0x7320b9ee
sub dword [rsp + 0x28], 0x356c840b
sub dword [rsp + 0x28], 0x21e61f34
mov byte [rsp + 0x2c], 0x36
add byte [rsp + 0x2c], 0x23
add byte [rsp + 0x2c], 0x2a
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x27e075e1
add edx, 0x82b458a
xor edx, 0x22c8a7e4
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x140073306
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x140073381
lea rcx, [rcx + 1]
cmp dil, al
je 0x140073448
movzx eax, byte [rcx]
test al, al
jne 0x140073369
mov word [rsp + 0x20], 0x1242
add word [rsp + 0x20], 0x3d72
sub word [rsp + 0x20], 0xdc2
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x40d320a8
xor edx, 0x19fe31be
sub edx, 0xa565737
sub edx, 0x3c139d50
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x1400733ab
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x14007342d
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x1400734be
movzx eax, byte [rcx]
test al, al
jne 0x140073415
xor dl, dl
mov r8d, 0x67b7e78d
add r8d, 0x1559ca06
xor r8d, 0x7d11b190
jmp 0x140073464
mov r8d, 0x578b238e
xor r8d, 0x3a3b0958
sub r8d, 0x6db02ad5
mov dl, 0x47
add dl, 0x12
xor dl, 0x58
test r8b, 2
je 0x14007348b
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x6bbd3529
xor ecx, 0x21b4f8a
xor ecx, 0x69a67aa1
rep stosb byte [rdi], al
test r8b, 1
je 0x1400734b5
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x277311b
add ecx, 0x1f3d0464
add ecx, 0x38045532
xor ecx, 0x59b88ab4
rep stosb byte [rdi], al
movzx eax, dl
sub rsp, 0xfffffffffffffff0
pop rdi
ret
mov r8d, 0x6b7f853c
sub r8d, 0x40a1132
sub r8d, 0x67757407
jmp 0x14007345c
Function at 0x140074110
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x96bf545
add rsp, 0x96bf535
mov word [rsp + 0x20], 0x494f
sub word [rsp + 0x20], 0xdb4
add word [rsp + 0x20], 0x657
mov r8, rcx
mov qword [rsp + 0x28], 0x6d3fed1a
xor qword [rsp + 0x28], 0x51b1070c
sub qword [rsp + 0x28], 0x3c8eea16
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x344e18f
add edx, 0x6be9ce5e
xor edx, 0x214f3ad7
xor edx, 0x5ca289b5
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007415b
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x1f
xor byte [rsp + 2], 0x28
sub byte [rsp + 2], 0x37
test al, al
je 0x1400741e6
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007421c
movzx eax, byte [rcx]
test al, al
jne 0x1400741cf
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x363e7ec3
add ecx, 0x2b65eef1
xor ecx, 0x2ed4fa9b
xor ecx, 0x4f70972d
rep stosb byte [rdi], al
test dl, dl
jne 0x14007422c
mov byte [r8], al
lea rax, [r8 + 1]
add rsp, 0x10
pop rdi
ret
mov dl, 0x7d
sub dl, 0x5c
add dl, 0x50
xor dl, 0x70
jmp 0x1400741e8
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x140074340
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg rbp, r15
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x20], esp
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, rsp
mov rdi, rsp
xchg rsp, rdx
xchg rdi, rcx
mov rsi, rdi
xchg rcx, rdi
mov edx, dword [rbx + rcx + 0xb0]
call fcn.1400764c0
sub rdi, qword [rbx + rsi + 0x30]
xchg r15, r15
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov r10, rax
mov ebx, r14d
mov r13, r13
test ebp, ebp
je 0x14007450f
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov dword [rsp - 0x14], 0x4e5bb9e
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov rsp, rsp
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x2c], ebx
jae 0x140074447
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140074402
xchg rdx, rdx
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x140074422
mov dword [rsp - 0x40], esp
add eax, r9d
cmp r11d, eax
jb 0x1400744c9
mov rcx, rcx
inc r8w
nop
add rdx, 0x49616e89
sub rdx, 0x49616e61
cmp r8w, cx
jb 0x1400743f1
mov dword [rsp - 0x20], 0x6be05028
mov r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
nop
add rax, 0x227ba57d
sub rax, 0x227ba585
nop
add r10, 0x5d04637f
sub r10, 0x5d046377
shr rax, 1
mov dword [rsp - 0x28], 0x215d871
test eax, eax
je 0x140074500
mov edx, eax
mov dword [rsp - 0x10], 0x546c5b1b
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xa
shr ecx, 1
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x30], 0x5ff2a9c7
je 0x1400744de
cmp ecx, 0xa
jne 0x1400744ea
and eax, 0xfff
xchg r10, r10
add qword [rax + r8], rdi
jmp 0x1400744ea
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
xchg rsp, rsp
add r8, r11
jmp 0x14007444a
and eax, 0xfff
add dword [rax + r8], edi
xchg rsi, rsi
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x140074491
mov dword [rsp - 0x34], 0x880fd05
add ebx, dword [r9]
cmp ebx, ebp
jb 0x1400743b9
mov dword [rsp - 0x38], ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov dword [rsp - 0x10], esp
mov rdi, qword [rsp + 0x48]
nop
add rsp, 0x6d9ef9
sub rsp, 0x6d9ed9
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140076590
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], 0x438272c4
push rbp
push rsi
push rdi
mov dword [rsp - 0x2c], 0x7541e5b9
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
xchg rsi, rsi
nop
push 0x4f1be07d
mov qword [rsp], r14
push r15
nop
sub rsp, 0xb8ce037
add rsp, 0xb8ce017
movzx eax, word [rcx]
xchg rsp, rsp
mov r15d, edx
xor eax, 0x56362ae
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
cmp eax, 0x56338e3
jne 0x140076742
xchg r10, r10
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x56362ae
mov dword [rsp - 0x30], 0x6349c2df
cmp eax, 0x56327fe
jne 0x140076742
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x44], esi
call fcn.1400764c0
mov rcx, rsi
xchg rsp, rax
mov r14, rsp
xchg rsp, rax
mov edx, dword [rax + 0x20]
call fcn.1400764c0
mov dword [rsp - 0x34], 0x39f6c10f
mov edx, dword [r14 + 0x24]
xchg r8, rcx
mov r8, rsi
xchg rcx, r8
xchg r14, rax
mov r12, r14
xchg r14, rax
call fcn.1400764c0
mov rdi, rdi
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r8, rax
mov r13, r8
xchg r8, rax
call fcn.1400764c0
xor edi, edi
mov qword [rsp + 0x70], rax
mov dword [rsp - 0x1c], ebx
cmp dword [r14 + 0x18], edi
jbe 0x140076742
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x2c], 0x46aee3e7
xchg rcx, rbx
mov rbx, rsi
xchg rbx, rcx
call fcn.1400764c0
mov ecx, 0x5ac728e1
sub ecx, 0x5ae28d2
sub ecx, 0x541729d
xor ecx, 0xcf71e12
add ecx, 0xbcdf6c9f
xchg r12, rax
mov rbx, r12
xchg r12, rax
mov dword [rsp + 0x60], ecx
mov rsi, rsi
cmp byte [rax], 0
je 0x140076725
nop dword [rax]
mov dword [rsp - 0x20], 0x27628ed8
xchg rdx, r9
mov r9, rbx
xchg r9, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x68bd1298
xor r8d, 0xd1373dd
xor r8d, 0x1f2608bd
xor r8d, 0x7a8869f9
inc rbx
call fcn.140082c00
xchg rcx, rcx
cmp byte [rbx], 0
jne 0x1400766e4
mov ecx, dword [rsp + 0x60]
not ecx
xchg rcx, rcx
cmp ecx, r15d
je 0x140076797
inc edi
cmp edi, dword [r14 + 0x18]
mov rbx, rbx
jb 0x14007668b
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x38], 0x68ea32d1
nop
add rsp, 0x1ff6d00c
sub rsp, 0x1ff6cfec
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
xchg rbx, rbx
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x30], 0x16367499
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x10], ebp
call fcn.1400764c0
jmp 0x140076744
Function at 0x14007aa03
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x40], 0x68f563f2
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x7015a775
add rsp, 0x7015a715
mov rbx, qword [rcx]
xchg r12, r12
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rdx, rsi
mov qword [rsp + 0x70], rdx
xchg rsi, rdx
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r12, r12
xchg rsi, rax
mov qword [rsp + 0x20], rsi
xchg rsi, rax
xchg r13, rsp
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x1c], ecx
xchg rsp, rbx
movups xmmword [rbx + 0x38], xmm0
xchg rbx, rsp
xchg rsp, rcx
movups xmmword [rcx + 0x48], xmm0
xchg rsp, rcx
call fcn.14000ed90
mov dword [rsp - 0x30], esi
mov edx, 0x6fadf021
sub edx, 0x162e3b7c
sub edx, 0x4b86c476
add edx, 0x4e6f6ffe
sub edx, 0x49a5439e
test rsi, rsi
je 0x14007aa88
xchg rdi, rdi
xchg r13, rdi
mov r13, rax
xchg r13, rdi
sub rbx, rax
mov dword [rsp - 0xc], 0x54ef12d
xchg r15, rsi
mov r8, r15
xchg r15, rsi
mov r9d, 0x770b8333
sub r9d, 0xd311c32
sub r9d, 0x355ece7
sub r9d, 0x5270c70a
xor r9d, 0x1413b3ef
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x20], 0x3c53506
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 4
ror edx, 3
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
sub r8, 1
mov dword [rsp - 0x30], 0x28f4f053
jne 0x14007aa52
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg rsi, rsi
mov rcx, qword [rsp + 0x20]
call fcn.14007ab40
xchg rcx, r14
mov r14, qword [rsp + 0x20]
xchg rcx, r14
mov ebx, eax
xchg r14, r14
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov r13, r13
jne 0x14007ab09
xor eax, eax
lea rdi, [rsp + 0x28]
xchg r8, r8
mov ecx, 0x704362d4
xor ecx, 0x26492286
sub ecx, 0xf8971d0
sub ecx, 0x4680ce52
rep stosb byte [rdi], al
mov eax, ebx
xchg rsi, rsi
xchg rcx, rbx
mov rcx, qword [rsp + 0x78]
xchg rcx, rbx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098620
mov eax, ebx
mov rdi, rdi
xchg rbp, rbx
mov rbp, qword [rsp + 0x78]
xchg rbx, rbp
nop
add rsp, 0x644c3833
sub rsp, 0x644c37d3
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007bb40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
mov r9, r9
xchg rbx, rcx
mov rcx, rdx
xchg rcx, rbx
mov rdi, rcx
xchg r11, r11
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x5e7dd13d
sub r8d, 0xc316c7e
xor r8d, 0x4d5eccf5
xor r8d, 0x1ada34b7
sub r8d, 0x5c89af5
call fcn.140098bf0
mov r12, r12
mov rax, qword gs:[0x60]
xchg r13, r8
mov r13, qword [rax + 0x18]
xchg r8, r13
mov rax, qword [r8 + 0x10]
xchg r8, r11
mov r11, qword [rax]
xchg r11, r8
test r8, r8
mov r14, r14
je 0x14007bdea
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x1c], 0x1162c0fa
je 0x14007bdea
mov edx, 0x3da21970
add edx, 0x577290a
add edx, 0x1f970d5a
xor edx, 0x4d8ac506
sub edx, 0x2f3a89ce
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x2c], edi
lea r9d, [rdx - 1]
call fcn.140099580
mov edx, 0x230ec79a
xor edx, 0x17f929e1
xor edx, 0x605a3378
sub edx, 0x54addca7
lea rcx, [rsp + 0x30]
xchg r13, r13
call fcn.140099640
test rax, rax
je 0x14007bdbd
xor ecx, ecx
xchg r13, r13
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
mov dword [rsp - 0x3c], 0x9796ef2
movabs rcx, 0x451ec4104bda7eb1
add rcx, 0x281bbf23
xor rcx, 0x1ea17d5b
sub rcx, 0x6521f0f0
add rcx, 0x7fffffff
xor rcx, 0x57b0779f
mov rax, qword [0x1404a2800]
not rax
xor rax, rcx
mov dword [rsp - 0x40], 0x22c1933
movabs rcx, 0x9ddea40c49440228
xor rcx, 0x260ed7d9
xor rcx, 0x6ac503cd
xor rcx, 0x8c5d5ef
rol rax, 7
rol rax, 0x14
rol rax, 2
rol rax, 1
rol rax, 1
xor rax, rcx
movabs rcx, 0x4587bdf2f6493f7
sub rcx, 0x17ee47a2
add rcx, 0x34417f6c
add rcx, 0x690446bd
ror rax, 5
ror rax, 2
ror rax, 0x15
ror rax, 2
ror rax, 1
add rax, rcx
mov r13, r13
lea rcx, [rsp + 0x20]
call rax
mov r10, qword [0x1404a27f0]
lea r8, [rsp + 0x20]
xchg r14, r14
movabs rcx, 0x70253add27053b33
add rcx, 0x35b15695
xor rcx, 0x6587631e
xor rcx, 0x52821e84
xor rcx, 0x605ec23b
lea rdx, [rsp + 0x260]
add r10, rcx
mov rsp, rsp
movabs rax, 0xc4d3c8c87681746d
xor rax, 0xcda78
xor rax, 0x68537baa
xor rax, 0x383b5b37
add rax, 0x7fffffff
add rax, 0x57145fb7
xor r10, rax
xchg rdx, rdx
lea rcx, [rsp + 0x30]
not r10
xchg rcx, r9
mov rcx, rbx
xchg r9, rcx
call r10
mov dword [rsp - 0x2c], 0x7bdc7439
mov rbx, qword [rsp + 0x250]
sub rsp, 0x54d69385
add rsp, 0x54d695c5
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x62486d20
xor eax, 0x39ca7dfb
sub eax, 0x1c4dbae8
add eax, 0x1022807a
add eax, 0x70a92994
mov rbx, qword [rsp + 0x250]
mov r12, r12
add rsp, 0x240
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x59c18b2e
add eax, 0xda3748
xor eax, 0x9aac963
add eax, 0x6ccef620
add rsp, 0x201fe1fe
sub rsp, 0x201fdfbe
pop rdi
ret
Function at 0x140082f60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a30d4], 0
jne 0x14008305f
xchg r15, r15
xor edx, edx
lea r8, [0x1404a30d0]
nop word [rax + rax]
mov ecx, edx
mov rsp, rsp
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x10], ebp
neg ecx
and ecx, 0xedb88320
inc edx
mov r11, r11
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x38], esi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x28], ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x3c], 0xad70043
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg rsi, rsi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov r8, r8
mov ecx, eax
shr eax, 1
and ecx, 1
xchg rsp, rsp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg rsi, rsi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x28], 0x2e4821ce
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x44], 0x6136752
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg rsi, rsi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg r12, r12
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x28], edi
cmp edx, 0x100
jb 0x140082f83
ret
Function at 0x140087cb2
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rcx
mov qword [rsp + 8], r8
xchg rcx, r8
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r14
mov dword [rsp - 0x1c], 0x26b49664
push r15
sub rsp, 0x28
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
mov r13d, r8d
xchg r10, r10
mov edx, 0x748233b6
sub edx, 0x236bc4d2
xor edx, 0x7d5573b7
xor edx, 0x2c471d53
cmp r8d, edx
jae 0x140087c44
mov dword [rsp - 0x20], 0x52a6d79d
mov edx, r13d
nop
movabs rcx, 0xffffffff7e3b2966
sub rcx, 0x1d8174cf
xor rcx, 0x6e7f21c7
add rcx, 0x7fffffff
xor rcx, 0x71396ab0
mov eax, 0x243d7063
add eax, 0x7371da6
add eax, 0xc3de58e
xor eax, 0x6d475f72
sub eax, 0x5af52ce1
mul rdx
cmovo rax, rcx
xchg r15, r15
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400984e0
xchg r15, r9
mov r9, rax
xchg r15, r9
mov byte [rsp + 0x70], 0x5f
sub byte [rsp + 0x70], 0x4a
add byte [rsp + 0x70], 0x68
sub byte [rsp + 0x70], 0x42
sub byte [rsp + 0x70], 0x3a
mov rax, qword [rsp + 0x60]
lea r12d, [r13 + 0xfffff]
xor esi, esi
mov dword [rsp - 0x28], edi
shr r12d, 2
shr r12d, 0xb
shr r12d, 1
shr r12d, 2
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
mov dword [rsp - 0x20], edx
test r12d, r12d
je 0x140087e13
xchg rdi, rbx
mov qword [rsp + 0x68], rdi
xchg rbx, rdi
mov ecx, 0x57f569e6
xor ecx, 0x62fed44c
add ecx, 0x10d214dc
sub ecx, 0x45cdd286
mov qword [rsp + 0x20], rdi
mov edi, esi
mov dword [rsp - 0x38], ecx
mov ebx, r13d
shl edi, 6
shl edi, 3
shl edi, 6
shl edi, 1
shl edi, 2
shl edi, 1
shl edi, 1
xchg rdx, rsi
mov rsi, r15
xchg rsi, rdx
sub ebx, edi
cmp ebx, ecx
mov dword [rsp - 0x24], edx
cmova ebx, ecx
xchg rdi, rcx
mov rdi, rax
xchg rdi, rcx
mov r8d, ebx
call fcn.1400848d0
test al, al
xchg rbx, rbx
je 0x140087dec
shr ebx, 2
xor eax, eax
shr edi, 1
shr edi, 1
test ebx, ebx
je 0x140087db8
mov dword [rsp - 0x3c], 0x72c32b
xchg r15, rsp
mov r9, rsp
xchg rsp, r15
lea ecx, [rdi + rax]
mov rsp, rsp
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
xor r8d, 0x56362ae
mov dword [rsp - 0x3c], 0x18c7a45c
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
jb 0x140087d88
mov r11, r11
xchg r8, rax
mov r8, qword [rsp + 0x60]
xchg r8, rax
inc esi
mov ecx, 0x5fb819d4
sub ecx, 0x2d20996a
xor ecx, 0x2c223831
xor ecx, 0x1ea5b85b
cmp esi, r12d
mov dword [rsp - 0xc], ebx
jb 0x140087d1b
jmp 0x140087e00
mov byte [rsp + 0x70], 0x72
sub byte [rsp + 0x70], 0x63
xor byte [rsp + 0x70], 0x7c
sub byte [rsp + 0x70], 0x73
mov rbx, qword [rsp + 0x68]
xchg r15, r15
xchg r15, rdi
mov r15, qword [rsp + 0x20]
xchg r15, rdi
xchg rbp, rcx
mov rbp, r15
xchg rbp, rcx
call fcn.1400984f0
mov dword [rsp - 0x18], 0x5f7bcf20
movzx eax, byte [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
pop r15
pop r14
mov dword [rsp - 0x18], 0x6dd3af47
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret