joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005f5b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edx, edx
mov r8d, 0x280
mov rbx, rcx
call fcn.18008c000
xor esi, esi
mov dword [rbx + 0x518], 1
xor r8d, r8d
mov qword [rbx + 0x500], rsi
xor edx, edx
mov dword [rbx + 0x508], esi
lea rcx, [rbx + 0x510]
mov qword [rbx + 0x510], rsi
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18005f635
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rbx + 0x510]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18005f635
mov dword [rbx + 0x518], esi
mov rcx, rbx
call fcn.18005f9c0
mov rcx, rbx
call fcn.180060190
mov rcx, rbx
call fcn.18005f9c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov dword [rbx + 0x500], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18005f6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x500], 0
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
jne 0x18005f6e3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
call fcn.18005f9c0
xor ebp, ebp
test esi, esi
je 0x18005f732
mov rdx, rdi
mov r8, rsi
nop dword [rax]
movsxd rax, dword [rbx + 0x508]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + rbx]
mov byte [rdx - 1], cl
inc dword [rbx + 0x508]
mov eax, dword [rbx + 0x508]
cmp eax, 0x280
cmove eax, ebp
mov dword [rbx + 0x508], eax
sub r8, 1
jne 0x18005f700
movdqa xmm1, xmmword [0x1800dae60]
mov rax, rbp
nop dword [rax]
movdqu xmm0, xmmword [rbx + rax*4]
pandn xmm0, xmm1
movdqu xmmword [rbx + rax*4], xmm0
movdqu xmm0, xmmword [rbx + rax*4 + 0x10]
pandn xmm0, xmm1
movdqu xmmword [rbx + rax*4 + 0x10], xmm0
add rax, 8
cmp rax, 0xa0
jl 0x18005f740
mov rcx, rbx
call fcn.18005f9c0
test esi, esi
je 0x18005f7b2
mov rdx, rsi
nop dword [rax]
movsxd rax, dword [rbx + 0x508]
lea rdi, [rdi + 1]
movzx ecx, byte [rax + rbx]
xor byte [rdi - 1], cl
inc dword [rbx + 0x508]
mov eax, dword [rbx + 0x508]
cmp eax, 0x280
cmove eax, ebp
mov dword [rbx + 0x508], eax
sub rdx, 1
jne 0x18005f780
mov rbp, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180060560
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1800eb008]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor ebp, ebp
lea rbx, [r11 - 0x57]
mov edi, ebp
sub rbx, rcx
mov rsi, rcx
nop word [rax + rax]
movaps xmm0, xmmword [0x1800cd920]
lea r8, [rsp + 0x20]
movaps xmm1, xmmword [0x1800cd930]
mov edx, 0x280
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
movaps xmm0, xmmword [0x1800cd940]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm1, xmmword [0x1800cd950]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.180061cd0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xf0]
call fcn.180061de0
lea rax, [rdi + rsi]
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [rbx + rax - 1]
xor byte [rax], cl
movzx ecx, byte [rbx + rax]
xor byte [rax + 1], cl
movzx ecx, byte [rbx + rax + 1]
xor byte [rax + 2], cl
movzx ecx, byte [rbx + rax + 2]
xor byte [rax + 3], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x180060610
add rdi, 0x40
sub rbx, 0x40
cmp rdi, 0x280
jl 0x1800605a0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180072920
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180063310
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800632a0
test eax, eax
jne 0x180063328
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 8]
mov qword [rsp + 0x30], rsi
cmp dword [rax], 0
je 0x180063342
mov rcx, qword [rbx]
add rcx, 0x20
call fcn.1800685f0
mov rax, qword [rbx + 8]
xor esi, esi
mov qword [rsp + 0x38], rdi
cmp dword [rax + 0x1024], esi
jne 0x180063390
xor ecx, ecx
mov rdi, rax
call fcn.18009af68
cmp qword [rdi + 0x68], rax
je 0x18006337e
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180063396
mov r8, qword [rdi + 0x60]
xor edx, edx
mov rcx, rbx
call rax
cmp eax, 1
jne 0x180063396
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov dword [rax + 0x1024], esi
mov rax, qword [rbx]
mov dword [rax], esi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1d0], esi
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x2a0]
call fcn.18009a6dc
mov rax, qword [rbx + 8]
mov rdi, qword [rsp + 0x38]
mov qword [rax + 0x2a0], rsi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1d4], esi
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 0x1c]
mov dword [rcx + 0x1020], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x1c4], esi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1c0], esi
mov rax, qword [rbx + 8]
add rax, 0x1030
mov dword [rax + 0x54], esi
mov qword [rax + 0x58], rsi
mov qword [rax + 0x60], rsi
mov dword [rax + 0x40], 0x67452301
mov dword [rax + 0x44], 0xefcdab89
mov dword [rax + 0x48], 0x98badcfe
mov qword [rax + 0x4c], 0x10325476
mov rax, qword [rbx + 8]
mov qword [rax + 0x1ad8], rsi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1ae8], esi
mov eax, 1
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1800678a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11d, dword [rcx + 0x18]
mov rax, rcx
test r11d, r11d
je 0x18006793b
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, dword [rax + 0x20]
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx + rdx*8]
cmp r9d, r11d
jae 0x18006792d
mov r10d, dword [rax + 0x1c]
mov qword [rsp], rdi
lea rdi, [0x1800cdf40]
nop dword [rax + rax]
mov ecx, 0x38
mov rdx, rbx
sub ecx, r9d
add r9d, 8
shr rdx, cl
mov ecx, r10d
shr rcx, 8
movzx r8d, dl
xor r8, rcx
movzx ecx, r10b
shl ecx, 8
mov r10d, dword [rdi + r8*4]
xor r10d, ecx
cmp r9d, r11d
jb 0x1800678e0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov dword [rax + 0x20], r9d
mov dword [rax + 0x1c], r10d
movzx eax, r10w
add rsp, 8
ret
movzx eax, word [rax + 0x1c]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
movzx eax, word [rcx + 0x1c]
add rsp, 8
ret
Function at 0x18006e290
Capabilities:
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
add edx, 0xfffffff0
mov rsi, r8
mov r8, rcx
cmp edx, 0xf0
ja case.0x18006e2d0.17
movsxd rax, edx
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x6e430]
mov edx, dword [rcx + rax*4 + 0x6e420]
add rdx, rcx
jmp rdx
mov ecx, dword [0x1800ec414]
mov edi, 1
test ecx, ecx
jns 0x18006e2f5
xor ecx, ecx
mov eax, edi
cpuid
and ecx, 0x2000000
mov dword [0x1800ec414], ecx
test ecx, ecx
mov rdx, rsi
mov rcx, r8
jne 0x18006e314
call fcn.18006c360
mov edi, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.18006e530
test eax, eax
jne 0x18006e34f
movzx eax, byte [rsi + 0xf0]
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x18006e34d
lea rcx, [rsi + 0x10]
aesimc xmm0, xmmword [rcx]
movdqa xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
movzx eax, byte [rsi + 0xf0]
inc edi
shr eax, 4
cmp edi, eax
jl 0x18006e330
xor edi, edi
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [0x1800ec414]
mov edi, 1
test ecx, ecx
jns 0x18006e384
xor ecx, ecx
mov eax, edi
cpuid
and ecx, 0x2000000
mov dword [0x1800ec414], ecx
test ecx, ecx
mov rdx, rsi
mov rcx, r8
jne 0x18006e3a3
call fcn.18006cb70
mov edi, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.18006e800
test eax, eax
jne 0x18006e34f
movzx eax, byte [rsi + 0xf0]
and eax, 0xfffffff0
cmp eax, 0x10
jbe 0x18006e34d
lea rcx, [rsi + 0x10]
nop
aesimc xmm0, xmmword [rcx]
movdqa xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
movzx eax, byte [rsi + 0xf0]
inc edi
shr eax, 4
cmp edi, eax
jl 0x18006e3c0
xor edi, edi
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, rsi
mov rcx, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.18006eef0
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18006efa0
Capabilities:
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
movzx r9d, byte [r8 + 0xf0]
mov r10, rdx
mov r11, rcx
lea eax, [r9 + 0x60]
test al, 0x9f
jne 0x18006f0a2
test r9b, r9b
je 0x18006f0a2
mov ecx, dword [0x1800ec414]
test ecx, ecx
jns 0x18006eff2
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov eax, 1
cpuid
mov rbx, qword [rsp + 0x30]
and ecx, 0x2000000
mov dword [0x1800ec414], ecx
test ecx, ecx
jne 0x18006f003
mov rdx, r10
mov rcx, r11
add rsp, 0x38
jmp fcn.18006f1d0
movdqu xmm0, xmmword [r11]
movzx ecx, r9b
pxor xmm0, xmmword [r8]
sub ecx, 0xa0
je 0x18006f047
sub ecx, 0x20
je 0x18006f035
cmp ecx, 0x20
jne 0x18006f096
aesenc xmm0, xmmword [r8 + 0x10]
aesenc xmm0, xmmword [r8 + 0x20]
add r8, 0x20
aesenc xmm0, xmmword [r8 + 0x10]
aesenc xmm0, xmmword [r8 + 0x20]
add r8, 0x20
aesenc xmm0, xmmword [r8 + 0x10]
aesenc xmm0, xmmword [r8 + 0x20]
aesenc xmm0, xmmword [r8 + 0x30]
aesenc xmm0, xmmword [r8 + 0x40]
aesenc xmm0, xmmword [r8 + 0x50]
aesenc xmm0, xmmword [r8 + 0x60]
aesenc xmm0, xmmword [r8 + 0x70]
aesenc xmm0, xmmword [r8 + 0x80]
aesenc xmm0, xmmword [r8 + 0x90]
aesenclast xmm0, xmmword [r8 + 0xa0]
movdqu xmmword [r10], xmm0
xor eax, eax
add rsp, 0x38
ret
mov eax, 1
add rsp, 0x38
ret
Function at 0x180071530
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x10]
mov rsi, rdx
mov r10d, dword [rcx + 0xc]
mov rdi, rax
add rdi, qword [rcx]
sub r10d, eax
test dword [rcx + 8], 0x80000000
mov rbx, rcx
je 0x180071562
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x58], r15
xor r15d, r15d
cmp dword [rcx + 0x18], r15d
jne 0x1800715bb
cmp r10d, 0x1b
jl 0x1800715c6
mov eax, dword [rdi]
cmp eax, dword [str.OggS]
jne 0x1800716a5
movzx eax, byte [rdi + 0x1a]
lea r9d, [rax + 0x1b]
cmp r10d, r9d
jl 0x1800715c6
mov ecx, r15d
test eax, eax
je 0x1800715b7
mov edx, dword [rbx + 0x1c]
lea r8, [rdi + 0x1b]
nop
movzx eax, byte [r8]
lea r8, [r8 + 1]
add edx, eax
inc ecx
mov dword [rbx + 0x1c], edx
movzx eax, byte [rdi + 0x1a]
cmp ecx, eax
jl 0x1800715a0
mov dword [rbx + 0x18], r9d
mov eax, dword [rbx + 0x1c]
add eax, dword [rbx + 0x18]
cmp eax, r10d
jle 0x1800715d5
xor eax, eax
mov r15, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov eax, dword [rdi + 0x16]
xor ecx, ecx
mov dword [rdi + 0x16], ecx
mov r8d, r15d
mov ecx, dword [rbx + 0x18]
mov qword [rsp + 0x48], r12
lea r12, [0x1800d34c0]
movsxd r9, ecx
add r9, rdi
mov qword [rsp + 0x50], r14
mov r14d, dword [rbx + 0x1c]
mov dword [rdi + 0x16], r15d
test ecx, ecx
jle 0x18007163a
mov qword [rsp + 0x40], rbp
mov r11, rdi
mov ebp, ecx
movzx ecx, byte [r11]
lea r11, [r11 + 1]
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
mov ecx, r8d
shl ecx, 8
mov r8d, dword [r12 + rdx*4]
xor r8d, ecx
sub rbp, 1
jne 0x180071610
mov rbp, qword [rsp + 0x40]
test r14d, r14d
jle 0x180071675
mov r11, r14
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
mov ecx, r8d
shl ecx, 8
mov r8d, dword [r12 + rdx*4]
xor r8d, ecx
sub r11, 1
jne 0x180071650
mov r14, qword [rsp + 0x50]
mov ecx, r8d
mov r12, qword [rsp + 0x48]
mov byte [rdi + 0x16], r8b
shr ecx, 8
mov byte [rdi + 0x17], cl
mov ecx, r8d
shr ecx, 0x10
shr r8d, 0x18
mov byte [rdi + 0x18], cl
mov byte [rdi + 0x19], r8b
cmp eax, dword [rdi + 0x16]
je 0x1800716e3
mov dword [rdi + 0x16], eax
lea eax, [r10 - 1]
mov qword [rbx + 0x18], r15
movsxd r8, eax
lea rcx, [rdi + 1]
mov edx, 0x4f
call fcn.18008be88
test rax, rax
jne 0x1800716ca
movsxd rax, dword [rbx + 0xc]
add rax, qword [rbx]
mov r15, qword [rsp + 0x58]
mov ecx, eax
sub ecx, dword [rbx]
sub rdi, rax
mov dword [rbx + 0x10], ecx
mov eax, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
movsxd rcx, dword [rbx + 0x10]
add rcx, qword [rbx]
test rsi, rsi
je 0x180071709
mov qword [rsi], rcx
mov eax, dword [rbx + 0x18]
mov dword [rsi + 8], eax
movsxd rax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsi + 0x10], rax
mov eax, dword [rbx + 0x1c]
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 0x1c]
add eax, dword [rbx + 0x18]
add dword [rbx + 0x10], eax
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x14], r15d
mov r15, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x180077a90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov dword [r9], 1
mov rdi, r9
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov esi, r12d
mov ebx, r8d
mov r10b, 1
test r8d, r8d
jle 0x180077b16
cmp dword [rdi], r12d
jbe 0x180077b16
test r10b, r10b
je 0x180077b16
mov rcx, qword [r15 + 0x18]
mov edx, ebp
sub edx, ebx
mov qword [rsp + 0x20], r12
add rdx, r14
mov r9, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne r10b
test r10b, r10b
je 0x180077b12
mov eax, dword [rdi]
test eax, eax
jne 0x180077b0e
xor r10b, r10b
jmp 0x180077b12
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x180077ad2
mov rbx, qword [rsp + 0x50]
test r10b, r10b
mov rbp, qword [rsp + 0x58]
mov eax, 0x3e8
mov dword [rdi], esi
cmovne eax, r12d
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x18007a3d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor ecx, ecx
mov r10, r8
mov r11, rdx
cmp r9, 2
jne 0x18007a44b
mov qword [rsp + 0x10], rbx
mov ebx, ecx
mov qword [rsp], rdi
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jle 0x18007a43b
sub r10, rdx
nop word [rax + rax]
mov r8d, dword [r10 + r11]
mov eax, r8d
mov r9d, dword [r11]
lea r11, [r11 + 4]
cdq
inc ebx
sub eax, edx
sar eax, 1
sub r9d, eax
lea eax, [r8 + r9]
cdq
mov r8d, eax
mov eax, r9d
xor r8d, edx
sub r8d, edx
cdq
xor eax, edx
sub eax, edx
movsxd rdx, ebx
add ecx, eax
add ecx, r8d
cmp rdx, rdi
jl 0x18007a400
mov rbx, qword [rsp + 0x10]
mov eax, ecx
mov rdi, qword [rsp]
add rsp, 8
ret
cmp r9, 1
jne 0x18007a51a
mov r10, qword [rsp + 0x30]
mov r8d, ecx
test r10, r10
jle 0x18007a4f5
cmp r10, 8
jb 0x18007a4f5
cmp dword [0x1800eb020], 2
jl 0x18007a4f5
mov rax, r10
xorps xmm3, xmm3
cqo
movdqa xmm2, xmm3
and edx, 7
mov rcx, r11
add rax, rdx
and eax, 7
sub rax, rdx
mov rdx, r10
sub rdx, rax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add r8d, 8
lea rcx, [rcx + 0x20]
movsxd rax, r8d
pabsd xmm1, xmm0
paddd xmm1, xmm3
movdqa xmm3, xmm1
movdqu xmm0, xmmword [rcx - 0x10]
pabsd xmm1, xmm0
paddd xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, rdx
jl 0x18007a4a0
paddd xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd ecx, xmm2
movsxd rax, r8d
cmp rax, r10
jge 0x18007a51a
lea r9, [r11 + rax*4]
mov eax, dword [r9]
lea r9, [r9 + 4]
cdq
inc r8d
xor eax, edx
sub eax, edx
add ecx, eax
movsxd rax, r8d
cmp rax, r10
jl 0x18007a501
mov eax, ecx
add rsp, 8
ret
Function at 0x18007bcf0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800ed400]
xor r10d, r10d
mov r11, rbx
nop dword [rax]
nop word [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 0x20
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 0x10
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 8
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 4
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 2
and al, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
and r8b, 2
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
xor r9d, r9d
lea r8d, [r9 + 0x1e]
nop
test al, 1
je 0x18007be22
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x18007be35
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x18007be10
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jle 0x18007bd10
lea r8, [0x1800edc00]
mov r9d, 0x100
nop word [rax + rax]
mov edx, dword [r8 - 0x800]
lea r8, [r8 + 4]
movzx eax, dl
shr edx, 8
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov edx, ecx
mov dword [r8 - 0x404], ecx
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov edx, ecx
mov dword [r8 - 4], ecx
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov edx, ecx
mov dword [r8 + 0x3fc], ecx
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov edx, ecx
mov dword [r8 + 0x7fc], ecx
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov edx, ecx
mov dword [r8 + 0xbfc], ecx
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
mov dword [r8 + 0xffc], ecx
movzx eax, cl
mov edx, ecx
shr edx, 8
mov eax, dword [rbx + rax*4]
xor eax, edx
mov dword [r8 + 0x13fc], eax
sub r9, 1
jne 0x18007be70
mov rbx, qword [rsp + 8]
mov al, 1
ret
Function at 0x18007bf20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, r8d
mov r10, rdx
lea rbx, [0x1800ed400]
cmp r8d, 8
jl 0x18007bff2
mov r11d, r9d
shr r11, 3
mov eax, r11d
neg eax
lea r9d, [r9 + rax*8]
nop dword [rax]
movzx eax, byte [r10 + 2]
movzx r8d, byte [r10 + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [r10 + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [r10]
shl r8d, 8
or r8, rax
mov eax, ecx
xor r8, rax
mov rax, r8
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
shr rax, 0x18
mov ecx, dword [rbx + rcx*4 + 0x1400]
xor ecx, dword [rbx + rdx*4 + 0x1800]
xor ecx, dword [rbx + rax*4 + 0x1000]
movzx eax, byte [r10 + 6]
xor ecx, dword [rbx + rax*4 + 0x400]
movzx eax, byte [r10 + 5]
xor ecx, dword [rbx + rax*4 + 0x800]
movzx eax, byte [r10 + 4]
xor ecx, dword [rbx + rax*4 + 0xc00]
movzx eax, byte [r10 + 7]
add r10, 8
xor ecx, dword [rbx + rax*4]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0x1c00]
sub r11, 1
jne 0x18007bf50
test r9d, r9d
je 0x18007c01e
nop word [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx edx, cl
xor rdx, rax
mov eax, ecx
shr eax, 8
mov ecx, dword [rbx + rdx*4]
xor ecx, eax
sub r9d, 1
jne 0x18007c000
mov rbx, qword [rsp + 8]
mov eax, ecx
ret

Function at 0x18007cf90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rbx, dword [rsp + 0x50]
mov r14, r8
mov rcx, r14
movsxd rdi, r9d
mov rsi, rdx
lea eax, [rbx*4]
movsxd r8, eax
call fcn.18008b7d0
lea rax, [r14 + rbx*4]
mov rdx, rbx
lea rbx, [r14 + rdi*4]
xor r9d, r9d
cmp rax, rbx
jae 0x18007d025
mov r10d, dword [rsp + 0x58]
sub rsi, r14
neg rdx
lea r11, [rdx*4]
nop dword [rax + rax]
mov ecx, dword [r11 + rax]
lea rdx, [r11 + rax]
imul ecx, r9d
lea r8, [rsi + rax]
sar ecx, 0xc
add ecx, dword [r8]
mov dword [rax], ecx
mov ecx, r9d
mov edx, dword [rdx]
sub ecx, r10d
xor edx, dword [r8]
add r9d, r10d
add rax, 4
test edx, edx
cmovle r9d, ecx
cmp rax, rbx
jb 0x18007cff0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18007e150
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movsxd rbp, r9d
mov rdi, r8
mov rsi, rdx
mov r12, rcx
mov r13, rbp
movsxd rbx, dword [rsp + 0xa0]
test rbx, rbx
js 0x18007e340
mov r15, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xb0]
movsxd r8, dword [r9 + rbx*4]
movsxd r14, dword [r15 + rbx*4]
test r14d, r14d
je 0x18007e2d6
test r8d, r8d
je 0x18007e2d6
cmp ebp, 0x40
jle 0x18007e2d6
mov rcx, rdi
mov rax, rsi
mov edx, 2
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18007e1e0
mov r10d, 0x40
mov r11d, r10d
cmp r13, r10
jle 0x18007e2f3
mov eax, r10d
sub rax, r8
lea r9, [rdi + rax*4]
mov rcx, r8
sub rcx, r14
lea r12, [rcx*4]
lea r15, [r8*4]
mov r13, r15
sub r13, rdi
add r13, rsi
lea r14, [rbp - 0x40]
lea r8, [r12 + r9]
mov ecx, r11d
imul ecx, dword [r9]
sar ecx, 9
mov eax, r10d
imul eax, dword [r8]
sar eax, 9
sub eax, ecx
add eax, dword [r9 + r13]
mov dword [r15 + r9], eax
mov edx, dword [r9 + r13]
mov eax, edx
xor eax, dword [r9]
lea ecx, [r11 + 1]
lea r11d, [r11 - 1]
cmovle r11d, ecx
lea r9, [r9 + 4]
xor edx, dword [r8]
lea eax, [r10 - 1]
lea r10d, [r10 + 1]
cmovle r10d, eax
sub r14, 1
jne 0x18007e271
mov r15, qword [rsp + 0xa8]
mov r13, rbp
mov r12, qword [rsp + 0x80]
jmp 0x18007e2eb
lea eax, [rbp*4]
movsxd r8, eax
mov rdx, rsi
mov rcx, rdi
call fcn.18008b7d0
mov r9, qword [rsp + 0xb0]
sub rbx, 1
mov rdx, rdi
js 0x18007e32e
mov dword [rsp + 0x30], 0x40
mov eax, dword [r9 + rbx*4]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + rbx*4]
mov dword [rsp + 0x20], eax
mov r9d, ebp
mov r8, rsi
mov rcx, r12
call fcn.18007ee60
sub rbx, 1
jns 0x18007e1a0
jmp 0x18007e340
lea eax, [rbp*4]
movsxd r8, eax
mov rcx, rsi
call fcn.18008b7d0
lea rcx, [rsp + 0x40]
call fcn.18007cf40
lea rax, [0x1800b1ee8]
mov qword [rsp + 0x40], rax
mov r9d, ebp
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.18007fb70
nop
lea rcx, [rsp + 0x40]
call fcn.18007cf50
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret