joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a548
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rdx, rsp
mov rbp, rdx
xchg rdx, rsp
nop
sub rsp, 0x57f8f1bf
add rsp, 0x57f8f16f
movabs rbx, 0x62d0528475205b31
xor rbx, 0x26048086
sub rbx, 0x2eb54af0
add rbx, 0x16cb208
add rbx, 0x386b0a90
xchg rdi, r15
mov r15, rcx
xchg r15, rdi
cmp qword [rcx + 0x20], rbx
jne 0x14006a785
mov dword [rsp - 0x34], ebp
mov eax, 0x6daeb86a
add eax, 0x1089d5b5
sub eax, 0xb008c58
xor eax, 0x6a207b3b
sub eax, 0x19187a1d
mov dword [rbp - 0x30], 0x3d0fbd9
add dword [rbp - 0x30], 0x1ad92434
xor dword [rbp - 0x30], 0x73a98a3a
sub dword [rbp - 0x30], 0x60f3e263
sub dword [rbp - 0x30], 0xbb9c7b2
mov word [rbp - 0x1c], ax
xor esi, esi
mov dword [rsp - 0x38], 0x4ab723fd
mov dword [rbp - 0x2c], 0x656e6589
xor dword [rbp - 0x2c], 0xc9bd565
xor dword [rbp - 0x2c], 0x219aaeb8
xor dword [rbp - 0x2c], 0x48021e82
mov dword [rbp - 0x28], 0x65ee1318
xor dword [rbp - 0x28], 0x3fe2d807
xor dword [rbp - 0x28], 0x1e1ec57b
sub dword [rbp - 0x28], 0x309eafe8
xor dword [rbp - 0x28], 0x137e5e61
mov dword [rbp - 0x24], 0x74c4d5a2
sub dword [rbp - 0x24], 0x5cb59291
add dword [rbp - 0x24], 0xd3bdfb
sub dword [rbp - 0x24], 0x18b4008b
mov dword [rbp - 0x20], 0x17fe2c0
add dword [rbp - 0x20], 0x742a52f1
sub dword [rbp - 0x20], 0x34a6c7b5
sub dword [rbp - 0x20], 0x1362f5fa
sub dword [rbp - 0x20], 0x2d4e77ed
xchg rsi, r14
mov qword [rbp + 0x10], r14
xchg r14, rsi
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
xchg rcx, rsp
mov rsp, qword [rbp + 0x10]
xchg rcx, rsp
mov rax, qword [rbp + 0x10]
mov rcx, rcx
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov rdx, rdx
mov eax, 0x78957e3d
xor eax, 0x538f3a47
add eax, 0x211a61ad
xor eax, 0x4d879856
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x18], edi
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
xor cx, dx
mov rsp, rsp
mov word [rbp + rax*2 - 0x1a], cx
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
inc rax
xchg r11, rax
mov qword [rbp + 0x10], r11
xchg r11, rax
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
cmp rax, 0xb
jb 0x14006a695
mov rsp, rsp
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.14008bba0
mov rbx, rbx
xchg rdx, r14
mov r14, rax
xchg r14, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov dword [rsp - 0x44], 0x5ca14fe2
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
xchg rbp, rbp
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006a78d
mov dword [rsp - 0x34], 0x5e042fa7
lea rdx, [0x140141298]
xchg rcx, r13
mov r13, r8
xchg r13, rcx
call fcn.140073270
test al, al
mov dword [rsp - 0x34], 0x4a51725
setne al
jmp 0x14006a78d
mov al, 6
add al, 0x52
xor al, 0x78
xor al, 0x21
xchg r14, rbx
mov r14, qword [rsp + 0x68]
xchg r14, rbx
xchg rsi, r15
mov r15, qword [rsp + 0x70]
xchg rsi, r15
mov rdi, qword [rsp + 0x78]
mov r12, r12
nop
sub rsp, 0x45c60b72
add rsp, 0x45c60bc2
pop rbp
mov rbx, rbx
ret
Function at 0x140074e8e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
nop
push r15
mov qword [rsp], rdi
sub rsp, 0x60
mov rbp, rbp
lea rax, [rcx + 8]
xchg r13, rbx
mov qword [rsp + 0x70], r13
xchg r13, rbx
xchg r15, rax
mov qword [rcx], r15
xchg r15, rax
xorps xmm0, xmm0
xchg r12, r12
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
mov rsi, rcx
mov qword [rsp + 0x78], rbp
mov dword [rsp - 0xc], ecx
xchg r11, rax
movups xmmword [r11 + 0x10], xmm0
xchg r11, rax
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x14], edx
xchg rdx, rax
movups xmmword [rdx + 0x20], xmm0
xchg rdx, rax
movups xmmword [rax + 0x30], xmm0
xchg rdi, rdi
xchg rdx, rax
movups xmmword [rdx + 0x40], xmm0
xchg rdx, rax
xchg r11, rax
movups xmmword [r11 + 0x50], xmm0
xchg r11, rax
xchg rbx, rax
movups xmmword [rbx + 0x60], xmm0
xchg rbx, rax
xchg r9, rax
movups xmmword [r9 + 0x70], xmm0
xchg r9, rax
xchg rbp, r12
mov r12, qword [rdx + 0x38]
xchg r12, rbp
lea rax, [rsp + 0x28]
mov r12, r12
mov rbx, qword [rdx]
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
mov dword [rsp - 0x18], ebx
movups xmmword [rsp + 0x38], xmm0
xchg r10, rsp
movups xmmword [r10 + 0x48], xmm0
xchg r10, rsp
call fcn.14001781c
mov edx, 0x5797b453
xor edx, 0x4f826c78
add edx, 0x4b055cb
sub edx, 0x1b12ef85
test rbp, rbp
je 0x140074fd0
xchg r9, rdi
mov r9, rax
xchg r9, rdi
sub rbx, rax
mov r9, rbp
mov dword [rsp - 0x44], esi
mov r8d, 0x16d4e8c8
add r8d, 0x54400f72
xor r8d, 0x69436535
xor r8d, 0x49c9e92a
xor r8d, 0x4b9e74da
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg r10, r10
and cx, r8w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r11, r11
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074fa4
xchg rdx, rdx
xor ecx, ecx
xchg r8, rbp
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
xchg r9, rdx
mov r9, qword [rsp + 0x20]
xchg r9, rdx
call fcn.140091b00
mov rdx, rdx
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg rcx, r11
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
xchg r8, r8
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14007506a
xor eax, eax
mov r11, r11
lea rdi, [rsp + 0x28]
mov ecx, 0x6e2b2f17
sub ecx, 0xd9316c1
xor ecx, 0x6739a11d
sub ecx, 0x7a1b91b
rep stosb byte [rdi], al
xchg rcx, rcx
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rsi, r11
mov r11, qword [rsp + 0x80]
xchg rsi, r11
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099570
mov rax, rsi
mov dword [rsp - 0x3c], 0x2f84e979
mov rsi, qword [rsp + 0x80]
nop
sub rsp, 0x7121e5e2
add rsp, 0x7121e642
pop rdi
ret
Function at 0x14007f77c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
sub r10, rcx
mov rbp, rbp
mov r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x2f5d01eb
xor edx, 0x67a2ddf7
add edx, 0x50f9630
sub edx, 0x156d2169
xor edx, 0x2496744b
inc r9
mov rsi, rsi
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov dword [rsp - 0x2c], 0x4224ba31
jb 0x14007f78f
xchg r10, r8
mov rax, r10
xchg r10, r8
ret
Function at 0x140080640
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg rbx, r10
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r13
mov dword [rsp - 0x30], 0x5d81457
nop
sub rsp, 8
mov qword [rsp], r14
nop
push 0x6e64847b
mov qword [rsp], r15
sub rsp, 0x20
mov rdi, rdi
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov r13d, r8d
mov r9d, 0x2c0de4db
add r9d, 0x15df9b47
add r9d, 0x2488ebc8
sub r9d, 0x66726bea
xchg rdi, r12
mov rdi, rdx
xchg rdi, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff48c6902a
add rcx, 0x2635f974
sub rcx, 0x11899de1
xor rcx, 0x258e8553
add rcx, 0x7fffffff
add rcx, 0x7039112
popf
pushf
mov eax, 0x6be51609
add eax, 0x1275c94c
xor eax, 0x12b2ab13
sub eax, 0x5a5cf12b
sub eax, 0x128b8317
popf
cmovb r9d, r13d
xchg r9, r9
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400993a0
mov dword [rsp - 0xc], ebp
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0x10
shr r15d, 3
shr r15d, 1
xchg r10, rax
mov rbp, r10
xchg r10, rax
mov eax, dword [rbx + 0x18]
xchg r11, r11
mov ebx, 0x259df451
xor ebx, 0x40a2523
xor ebx, 0x41d47f25
sub ebx, 0x211dcc52
sub ebx, 0x3f25e204
mov dword [rsp + 0x70], eax
mov rdx, rdx
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x140080875
mov eax, 0xd260925
add eax, 0x534623de
sub eax, 0x2a1e51f
sub eax, 0x522c18e0
xor eax, 0xb8e2f04
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x28], 0x514e22cb
mov r14d, esi
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov dword [rsp - 0x30], edi
sub edi, r14d
xchg rbx, rdx
mov rbx, rbp
xchg rdx, rbx
cmp edi, eax
xchg r13, r13
cmova edi, eax
mov r8d, edi
call fcn.140093720
test al, al
mov dword [rsp - 0x18], 0x45354323
je 0x140080873
shr edi, 2
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
je 0x140080847
mov dword [rsp - 0x40], 0x1d8bc5d
mov r15d, dword [rsp + 0x70]
mov r9, rbp
lea eax, [r14 + r8]
xchg rbx, rbx
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov r9, r9
xor edx, 0x7f884e56
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
mov dword [rsp - 0x38], 0x6e718e26
jb 0x140080810
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov dword [rsp - 0x20], ebp
mov eax, 0x67576b62
sub eax, 0x22596f88
sub eax, 0x42456432
sub eax, 0x2a897a8
cmp esi, r15d
jb 0x14008079f
mov dword [rsp - 0x40], edx
jmp 0x140080875
xor bl, bl
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.1400993b0
mov al, bl
mov dword [rsp - 0x30], 0x7b90b2fb
xchg rbx, r15
mov r15, qword [rsp + 0x68]
xchg r15, rbx
nop
sub rsp, 0xa7ac40d
add rsp, 0xa7ac42d
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
mov dword [rsp - 0x28], 0x3da8fd27
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
xchg rdx, rdx
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140081260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg r15, rbp
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
xchg r15, rcx
mov rcx, r15
xchg rcx, r15
mov r14d, r8d
xchg r14, r14
mov r9d, 0x7c5b658
xor r9d, 0x3cd9d515
sub r9d, 0x681fa1d
xor r9d, 0xf451b0f
sub r9d, 0x3bdb723f
mov r12, rdx
mov dword [rsp - 0x44], edi
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff60ac00c6
sub rcx, 0x102a20c9
sub rcx, 0x9fc95e0
sub rcx, 0x2c5adf0b
add rcx, 0x7fffffff
add rcx, 0x65d594ee
popf
pushf
mov eax, 0x43bcfa3e
add eax, 0x3741f9d1
xor eax, 0x3966181c
add eax, 0x20dc1eb3
sub eax, 0x64750ac2
popf
cmovb r9d, r14d
mov r9, r9
mul r9
cmovo rax, rcx
mov rcx, rax
call fcn.1400993a0
mov r9, r9
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0x11
shr ebp, 2
shr ebp, 1
xor edi, edi
xchg rcx, rsi
mov rcx, rax
xchg rsi, rcx
mov ebx, 0x51ecb0a8
sub ebx, 0x1c6bd0dd
xor ebx, 0x68a338ab
sub ebx, 0x23b04a17
xor ebx, 0x39739d48
test ebp, ebp
mov dword [rsp - 0x30], esp
je 0x140081476
mov eax, 0x42417920
sub eax, 0xc4e8a9d
add eax, 0xe15cd96
xor eax, 0x4418bc19
mov r9d, edi
mov r8d, r14d
mov dword [rsp - 0xc], 0x7e44d858
shl r9d, 0x11
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x44], ecx
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov r9, r9
xor r10d, r10d
shr r11d, 2
test r11d, r11d
mov dword [rsp - 0x18], 0x3b13bed1
je 0x140081426
xchg rdi, rdx
mov rdi, rsi
xchg rdx, rdi
lea ecx, [r9 + r10]
mov eax, r13d
mov r8, r8
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x7f884e56
mov dword [rdx], eax
mov dword [rsp - 0x24], 0x383e47f1
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x1400813f9
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r8, r15
mov rcx, r8
xchg r15, r8
call fcn.140093b50
mov r9, r9
test al, al
je 0x140081474
add edi, ebx
mov eax, 0x77b76fb4
sub eax, 0x73e7e890
add eax, 0x17e5aab9
xor eax, 0x54de04a1
sub eax, 0x4f5b357c
cmp edi, ebp
mov dword [rsp - 0x30], edx
jb 0x1400813a3
jmp 0x140081476
xor bl, bl
mov rcx, rsi
call fcn.1400993b0
mov rdx, rdx
xchg rcx, rbp
mov rcx, qword [rsp + 0x58]
xchg rbp, rcx
mov al, bl
mov dword [rsp - 0x30], esp
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
nop
add rsp, 0x4eaee284
sub rsp, 0x4eaee264
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083d30
Capabilities:
Enumerate pe sections

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rdi, rbp
mov qword [rsp + 0x10], rdi
xchg rbp, rdi
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
add rsp, 0x22385973
sub rsp, 0x22385993
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, rcx
mov rdi, rcx
xchg rdx, rcx
xchg rcx, rbx
mov rsi, rbx
xchg rbx, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x38], esp
call fcn.140085ad0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x2c], ebp
mov ebp, dword [rbx + rsi + 0xb4]
xchg rdi, rax
mov r10, rdi
xchg rdi, rax
mov ebx, r14d
test ebp, ebp
je 0x140083f19
mov dword [rsp - 0x24], 0x6cc3f5e2
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x3c], ebp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
xchg r13, r13
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x20], 0x422b6485
cmp r14w, cx
jae 0x140083e4c
mov eax, dword [rdx + 8]
mov rcx, rcx
test eax, eax
jne 0x140083e0b
mov eax, dword [rdx + 0x10]
mov r11, r11
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x140083e27
add eax, r9d
xchg rdi, rdi
cmp r11d, eax
jb 0x140083ec6
inc r8w
mov dword [rsp - 0xc], 0x5ee83b9e
nop
add rdx, 0x24b86c58
sub rdx, 0x24b86c30
cmp r8w, cx
jb 0x140083df7
xchg r8, r14
mov r14, r8
xchg r8, r14
mov eax, dword [r10 + 4]
mov rcx, rcx
lea r9, [r10 + 4]
nop
sub rax, 0x3702bb20
add rax, 0x3702bb18
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
xchg r13, r13
je 0x140083f0b
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x20], ebp
movzx eax, word [r10]
mov ecx, eax
shr ecx, 9
shr ecx, 2
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x2c], ecx
je 0x140083ee3
cmp ecx, 0xa
jne 0x140083eef
and eax, 0xfff
xchg r13, r13
add qword [rax + r8], rdi
jmp 0x140083eef
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x28], 0x232fe8a3
sub r8, r9
add r8, rsi
add r8, r11
xchg rdi, rdi
jmp 0x140083e55
and eax, 0xfff
add dword [rax + r8], edi
xchg rbx, rbx
nop
sub r10, 0x738308b0
add r10, 0x738308b2
sub rdx, 1
mov rcx, rcx
jne 0x140083e91
add ebx, dword [r9]
cmp ebx, ebp
xchg rdi, rdi
jb 0x140083dbf
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg r13, r13
mov rsi, qword [rsp + 0x40]
xchg rdi, rbx
mov rbx, qword [rsp + 0x48]
xchg rbx, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140085ba0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, rbp
push rbp
nop
push 0x209412d5
mov qword [rsp], rsi
push rdi
push r12
push r13
mov dword [rsp - 0x3c], esi
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
mov r10, r10
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x7f884e56
xchg r9, rsi
mov r9, rcx
xchg rsi, r9
cmp eax, 0x7f88141b
jne 0x140085d32
mov r15, r15
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x7f884e56
mov r9, r9
cmp eax, 0x7f880b06
jne 0x140085d32
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085ad0
xchg rdx, rdx
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
xchg r12, r12
call fcn.140085ad0
mov edx, dword [r14 + 0x24]
xchg rcx, rbx
mov rbx, rsi
xchg rbx, rcx
xchg r9, rax
mov r12, r9
xchg r9, rax
call fcn.140085ad0
mov rsi, rsi
mov edx, dword [r14 + 0x1c]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r13, rax
call fcn.140085ad0
xor edi, edi
xchg rsp, rsp
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140085d32
mov dword [rsp - 0x14], edi
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140085ad0
mov dword [rsp - 0xc], 0x52e2b73
mov ecx, 0x3a181485
xor ecx, 0x1f654ee1
add ecx, 0x7a3b095
xor ecx, 0xd2def506
mov rbx, rax
mov dword [rsp + 0x60], ecx
xchg r14, r14
cmp byte [rax], 0
je 0x140085d10
nop dword [rax]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
lea rcx, [rsp + 0x60]
mov r12, r12
mov r8d, 0x17db899f
sub r8d, 0xe375f57
xor r8d, 0x6c1f783d
xor r8d, 0x65bb5274
inc rbx
call fcn.14008ed90
mov r10, r10
cmp byte [rbx], 0
jne 0x140085ccc
mov ecx, dword [rsp + 0x60]
not ecx
xchg rbx, rbx
cmp ecx, r15d
je 0x140085d70
inc edi
mov dword [rsp - 0x1c], 0x35583c7e
cmp edi, dword [r14 + 0x18]
jb 0x140085c85
xor eax, eax
mov rbx, qword [rsp + 0x68]
xchg r13, r13
add rsp, 0x20
pop r15
pop r14
mov rsi, rsi
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
pop rsi
mov dword [rsp - 0x2c], 0xecfc78e
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, r13
mov rcx, r13
xchg r13, rsi
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
mov edx, dword [rax + rdx*4]
call fcn.140085ad0
jmp 0x140085d34
Function at 0x14008a205
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffa0
xchg r15, r15
xchg rbx, r14
mov r14, qword [rcx]
xchg r14, rbx
lea rax, [rsp + 0x28]
mov r11, r11
xorps xmm0, xmm0
xchg r10, rsi
mov qword [rsp + 0x70], r10
xchg rsi, r10
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
mov rcx, rcx
mov qword [rsp + 0x20], rax
xchg rsp, rbp
movups xmmword [rbp + 0x28], xmm0
xchg rsp, rbp
lea rdx, [rsi + 1]
mov dword [rsp - 0xc], 0x6fc04e1a
xchg r10, rsp
movups xmmword [r10 + 0x38], xmm0
xchg rsp, r10
xchg rbp, rsp
movups xmmword [rbp + 0x48], xmm0
xchg rbp, rsp
call fcn.14001781c
mov edx, 0x6471081e
add edx, 0xe317887
sub edx, 0x79ead1a
xor edx, 0x6ab0edfa
test rsi, rsi
mov dword [rsp - 0x28], edx
je 0x14008a2fa
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rbx, r8
mov rbx, rsi
xchg rbx, r8
mov r9d, 0x6ca6afe
xor r9d, 0x51af47cb
xor r9d, 0x7644218e
sub r9d, 0x6fdd18a
sub r9d, 0x1a233a32
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0xc], ebx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 5
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg rbx, rbx
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008a2cc
xor ecx, ecx
mov rdx, rdx
mov word [rax + rsi*2], cx
xchg rcx, r9
mov r9, qword [rsp + 0x20]
xchg r9, rcx
call fcn.14008a3a0
xchg rdi, rcx
mov rdi, qword [rsp + 0x20]
xchg rdi, rcx
mov ebx, eax
mov rsi, qword [rsp + 0x70]
mov r9, r9
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14008a370
xor eax, eax
mov dword [rsp - 0x1c], ebp
lea rdi, [rsp + 0x28]
mov ecx, 0x4a485db2
sub ecx, 0x2a3a37dc
xor ecx, 0xb15317c
xor ecx, 0x2910e40d
sub ecx, 0x20bf077
rep stosb byte [rdi], al
mov eax, ebx
xchg r12, r12
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
pop rdi
ret
call fcn.140099570
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0x28], 0x1eccf50d
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008b7d6
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg r11, rsp
xchg rbx, r8
mov qword [r11 + 0x20], r8
xchg rbx, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
mov rbx, qword [rcx]
xchg r14, r14
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov r9, r9
xchg r15, rax
mov qword [r11 - 0x48], r15
xchg r15, rax
mov ebp, r8d
mov dword [rsp - 0x34], edi
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov dword [rsp - 0xc], 0xf1b7fd9
xchg r14, r9
mov qword [r11 + 0x18], r9
xchg r14, r9
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
xchg r14, rsp
movups xmmword [r14 + 0x28], xmm0
xchg r14, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
xchg rsi, rsp
movups xmmword [rsi + 0x48], xmm0
xchg rsi, rsp
call fcn.14001781c
mov edx, 0x5f94d1eb
sub edx, 0x16ce8fbc
sub edx, 0xd09f6ee
xor edx, 0x3a0f7530
test rsi, rsi
je 0x14008b837
mov rdi, rax
xchg r13, r13
sub rbx, rax
xchg r8, r9
mov r9, rsi
xchg r9, r8
mov r9d, 0x38662edf
add r9d, 0xd3ac22c
sub r9d, 0x3465d0a4
add r9d, 0xa0313d4
sub r9d, 0x1b3e333c
nop word [rax + rax]
xchg r14, r14
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov r15, r15
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rcx, rcx
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008b806
mov dword [rsp - 0x28], 0x4c40b9db
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rdi, rdi
mov rdx, r14
xchg rcx, rdx
mov rdx, qword [rsp + 0x20]
xchg rdx, rcx
call fcn.14008b910
xchg r14, rcx
mov r14, qword [rsp + 0x20]
xchg r14, rcx
mov ebx, eax
xchg r13, r14
mov r13, qword [rsp + 0x80]
xchg r14, r13
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov rcx, rcx
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14008b8df
xor eax, eax
mov dword [rsp - 0x18], edi
lea rdi, [rsp + 0x28]
mov ecx, 0x6cceebd3
xor ecx, 0x2dfa0776
add ecx, 0x3bdbb737
sub ecx, 0x7d10a3ac
rep stosb byte [rdi], al
mov dword [rsp - 0x44], 0x20cadde5
mov eax, ebx
xchg rbx, r13
mov r13, qword [rsp + 0x88]
xchg r13, rbx
add rsp, 0x60
mov dword [rsp - 0xc], 0xa8d411d
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140099570
mov eax, ebx
xchg rbp, rbx
mov rbp, qword [rsp + 0x88]
xchg rbx, rbp
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008b910
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x3c], edx
mov dword [rsp + 0x18], r8d
push rdi
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
mov rbx, rdx
xchg rcx, rbx
mov rdi, rbx
xchg rcx, rbx
xor edx, edx
mov dword [rsp - 0x44], 0x32891ecb
lea rcx, [rsp + 0x30]
mov r8d, 0x74af791
add r8d, 0x6c75a58f
add r8d, 0xb9afd55
sub r8d, 0x7f5b986d
call fcn.140099b40
mov r15, r15
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg r14, r14
xchg r15, r8
mov r15, qword [rax]
xchg r15, r8
test r8, r8
mov dword [rsp - 0x3c], edi
je 0x14008bb5e
mov r8, qword [r8 + 0x50]
test r8, r8
mov rdi, rdi
je 0x14008bb5e
mov edx, 0x7dc584f3
sub edx, 0x2ac0d8d3
xor edx, 0x64252c09
sub edx, 0x37217f25
lea rcx, [rsp + 0x30]
xchg rdx, rdx
lea r9d, [rdx - 1]
call fcn.14009a6b0
mov edx, 0x3ca48bc6
xor edx, 0x7ff3d4cb
add edx, 0x3571f115
sub edx, 0x78c94fc6
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x34], esp
call fcn.14009a7d0
test rax, rax
je 0x14008bb2b
xor ecx, ecx
mov dword [rsp - 0x34], 0x617e03da
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
mov r15, r15
movabs rcx, 0xbf06f7326592b0c4
xor rcx, 0x79180b1e
xor rcx, 0x224e97cd
xor rcx, 0x563a3c1e
mov r8, qword [0x140141690]
mov r10, r10
add r8, rcx
lea rcx, [rsp + 0x20]
not r8
rol r8, 2
rol r8, 7
rol r8, 1
rol r8, 1
not r8
mov dword [rsp - 0x30], 0x7d3a6abb
call r8
mov r10, qword [0x140141680]
lea r8, [rsp + 0x20]
mov dword [rsp - 0x28], edx
movabs rcx, 0x40e88c2800f2b19c
add rcx, 0x3b2978a0
add rcx, 0x39f045b
sub rcx, 0x8eae3d5
lea rdx, [rsp + 0x260]
add r10, rcx
mov dword [rsp - 0x30], 0x49730a7c
movabs rax, 0x15dab5f801a996c4
xor rax, 0x597d9d88
sub rax, 0x417aea4
xor rax, 0x36ce0dd5
xor rax, 0x3e8f708d
not r10
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x28], ebx
add r10, rax
xchg rbx, r14
mov r9, r14
xchg r14, rbx
rol r10, 0x1e
rol r10, 0xc
rol r10, 1
rol r10, 2
rol r10, 8
rol r10, 1
rol r10, 1
rol r10, 1
not r10
mov rbx, rbx
call r10
xchg rbx, rbp
mov rbp, qword [rsp + 0x250]
xchg rbp, rbx
add rsp, 0x3f1fdf0d
sub rsp, 0x3f1fdccd
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x425ecc60
add eax, 0xad2b579
add eax, 0x3230f5e
add eax, 0x6fab6eca
mov rbx, qword [rsp + 0x250]
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x250]
xchg r15, r15
mov eax, 0x2f323fd1
xor eax, 0x800d43d
add eax, 0x34b0cb48
add eax, 0x641c4a01
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret