joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069634
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rdi, rsi
push rbp
xchg rbx, rbx
xchg rsi, rsp
mov rbp, rsi
xchg rsp, rsi
add rsp, 0xffffffffffffffb0
mov dword [rsp - 0xc], 0x6f913e19
movabs rbx, 0x28510a1f27dfe4fd
add rbx, 0xa9ccb06
sub rbx, 0x28a3ebe3
xor rbx, 0x514ad26b
mov rdi, rcx
mov dword [rsp - 0x24], 0x570eb4b9
cmp qword [rcx + 0x38], rbx
jne 0x140069821
xor esi, esi
mov r8, r8
mov dword [rbp - 0x30], 0x56f05f30
xor dword [rbp - 0x30], 0x7daf59a
xor dword [rbp - 0x30], 0x21ef421a
sub dword [rbp - 0x30], 0x7091e854
mov dword [rbp - 0x2c], 0x54a83418
add dword [rbp - 0x2c], 0x160f7a47
xor dword [rbp - 0x2c], 0x678db4df
add dword [rbp - 0x2c], 0x767f8f5
sub dword [rbp - 0x2c], 0x14601347
mov dword [rbp - 0x28], 0x275e330
add dword [rbp - 0x28], 0x5239b8b7
xor dword [rbp - 0x28], 0x64ab216b
sub dword [rbp - 0x28], 0x2f94ba12
mov dword [rbp - 0x24], 0x55bc18f3
sub dword [rbp - 0x24], 0x130777ae
sub dword [rbp - 0x24], 0x1c9a66a5
sub dword [rbp - 0x24], 0x25c63a3d
mov dword [rbp - 0x20], 0x4c5ba582
sub dword [rbp - 0x20], 0x3f67e0f
sub dword [rbp - 0x20], 0x3ce698a5
xor dword [rbp - 0x20], 0x5ebfbb43
xor dword [rbp - 0x20], 0x55e935ef
mov qword [rbp + 0x10], rsi
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
xchg rcx, rdx
mov rdx, qword [rbp + 0x10]
xchg rdx, rcx
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
and cl, 3
shl cl, 3
mov dword [rsp - 0x40], 0x7806286e
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x2e11476b
add eax, 0x41af683c
sub eax, 0x2208b569
sub eax, 0x1d6ab630
shr eax, cl
movzx ecx, al
xchg rbx, rbx
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
xor cx, dx
mov dword [rsp - 0x24], edi
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
mov rdi, rdi
mov qword [rbp + 0x10], rax
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
cmp rax, 0xa
jb 0x140069741
mov r9, r9
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008c080
xchg r12, r12
mov rdx, rax
xchg rsi, rax
mov r8, rsi
xchg rsi, rax
xor eax, eax
xor rdx, rbx
mov r8, r8
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov dword [rsp - 0x24], 0x39a7db51
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006982b
mov rdi, rdi
lea rdx, [0x140143830]
xchg r9, rcx
mov r9, r8
xchg r9, rcx
call fcn.140072800
test al, al
mov dword [rsp - 0x10], edi
setne al
jmp 0x14006982b
mov al, 0x68
xor al, 0x61
add al, 0x51
sub al, 0x58
sub al, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
xchg rdi, r13
mov r13, qword [rsp + 0x78]
xchg r13, rdi
nop
sub rsp, 0x243f621d
add rsp, 0x243f626d
pop rbp
mov dword [rsp - 0x44], 0x4ec1494a
ret
Function at 0x14006985c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x24], 0x6af48833
mov qword [rsp + 0x18], rsi
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg r11, rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rsp, rbp
mov rsp, rbp
xchg rbp, rsp
nop
add rsp, 0x31da86dd
sub rsp, 0x31da872d
movabs rbx, 0x28510a1f4a038104
xor rbx, 0x934c4ae
sub rbx, 0x41db5bcb
add rbx, 0x4a72cf06
add rbx, 0xcc35d66
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x20], rbx
jne 0x140069a88
mov dword [rsp - 0x18], edx
mov eax, 0x1111bc68
add eax, 0xdf1cc0
add eax, 0x33babdb9
sub eax, 0x29f5aee9
xor eax, 0x1bb5e7d9
mov dword [rbp - 0x30], 0x1c23bf05
add dword [rbp - 0x30], 0x1dfd6e8d
xor dword [rbp - 0x30], 0x7cc7ed6b
xor dword [rbp - 0x30], 0x46cac0a4
mov word [rbp - 0x1c], ax
xor esi, esi
xchg r11, r11
mov dword [rbp - 0x2c], 0x14102815
add dword [rbp - 0x2c], 0x5b84bb85
xor dword [rbp - 0x2c], 0x481d1c9f
sub dword [rbp - 0x2c], 0x1cbff768
xor dword [rbp - 0x2c], 0xa9607b5
mov dword [rbp - 0x28], 0x66d34249
sub dword [rbp - 0x28], 0x3730c715
add dword [rbp - 0x28], 0x2e73be28
sub dword [rbp - 0x28], 0x254c1f2b
sub dword [rbp - 0x28], 0x385319cf
mov dword [rbp - 0x24], 0x7ec17569
xor dword [rbp - 0x24], 0x2c774aee
add dword [rbp - 0x24], 0x11f753e0
xor dword [rbp - 0x24], 0x64b39318
mov dword [rbp - 0x20], 0x3997e1d8
sub dword [rbp - 0x20], 0x12845b33
add dword [rbp - 0x20], 0x358e4f6a
xor dword [rbp - 0x20], 0x5c89d665
mov qword [rbp + 0x10], rsi
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
xchg r15, rcx
mov r15, qword [rbp + 0x10]
xchg rcx, r15
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x18], 0x2e5df087
mov eax, 0x232296ef
add eax, 0x45b9a8bc
sub eax, 0x3d345c52
sub eax, 0x221ed215
xor eax, 0x39c4554a
shr eax, cl
mov dword [rsp - 0x38], 0x519ecee5
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov dword [rsp - 0xc], edx
mov word [rbp + rax*2 - 0x1a], cx
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
inc rax
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
cmp rax, 0xb
mov dword [rsp - 0x20], ecx
jb 0x1400699a0
xor edx, edx
mov word [rbp - 4], si
mov dword [rsp - 0x14], edx
lea rcx, [rbp - 0x1a]
call fcn.14008c080
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg rbp, rax
mov r8, rbp
xchg rbp, rax
xor eax, eax
xchg rcx, rcx
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
xchg rsp, rsp
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069a92
mov rdx, rdx
lea rdx, [0x140143298]
mov rcx, r8
call fcn.140072b9c
mov r13, r13
test al, al
setne al
jmp 0x140069a92
mov al, 0x1c
add al, 0x5f
sub al, 0x37
xor al, 0x47
sub al, 2
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x24], edi
mov rsi, qword [rsp + 0x70]
xchg rdi, rbp
mov rbp, qword [rsp + 0x78]
xchg rdi, rbp
nop
add rsp, 0x1ad976a9
sub rsp, 0x1ad97659
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140074a4c
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg rsi, r13
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffa0
lea rax, [rcx + 8]
mov dword [rsp - 0x28], esi
xchg r11, rbx
mov qword [rsp + 0x70], r11
xchg r11, rbx
mov qword [rcx], rax
xchg r12, r12
xorps xmm0, xmm0
xchg rsp, rax
movups xmmword [rsp], xmm0
xchg rsp, rax
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov qword [rsp + 0x78], rbp
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov dword [rsp - 0x1c], esp
xchg rbp, rax
movups xmmword [rbp + 0x40], xmm0
xchg rbp, rax
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
xchg r11, rax
movups xmmword [r11 + 0x70], xmm0
xchg r11, rax
xchg rbp, r9
mov r9, qword [rdx + 0x38]
xchg r9, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x10], 0x71f3e09e
mov rbx, qword [rdx]
xchg r9, rax
mov qword [rsp + 0x20], r9
xchg r9, rax
xchg rsp, rdi
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rbp + 1]
mov dword [rsp - 0x2c], ebx
xchg rdx, rsp
movups xmmword [rdx + 0x38], xmm0
xchg rsp, rdx
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg rsp, r8
call fcn.140017a7c
mov dword [rsp - 0x2c], ebp
mov edx, 0xd20afa5
xor edx, 0x53b4cf56
sub edx, 0x3b215f9d
sub edx, 0x295faa0
add edx, 0xf703d58
test rbp, rbp
mov dword [rsp - 0x38], 0x287fae1b
je 0x140074ad7
xchg r9, rax
mov rdi, r9
xchg r9, rax
sub rbx, rax
xchg r8, r8
mov r9, rbp
mov r8d, 0x61513f0d
xor r8d, 0x28a39191
sub r8d, 0x1dbe0e27
add r8d, 0x17e31a8
sub r8d, 0x2db2d11e
nop word [rax + rax]
movzx ecx, dx
mov r15, r15
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
mov dword [rsp - 0x3c], ebp
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074aab
mov dword [rsp - 0xc], ecx
xor ecx, ecx
xchg r8, r13
mov r13, rbp
xchg r13, r8
mov word [rax + rbp*2], cx
xchg r15, rcx
mov r15, rsi
xchg rcx, r15
mov rdx, qword [rsp + 0x20]
call fcn.140091f90
mov r14, r14
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
xchg rbp, r9
mov r9, qword [rsp + 0x78]
xchg r9, rbp
xchg rbx, r12
mov r12, qword [rsp + 0x70]
xchg rbx, r12
cmp rcx, rax
jne 0x140074b71
mov dword [rsp - 0x1c], 0x3ec91766
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x794f2848
sub ecx, 0x486d9972
xor ecx, 0x2d257aa4
sub ecx, 0x1dc4f442
rep stosb byte [rdi], al
xchg r8, r8
xchg rbp, rax
mov rbp, rsi
xchg rbp, rax
mov rsi, qword [rsp + 0x80]
mov rdi, rdi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
xchg r12, r12
ret
call fcn.140099d90
xchg rbp, rsi
mov rax, rbp
xchg rsi, rbp
xchg rsi, r9
mov r9, qword [rsp + 0x80]
xchg rsi, r9
nop
sub rsp, 0x493534e5
add rsp, 0x49353545
pop rdi
xchg r9, r9
ret
Function at 0x14007f72c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
xchg r12, r12
sub r10, rcx
xchg rcx, r15
mov r8, r15
xchg r15, rcx
lea rax, [r9 + r8]
mov dword [rsp - 0xc], 0x39872ff4
mov ecx, r9d
mov edx, 0x49d4dc2
add edx, 0x623830ec
sub edx, 0x8c28751
xor edx, 0x504971c9
add edx, 0x31f89740
inc r9
mov dword [rsp - 0x3c], edi
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov dword [rsp - 0x14], 0x34aec92d
jb 0x14007f745
xchg r10, rax
mov r10, r8
xchg r10, rax
ret
Function at 0x1400805a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r10, r10
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
mov dword [rsp - 0x30], edx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
nop
push 0xd6b8db4
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg rbx, r13
mov r13, rcx
xchg r13, rbx
mov r13d, r8d
mov r9d, 0x12c9e2e7
add r9d, 0x30542a06
add r9d, 0x30de9857
sub r9d, 0x73f8a544
xchg rbx, r12
mov rbx, rdx
xchg r12, rbx
cmp r8d, r9d
mov r10, r10
pushf
movabs rcx, 0xffffffff35a8b176
sub rcx, 0x152d4274
add rcx, 0x35d229f4
add rcx, 0x7fffffff
add rcx, 0x29b2670a
popf
pushf
mov eax, 0x582b9c54
xor eax, 0x6549f083
sub eax, 0xa8d3495
sub eax, 0x32d5383e
popf
cmovb r9d, r13d
mov dword [rsp - 0x2c], 0x2cbf2a8d
mul r9
cmovo rax, rcx
mov rcx, rax
call fcn.140099c50
mov dword [rsp - 0x30], 0xebba922
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 6
shr r15d, 7
shr r15d, 7
xchg rbp, r12
mov r12, rax
xchg rbp, r12
mov eax, dword [rbx + 0x18]
mov r12, r12
mov ebx, 0x602b2c98
sub ebx, 0x1cc62ed9
sub ebx, 0x2094a22
sub ebx, 0x415bb39c
mov dword [rsp + 0x70], eax
mov rdx, rdx
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x1400807d9
mov dword [rsp - 0x28], 0x287590c4
mov eax, 0x42d97b30
add eax, 0x2f71cbe0
xor eax, 0x64cb064d
sub eax, 0x1670415d
mov rcx, qword [rsp + 0x60]
xchg r10, r10
mov r14d, esi
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov r13, r13
sub edi, r14d
xchg r12, rdx
mov r12, rbp
xchg rdx, r12
cmp edi, eax
mov dword [rsp - 0x44], 0x52b3f99e
cmova edi, eax
mov r8d, edi
call fcn.140094090
mov r12, r12
test al, al
je 0x1400807d7
shr edi, 1
shr edi, 1
xor r8d, r8d
mov dword [rsp - 0x2c], 0x79c244e8
shr r14d, 1
shr r14d, 1
test edi, edi
je 0x1400807a6
mov r13, r13
mov r15d, dword [rsp + 0x70]
xchg r9, rbp
mov rbp, r9
xchg rbp, r9
lea eax, [r14 + r8]
mov edx, r15d
mov rcx, rcx
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x476b3605
lea r9, [r9 + 4]
mov dword [rsp - 0x3c], 0x3aa4e5a9
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14008076a
mov r15d, dword [rsp + 0x78]
mov dword [rsp - 0x20], 0x71f64c5f
add esi, ebx
mov eax, 0xbca0123
add eax, 0x271e8abc
add eax, 0x32557c04
sub eax, 0x39864fd
xor eax, 0x61b5a2e6
cmp esi, r15d
mov dword [rsp - 0x40], 0x76d8bb0f
jb 0x1400806f5
jmp 0x1400807d9
xor bl, bl
xchg rcx, rbp
mov rbp, rcx
xchg rcx, rbp
call fcn.140099c60
mov al, bl
mov dword [rsp - 0x44], ecx
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
nop
add rsp, 0x60228e6a
sub rsp, 0x60228e4a
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0x14], 0x35dd35ab
ret
Function at 0x1400810a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rsi, rsi
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg rbp, r13
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x24], 0x52aa4294
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov dword [rsp - 0x14], 0x4193940e
nop
sub rsp, 8
mov qword [rsp], r13
push r10
mov qword [rsp], r14
push r15
add rsp, 0xffffffffffffffe0
xchg rdi, rdi
xchg r12, r15
mov r12, rcx
xchg r12, r15
mov r14d, r8d
mov r9d, 0x28a063a
add r9d, 0x212a208a
add r9d, 0x5131c48a
xor r9d, 0x2b954111
sub r9d, 0x5f6caa5f
mov r12, rdx
mov dword [rsp - 0x2c], ebx
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff634d9178
sub rcx, 0x4ecf962b
sub rcx, 0x10691bfb
add rcx, 0x7fffffff
add rcx, 0x7beb20ae
popf
pushf
mov eax, 0x558c82d5
xor eax, 0x37439220
xor eax, 0x1e29bc45
sub eax, 0x18408161
sub eax, 0x64a62b4b
popf
cmovb r9d, r14d
mul r9
mov dword [rsp - 0xc], 0x11ebb94b
cmovo rax, rcx
mov rcx, rax
call fcn.140099c50
mov r13d, dword [r15 + 0x18]
mov r14, r14
lea ebp, [r14 + 0xfffff]
shr ebp, 0xf
shr ebp, 2
shr ebp, 2
shr ebp, 1
xor edi, edi
mov r11, r11
xchg r13, rax
mov rsi, r13
xchg r13, rax
mov ebx, 0x3803741a
xor ebx, 0x514a6444
sub ebx, 0x4dfa8fc5
add ebx, 0x4374a2da
sub ebx, 0x5ec32372
test ebp, ebp
je 0x1400812be
mov dword [rsp - 0x24], edx
mov eax, 0x654866ad
add eax, 0x149ece3f
sub eax, 0xa243bcb
sub eax, 0x6fb2f921
mov r9d, edi
mov r8d, r14d
shl r9d, 0xa
shl r9d, 3
shl r9d, 1
shl r9d, 3
shl r9d, 2
shl r9d, 1
sub r8d, r9d
xchg r14, r14
cmp r8d, eax
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov dword [rsp - 0x20], edx
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
mov dword [rsp - 0x18], ebx
je 0x140081271
xchg rdx, rcx
mov rcx, rsi
xchg rcx, rdx
lea ecx, [r9 + r10]
mov eax, r13d
xchg r15, r15
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x476b3605
mov rbp, rbp
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0x44], edx
jb 0x140081245
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
xchg r12, rcx
mov r12, r15
xchg rcx, r12
call fcn.140094490
test al, al
mov r9, r9
je 0x1400812b9
add edi, ebx
mov eax, 0x50f99a53
add eax, 0x1743627d
sub eax, 0x36c7fe19
sub eax, 0x3164feb7
cmp edi, ebp
jb 0x1400811f0
xchg rbp, rbp
jmp 0x1400812be
xor bl, bl
mov rsp, rsp
mov rcx, rsi
call fcn.140099c60
xchg r9, rbp
mov r9, qword [rsp + 0x58]
xchg rbp, r9
mov al, bl
xchg rbp, rbx
mov rbp, qword [rsp + 0x50]
xchg rbx, rbp
xchg r13, rsi
mov r13, qword [rsp + 0x60]
xchg r13, rsi
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0x20], ecx
pop r15
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
xchg rbx, rbx
ret
Function at 0x140083f10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rbp
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg r14, rsi
xchg rdi, rcx
mov qword [rsp + 0x20], rcx
xchg rdi, rcx
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x5eb28b7f
add rsp, 0x5eb28b5f
movsxd rbx, dword [rcx + 0x3c]
mov r10, r10
xchg rdi, r13
mov r13, rdx
xchg r13, rdi
xchg rcx, rdx
mov rsi, rdx
xchg rcx, rdx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x1c], 0x42fdabf
call fcn.140085cb0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
xchg rcx, rcx
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x40], 0x51387c5e
je 0x1400840f7
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
xchg r14, r14
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x28], 0x2be32073
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x40], edx
cmp r14w, cx
jae 0x140084033
mov eax, dword [rdx + 8]
mov dword [rsp - 0xc], edx
test eax, eax
jne 0x140083ff5
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x24], 0xf18ea51
cmp r11d, r9d
jb 0x140084019
add eax, r9d
cmp r11d, eax
xchg r9, r9
jb 0x1400840ab
inc r8w
sub rdx, 0xffffffffffffffd8
cmp r8w, cx
mov dword [rsp - 0x14], 0x5262782d
jb 0x140083fe3
xchg r8, r11
mov r11, r14
xchg r11, r8
mov eax, dword [r10 + 4]
mov r8, r8
lea r9, [r10 + 4]
neg rax
sub rax, 0xfffffffffffffff8
neg rax
sub r10, 0xfffffffffffffff8
mov r13, r13
shr rax, 1
test eax, eax
je 0x1400840e9
mov edx, eax
xchg r12, r12
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
mov dword [rsp - 0x40], edx
shr ecx, 7
shr ecx, 2
shr ecx, 2
shr ecx, 1
cmp ecx, 3
je 0x1400840c8
cmp ecx, 0xa
mov dword [rsp - 0x18], 0x5d7cb826
jne 0x1400840d1
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x1400840d1
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x18], 0x35dccfea
sub r8, r9
add r8, rsi
add r8, r11
xchg rcx, rcx
jmp 0x14008403c
and eax, 0xfff
add dword [rax + r8], edi
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
mov dword [rsp - 0xc], edi
jne 0x14008406e
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083fab
mov r15, r15
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
xchg rbp, r15
mov r15, qword [rsp + 0x38]
xchg r15, rbp
xchg r10, rsi
mov r10, qword [rsp + 0x40]
xchg r10, rsi
xchg r15, rdi
mov r15, qword [rsp + 0x48]
xchg r15, rdi
add rsp, 0x20
mov r10, r10
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140085d80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x54422c22
sub rsp, 0x54422c42
movzx eax, word [rcx]
mov r15, r15
mov r15d, edx
xor eax, 0x476b3605
xchg rcx, rbp
mov rsi, rbp
xchg rbp, rcx
cmp eax, 0x476b6c48
mov dword [rsp - 0x2c], 0x50456f71
jne 0x140085f33
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xchg rdx, rdx
xor eax, 0x476b3605
cmp eax, 0x476b7355
jne 0x140085f33
mov r15, r15
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085cb0
xchg rbp, rcx
mov rbp, rsi
xchg rcx, rbp
mov r14, rax
xchg r15, r15
mov edx, dword [rax + 0x20]
call fcn.140085cb0
mov edx, dword [r14 + 0x24]
xchg rbp, rcx
mov rbp, rsi
xchg rcx, rbp
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.140085cb0
mov r8, r8
mov edx, dword [r14 + 0x1c]
xchg rsi, rsp
mov rcx, rsp
xchg rsi, rsp
xchg rsp, rax
mov r13, rsp
xchg rsp, rax
call fcn.140085cb0
mov dword [rsp - 0x30], edi
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140085f33
xchg rdx, rdx
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
mov dword [rsp - 0x3c], 0x4a839da4
call fcn.140085cb0
mov ecx, 0x1d15318c
add ecx, 0x2a1ad2c
sub ecx, 0x7492d77
add ecx, 0xe7924ebe
xchg rbx, r15
mov r15, rax
xchg rbx, r15
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140085f19
mov dword [rsp - 0x40], 0x6e45129d
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r12, r12
mov r8d, 0x799675ec
xor r8d, 0x3d82c6d7
xor r8d, 0x2497d20f
sub r8d, 0x60836133
inc rbx
mov r11, r11
call fcn.14008f1d0
cmp byte [rbx], 0
jne 0x140085ed8
mov ecx, dword [rsp + 0x60]
xchg rcx, rcx
not ecx
cmp ecx, r15d
je 0x140085f8a
mov rbp, rbp
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140085e8c
xor eax, eax
mov rdi, rdi
xchg rbx, r12
mov r12, qword [rsp + 0x68]
xchg rbx, r12
nop
sub rsp, 0x4005cb26
add rsp, 0x4005cb46
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
mov dword [rsp - 0x28], esi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, r10
mov r10, rsi
xchg r10, rcx
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x24], 0x859bc53
call fcn.140085cb0
jmp 0x140085f38
Function at 0x14008a563
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
push rdi
add rsp, 0xffffffffffffffa0
xchg rbx, rbx
xchg rbx, rbp
mov rbp, qword [rcx]
xchg rbx, rbp
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rbx, rsi
mov qword [rsp + 0x70], rbx
xchg rbx, rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
mov r8, r8
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rsp, rcx
lea rdx, [rsi + 1]
xchg rsp, rdi
movups xmmword [rdi + 0x38], xmm0
xchg rsp, rdi
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.140017a7c
mov edx, 0x3993c09e
add edx, 0x3cb90b9
add edx, 0x235b21d0
sub edx, 0x556311ec
add edx, 0x24f5e2d3
test rsi, rsi
je 0x14008a5c1
xchg r14, r14
xchg r10, rax
mov rdi, r10
xchg r10, rax
sub rbx, rax
mov dword [rsp - 0x28], ecx
xchg r8, rdx
mov rdx, rsi
xchg rdx, r8
mov r9d, 0x20cd6c7
add r9d, 0x17d961ca
add r9d, 0x53167d18
xor r9d, 0x65fc4176
sub r9d, 0x900f3e0
nop dword [rax]
mov dword [rsp - 0x38], ebx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 8
xchg rcx, rcx
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
xchg r14, r14
jne 0x14008a59a
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0xc], 0x2713d98e
call fcn.14008a690
xchg rdx, rcx
mov rdx, qword [rsp + 0x20]
xchg rcx, rdx
mov ebx, eax
mov dword [rsp - 0x38], ecx
xchg r14, rsi
mov r14, qword [rsp + 0x70]
xchg r14, rsi
lea rax, [rsp + 0x28]
cmp rcx, rax
mov r8, r8
jne 0x14008a65d
xor eax, eax
lea rdi, [rsp + 0x28]
xchg rdx, rdx
mov ecx, 0x54eefffc
add ecx, 0x105fe530
xor ecx, 0x3a04ace2
sub ecx, 0x1d9a7a6f
sub ecx, 0x41afcf2f
rep stosb byte [rdi], al
mov dword [rsp - 0x40], 0x2c8a230a
mov eax, ebx
xchg rbx, r8
mov r8, qword [rsp + 0x78]
xchg rbx, r8
nop
sub rsp, 0x58df0957
add rsp, 0x58df09b7
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099d90
mov rbx, rbx
mov eax, ebx
xchg rbx, rbp
mov rbp, qword [rsp + 0x78]
xchg rbp, rbx
nop
sub rsp, 0x415ab4d1
add rsp, 0x415ab531
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008bba6
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r8
mov r8, rsp
xchg r11, r8
xchg rsi, rbx
mov qword [r11 + 0x20], rsi
xchg rbx, rsi
push rdi
mov rbp, rbp
nop
sub rsp, 0x1e31644c
add rsp, 0x1e3163ec
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
mov dword [rsp - 0x3c], 0xfcd3591
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg r10, rsi
mov qword [r11 + 0x10], r10
xchg r10, rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
xchg rsi, r14
mov qword [r11 + 0x18], rsi
xchg r14, rsi
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rsp, rcx
lea rdx, [rsi + 1]
mov dword [rsp - 0x14], 0x78de97f8
xchg rsp, rbp
movups xmmword [rbp + 0x38], xmm0
xchg rbp, rsp
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg r8, rsp
call fcn.140017a7c
mov dword [rsp - 0x20], ebx
mov edx, 0x20fbb910
xor edx, 0x3b9b2c67
sub edx, 0x15e1e4e6
xor edx, 0x76d6d3ff
xor edx, 0x43e52760
test rsi, rsi
xchg r9, r9
je 0x14008bc11
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rsi, rcx
mov r8, rcx
xchg rcx, rsi
mov r9d, 0x3f9545be
add r9d, 0x2498590a
add r9d, 0x72f1453
sub r9d, 0x5b043e0a
sub r9d, 0x10587412
nop word [rax + rax]
movzx ecx, dx
mov r10, r10
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x3c], ebp
sub r8, 1
jne 0x14008bbe5
xor ecx, ecx
mov r8d, ebp
mov dword [rsp - 0x2c], 0x26011a5
mov word [rax + rsi*2], cx
xchg r14, r9
mov rdx, r9
xchg r14, r9
xchg rcx, r14
mov r14, qword [rsp + 0x20]
xchg r14, rcx
call fcn.14008bcf0
mov dword [rsp - 0x28], esi
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg r11, r14
mov r11, qword [rsp + 0x80]
xchg r11, r14
lea rax, [rsp + 0x28]
xchg r14, r14
mov rsi, qword [rsp + 0x78]
xchg r8, rbp
mov r8, qword [rsp + 0x70]
xchg rbp, r8
cmp rcx, rax
jne 0x14008bcc5
xor eax, eax
mov dword [rsp - 0x3c], ecx
lea rdi, [rsp + 0x28]
mov ecx, 0x1786eb4
xor ecx, 0x32b7479c
sub ecx, 0x32fde05c
add ecx, 0x57d4611d
xor ecx, 0x58a5a9d9
rep stosb byte [rdi], al
mov eax, ebx
mov rsp, rsp
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x6448bd35
sub rsp, 0x6448bcd5
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099d90
mov eax, ebx
xchg rcx, rcx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret