joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084e30
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
push rdx
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r15
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
push r15
nop
add rsp, 0x2a8a4000
sub rsp, 0x2a8a4020
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x691058b1
mov dword [rsp - 0x18], ebp
xchg rcx, rsp
mov rsi, rsp
xchg rcx, rsp
cmp eax, 0x691002fc
jne 0x140084ffa
xchg rdx, rdx
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x691058b1
xchg r10, r10
cmp eax, 0x69101de1
jne 0x140084ffa
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084d60
mov dword [rsp - 0xc], 0x6fc1f4a7
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r14, rax
mov rsp, rsp
mov edx, dword [rax + 0x20]
call fcn.140084d60
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0x3c], 0x1ce6d830
xchg rsi, r13
mov rcx, r13
xchg r13, rsi
xchg r10, rax
mov r12, r10
xchg r10, rax
call fcn.140084d60
mov edx, dword [r14 + 0x1c]
mov r9, r9
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg r13, rcx
mov rcx, rax
xchg r13, rcx
call fcn.140084d60
mov dword [rsp - 0x3c], edx
xor edi, edi
xchg rsi, rax
mov qword [rsp + 0x70], rsi
xchg rsi, rax
cmp dword [r14 + 0x18], edi
mov r15, r15
jbe 0x140084ffa
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rdi, rdi
mov rcx, rsi
call fcn.140084d60
mov ecx, 0x5372f5c2
sub ecx, 0x40561ef0
xor ecx, 0x3d261d67
add ecx, 0x239951ea
xor ecx, 0xae2be260
xchg rbx, rbp
mov rbp, rax
xchg rbp, rbx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov rsi, rsi
je 0x140084fdd
nop dword [rax]
xchg rdx, rbp
mov rbp, rbx
xchg rbp, rdx
lea rcx, [rsp + 0x60]
mov rdx, rdx
mov r8d, 0x7180ee97
sub r8d, 0xbd8229c
sub r8d, 0x1449e4bb
add r8d, 0x2ce46e13
xor r8d, 0x7e435552
inc rbx
mov dword [rsp - 0x1c], 0x42bf0f60
call fcn.14008df10
cmp byte [rbx], 0
jne 0x140084f8a
xchg rsp, rsp
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov r10, r10
je 0x140085050
inc edi
cmp edi, dword [r14 + 0x18]
xchg r14, r14
jb 0x140084f42
xor eax, eax
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg rbx, r10
add rsp, 0x20
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x3c], 0x5b9566e6
ret
movzx edx, word [r13 + rdi*2]
xchg rdx, rsi
mov rcx, rdx
xchg rdx, rsi
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x18], 0x4dd5b802
call fcn.140084d60
jmp 0x140084ffc
Function at 0x1400894a3
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x62a21e41
add rsp, 0x62a21de1
xchg rdi, rbx
mov rdi, qword [rcx]
xchg rbx, rdi
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp - 0x30], ebp
mov qword [rsp + 0x70], rsi
xchg r10, rsi
mov r10, qword [rcx + 0x38]
xchg r10, rsi
lea rcx, [rsp + 0x20]
xchg rcx, rax
mov qword [rsp + 0x20], rcx
xchg rcx, rax
xchg rbp, rsp
movups xmmword [rbp + 0x28], xmm0
xchg rbp, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov rbx, rbx
xchg rbp, rsp
movups xmmword [rbp + 0x48], xmm0
xchg rbp, rsp
call fcn.140017bbc
mov dword [rsp - 0x14], 0x658ec9da
mov edx, 0x72a1bc12
sub edx, 0x5632cc11
add edx, 0x53b28af3
sub edx, 0x3e1e110e
test rsi, rsi
je 0x14008950b
mov dword [rsp - 0xc], 0x34631156
mov rdi, rax
sub rbx, rax
xchg rsp, r8
mov rsp, rsi
xchg r8, rsp
mov r9d, 0x7e796cd2
xor r9d, 0x33d10e9e
xor r9d, 0x3eca63df
xor r9d, 0x7362016c
nop dword [rax]
xchg rsi, rsi
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 8
mov dword [rsp - 0x3c], 0x1b4096d4
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov rbp, rbp
jne 0x1400894df
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rbx, rbx
mov rcx, qword [rsp + 0x20]
call fcn.1400895a0
xchg rcx, r13
mov r13, qword [rsp + 0x20]
xchg rcx, r13
mov ebx, eax
mov dword [rsp - 0x20], 0x59a70c39
xchg r13, rsi
mov r13, qword [rsp + 0x70]
xchg r13, rsi
lea rax, [rsp + 0x28]
cmp rcx, rax
mov r9, r9
jne 0x140089582
xor eax, eax
lea rdi, [rsp + 0x28]
xchg r9, r9
mov ecx, 0x67c749a0
sub ecx, 0x53f469fa
xor ecx, 0x30357ec0
sub ecx, 0x23e7a136
rep stosb byte [rdi], al
mov eax, ebx
xchg rdx, rdx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140098600
mov eax, ebx
mov r15, r15
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
mov dword [rsp - 0xc], ebx
ret
Function at 0x14008a996
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r14
mov r14, rsp
xchg r11, r14
mov qword [r11 + 0x20], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x1f26cae2
sub rsp, 0x1f26cb42
xchg rdx, rbx
mov rdx, qword [rcx]
xchg rbx, rdx
lea rax, [r11 - 0x40]
mov dword [rsp - 0x14], 0x1e9db8d5
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov dword [rsp - 0x14], 0x5d4b852c
xchg r13, rsi
mov qword [r11 + 0x10], r13
xchg rsi, r13
xchg rdx, rsi
mov rdx, qword [rcx + 0x38]
xchg rdx, rsi
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp - 0x24], 0x3a444905
lea rdx, [rsi + 1]
xchg rsp, r10
movups xmmword [r10 + 0x38], xmm0
xchg r10, rsp
xchg rsp, rdi
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017bbc
mov edx, 0x74364b15
sub edx, 0x62393b33
xor edx, 0x15ec3468
xor edx, 0x6cceadd3
sub edx, 0x36dc2c73
test rsi, rsi
je 0x14008aa03
mov r15, r15
mov rdi, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x10], edx
mov r9d, 0x5bf5a1ee
xor r9d, 0x489488f9
xor r9d, 0x67077be1
xor r9d, 0x74665209
nop word [rax + rax]
mov dword [rsp - 0x2c], ebx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
xchg rbx, rbx
ror edx, 3
ror edx, 3
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x10], 0x314694df
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008a9d0
xor ecx, ecx
mov rdi, rdi
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg r14, rdx
mov r14, rdx
xchg r14, rdx
mov rcx, qword [rsp + 0x20]
mov r13, r13
call fcn.14008aae0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r13, r13
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rdx, rsi
mov rdx, qword [rsp + 0x78]
xchg rsi, rdx
xchg rdx, rbp
mov rdx, qword [rsp + 0x70]
xchg rdx, rbp
cmp rcx, rax
jne 0x14008aaa5
mov rbp, rbp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x1a734c0c
sub ecx, 0xcfedab6
xor ecx, 0x13b26f91
xor ecx, 0x1ec61ef7
rep stosb byte [rdi], al
mov dword [rsp - 0x18], ecx
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x38156b44
sub rsp, 0x38156ae4
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098600
mov eax, ebx
xchg rdi, rdi
xchg rbx, r8
mov r8, qword [rsp + 0x88]
xchg r8, rbx
sub rsp, 0xffffffffffffffa0
mov dword [rsp - 0x38], 0x5546a296
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008aae0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
mov dword [rsp - 0x2c], 0x6780356a
add rsp, 0xfffffffffffffdc0
xchg rdx, rcx
mov rbx, rcx
xchg rdx, rcx
xchg rcx, r15
mov rdi, r15
xchg rcx, r15
xor edx, edx
xchg r13, r13
lea rcx, [rsp + 0x30]
mov r8d, 0xe5c13fc
add r8d, 0x255ff971
add r8d, 0x2769de60
sub r8d, 0x5b25e9c5
call fcn.140098bf0
mov rax, qword gs:[0x60]
xchg rbp, rbp
xchg r8, rsp
mov rsp, qword [rax + 0x18]
xchg r8, rsp
mov rax, qword [r8 + 0x10]
xchg rcx, rcx
xchg r9, r8
mov r9, qword [rax]
xchg r9, r8
test r8, r8
mov r13, r13
je 0x14008ada3
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008ada3
xchg r14, r14
mov edx, 0x14cc48bd
xor edx, 0x520b0169
sub edx, 0x3648455f
sub edx, 0x107f0371
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
xchg r10, r10
call fcn.140099750
mov edx, 0x7ad60868
sub edx, 0x43679166
xor edx, 0x450801a0
xor edx, 0x2b7a5545
sub edx, 0x591c238b
lea rcx, [rsp + 0x30]
call fcn.140099850
mov r13, r13
test rax, rax
je 0x14008ad6c
xor ecx, ecx
xchg rdi, r13
mov rdx, r13
xchg r13, rdi
mov word [rax], cx
movabs rcx, 0xa00d922d5a73e8dd
sub rcx, 0x276ac6e7
add rcx, 0xd253214
add rcx, 0x7fffffff
xor rcx, 0x7c7b6f0a
mov r8, qword [0x140142690]
movabs rax, 0x460e0b401e20c569
xor rax, 0x726513b6
xor rax, 0x1e2b57b9
sub rax, 0x579bdce
sub rax, 0x3e54b062
add r8, rcx
lea rcx, [rsp + 0x20]
mov rbp, rbp
xor r8, rax
movabs rax, 0x5178ad9309e96920
sub rax, 0x8851a99
add rax, 0x6ba24bac
add rax, 0x266fae03
ror r8, 0x1d
ror r8, 3
ror r8, 1
ror r8, 1
sub r8, rax
xchg rsp, rsp
ror r8, 0x14
ror r8, 6
ror r8, 1
call r8
mov dword [rsp - 0x24], esi
mov r10, qword [0x140142680]
lea r8, [rsp + 0x20]
movabs rcx, 0xfd29f3fd44157ad4
xor rcx, 0x411e59e9
add rcx, 0x777342db
sub rcx, 0x5667851d
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x38], 0x3520e7cd
add r10, rcx
movabs rax, 0xdb81d15f66ada280
xor rax, 0x6325700b
xor rax, 0x29cadcc6
xor rax, 0x455ea3ee
add rax, 0x3cfb958a
xor r10, rax
xchg r15, r15
lea rcx, [rsp + 0x30]
ror r10, 0x23
ror r10, 2
ror r10, 2
ror r10, 1
ror r10, 1
movabs rax, 0x311fa4c034fa0521
add rax, 0x362467ad
sub rax, 0x2f30ab38
sub rax, 0x903e6c
add rax, 0x7fffffff
xor rax, 0x47c9de2e
sub r10, rax
xchg rbx, rsi
mov r9, rsi
xchg rsi, rbx
rol r10, 0x15
rol r10, 1
rol r10, 5
rol r10, 1
call r10
mov dword [rsp - 0x20], ecx
xchg rbx, rsi
mov rsi, qword [rsp + 0x250]
xchg rsi, rbx
add rsp, 0x3174229f
sub rsp, 0x3174205f
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0xdbb9cbf
xor eax, 0x6f587069
xor eax, 0x12383f8e
sub eax, 0x40a523f5
xor eax, 0xf036af62
xchg rbx, r15
mov r15, qword [rsp + 0x250]
xchg rbx, r15
add rsp, 0x5ea3ef71
sub rsp, 0x5ea3ed31
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x29bb2d96
add eax, 0x8a2c038
xor eax, 0x12fff945
add eax, 0xd89087b
add eax, 0x91d4e42f
sub rsp, 0x1cdaad58
add rsp, 0x1cdaaf98
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008e270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142c24], 0
jne 0x14008e378
xor edx, edx
mov dword [rsp - 0x34], ebx
lea r8, [0x140142c20]
nop word [rax + rax]
mov ecx, edx
xchg rsp, rsp
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
xchg r15, r15
neg ecx
and ecx, 0xedb88320
inc edx
mov dword [rsp - 0x34], 0x2859c05b
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0xc], esi
and eax, 1
neg eax
and eax, 0xedb88320
mov r14, r14
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x28], 0x37f40e71
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x44], esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov r12, r12
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rbp, rbp
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg r12, r12
mov eax, ecx
shr ecx, 1
and eax, 1
mov rbp, rbp
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rbx, rbx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x38], 0x12c25998
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x24], 0x4899ff8e
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x44], 0xf9e41bb
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008e294
ret
Function at 0x1400934dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x20], ebx
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
push r15
mov dword [rsp - 0x10], esi
sub rsp, 0x20
movzx eax, byte [rdx + 1]
xchg r15, r8
mov r8, r15
xchg r15, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x44], 0x65dae9b
mov r8d, dword [rcx + 4]
shl ebx, 2
shl ebx, 5
shl ebx, 1
dec r8d
mov dword [rsp - 0x18], esp
or ebx, eax
shl edi, 2
shl edi, 3
shl edi, 2
shl edi, 1
movzx eax, byte [rdx + 2]
mov r11, r11
shl ebx, 2
shl ebx, 2
shl ebx, 2
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x14], ebp
movzx eax, byte [rdx + 3]
shl ebx, 7
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
mov dword [rsp - 0x24], 0x39ca8f9a
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x3c], 0x4af046b7
movzx eax, byte [rdx + 7]
shl edi, 8
or edi, eax
mov dword [rsp - 0x38], ebx
test r8d, r8d
jle 0x14009361d
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov dword [rsp - 0x40], ecx
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov dword [rsp - 0x20], 0x6dc8d4e
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
mov dword [rsp - 0x10], 0x286ae4d7
lea rbp, [rdx + rax*4]
xchg rcx, rsi
mov rdx, rcx
xchg rcx, rsi
mov ecx, edi
call fcn.140093d68
xchg r12, r12
xor ebx, eax
mov rdx, rbp
mov ecx, ebx
xchg r15, r15
call fcn.140093d68
xor edi, eax
add rsi, 0xffffffffffffffe8
mov dword [rsp - 0xc], ecx
add rbp, 0xffffffffffffffe8
sub r14, 1
jne 0x1400935db
mov dword [rsp - 0x10], 0x57158228
lea rax, [r15 + 7]
mov ecx, 0x310828d8
xor ecx, 0x78b4dfca
add ecx, 0x1e6fcdea
xor ecx, 0x682cc4f8
mov byte [rax - 4], dil
xchg r15, r15
mov byte [rax], bl
dec rax
shr ebx, 5
shr ebx, 2
shr ebx, 1
shr edi, 5
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x140093638
xchg r11, rbx
mov r11, qword [rsp + 0x40]
xchg r11, rbx
xchg r14, rbp
mov r14, qword [rsp + 0x48]
xchg rbp, r14
mov rsi, qword [rsp + 0x50]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
ret
Function at 0x14009369c
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg r12, rbx
mov qword [rax + 8], r12
xchg rbx, r12
xchg rbp, rdx
mov qword [rax + 0x10], rdx
xchg rbp, rdx
xchg r15, rsi
mov qword [rax + 0x18], r15
xchg rsi, r15
mov qword [rax + 0x20], rdi
mov dword [rsp - 0x10], edx
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x5fd69bf9
add rsp, 0x5fd69bd9
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x2c], 0xc822a42
xchg r14, r11
mov r11, r8
xchg r11, r14
movzx ebx, byte [rdx]
xchg r10, r10
movzx edi, byte [rdx + 4]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 4
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 8
xchg r11, r11
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 3
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x34], ebp
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 6
or edi, eax
movzx eax, byte [rdx + 7]
xchg r8, r8
shl edi, 8
or edi, eax
mov eax, dword [rcx + 4]
mov r13, r13
test eax, eax
jle 0x1400937b8
xchg r14, rsi
mov r14, qword [rcx + 8]
xchg r14, rsi
lea ebp, [rax - 1]
mov dword [rsp - 0x18], 0x31b29101
shr ebp, 1
inc ebp
xchg rbx, rsi
mov rdx, rbx
xchg rbx, rsi
mov ecx, edi
mov dword [rsp - 0x38], edi
call fcn.140093d68
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov dword [rsp - 0x28], ecx
call fcn.140093d68
xor edi, eax
nop
sub rsi, 0x21a3181a
add rsi, 0x21a31832
sub rbp, 1
mov dword [rsp - 0x18], edx
jne 0x140093774
lea rax, [r14 + 7]
mov ecx, 0x341f3e47
xor ecx, 0x380df524
add ecx, 0x61fb9203
sub ecx, 0x612ec0b6
sub ecx, 0xcdf9cac
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x38], edi
dec rax
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 3
shr edi, 1
shr edi, 1
shr edi, 2
shr edi, 1
sub rcx, 1
jne 0x1400937d9
mov dword [rsp - 0xc], 0x53eca0e3
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xchg r12, rbp
mov r12, qword [rsp + 0x38]
xchg rbp, r12
mov rsi, qword [rsp + 0x40]
mov dword [rsp - 0x44], 0x3d098609
mov rdi, qword [rsp + 0x48]
nop
add rsp, 0x367ac686
sub rsp, 0x367ac666
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140093a28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rbp, rbp
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
mov dword [rsp - 0x10], 0x48601466
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140001e20]
xor edi, edi
mov dword [rsp - 0x44], ecx
movdqa xmm1, xmmword [0x140001dc0]
xchg r9, rbx
mov r9, rdx
xchg r9, rbx
xchg rbp, rsi
movdqu xmmword [rsi - 0x39], xmm0
xchg rsi, rbp
mov rsi, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001db0]
xchg rbx, rbx
mov r8d, edi
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x140001da0]
mov dword [rsp - 0x40], edx
xchg rbp, r11
movdqu xmmword [r11 - 0x19], xmm0
xchg r11, rbp
xchg r15, rbp
movdqu xmmword [r15 - 9], xmm1
xchg r15, rbp
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0x2a87c976
xor eax, 0x1af47bc0
xor eax, 0x11996b80
add eax, 0x1bec2ef1
inc rdx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
xchg rcx, rcx
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140093ac3
cmp dword [rsi + 4], 8
mov dword [rsp - 0x1c], ebp
jne 0x140093b66
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
mov r9, r9
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 4
shl cx, 1
shl cx, 1
shl cx, 1
shl cx, 1
or cx, ax
mov word [rdx], cx
mov dword [rsp - 0x18], edi
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140093b0b
mov r8, r8
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rsp, rcx
mov rsp, rsi
xchg rsp, rcx
call fcn.14009384c
xchg rbx, rbx
jmp 0x140093c47
cmp dword [rsi], edi
jle 0x140093c47
mov r14d, edi
mov rsi, rsi
lea rdx, [rbp + 0x6d]
mov r8d, 0xe757fa5
add r8d, 0x5c03e97f
xor r8d, 0x4f7ba327
sub r8d, 0x2502c9ff
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov dword [rsp - 0x28], 0x69617946
nop
sub rbx, 0x18ff52c6
add rbx, 0x18ff52c8
shl ax, 4
shl ax, 4
or cx, ax
mov rbx, rbx
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140093b93
xchg rsp, rsp
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rbp, rbp
xchg rcx, r12
mov r12, rsi
xchg r12, rcx
call fcn.14009384c
mov dword [rsp - 0x3c], esp
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x38], 0x61c63335
neg r8d
sub r8d, 0xfffffff8
neg r8d
xchg rcx, r8
mov r8, rsi
xchg rcx, r8
call fcn.14009384c
inc edi
mov dword [rsp - 0x34], 0x7d918650
nop
add r14d, 0x2b94040
sub r14d, 0x2b94038
cmp edi, dword [rsi]
jl 0x140093b74
mov dword [rsp - 0x24], ecx
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rcx, rbx
mov rcx, qword [r11 + 0x28]
xchg rbx, rcx
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
mov rbx, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg r8, rsp
mov r8, r11
xchg rsp, r8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140093d20
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov dword [rsp - 0x3c], edx
test edx, edx
je 0x140093d62
lea ecx, [r11 + r11]
xchg r12, r12
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
test dl, 1
xchg r15, r15
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov r13, r13
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
xchg r10, r10
jne 0x140093d2e
mov eax, r10d
ret
Function at 0x140099a90
Capabilities:
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
xchg r10, rcx
mov qword [rsp], rcx
xchg rcx, r10
xchg r11, rsi
mov qword [rsp + 8], rsi
xchg r11, rsi
xor r11, r11
mov dword [rsp - 0x44], 0x3f286fa8
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
xchg rcx, rcx
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x140099aff
mov r12, r12
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 4
xor byte [r11], 0x13
sub byte [r11], 0xb
add byte [r11], 0x55
sub byte [r11], 0x61
cmp r10, r11
bnd jne 0x140099adb
mov r15, r15
mov r10, qword [rsp]
xchg rdi, r11
mov rdi, qword [rsp + 8]
xchg rdi, r11
add rsp, 0x10
mov dword [rsp - 0x14], 0x364fd180
bnd ret
Function at 0x14009ef00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0xf8]
xchg r13, rax
xor r8d, r8d
mov r9, rdx
test rax, rax
xchg r8, r8
je 0x14009ef64
mov ecx, r8d
mov edx, 0x5400e863
xor edx, 0xbed3750
add edx, 0x1ebe6c9f
sub edx, 0x40d543ab
rol edx, cl
mov dword [rsp - 0x34], ebp
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
inc r8
mov dword [rsp - 0x18], 0x2c364c39
cmp r8, 0x20
jb 0x14009ef1d
mov al, 0x18
xor al, 8
add al, 0x4a
sub al, 0x59
ret
mov rax, qword [rcx + 0x100]
test rax, rax
xchg rbp, rbp
je 0x14009ef98
xchg rsp, rax
movups xmm0, xmmword [rsp]
xchg rsp, rax
movups xmmword [rdx], xmm0
xchg r9, r9
movups xmm1, xmmword [rax + 0x10]
xchg rdx, rdi
movups xmmword [rdi + 0x10], xmm1
xchg rdx, rdi
jmp 0x14009ef5b
xorps xmm0, xmm0
mov dword [rsp - 0x20], esi
xor al, al
xchg rdx, r15
movups xmmword [r15], xmm0
xchg r15, rdx
xchg rbp, rdx
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rdx
ret
Function at 0x1400b5900
Capabilities:
Encode data using xor

Disassembly:
xchg r9, r11
mov r9, rsp
xchg r9, r11
mov qword [r11 + 8], rbx
xchg r8, r8
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
nop
push 0x6e1e1bb6
mov qword [rsp], r14
nop
sub rsp, 0x37781c16
add rsp, 0x37781bd6
mov rax, qword [0x1401424c8]
lea rdx, [r11 + 0x10]
mov dword [rsp - 0x2c], 0x63d251e2
xchg rbx, rsi
mov rsi, rcx
xchg rbx, rsi
mov dword [rsp + 0x58], 0x25c87120
add dword [rsp + 0x58], 0x23a232d
xor dword [rsp + 0x58], 0x41eacd47
sub dword [rsp + 0x58], 0x4d427cac
sub dword [rsp + 0x58], 0x1ca5dc4e
movabs rcx, 0x1c53f8686b183288
xor rcx, 0x6c982ae
add rcx, 0x4c1a0a8
add rcx, 0xd0b3f67
xor rax, rcx
xchg r9, r9
movabs rcx, 0xd57bf0d11eb10871
sub rcx, 0x15c0c353
add rcx, 0x4d206b39
add rcx, 0x6f4731e9
rol rax, 0x33
rol rax, 5
rol rax, 1
rol rax, 1
xor rax, rcx
mov dword [rsp - 0x44], 0x6068be13
movabs rcx, 0x57b50c517be70037
sub rcx, 0x16dbda88
xor rcx, 0x4436db59
add rcx, 0x347952aa
add rcx, 0x459bc7b7
add rax, rcx
lea rcx, [r11 - 0x28]
rol rax, 0xb
rol rax, 6
rol rax, 0xd
rol rax, 1
rol rax, 1
rol rax, 1
rol rax, 1
call rax
lea rdi, [rbx + 8]
mov rbp, rbp
xorps xmm0, xmm0
mov qword [rbx], rdi
xor esi, esi
mov dword [rsp - 0x3c], edi
xchg rcx, rdi
movups xmmword [rcx], xmm0
xchg rcx, rdi
xchg rsp, rdi
movups xmmword [rsp + 0x10], xmm0
xchg rsp, rdi
xchg rbx, rdi
movups xmmword [rbx + 0x20], xmm0
xchg rdi, rbx
test eax, eax
jne 0x1400b5a5e
mov qword [rbx + 0x38], rsi
xchg r15, r15
jmp 0x1400b5ba7
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
inc r14
mov dword [rsp - 0x20], 0x2a180b0c
cmp word [rax + r14*2], si
jne 0x1400b5a67
mov qword [rbx + 0x38], r14
cmp qword [rbx], rdi
mov dword [rsp - 0x1c], 0x54434342
je 0x1400b5aa0
xchg rcx, r14
mov r14, qword [rbx]
xchg rcx, r14
call fcn.140098600
cmp r14, 0x18
jbe 0x1400b5ae6
mov dword [rsp - 0x24], 0x785df495
lea rcx, [r14 + r14]
call fcn.1400988d0
mov qword [rbx], rax
test rax, rax
mov dword [rsp - 0xc], 0x71107139
jne 0x1400b5af6
xchg rdi, r13
mov qword [rbx], r13
xchg rdi, r13
xchg rsp, rsi
mov rcx, rsp
xchg rsp, rsi
jmp 0x1400b5b1d
xchg r10, rdi
mov qword [rbx], r10
xchg r10, rdi
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xorps xmm0, xmm0
mov dword [rsp - 0x34], ebx
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
mov rcx, qword [rbx]
xchg rsp, rsp
mov edx, 0x21afeb71
sub edx, 0x10aeb088
add edx, 0x862d308
xor edx, 0x2dd1054c
sub edx, 0x2b19ed7
cmp qword [rbx + 0x38], rsi
jbe 0x1400b5ba7
mov r9, r9
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov r9d, 0x62c72fd3
xor r9d, 0x21882734
xor r9d, 0x2e026ce0
sub r9d, 0x6d4d6308
and ax, r9w
mov dword [rsp - 0x34], 0x538fa094
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor ax, word [r8 + rcx]
inc rsi
mov rbx, rbx
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x1c], 0x2f87b407
jb 0x1400b5b4f
mov rsi, qword [rsp + 0x60]
xchg rsp, rbx
mov rax, rsp
xchg rbx, rsp
xchg r13, rbx
mov r13, qword [rsp + 0x50]
xchg rbx, r13
mov rdi, qword [rsp + 0x68]
nop
sub rsp, 0x3b8d22e8
add rsp, 0x3b8d2328
pop r14
ret