joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068dcc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg rsi, r15
mov qword [rsp + 0x20], rdi
nop
push 0x68c3d07f
mov qword [rsp], rbp
mov rbp, rsp
nop
sub rsp, 0x152237ff
add rsp, 0x1522379f
movabs rbx, 0x648463814c8a88e8
sub rbx, 0x16f871c2
xor rbx, 0x27024fd8
add rbx, 0x43a8c975
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
cmp qword [rcx + 0x30], rbx
xchg rdi, rdi
jne 0x140068fbe
xor esi, esi
mov dword [rbp - 0x40], 0x7e515697
sub dword [rbp - 0x40], 0x50abd065
add dword [rbp - 0x40], 0x19ac20c8
xor dword [rbp - 0x40], 0x475ca65d
mov dword [rbp - 0x3c], 0x2594879c
add dword [rbp - 0x3c], 0x1bf59fb7
add dword [rbp - 0x3c], 0x2cdcd124
sub dword [rbp - 0x3c], 0x6e13f802
mov dword [rbp - 0x38], 0x4e0ac2ac
add dword [rbp - 0x38], 0x9b6b663
add dword [rbp - 0x38], 0x18953f74
sub dword [rbp - 0x38], 0x5b1cab2d
sub dword [rbp - 0x38], 0x153a0cc0
mov dword [rbp - 0x34], 0x5e613919
sub dword [rbp - 0x34], 0x46a5d8f3
xor dword [rbp - 0x34], 0x32515022
sub dword [rbp - 0x34], 0x25ea2fd4
mov dword [rbp - 0x30], 0xbbeba53
xor dword [rbp - 0x30], 0x4c06f5cc
sub dword [rbp - 0x30], 0x470fe1ed
add dword [rbp - 0x30], 0x727e8bbe
sub dword [rbp - 0x30], 0x7319f8a8
mov dword [rbp - 0x2c], 0x1634ef2a
xor dword [rbp - 0x2c], 0x3ad1c271
add dword [rbp - 0x2c], 0x20dfe592
sub dword [rbp - 0x2c], 0x4d67127e
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
xchg rsi, rsi
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
mov rsi, rsi
mov eax, 0x2f9646d4
add eax, 0x1b84e5b9
xor eax, 0x5546fdba
add eax, 0x5f919749
sub eax, 0x4bebfe9a
shr eax, cl
movzx ecx, al
mov rsp, rsp
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
inc rax
mov qword [rbp + 0x10], rax
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
cmp rax, 0xc
jb 0x140068ef5
xchg r11, r11
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
mov dword [rsp - 0x14], edx
call fcn.14008ade0
mov rdx, rax
mov r8, rax
xor eax, eax
xchg r14, r14
xor rdx, rbx
xchg r11, rdx
mov qword [rdi + 0x30], r11
xchg rdx, r11
lea rdi, [rbp - 0x28]
mov r15, r15
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140068fc8
xchg rsi, rsi
lea rdx, [0x1401422c0]
mov rcx, r8
call fcn.14006d808
xchg r12, r12
test al, al
setne al
jmp 0x140068fc8
mov al, 0x7e
xor al, 0x40
add al, 2
add al, 9
sub al, 0x48
lea r11, [rsp + 0x60]
xchg rsi, rsi
xchg rbx, rsp
mov rsp, qword [r11 + 0x18]
xchg rbx, rsp
mov rsi, qword [r11 + 0x20]
mov dword [rsp - 0x38], 0x17db83d7
mov rdi, qword [r11 + 0x28]
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069000
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
mov rbp, rsp
nop
add rsp, 0x31e152d3
sub rsp, 0x31e15323
movabs rsi, 0x648463813bf863ec
xor rsi, 0x6e0d5b11
xor rsi, 0x386d913d
sub rsi, 0x22845790
add rsi, 0xb24d043
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
cmp qword [rcx + 0x28], rsi
jne 0x14006922f
mov dword [rsp - 0x30], ebx
mov eax, 0x141b521a
add eax, 0x1c9345c
xor eax, 0x3cbbee58
add eax, 0x4998639d
sub eax, 0x72f7cb41
mov dword [rbp - 0x30], 0x37015aaf
sub dword [rbp - 0x30], 0x23073bfc
add dword [rbp - 0x30], 0x4d45aa7a
add dword [rbp - 0x30], 0x178fc215
sub dword [rbp - 0x30], 0x78ca8a99
mov word [rbp - 0x20], ax
xor r14d, r14d
mov dword [rsp - 0x14], edx
mov dword [rbp - 0x2c], 0x34618e7e
sub dword [rbp - 0x2c], 0x23ec42e4
add dword [rbp - 0x2c], 0x31cb5db9
sub dword [rbp - 0x2c], 0x423fa8ed
mov edi, 0x6b8d1e23
xor edi, 0x15d558a9
sub edi, 0x2b52df
sub edi, 0x7e2cf3aa
mov dword [rbp - 0x28], 0x44a375e5
xor dword [rbp - 0x28], 0x2315d48e
sub dword [rbp - 0x28], 0x35d53999
xor dword [rbp - 0x28], 0x715b02ef
xor dword [rbp - 0x28], 0x40fd65e9
mov dword [rbp - 0x24], 0x5d6cba56
sub dword [rbp - 0x24], 0x3e78dc08
xor dword [rbp - 0x24], 0x29fce0e8
sub dword [rbp - 0x24], 0x2124999c
sub dword [rbp - 0x24], 0x158ca4a3
xchg r14, rsi
mov qword [rbp + 0x20], rsi
xchg rsi, r14
mov rax, qword [rbp + 0x20]
xchg rcx, r10
mov r10, qword [rbp + 0x20]
xchg rcx, r10
mov rax, qword [rbp + 0x20]
mov r8, r8
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x34], ebp
mov eax, 0x1835d2f2
xor eax, 0x77ec0dbe
sub eax, 0x31e07e63
sub eax, 0x49174d
sub eax, 0xbacdfb6
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x20]
mov r10, r10
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov rax, qword [rbp + 0x20]
add rax, rdi
xchg r13, r13
xchg r15, rax
mov qword [rbp + 0x20], r15
xchg r15, rax
xchg rdx, rax
mov rdx, qword [rbp + 0x20]
xchg rdx, rax
cmp rax, 9
jb 0x140069147
mov dword [rsp - 0x38], 0x249d54c4
xor edx, edx
mov word [rbp - 0xc], r14w
lea rcx, [rbp - 0x1e]
call fcn.14008ade0
xchg r10, r10
xchg r15, rdx
mov r15, rax
xchg r15, rdx
lea rdi, [rbp - 0x1e]
xchg rbp, rbp
xor rdx, rsi
mov r8, rax
xor eax, eax
xchg rdi, rdi
xchg rbp, rdx
mov qword [rbx + 0x28], rbp
xchg rbp, rdx
lea ecx, [rax + 9]
xchg r9, r9
rep stosb byte [rdi], al
cmp rdx, rsi
je 0x140069248
mov rdi, rdi
lea rdx, [0x140142810]
mov rcx, r8
call fcn.140071a88
test al, al
mov dword [rsp - 0xc], 0x4d1ec35b
setne al
jmp 0x140069248
mov eax, 0x5db8b70f
xor eax, 0x8e6b741
sub eax, 0xfbdc47b
xor eax, 0x5686bb6a
sub eax, 0x132680b8
lea r11, [rsp + 0x50]
xchg r12, r12
xchg rbx, r14
mov r14, qword [r11 + 0x28]
xchg rbx, r14
mov rsi, qword [r11 + 0x30]
mov r11, r11
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
pop r14
mov dword [rsp - 0x3c], ebx
nop
mov rdi, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0x30], edx
ret
Function at 0x140069280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x24], ebp
mov qword [rsp + 0x18], rsi
xchg r14, rdi
mov qword [rsp + 0x20], r14
xchg r14, rdi
push rbp
xchg rsp, r9
mov rbp, r9
xchg r9, rsp
add rsp, 0xffffffffffffffb0
mov rsp, rsp
movabs rbx, 0x6484638104e00294
xor rbx, 0x5eef2fab
add rbx, 0xf0af86c
xor rbx, 0x4e6a407c
add rbx, 0x2ec8bc9c
xchg rcx, rbx
mov rdi, rbx
xchg rcx, rbx
cmp qword [rcx + 0x38], rbx
xchg rcx, rcx
jne 0x140069471
xor esi, esi
mov dword [rbp - 0x30], 0x2017e3b8
add dword [rbp - 0x30], 0x4b918691
xor dword [rbp - 0x30], 0x33fe16cd
sub dword [rbp - 0x30], 0x3c44520f
sub dword [rbp - 0x30], 0x1bfa29c1
mov dword [rbp - 0x2c], 0xae47080
sub dword [rbp - 0x2c], 0x15b337e
xor dword [rbp - 0x2c], 0x28aa74b
xor dword [rbp - 0x2c], 0x3b33f9a6
sub dword [rbp - 0x2c], 0x2ff0638f
mov dword [rbp - 0x28], 0x5fb3935a
sub dword [rbp - 0x28], 0x2087b67d
add dword [rbp - 0x28], 0x353d1388
sub dword [rbp - 0x28], 0x740befd3
mov dword [rbp - 0x24], 0x4ea02cf9
xor dword [rbp - 0x24], 0x291ea4e5
sub dword [rbp - 0x24], 0xa48be14
sub dword [rbp - 0x24], 0x5d1fc9db
mov dword [rbp - 0x20], 0x4bc67fca
sub dword [rbp - 0x20], 0x3fba9a31
xor dword [rbp - 0x20], 0x43c92c82
sub dword [rbp - 0x20], 0x4ab5af61
xor dword [rbp - 0x20], 0x5081930
xchg rdx, rsi
mov qword [rbp + 0x10], rdx
xchg rdx, rsi
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
mov rcx, qword [rbp + 0x10]
xchg r12, r12
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x2c], ebx
mov eax, 0x408ccbdd
sub eax, 0x19136125
xor eax, 0x2d07cc27
add eax, 0x2784c347
shr eax, cl
mov dword [rsp - 0x14], 0x1c66aa84
movzx ecx, al
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x24], 0x60a02375
inc rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xa
mov dword [rsp - 0x40], 0xd5c8c0a
jb 0x14006939b
xor edx, edx
mov word [rbp - 8], si
mov dword [rsp - 0xc], esp
lea rcx, [rbp - 0x1c]
call fcn.14008ade0
xchg rdx, rsp
mov rsp, rax
xchg rdx, rsp
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
mov rsi, rsi
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov r8, r8
cmp rdx, rbx
je 0x14006947b
lea rdx, [0x140142830]
mov rcx, r8
xchg r15, r15
call fcn.140071e40
test al, al
setne al
jmp 0x14006947b
mov al, 0x1d
xor al, 0x51
sub al, 0x2b
add al, 0x2b
xor al, 0x4d
xchg rbx, rbp
mov rbp, qword [rsp + 0x68]
xchg rbp, rbx
mov rsi, qword [rsp + 0x70]
xchg rsp, rsp
mov rdi, qword [rsp + 0x78]
nop
add rsp, 0xbe15a39
sub rsp, 0xbe159e9
pop rbp
ret
Function at 0x1400694a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg rsi, r14
push rbp
mov r8, r8
push rdi
push r14
mov rbp, rsp
nop
sub rsp, 0x12d38181
add rsp, 0x12d38131
movabs rsi, 0x648463811e7df0b2
xor rsi, 0x1519fa3
add rsi, 0x90f50f7
xor rsi, 0x419d091e
sub rsi, 0x136da6a3
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
cmp qword [rcx + 0x20], rsi
mov dword [rsp - 0xc], ecx
jne 0x1400696bd
mov edi, 0x147e1d36
xor edi, 0x1210bf28
add edi, 0x317dcd37
sub edi, 0x37ec6f54
mov dword [rbp - 0x30], 0x7a45c76
add dword [rbp - 0x30], 0x41f2f95c
sub dword [rbp - 0x30], 0x3b2641be
xor dword [rbp - 0x30], 0x4be2b8e1
sub dword [rbp - 0x30], 0x4592ac40
xor r14d, r14d
xchg rcx, rcx
mov dword [rbp - 0x2c], 0x6a8d0b81
xor dword [rbp - 0x2c], 0x146dab61
sub dword [rbp - 0x2c], 0x13c1cf32
sub dword [rbp - 0x2c], 0x6ac0d148
mov dword [rbp - 0x28], 0x6fb5185f
xor dword [rbp - 0x28], 0x560f03b5
sub dword [rbp - 0x28], 0xfb9c4ca
add dword [rbp - 0x28], 0x37026050
sub dword [rbp - 0x28], 0x60a8b6e6
mov dword [rbp - 0x24], 0x54727847
sub dword [rbp - 0x24], 0x312407b8
add dword [rbp - 0x24], 0x34a0011c
sub dword [rbp - 0x24], 0x57d2717a
lea eax, [rdi + 0x6e]
mov dword [rbp - 0x20], 0x7b3dd059
sub dword [rbp - 0x20], 0x4245f6ce
add dword [rbp - 0x20], 0x1beec154
sub dword [rbp - 0x20], 0x54e19a5d
mov word [rbp - 0x1c], ax
mov r9, r9
xchg r14, rsi
mov qword [rbp + 0x20], rsi
xchg rsi, r14
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x38], ecx
xchg r11, rcx
mov r11, qword [rbp + 0x20]
xchg r11, rcx
xchg rcx, rax
mov rcx, qword [rbp + 0x20]
xchg rcx, rax
and cl, 3
mov dword [rsp - 0x3c], ebp
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x7f489dbe
sub eax, 0x5d036158
xor eax, 0x4de59ec5
xor eax, 0x4737904e
xor eax, 0x1a945b0b
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x18], 0x5e2b47b0
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x30], esp
add rax, rdi
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x40], ebp
cmp rax, 0xb
jb 0x1400695dd
xor edx, edx
mov word [rbp - 4], r14w
mov dword [rsp - 0x30], ecx
lea rcx, [rbp - 0x1a]
call fcn.14008ade0
mov rdx, rax
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x1c], edi
xor rdx, rsi
xchg r8, rdx
mov rdx, rax
xchg rdx, r8
xor eax, eax
mov qword [rbx + 0x20], rdx
mov r12, r12
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rsi
mov dword [rsp - 0x20], 0x42ce98cc
je 0x1400696d6
lea rdx, [0x140142298]
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.1400721ac
xchg rsp, rsp
test al, al
setne al
jmp 0x1400696d6
mov eax, 0x32b16331
xor eax, 0x69ab4b82
sub eax, 0x1e2a740e
add eax, 0x3234bcaf
sub eax, 0x6f247153
lea r11, [rsp + 0x50]
mov r11, r11
xchg rbx, r12
mov r12, qword [r11 + 0x28]
xchg rbx, r12
xchg rsi, r8
mov r8, qword [r11 + 0x30]
xchg rsi, r8
mov rsp, r11
pop r14
mov dword [rsp - 0x2c], ebp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
xchg rbp, rbp
ret
Function at 0x140073e40
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
push rdx
mov qword [rsp], rdi
nop
add rsp, 0x55c4deff
sub rsp, 0x55c4df5f
lea rax, [rcx + 8]
mov dword [rsp - 0x24], 0x393d95ba
mov qword [rsp + 0x70], rbx
xchg r12, rax
mov qword [rcx], r12
xchg r12, rax
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
xchg rbp, rsi
mov qword [rsp + 0x78], rsi
xchg rsi, rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x44], edi
movups xmmword [rax + 0x20], xmm0
xchg rbp, rax
movups xmmword [rbp + 0x30], xmm0
xchg rbp, rax
xchg rdi, rax
movups xmmword [rdi + 0x40], xmm0
xchg rdi, rax
xchg r11, rax
movups xmmword [r11 + 0x50], xmm0
xchg r11, rax
movups xmmword [rax + 0x60], xmm0
mov dword [rsp - 0xc], edi
xchg rcx, rax
movups xmmword [rcx + 0x70], xmm0
xchg rcx, rax
xchg rsi, rbp
mov rsi, qword [rdx + 0x38]
xchg rsi, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x40], esi
mov rbx, qword [rdx]
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
xchg rsp, rbx
movups xmmword [rbx + 0x28], xmm0
xchg rsp, rbx
lea rdx, [rbp + 1]
mov dword [rsp - 0x44], 0x4a2b14b2
xchg r12, rsp
movups xmmword [r12 + 0x38], xmm0
xchg rsp, r12
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x3c], 0x7e15e98f
call fcn.140017bbc
mov edx, 0x257fd14e
xor edx, 0x2074e00d
add edx, 0x3133d987
xor edx, 0x43c632c
test rbp, rbp
mov dword [rsp - 0x2c], 0x42dc264
je 0x140073fb3
mov rdi, rax
sub rbx, rax
mov rbp, rbp
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
mov r8d, 0x52c8f807
sub r8d, 0xa84098
xor r8d, 0x262867cd
sub r8d, 0x5f48a92c
xor r8d, 0x14c02789
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg rdx, rdx
and cx, r8w
ror edx, 1
ror edx, 6
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rcx, rcx
mov word [rdi - 2], cx
sub r9, 1
jne 0x140073f88
xor ecx, ecx
mov dword [rsp - 0x30], 0x55e14a2
xchg rbp, r8
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
mov dword [rsp - 0x28], ebx
xchg r14, rsi
mov rcx, r14
xchg r14, rsi
mov rdx, qword [rsp + 0x20]
mov rsi, rsi
call fcn.140090b00
xchg rcx, r12
mov r12, qword [rsp + 0x20]
xchg r12, rcx
lea rax, [rsp + 0x28]
xchg r12, rbp
mov r12, qword [rsp + 0x78]
xchg rbp, r12
xchg rbp, rbx
mov rbp, qword [rsp + 0x70]
xchg rbp, rbx
cmp rcx, rax
jne 0x140074074
xor eax, eax
mov dword [rsp - 0x1c], 0x1aa3190f
lea rdi, [rsp + 0x28]
mov ecx, 0x5ca6ce94
sub ecx, 0x33d509f0
sub ecx, 0x3fcc17e
xor ecx, 0x24d50316
rep stosb byte [rdi], al
mov dword [rsp - 0x24], 0x3a64bdd6
xchg rsi, rdx
mov rax, rdx
xchg rsi, rdx
xchg r12, rsi
mov r12, qword [rsp + 0x80]
xchg r12, rsi
nop
sub rsp, 0x23cbf02c
add rsp, 0x23cbf08c
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098600
xchg r15, r15
xchg rcx, rsi
mov rax, rcx
xchg rcx, rsi
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
mov dword [rsp - 0x14], 0x5d51b3b0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007e9a4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001900]
mov r13, r13
sub r10, rcx
xchg rcx, rbp
mov r8, rbp
xchg rcx, rbp
lea rax, [r9 + r8]
mov ecx, r9d
mov rbx, rbx
mov edx, 0x18b9ab4c
add edx, 0x28e768d1
sub edx, 0x17500e10
xor edx, 0x17860e2a
inc r9
mov rdi, rdi
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov rbp, rbp
jb 0x14007e9bd
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x14007f890
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
mov qword [rsp + 8], rcx
mov rdi, rdi
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push rdx
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
mov dword [rsp - 0x24], 0x56ef8bc5
xchg rcx, r12
mov rbx, r12
xchg r12, rcx
mov r13d, r8d
xchg r10, r10
mov r9d, 0x2b5af0cf
add r9d, 0x4dc21603
xor r9d, 0x689682fc
add r9d, 0x267ab6d3
xor r9d, 0x38023b01
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff0a03e873
sub rcx, 0x891b848
sub rcx, 0x2866ba
add rcx, 0x1ebc0816
add rcx, 0x7fffffff
add rcx, 0x5ffa2e79
popf
pushf
mov eax, 0x19de95ed
add eax, 0x2f5c42ed
xor eax, 0xc8bf048
xor eax, 0x45b12896
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x3c], esp
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400984a0
xchg r12, r12
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0xa
shr r15d, 7
shr r15d, 1
shr r15d, 1
shr r15d, 1
xchg r15, rax
mov rbp, r15
xchg r15, rax
mov eax, dword [rbx + 0x18]
xchg rbp, rbp
mov ebx, 0x62aa4c1a
xor ebx, 0x5f2c8ab5
add ebx, 0x20d237fb
xor ebx, 0x7a718952
sub ebx, 0x242977f7
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x2c], edx
test r15d, r15d
je 0x14007fac4
mov eax, 0x4850ab53
xor eax, 0x513beec
sub eax, 0x212b2f4b
xor eax, 0x12ec3fac
sub eax, 0x3eebd9d8
xchg rsi, rcx
mov rsi, qword [rsp + 0x60]
xchg rsi, rcx
mov r14d, esi
shl r14d, 0x14
mov dword [rsp - 0x3c], edi
mov edi, r13d
sub edi, r14d
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
cmp edi, eax
cmova edi, eax
mov r8d, edi
xchg r8, r8
call fcn.1400928f0
test al, al
je 0x14007fac2
shr edi, 2
mov r8, r8
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
mov dword [rsp - 0x40], 0x3f523b89
je 0x14007fa97
mov r15d, dword [rsp + 0x70]
xchg r13, r9
mov r13, rbp
xchg r13, r9
lea eax, [r14 + r8]
xchg rbx, rbx
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov rdx, rdx
xor edx, 0x691058b1
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
xchg r11, r11
cmp r8d, edi
jb 0x14007fa65
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov rcx, rcx
mov eax, 0x2dae6c63
add eax, 0x1fe2a319
sub eax, 0x2e6a5d6
xor eax, 0x4aba69a6
cmp esi, r15d
jb 0x14007f9fb
mov dword [rsp - 0x14], ebp
jmp 0x14007fac4
xor bl, bl
xchg r14, rbp
mov rcx, r14
xchg r14, rbp
call fcn.1400984b0
xchg rsi, rsi
mov al, bl
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
nop
sub rsp, 0x41d8a3a0
add rsp, 0x41d8a3c0
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140080374
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rbp, rdx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x44], 0x54a5616d
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg rcx, rbx
mov r15, rbx
xchg rbx, rcx
mov r14d, r8d
mov r9d, 0x687eab1a
sub r9d, 0x59b71ee4
xor r9d, 0x66a965b1
xor r9d, 0x2266eb9d
xor r9d, 0x4a0c021a
xchg r15, r12
mov r15, rdx
xchg r15, r12
cmp r8d, r9d
mov dword [rsp - 0x18], 0x21106e6c
pushf
movabs rcx, 0xffffffff1147b3fa
add rcx, 0x6124e0e6
sub rcx, 0x56ed3d16
xor rcx, 0x76a2b850
add rcx, 0x7fffffff
xor rcx, 0x12221066
popf
pushf
mov eax, 0x22faed46
add eax, 0x1cd01bc
add eax, 0x9ddece5
xor eax, 0x469306e9
sub eax, 0x6836dd0a
popf
cmovb r9d, r14d
mul r9
cmovo rax, rcx
xchg r12, r12
xchg rcx, r10
mov r10, rax
xchg rcx, r10
call fcn.1400984a0
mov dword [rsp - 0x40], edx
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xe
shr ebp, 5
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x28], ebx
xchg rdx, rsi
mov rdx, rax
xchg rdx, rsi
mov ebx, 0x49e1f3e5
xor ebx, 0x36ecaf29
xor ebx, 0xd0b005
sub ebx, 0x23458cd8
sub ebx, 0x5c985ff0
test ebp, ebp
xchg r15, r15
je 0x1400805a6
mov eax, 0x4573fc41
sub eax, 0x1466993b
xor eax, 0x6aeac3
xor eax, 0x326399d9
xor eax, 0x314101c
mov r9d, edi
mov r8d, r14d
mov dword [rsp - 0x2c], 0x365493f2
shl r9d, 0xc
shl r9d, 8
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x2c], ebx
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x2c], 0x527b54f3
xor r10d, r10d
shr r11d, 2
test r11d, r11d
je 0x140080552
mov dword [rsp - 0x28], 0x726c4cd2
xchg rsi, rbx
mov rdx, rbx
xchg rsi, rbx
lea ecx, [r9 + r10]
mov eax, r13d
xor eax, dword [r12 + rcx*4]
xchg rcx, rcx
add r10d, ebx
xor eax, 0x691058b1
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [rsp - 0x28], ebx
cmp r10d, r11d
jb 0x140080529
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
mov rcx, r15
mov dword [rsp - 0x10], 0x642382e6
call fcn.140092d60
test al, al
je 0x1400805a1
mov rdi, rdi
add edi, ebx
mov eax, 0x3b954691
add eax, 0x4187f0e9
sub eax, 0x6d913aeb
sub eax, 0xf7bfc8f
cmp edi, ebp
jb 0x1400804d5
mov dword [rsp - 0x3c], 0x555bed42
jmp 0x1400805a6
xor bl, bl
xchg r12, r12
xchg r9, rcx
mov r9, rsi
xchg r9, rcx
call fcn.1400984b0
mov dword [rsp - 0x40], ebx
xchg rbx, rbp
mov rbx, qword [rsp + 0x58]
xchg rbp, rbx
mov al, bl
xchg rbx, r12
mov r12, qword [rsp + 0x50]
xchg rbx, r12
xchg r9, rsi
mov r9, qword [rsp + 0x60]
xchg r9, rsi
nop
sub rsp, 0x275f4e63
add rsp, 0x275f4e83
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083010
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdi
mov qword [rsp + 0x10], rdi
xchg rbp, rdi
mov qword [rsp + 0x18], rsi
xchg rsp, rsp
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x48cf81d3
add rsp, 0x48cf81b3
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x44], ebx
mov rdi, rdx
xchg rbx, rsi
mov rbx, rcx
xchg rsi, rbx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140084d60
mov rsi, rsi
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rsi, rsi
xchg r10, r11
mov r11, rax
xchg r10, r11
mov ebx, r14d
test ebp, ebp
je 0x1400831e5
xchg rbx, rbx
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x10], ecx
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov r10, r10
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x14], 0x77fa52af
jae 0x140083125
mov eax, dword [rdx + 8]
test eax, eax
jne 0x1400830e3
mov dword [rsp - 0xc], 0x42212994
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x24], ebx
jb 0x140083104
add eax, r9d
cmp r11d, eax
jb 0x1400831a3
mov dword [rsp - 0x14], esp
inc r8w
nop
sub rdx, 0x7d3a41d8
add rdx, 0x7d3a4200
cmp r8w, cx
mov dword [rsp - 0x20], ebx
jb 0x1400830cd
mov r8, r14
mov eax, dword [r10 + 4]
xchg rdx, rdx
lea r9, [r10 + 4]
add rax, 0xfffffffffffffff8
nop
add r10, 0x7acf33e4
sub r10, 0x7acf33dc
shr rax, 1
test eax, eax
je 0x1400831d7
mov dword [rsp - 0x40], 0x48efd4ad
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov dword [rsp - 0x1c], 0x4a6e4abb
mov ecx, eax
shr ecx, 1
shr ecx, 5
shr ecx, 3
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x1400831bd
xchg r12, r12
cmp ecx, 0xa
jne 0x1400831c9
and eax, 0xfff
xchg rbp, rbp
add qword [rax + r8], rdi
jmp 0x1400831c9
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x14], 0x738f8fbb
add r8, r11
jmp 0x140083128
and eax, 0xfff
add dword [rax + r8], edi
xchg r13, r13
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x140083161
add ebx, dword [r9]
xchg r10, r10
cmp ebx, ebp
jb 0x140083095
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x28], edi
mov rsi, qword [rsp + 0x40]
xchg rbp, rdi
mov rbp, qword [rsp + 0x48]
xchg rbp, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
ret