joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov r10, r10
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x240
mov dword [rsp - 0x18], 0x3d20a2b4
xchg rbx, r15
mov r15, rdx
xchg r15, rbx
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
mov dword [rsp - 0x34], ebx
lea rcx, [rsp + 0x30]
mov r8d, 0x78cd564e
sub r8d, 0x21c64098
add r8d, 0x156c456e
xor r8d, 0x6c73592c
call fcn.140098cd0
xchg rdi, rdi
mov rax, qword gs:[0x60]
xchg r8, rsp
mov rsp, qword [rax + 0x18]
xchg rsp, r8
xchg r13, rax
mov r13, qword [r8 + 0x10]
xchg r13, rax
xchg r8, rsp
mov rsp, qword [rax]
xchg rsp, r8
test r8, r8
mov dword [rsp - 0x3c], 0x2a15397
je 0x14007c66f
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x34], edi
je 0x14007c66f
mov edx, 0x3ce8c14e
sub edx, 0x375ac403
add edx, 0x14e02c64
xor edx, 0x1a6e28ab
lea rcx, [rsp + 0x30]
mov r9d, 0xf9aa515
sub r9d, 0x56615de
sub r9d, 0x4d4817b
xor r9d, 0x30a9d67f
xor r9d, 0x35c9dac0
call fcn.1400996c0
mov dword [rsp - 0xc], 0x252575a1
mov edx, 0x5572b14b
sub edx, 0x83ac00b
sub edx, 0x4208cc86
add edx, 0x4c2d4a08
xor edx, 0x575c6e9e
lea rcx, [rsp + 0x30]
call fcn.140099790
mov dword [rsp - 0x24], 0x22304d7b
test rax, rax
je 0x14007c638
xor ecx, ecx
mov dword [rsp - 0x40], esp
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
movabs rcx, 0x4bde4a7217817d59
sub rcx, 0xec5e90c
add rcx, 0x372de1df
add rcx, 0x7037c5
add rcx, 0x7fffffff
add rcx, 0x32a8e1c5
mov rax, qword [0x1404a7370]
not rax
xchg r12, r12
add rax, rcx
movabs rcx, 0x1627ffc0196ff71c
xor rcx, 0x551f3679
xor rcx, 0x4f7b1a3c
add rcx, 0x5a5f073
add rcx, 0x7fffffff
sub rcx, 0x327b7b4
xor rax, rcx
mov dword [rsp - 0x38], 0x55a120fe
lea rcx, [rsp + 0x20]
rol rax, 0x11
rol rax, 5
rol rax, 0xe
rol rax, 0xb
rol rax, 2
rol rax, 1
call rax
mov rax, qword [0x1404a7360]
mov dword [rsp - 0x3c], 0x29b9ddee
lea r8, [rsp + 0x20]
movabs rcx, 0x7af18a3930467cab
add rcx, 0x6f7889d
add rcx, 0x1122a77c
xor rcx, 0x6be0c764
add rcx, 0x7fffffff
xor rcx, 0x46b252d
lea rdx, [rsp + 0x260]
xchg r10, r10
xor rax, rcx
xchg rbx, rbp
mov r9, rbp
xchg rbx, rbp
ror rax, 4
ror rax, 1
ror rax, 2
ror rax, 3
ror rax, 1
movabs rcx, 0x737949446b667589
xor rcx, 0x4301291a
add rcx, 0x4959dba4
add rcx, 0x7fffffff
sub rcx, 0x133490f0
not rax
mov dword [rsp - 0x34], 0x77c4484
add rax, rcx
lea rcx, [rsp + 0x30]
call rax
mov rbx, qword [rsp + 0x250]
xchg rdx, rdx
add rsp, 0x6b876091
sub rsp, 0x6b875e51
pop rdi
mov dword [rsp - 0x20], ebx
ret
mov eax, 0x15a598e0
add eax, 0x65a0c61d
sub eax, 0x10386e48
xor eax, 0xab0df0b4
xchg rcx, rbx
mov rcx, qword [rsp + 0x250]
xchg rcx, rbx
add rsp, 0x240
mov dword [rsp - 0x34], esp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x6358d6e3
xor eax, 0x4859ef64
add eax, 0x3a776c05
sub eax, 0x231bf46c
xor eax, 0x825cb015
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
ret
Function at 0x14007c6a0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov r8d, edx
mov qword [rsp + 0x40], 0x5a9e1f7e
sub qword [rsp + 0x40], 0x52bffa08
add qword [rsp + 0x40], 0x5a126566
xor qword [rsp + 0x40], 0x61f08adc
lea rdx, [rsp + 0x40]
mov dword [rsp - 0x24], edi
call fcn.14007c3a0
test eax, eax
jns 0x14007c7c4
mov rdx, qword [0x1404a73b0]
mov dword [rsp - 0x38], 0x10c5ed73
movabs rcx, 0xb6b912653d6ce0a
add rcx, 0x568c52
add rcx, 0x8ff4818
xor rcx, 0x54a1729a
not rdx
xchg r10, r10
rol rdx, 0xc
rol rdx, 0x1a
rol rdx, 3
rol rdx, 2
rol rdx, 1
not rdx
mov dword [rsp - 0x30], 0x2959c24
sub rdx, rcx
mov ecx, eax
call rdx
xchg rsp, rsp
mov rcx, qword [0x1404a7128]
movabs rdx, 0xd9cd187a0a1323d3
add rdx, 0x63bc944f
xor rdx, 0x1decb5ef
sub rdx, 0x344edd86
rol rcx, 0xd
rol rcx, 0xf
rol rcx, 1
rol rcx, 1
rol rcx, 1
add rdx, rcx
movabs rcx, 0x6427ad0661edf96a
sub rcx, 0x253893a5
add rcx, 0x31071d23
sub rcx, 0x4f2a7a5d
add rcx, 0x7fffffff
add rcx, 0x6033ff03
rol rdx, 0x2f
rol rdx, 2
rol rdx, 2
rol rdx, 2
rol rdx, 1
not rdx
mov r14, r14
add rdx, rcx
mov ecx, eax
call rdx
xchg r14, rax
mov r14, qword [rsp + 0x40]
xchg r14, rax
sub rsp, 0xffffffffffffffd8
ret
Function at 0x1400820b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
xchg rdx, rdx
xchg rcx, r14
mov rdi, r14
xchg r14, rcx
mov rsi, r8
lea rcx, [rsp + 0x40]
xchg rcx, rcx
movzx ebx, dl
call fcn.140083920
mov byte [rsp + 0x38], 0x56
add byte [rsp + 0x38], 0x1d
sub byte [rsp + 0x38], 0x1c
xor byte [rsp + 0x38], 0x79
sub byte [rsp + 0x38], 0x2e
lea rcx, [rsp + 0x40]
mov eax, 0x56c99cd
add eax, 0x1cf1840d
xor eax, 0x10f587c0
add eax, 0x164e4e98
sub eax, 0x48f9e8b0
mov dword [rsp + 0x30], 0x252373f4
add dword [rsp + 0x30], 0x14e1ac33
xor dword [rsp + 0x30], 0x2c76679a
add dword [rsp + 0x30], 0x59475b1f
sub dword [rsp + 0x30], 0x6fbaa2db
mov r9d, 0x61c93066
sub r9d, 0x9124c6
add r9d, 0x161e0f23
sub r9d, 0x5530f2c9
sub r9d, 0x2225277a
mov dword [rsp + 0x28], 0x3f557258
add dword [rsp + 0x28], 0x1d806f35
xor dword [rsp + 0x28], 0x5ad650d3
add dword [rsp + 0x28], 0x57c51429
sub dword [rsp + 0x28], 0x5dc8c584
test bl, bl
xchg r13, r13
pushf
mov dword [rsp + 0x22], 0x4a31f7d6
sub dword [rsp + 0x22], 0x820c62b
add dword [rsp + 0x22], 0x203aa2d8
xor dword [rsp + 0x22], 0x2db6a235
xor dword [rsp + 0x22], 0x4ffd76b6
popf
pushf
mov r8d, 0x4c7cce9d
xor r8d, 0xd4c4fb6
add r8d, 0x6965b67
xor r8d, 0x43920f47
add r8d, 0xbab2c2b
popf
xchg rdi, rcx
mov rdx, rcx
xchg rcx, rdi
cmovne r9d, eax
call fcn.140084520
mov dword [rsp - 0x18], 0x483d3173
movzx ebx, al
test rsi, rsi
je 0x140082228
mov dword [rsp - 0x14], 0x76e91017
lea rcx, [rsp + 0x40]
call fcn.140084510
mov dword [rsi], eax
mov dword [rsp - 0x28], 0x2ac95913
lea rcx, [rsp + 0x40]
call fcn.140083940
mov rsi, qword [rsp + 0x78]
movzx eax, bl
xchg rsp, rsp
mov rbx, qword [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a8114], 0
jne 0x140083919
mov dword [rsp - 0x2c], 0x1b2f4b48
xor edx, edx
lea r8, [0x1404a8110]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x18], ebp
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
xchg r14, r14
shr eax, 1
neg ecx
and ecx, 0xedb88320
xchg rdx, rdx
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov rbp, rbp
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], ebp
xor eax, ecx
mov ecx, eax
shr eax, 1
mov r12, r12
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg r13, r13
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg r14, r14
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x1c], ebx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov rbp, rbp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x1c], ebx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r12, r12
shr eax, 1
and ecx, 1
neg ecx
xchg r12, r12
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov r9, r9
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x3c], esi
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140083848
xchg rsi, rsi
ret
Function at 0x1400883b3
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push rdx
mov qword [rsp], r15
nop
sub rsp, 0x8f4f9c
add rsp, 0x8f4f74
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
mov r13d, r8d
mov dword [rsp - 0x1c], esp
mov edx, 0x6dcdf94e
sub edx, 0x124097e9
sub edx, 0x11abdb33
xor edx, 0x5b938e9a
xor edx, 0x127608a8
cmp r8d, edx
jae 0x1400883c5
mov edx, r13d
xchg rsp, rsp
nop
movabs rcx, 0xffffffff18166a1a
xor rcx, 0x6fe17511
sub rcx, 0x2af9fca6
add rcx, 0x1121dafa
add rcx, 0x7fffffff
add rcx, 0x21e102a1
mov eax, 0x7b7c2e88
sub eax, 0x2ce5db7b
add eax, 0x19735f22
sub eax, 0x6809b22b
mul rdx
cmovb rax, rcx
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.1400985f0
mov dword [rsp - 0x28], 0x72a41b0d
mov r15, rax
mov byte [rsp + 0x70], 0xa
add byte [rsp + 0x70], 0x2f
add byte [rsp + 0x70], 0x22
sub byte [rsp + 0x70], 0x5a
mov rax, qword [rsp + 0x60]
lea r12d, [r13 + 0xfffff]
xor esi, esi
mov r9, r9
shr r12d, 8
shr r12d, 4
shr r12d, 8
mov ebp, dword [rax + 0x18]
mov dword [rsp - 0x38], ecx
test r12d, r12d
je 0x14008858a
xchg r13, rbx
mov qword [rsp + 0x68], r13
xchg rbx, r13
mov ecx, 0x756fffaf
sub ecx, 0x1fd8dd35
sub ecx, 0x1d031297
xor ecx, 0x38840fe3
mov qword [rsp + 0x20], rdi
mov edi, esi
mov dword [rsp - 0x34], 0x59e488d2
mov ebx, r13d
shl edi, 0xa
shl edi, 0xa
xchg rdx, r8
mov r8, r15
xchg rdx, r8
sub ebx, edi
mov dword [rsp - 0x40], 0x619bc836
cmp ebx, ecx
cmova ebx, ecx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
mov r8d, ebx
xchg r8, r8
call fcn.140085080
test al, al
je 0x140088561
mov dword [rsp - 0x18], 0x22d2757c
shr ebx, 2
xor eax, eax
shr edi, 2
test ebx, ebx
mov rcx, rcx
je 0x140088521
mov r9, r15
lea ecx, [rdi + rax]
mov dword [rsp - 0x24], edx
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
mov dword [rsp - 0xc], 0x4e4e57c8
xor r8d, 0x2dbe645e
inc eax
mov dword [r14 + rcx*4], r8d
mov rbp, rbp
cmp eax, ebx
jb 0x1400884f0
xchg rbx, rax
mov rbx, qword [rsp + 0x60]
xchg rbx, rax
inc esi
mov dword [rsp - 0x20], 0x45c4ed1a
mov ecx, 0x67dcaa14
sub ecx, 0x943aee
sub ecx, 0x15d49b62
sub ecx, 0x5163d3c4
cmp esi, r12d
jb 0x14008848d
mov dword [rsp - 0x28], 0x5f6047bf
jmp 0x14008857a
mov byte [rsp + 0x70], 0x72
sub byte [rsp + 0x70], 0x52
sub byte [rsp + 0x70], 3
sub byte [rsp + 0x70], 5
sub byte [rsp + 0x70], 0x18
mov rbx, qword [rsp + 0x68]
xchg rdi, r14
mov r14, qword [rsp + 0x20]
xchg rdi, r14
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.140098600
movzx eax, byte [rsp + 0x70]
xchg r15, r15
add rsp, 0x28
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
xchg rsp, rsp
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x38], esp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400885e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rdi, rbp
mov qword [rsp + 0x10], rdi
xchg rbp, rdi
mov qword [rsp + 0x20], rsi
mov dword [rsp - 0x28], esi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
xchg r9, r9
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
mov r14d, r8d
mov r13, r13
xchg rdi, rbx
mov rbx, rdx
xchg rdi, rbx
mov r9d, r14d
mov r13, rcx
mov dword [rsp - 0x38], ebx
cmp r8d, 0x40000
jb 0x140088676
mov r9d, 0x2ff27778
xor r9d, 0x7752007d
sub r9d, 0x41f378c2
sub r9d, 0xa527d83
sub r9d, 0xc5680c0
nop
movabs rcx, 0xffffffff1a2c8198
xor rcx, 0x669f5c34
xor rcx, 0xb2fc2ca
add rcx, 0x7fffffff
add rcx, 0x863e09a
mov eax, 0x3fa7f1f
add eax, 0x155bf76
add eax, 0x272e2ce8
xor eax, 0x2c7e6b79
mul r9
cmovb rax, rcx
mov rsp, rsp
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400985f0
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
xchg rbp, rbp
shr r15d, 7
shr r15d, 0xc
shr r15d, 1
xor ebx, ebx
xchg rsp, rsp
xchg rbp, rdx
mov rdx, rax
xchg rdx, rbp
mov r12b, 0x46
xor r12b, 0x20
add r12b, 0x17
sub r12b, 0x12
sub r12b, 0x6a
test r15d, r15d
xchg r8, r8
je 0x14008880f
nop
mov r8d, ebx
mov r9, r9
mov r10d, r14d
shl r8d, 0xe
shl r8d, 5
shl r8d, 1
xor eax, eax
xchg rbp, rbp
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov dword [rsp - 0x38], esi
jbe 0x14008877d
mov r10d, 0x6f3b16a
add r10d, 0x2ff79404
xor r10d, 0xb2cb9a8
xor r10d, 0x3dd7fcc6
mov r11d, 0x61922a81
sub r11d, 0x323ba255
sub r11d, 0x2ec35cb4
xor r11d, 0x972b78
jmp 0x140088795
mov r11d, r10d
shr r11d, 2
test r11d, r11d
mov dword [rsp - 0x34], 0x649066a5
je 0x1400887d2
xchg rbp, r12
mov r9, r12
xchg r12, rbp
nop dword [rax]
lea edx, [r8 + rax]
mov dword [rsp - 0x34], ebp
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
mov dword [rsp - 0x14], ebx
xor ecx, 0x2dbe645e
inc eax
mov dword [r9 - 4], ecx
xchg r13, r13
cmp eax, r11d
jb 0x1400887a5
mov r8d, r10d
xchg rdx, r14
mov r14, rbp
xchg r14, rdx
mov rcx, r13
mov r10, r10
call fcn.1400855e0
test al, al
je 0x14008880c
mov dword [rsp - 0x3c], 0x2fcf70c6
inc ebx
cmp ebx, r15d
jb 0x14008870f
xchg r12, r12
jmp 0x14008880f
xor r12b, r12b
xchg rbp, r12
mov rcx, r12
xchg rbp, r12
call fcn.140098600
mov dword [rsp - 0x44], esp
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
mov rbp, qword [rsp + 0x58]
mov dword [rsp - 0x24], ebp
mov rsi, qword [rsp + 0x68]
nop
sub rsp, 0x7703b48e
add rsp, 0x7703b4ae
pop r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140088870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r9
mov qword [rsp + 0x18], r9
xchg r9, rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov eax, 0xb216215
xor eax, 0x16901c6d
add eax, 0x1f71d473
xor eax, 0x3d2342cb
call fcn.14009a3e0
mov r8, r8
sub rsp, rax
xchg rcx, r15
mov rcx, r15
xchg r15, rcx
call fcn.14009a2a0
mov ebp, eax
and ebp, 0x3fc
xchg rdi, rdi
jbe 0x14008891c
lea rdi, [rsp + 0x20]
mov esi, ebp
mov dword [rsp - 0x40], 0x335fa932
call fcn.14009a2a0
movzx ebx, ax
shl ebx, 5
shl ebx, 1
shl ebx, 0xa
call fcn.14009a2a0
mov dword [rsp - 0x18], esp
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
mov r12, r12
sub rsi, 1
jne 0x1400888ea
lea r14d, [rbp*4]
mov eax, 0x6454776d
sub eax, 0x597ddbf2
add eax, 0x5720adc7
xor eax, 0x61f74946
mov ecx, r14d
mul rcx
xchg rdi, rdi
pushf
movabs rcx, 0xffffffff6f35c396
sub rcx, 0x50a1a06c
xor rcx, 0x7762829d
sub rcx, 0xb6ad893
add rcx, 0x7fffffff
add rcx, 0x217436dc
popf
cmovb rax, rcx
mov dword [rsp - 0x40], ebp
xchg r12, rcx
mov r12, rax
xchg rcx, r12
call fcn.1400985f0
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
mov dword [rsp - 0x30], 0x45ff71a1
shr ebp, 2
shr ebp, 9
shr ebp, 8
shr ebp, 1
xor ebx, ebx
xchg r12, r12
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov r12b, 0x42
sub r12b, 0x42
add r12b, 0xb
xor r12b, 0x2c
xor r12b, 0x26
test ebp, ebp
mov dword [rsp - 0x3c], edx
je 0x140088ad8
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x10], 0x71f7f96b
shl r8d, 0x10
shl r8d, 3
shl r8d, 1
xor eax, eax
mov rbx, rbx
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
xchg rsi, rsi
jbe 0x140088a53
mov r10d, 0x21f3d549
add r10d, 0x3bd9030a
xor r10d, 0x78812b96
sub r10d, 0x23d3363f
sub r10d, 0x16abd86
mov r11d, 0x5b42f5e8
xor r11d, 0x5d4f476e
add r11d, 0x32d774b6
sub r11d, 0x1d6822d8
xor r11d, 0x1b790464
jmp 0x140088a66
mov r11d, r10d
xchg rsi, rsi
shr r11d, 2
test r11d, r11d
je 0x140088aa4
xchg rdi, rsi
mov r9, rdi
xchg rdi, rsi
nop dword [rax]
lea edx, [r8 + rax]
mov ecx, edi
xchg r11, r11
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
xor ecx, 0x2dbe645e
inc eax
mov dword [rsp - 0x28], ebx
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x140088a76
mov dword [rsp - 0x30], edi
mov r8d, r10d
xchg rdx, r9
mov r9, rsi
xchg rdx, r9
mov rcx, r15
call fcn.1400855e0
mov r9, r9
test al, al
je 0x140088ad5
inc ebx
cmp ebx, ebp
xchg rdx, rdx
jb 0x1400889d3
jmp 0x140088ad8
xor r12b, r12b
mov rcx, rsi
xchg rbp, rbp
call fcn.140098600
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov dword [rsp - 0x28], esp
xchg rbx, r13
mov r13, qword [r11 + 0x38]
xchg r13, rbx
xchg rbp, r8
mov r8, qword [r11 + 0x40]
xchg r8, rbp
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x44], edi
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov rdi, rdi
ret
Function at 0x14008bd30
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x34], ebx
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg r9, rdi
push rcx
mov qword [rsp], r12
push r13
mov r9, r9
push r14
push r15
movsxd rax, r8d
xchg rsp, rcx
mov r13, rsp
xchg rsp, rcx
xor ecx, ecx
mov dword [rsp - 0x44], ebp
mov r12, r9
xchg rbx, rcx
mov rcx, rdx
xchg rcx, rbx
mov r10d, ecx
mov dword [rsp - 0x3c], 0x23bad79f
lea r11, [rax + rax*2]
shl r11, 1
shl r11, 1
nop word [rax + rax]
mov dword [rsp - 0x1c], ebx
movsxd rax, dword [r12 + r10*4]
mov edi, ecx
mov r9, qword [r13 + 8]
mov r8, r8
add r9, r11
mov dword [r9 + 8], ecx
xchg rsp, rax
mov rcx, rsp
xchg rsp, rax
and eax, 3
mov qword [r9], 0x229c56c5
add qword [r9], 0x58ea505d
xor qword [r9], 0x15f43c6f
sub qword [r9], 0x6e729b4d
lea rsi, [rbx + rax*2]
mov r14, r14
lea rax, [rcx + 1]
and eax, 3
lea r14, [rbx + rax*2]
lea rax, [rcx - 2]
mov dword [rsp - 0x18], 0x14b3f0d4
and eax, 3
lea r15, [rbx + rax*2]
lea rax, [rcx - 1]
and eax, 3
mov r9, r9
lea rbp, [rbx + rax*2]
mov eax, 0x6e24f8d8
xor eax, 0x65ee5b0e
add eax, 0x2b180d43
add eax, 0x18f0c5e3
add eax, 0x5ad733af
mov ecx, edi
mul edi
xchg rdx, rdx
inc edi
shr edx, 1
lea eax, [rdx + rdx*2]
xchg rdx, rdx
movzx edx, word [rsi]
sub ecx, eax
and dx, 1
mov dword [rsp - 0x20], 0x79e4ff5
movsxd rax, ecx
mov ecx, dword [r9 + rax*4]
lea r8, [r9 + rax*4]
mov dword [rsp - 0x1c], 0xb027e8b
movzx eax, dx
add ecx, ecx
or ecx, eax
not dx
mov r10, r10
mov dword [r8], ecx
movzx eax, word [rsi]
shl dx, 0xc
shl dx, 3
shr ax, 1
xchg r9, r9
or dx, ax
mov word [rsi], dx
movzx edx, word [r14]
mov dword [rsp - 0x18], 0x3a5cf29
mov ecx, dword [r8]
and dx, 1
movzx eax, dx
add ecx, ecx
mov r13, r13
or ecx, eax
not dx
mov dword [r8], ecx
movzx eax, word [r14]
xchg r15, r15
shl dx, 0xf
shr ax, 1
or dx, ax
mov word [r14], dx
mov dword [rsp - 0x24], 0x79de1f0d
movzx edx, word [r15]
mov ecx, dword [r8]
and dx, 1
mov dword [rsp - 0x24], 0x74ed117f
movzx eax, dx
add ecx, ecx
or ecx, eax
mov dword [rsp - 0x14], ecx
not dx
mov dword [r8], ecx
movzx eax, word [r15]
xchg rdi, rdi
shl dx, 7
shl dx, 4
shl dx, 2
shl dx, 1
shl dx, 1
shr ax, 1
mov r10, r10
or dx, ax
mov word [r15], dx
movzx edx, word [rbp]
mov ecx, dword [r8]
xchg rdx, rdx
and dx, 1
movzx eax, dx
add ecx, ecx
or ecx, eax
mov dword [rsp - 0x20], 0x1c797ca3
not dx
mov dword [r8], ecx
movzx eax, word [rbp]
shr ax, 1
mov dword [rsp - 0x24], 0xc46b2bf
shl dx, 0xc
shl dx, 1
shl dx, 1
shl dx, 1
or dx, ax
mov dword [rsp - 0x44], esp
mov word [rbp], dx
cmp edi, 0xf
jl 0x14008be17
inc r10
mov rdx, rdx
add r11, 0xc
mov ecx, 0x684f3cb5
sub ecx, 0x4cbb43fe
xor ecx, 0x139d49ff
sub ecx, 0x80eb148
cmp r10, 8
mov dword [rsp - 0x24], 0x73212a61
jl 0x14008bdaa
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xchg rcx, rcx
mov rdi, qword [rsp + 0x40]
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
ret
Function at 0x14008c390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x3c], 0x157c5156
mov ebx, edx
mov r8d, ecx
test ecx, ecx
mov dword [rsp - 0x2c], 0x7eb5f28a
jne 0x14008c3c0
xor eax, eax
xchg rbx, r12
mov r12, qword [rsp + 8]
xchg rbx, r12
ret
xor r10d, r10d
mov dword [rsp - 0x38], 0x400936af
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
nop dword [rax]
mov dword [rsp - 0xc], esi
nop word [rax + rax]
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
mov dword [rsp - 0x24], 0x1ac5096c
mov r9d, eax
test r11b, 1
cmove ecx, edx
xchg rbp, rbp
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
mov dword [rsp - 0x38], 0x5654930d
cmovb r9d, eax
shr r11d, 1
jne 0x14008c3e6
mov r10, r10
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov dword [rsp - 0x2c], 0x72aa00d5
je 0x14008c47d
lea eax, [r11 + r11]
mov ecx, r9d
mov r10, r10
xor ecx, r11d
mov r11d, eax
test dl, 1
mov dword [rsp - 0x40], 0x613bed1d
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
xchg r11, r11
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
jne 0x14008c43c
mov dword [rsp - 0x28], 0x759d0fc
mov r11d, r9d
mov edx, r10d
test r9d, r9d
xchg rsp, rsp
je 0x14008c4d8
nop dword [rax]
nop word [rax + rax]
mov r12, r12
lea eax, [r11 + r11]
mov ecx, edx
xor ecx, r11d
mov r11d, eax
mov dword [rsp - 0x14], 0x56fe2f78
test r9b, 1
cmove ecx, edx
xor r11d, ebx
xchg r8, r8
cmp eax, 0x100
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
mov r15, r15
jne 0x14008c4a0
test edx, edx
je 0x14008c524
mov rdi, rdi
nop word [rax + rax]
mov ecx, r10d
xor ecx, r8d
test dl, 1
mov dword [rsp - 0xc], edx
cmove ecx, r10d
mov r10d, ecx
lea ecx, [r8 + r8]
mov dword [rsp - 0x30], 0x1601c5ae
mov r8d, ecx
xor r8d, ebx
cmp ecx, 0x100
cmovb r8d, ecx
xchg r14, r14
shr edx, 1
jne 0x14008c4e9
mov rbx, qword [rsp + 8]
xchg rdx, rdx
mov eax, r10d
ret
Function at 0x140479350
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
mov qword [rax + 0x10], rbx
mov rsp, rsp
xchg r10, rsi
mov qword [rax + 0x18], r10
xchg rsi, r10
push rdi
mov dword [rsp - 0x18], 0x4f1258a3
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
mov dword [rax - 0x38], 0x4da882f7
sub dword [rax - 0x38], 0x149d117f
add dword [rax - 0x38], 0xaaa33a
xor dword [rax - 0x38], 0x15679bde
sub dword [rax - 0x38], 0x2ca28eee
xor esi, esi
mov dword [rsp - 0x24], edi
mov dword [rax - 0x34], 0x1463d6c3
add dword [rax - 0x34], 0x45284a93
xor dword [rax - 0x34], 0x67e2be7b
xor dword [rax - 0x34], 0x3e609f98
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov dword [rax - 0x30], 0x20f8b4ed
add dword [rax - 0x30], 0xde94661
add dword [rax - 0x30], 0x22e13fcd
sub dword [rax - 0x30], 0x2bd57cb6
sub dword [rax - 0x30], 0x257fbe4b
mov dword [rax - 0x2c], 0x2faa24fd
add dword [rax - 0x2c], 0x39b1530a
sub dword [rax - 0x2c], 0x16444eef
xor dword [rax - 0x2c], 0x532229b1
mov dword [rax - 0x28], 0x137e1d68
add dword [rax - 0x28], 0x3c922081
sub dword [rax - 0x28], 0x4921651d
sub dword [rax - 0x28], 0x6bed887
mov qword [rsp + 0x60], rsi
mov dword [rsp - 0x18], esi
xchg r12, rax
mov r12, qword [rsp + 0x60]
xchg r12, rax
nop dword [rax]
mov dword [rsp - 0x24], 0x1974d654
nop word [rax + rax]
mov rcx, qword [rsp + 0x60]
xchg r11, rax
mov r11, qword [rsp + 0x60]
xchg r11, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x5704b9fe
xor eax, 0x51cee622
add eax, 0x243dfedf
add eax, 0x267efd6e
shr eax, cl
movzx ecx, al
mov rdx, rdx
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
xor cx, dx
xchg r13, r13
mov word [rsp + rax*2 + 0x34], cx
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
mov r12, r12
mov rax, qword [rsp + 0x60]
cmp rax, 0xa
jb 0x14047944c
mov dword [rsp - 0xc], 0x4232c5c8
xor edx, edx
mov word [rsp + 0x48], si
lea rcx, [rsp + 0x34]
call fcn.14007c6a0
xchg rdx, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x210], rax
mov dword [rsp - 0x20], 0x25efce50
xor eax, eax
lea rdi, [rsp + 0x34]
mov ecx, 0x37b40ce1
add ecx, 0x996781
sub ecx, 0x176ac238
xor ecx, 0x2f966d63
sub ecx, 0xf74df3f
rep stosb byte [rdi], al
test r8, r8
xchg r9, r9
je 0x14047957d
lea rdx, [rbx + 0x218]
xchg rbp, rcx
mov rbp, r8
xchg rbp, rcx
call fcn.140479a50
mov dword [rsp - 0x38], 0x2aff146f
test al, al
jne 0x140479575
mov rcx, qword [rbx + 0x210]
mov dword [rsp - 0x34], edx
call fcn.14007eba0
xor al, al
mov qword [rbx + 0x210], rsi
xchg rbx, r8
mov r8, qword [rsp + 0x68]
xchg r8, rbx
mov rsi, qword [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rdi
ret
mov al, 0x49
xor al, 0x6c
sub al, 5
sub al, 0x1f
xchg rdi, rbx
mov rdi, qword [rsp + 0x68]
xchg rbx, rdi
xchg rsi, rcx
mov rcx, qword [rsp + 0x70]
xchg rcx, rsi
sub rsp, 0xffffffffffffffb0
xchg r8, r8
pop rdi
ret
Function at 0x140499ec0
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a80cc]
mov dword [rsp - 0x44], esp
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
syscall
mov dword [rsp - 0x44], ecx
ret
jmp 0x140089e21