joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083b00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
xchg rbp, rbp
nop
push 0x64173291
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x6ede9190
sub rsp, 0x6ede91b0
movzx eax, word [rcx]
mov dword [rsp - 0x28], edx
mov r15d, edx
xor eax, 0xa8323c2
xchg rbx, rsi
mov rbx, rcx
xchg rbx, rsi
cmp eax, 0xa83798f
xchg r15, r15
jne 0x140083cd4
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x30], 0x1e982f0f
xor eax, 0xa8323c2
cmp eax, 0xa836692
jne 0x140083cd4
mov dword [rsp - 0x14], 0x309214dd
mov edx, dword [rdx + rcx + 0x88]
call fcn.140083a30
xchg rcx, r12
mov r12, rsi
xchg r12, rcx
xchg r14, rdi
mov rdi, rax
xchg r14, rdi
mov edx, dword [rax + 0x20]
call fcn.140083a30
xchg r12, r12
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg rdi, rax
mov r12, rdi
xchg rdi, rax
call fcn.140083a30
mov r13, r13
mov edx, dword [r14 + 0x1c]
xchg rbx, rcx
mov rbx, rsi
xchg rcx, rbx
xchg r14, rax
mov r13, r14
xchg r14, rax
call fcn.140083a30
xor edi, edi
mov rbx, rbx
xchg r13, rax
mov qword [rsp + 0x70], r13
xchg r13, rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x10], 0x7ed06b59
jbe 0x140083cd4
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rdi, rdi
xchg rsi, r11
mov rcx, r11
xchg rsi, r11
call fcn.140083a30
mov dword [rsp - 0x14], edi
mov ecx, 0x3e6c48d8
add ecx, 0x1cc58ba0
sub ecx, 0xa67683e
xor ecx, 0xaf3593c5
xchg r12, rax
mov rbx, r12
xchg r12, rax
mov dword [rsp + 0x60], ecx
xchg rsi, rsi
cmp byte [rax], 0
je 0x140083cb6
nop dword [rax]
mov dword [rsp - 0x38], esi
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x777fdd1f
sub r8d, 0x1980e6c8
xor r8d, 0x5d4d5c6d
xor r8d, 0x4998110a
xor r8d, 0x492bbb31
inc rbx
call fcn.14008cc90
xchg r8, r8
cmp byte [rbx], 0
jne 0x140083c6c
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x14], 0x6efe3477
not ecx
cmp ecx, r15d
je 0x140083d13
mov rbx, rbx
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140083c1e
mov dword [rsp - 0x3c], esp
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
mov dword [rsp - 0x18], 0x71d29419
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x1c], ebp
xchg rcx, r9
mov r9, rsi
xchg rcx, r9
xchg rcx, rax
mov rcx, qword [rsp + 0x70]
xchg rcx, rax
mov edx, dword [rax + rdx*4]
call fcn.140083a30
mov dword [rsp - 0x18], 0x4b839d5
jmp 0x140083cd6
Function at 0x140088090
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg r10, rbx
push rdi
nop
sub rsp, 0x143ac77e
add rsp, 0x143ac71e
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x28], ecx
xorps xmm0, xmm0
xchg rsi, r9
mov qword [rsp + 0x70], r9
xchg rsi, r9
xchg rsi, rsp
mov rsp, qword [rcx + 0x38]
xchg rsi, rsp
lea rcx, [rsp + 0x20]
xchg r14, r14
mov qword [rsp + 0x20], rax
xchg r13, rsp
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
xchg rdi, rsp
movups xmmword [rdi + 0x38], xmm0
xchg rdi, rsp
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.140017c38
xchg r8, r8
mov edx, 0x43c9acac
add edx, 0xcc8f652
xor edx, 0x38b30269
sub edx, 0xbf1e392
sub edx, 0x43daa497
test rsi, rsi
mov r8, r8
je 0x14008819f
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x10], edx
xchg rdx, rsi
mov r8, rdx
xchg rsi, rdx
mov r9d, 0x7cba9802
sub r9d, 0x1a1157fd
xor r9d, 0x675c64cc
sub r9d, 0x5f523ca
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x18], ebx
and cx, r9w
ror edx, 6
ror edx, 2
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x10], esp
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008816b
mov dword [rsp - 0x1c], 0x586d9d
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg rbp, rcx
mov rbp, qword [rsp + 0x20]
xchg rbp, rcx
call fcn.140088240
mov r11, r11
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rsi, qword [rsp + 0x70]
xchg rsi, rsi
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140088208
xor eax, eax
xchg r8, r8
lea rdi, [rsp + 0x28]
mov ecx, 0x5bb9aa1e
xor ecx, 0x3a9a452c
xor ecx, 0x6f1de213
sub ecx, 0xe3e0cf1
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x78]
xchg rbx, rbx
add rsp, 0x60
pop rdi
ret
call fcn.140097490
mov eax, ebx
xchg rbx, r8
mov r8, qword [rsp + 0x78]
xchg rbx, r8
nop
sub rsp, 0x14487eff
add rsp, 0x14487f5f
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140089623
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov dword [rsp - 0x3c], 0x7255173f
mov qword [r11 + 0x20], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
mov rbx, qword [rcx]
xchg r9, r9
lea rax, [r11 - 0x40]
xchg rcx, rbp
mov qword [r11 + 8], rcx
xchg rcx, rbp
xorps xmm0, xmm0
xchg rdx, rdx
xchg rbx, rax
mov qword [r11 - 0x48], rbx
xchg rbx, rax
mov ebp, r8d
mov rdi, rdi
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
xchg r15, r15
mov qword [r11 + 0x18], r14
xchg r14, rdx
mov rdx, r14
xchg r14, rdx
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rcx, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x24], 0x5a1c87ee
xchg rsp, rbx
movups xmmword [rbx + 0x38], xmm0
xchg rbx, rsp
xchg rbx, rsp
movups xmmword [rbx + 0x48], xmm0
xchg rsp, rbx
call fcn.140017c38
mov dword [rsp - 0x18], ecx
mov edx, 0x1a9c8d1e
add edx, 0x5849a694
xor edx, 0x6cde8b05
xor edx, 0x20b1b10f
sub edx, 0x2633f14a
test rsi, rsi
je 0x14008973d
mov rdi, rax
mov dword [rsp - 0x18], 0x21416f05
sub rbx, rax
xchg rsi, rdx
mov r8, rdx
xchg rdx, rsi
mov r9d, 0x2e93aca2
add r9d, 0x3b2c6456
xor r9d, 0x6f801e53
xor r9d, 0x49ef5408
sub r9d, 0x4faf59a4
nop word [rax + rax]
mov dword [rsp - 0x24], 0x6b0fd5d1
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov r9, r9
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov rdi, rdi
jne 0x140089716
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rbx, rbx
xchg r14, rdx
mov r14, rdx
xchg rdx, r14
mov rcx, qword [rsp + 0x20]
call fcn.140089820
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0xc], 0x4b9f9d70
mov ebx, eax
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rsi, r15
mov r15, qword [rsp + 0x78]
xchg r15, rsi
xchg r10, rbp
mov r10, qword [rsp + 0x70]
xchg r10, rbp
cmp rcx, rax
jne 0x1400897e7
xor eax, eax
mov dword [rsp - 0x30], edx
lea rdi, [rsp + 0x28]
mov ecx, 0x69545846
add ecx, 0x5892016
xor ecx, 0x4deba153
xor ecx, 0x5b00250d
sub ecx, 0x7836fbd2
rep stosb byte [rdi], al
mov r15, r15
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x4c2c5d94
sub rsp, 0x4c2c5d34
pop rdi
mov dword [rsp - 0x14], 0x3ca131e4
ret
call fcn.140097490
mov dword [rsp - 0x24], edx
mov eax, ebx
xchg rdx, rbx
mov rdx, qword [rsp + 0x88]
xchg rdx, rbx
nop
add rsp, 0x319bbb88
sub rsp, 0x319bbb28
pop rdi
ret
Function at 0x140089820
Capabilities:
Access peb ldr_data

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov dword [rsp + 0x18], r8d
mov rbp, rbp
nop
push 0x237687d9
mov qword [rsp], rdi
sub rsp, 0xfcc793b
add rsp, 0xfcc76fb
xchg r13, rdx
mov rbx, r13
xchg r13, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x34], 0x45442824
mov r8d, 0x3508191f
xor r8d, 0x7c1b9cd0
add r8d, 0x2e34aefb
xor r8d, 0x774836c2
call fcn.140097a60
mov rax, qword gs:[0x60]
xchg rdi, r8
mov rdi, qword [rax + 0x18]
xchg rdi, r8
mov rax, qword [r8 + 0x10]
xchg rsi, rsi
xchg r11, r8
mov r11, qword [rax]
xchg r8, r11
test r8, r8
mov dword [rsp - 0x24], 0x30d76a20
je 0x140089b34
mov r8, qword [r8 + 0x50]
test r8, r8
xchg r10, r10
je 0x140089b34
mov edx, 0x3cdd9186
xor edx, 0x572560a0
sub edx, 0x4141ce53
sub edx, 0x1d5e9fd
sub edx, 0x28e137d2
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
xchg r11, r11
call fcn.140098570
mov edx, 0x360cbff
add edx, 0x126468c3
sub edx, 0xc327000
add edx, 0x45142e11
sub edx, 0x4ea6f277
lea rcx, [rsp + 0x30]
mov rdx, rdx
call fcn.140098690
test rax, rax
je 0x140089afa
xor ecx, ecx
mov dword [rsp - 0x28], 0x280f7f49
xchg rdi, r11
mov rdx, r11
xchg r11, rdi
mov word [rax], cx
movabs rcx, 0x804f82cb521efb16
sub rcx, 0x11bd9b3c
sub rcx, 0x27b86750
add rcx, 0x7fffffff
sub rcx, 0x101193d8
mov r8, qword [0x140140690]
xchg rsi, rsi
movabs rax, 0xd32d8144822a3c8
xor rax, 0x5677d4c0
add rax, 0x3ec51da0
xor rax, 0x118b855f
add rax, 0x1c86f9b4
rol r8, 0xf
rol r8, 3
rol r8, 6
rol r8, 1
rol r8, 1
rol r8, 1
add r8, rcx
lea rcx, [rsp + 0x20]
xchg rbp, rbp
xor r8, rax
movabs rax, 0x6e1930b8194a7590
sub rax, 0x13b5e7fc
xor rax, 0x1e1522df
add rax, 0x46c3c7a0
sub rax, 0x27c65b7
sub r8, rax
mov r10, r10
call r8
movabs rcx, 0xeee0ba0c255d7201
sub rcx, 0x1de0936a
xor rcx, 0x675b2dee
add rcx, 0x1cd7c7cb
lea r8, [rsp + 0x20]
xchg rbp, rbp
add rcx, qword [0x140140680]
lea rdx, [rsp + 0x260]
ror rcx, 0x23
ror rcx, 0xc
ror rcx, 1
ror rcx, 1
movabs rax, 0xda75033f6990695b
xor rax, 0x795a390a
add rax, 0x18e211c
add rax, 0x2505676a
add rax, rcx
mov dword [rsp - 0x2c], 0x2c95426
mov r9, rbx
not rax
movabs rcx, 0x4f0ee0bc1f2e0c22
add rcx, 0x3b6e626b
sub rcx, 0x1c218dcd
sub rcx, 0x256fe84d
add rax, rcx
mov r14, r14
movabs rcx, 0x214e08d53b8f1593
add rcx, 0x3869d4a7
sub rcx, 0x6158f410
add rcx, 0x7fffffff
xor rcx, 0x6c10e637
xor rax, rcx
movabs rcx, 0x35af703a15d334d2
xor rcx, 0x1a5d4e47
xor rcx, 0x39590871
add rcx, 0x6133281
add rcx, 0x7fffffff
add rcx, 0x9c4ed75
sub rax, rcx
lea rcx, [rsp + 0x30]
call rax
mov r10, r10
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x6ff346ad
sub eax, 0x394bfcb1
sub eax, 0x2f999a6d
xor eax, 0xc70daf8e
xchg rbx, r12
mov r12, qword [rsp + 0x250]
xchg rbx, r12
sub rsp, 0x326a3526
add rsp, 0x326a3766
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x173bb182
add eax, 0x4b9c6eaf
sub eax, 0x28fbab3c
xor eax, 0x3969d6ff
xor eax, 0xc0b5a33f
add rsp, 0x1d0aad65
sub rsp, 0x1d0aab25
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008cfe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140141084], 0
jne 0x14008d0ed
xor edx, edx
mov dword [rsp - 0x14], edx
lea r8, [0x140141080]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x10], 0x4771e463
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
xchg r13, r13
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
xchg rbp, rbp
mov eax, ecx
shr ecx, 1
and eax, 1
mov rdx, rdx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x20], edi
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x1c], 0x17d65026
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x14], ebx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rsi, rsi
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x20], 0x4b9960a1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x28], 0x6395e33d
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r11, r11
mov ecx, eax
shr eax, 1
and ecx, 1
xchg r15, r15
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x14], 0x181cfa8f
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0xc], 0x219a489f
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov r9, r9
cmp edx, 0x100
jb 0x14008d004
ret
Function at 0x1400922f4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rbp
xchg rsi, rbp
mov qword [rsp + 0x18], rbp
xchg rbp, rsi
nop
push 0x5bbc9a6f
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x1d3ee025
add rsp, 0x1d3ee005
movzx eax, byte [rdx + 1]
xchg r8, rsp
mov r15, rsp
xchg rsp, r8
movzx ebx, byte [rdx]
xchg rbp, rbp
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
dec r8d
or ebx, eax
shl edi, 1
shl edi, 7
movzx eax, byte [rdx + 2]
shl ebx, 7
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
mov dword [rsp - 0x38], ecx
shl ebx, 7
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x24], esp
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
mov dword [rsp - 0x3c], ebp
shl edi, 4
shl edi, 3
shl edi, 1
or edi, eax
mov dword [rsp - 0x3c], 0x77ad1add
movzx eax, byte [rdx + 7]
shl edi, 1
shl edi, 5
shl edi, 1
shl edi, 1
or edi, eax
xchg rbp, rbp
test r8d, r8d
jle 0x140092445
xchg r11, rdx
mov r11, qword [rcx + 8]
xchg rdx, r11
lea r14d, [r8 - 1]
movsxd rax, r8d
mov dword [rsp - 0x38], esi
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov dword [rsp - 0x20], ebp
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
mov dword [rsp - 0x3c], 0x3fb05d1a
lea rbp, [rdx + rax*4]
xchg rdx, r15
mov r15, rsi
xchg r15, rdx
mov ecx, edi
mov r8, r8
call fcn.140092b8c
xor ebx, eax
mov rdx, rbp
mov ecx, ebx
mov r13, r13
call fcn.140092b8c
xor edi, eax
nop
add rsi, 0xa6a8ac7
sub rsi, 0xa6a8adf
add rbp, 0xffffffffffffffe8
xchg r12, r12
sub r14, 1
jne 0x140092401
lea rax, [r15 + 7]
mov ecx, 0x60269597
xor ecx, 0x25c64e26
add ecx, 0x33d4c2c5
sub ecx, 0x29fe84cd
sub ecx, 0x4fb719a5
mov byte [rax - 4], dil
mov dword [rsp - 0x14], 0x7054d5a6
mov byte [rax], bl
dec rax
shr ebx, 7
shr ebx, 1
shr edi, 3
shr edi, 2
shr edi, 2
shr edi, 1
sub rcx, 1
xchg rdx, rdx
jne 0x140092466
xchg r11, rbx
mov r11, qword [rsp + 0x40]
xchg r11, rbx
xchg rsi, rbp
mov rsi, qword [rsp + 0x48]
xchg rsi, rbp
xchg r8, rsi
mov r8, qword [rsp + 0x50]
xchg rsi, r8
sub rsp, 0xffffffffffffffe0
mov r14, r14
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop rdi
mov r12, r12
ret
Function at 0x1400924cc
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rsp
mov rax, r9
xchg r9, rsp
xchg rbx, rcx
mov qword [rax + 8], rcx
xchg rbx, rcx
xchg r11, rbp
mov qword [rax + 0x10], r11
xchg rbp, r11
xchg rsi, rbx
mov qword [rax + 0x18], rbx
xchg rbx, rsi
xchg rdi, r13
mov qword [rax + 0x20], r13
xchg rdi, r13
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x38], 0x19b63a08
mov r14, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x18], ecx
shl ebx, 4
shl ebx, 4
or ebx, eax
xchg rcx, rcx
shl edi, 6
shl edi, 2
movzx eax, byte [rdx + 2]
shl ebx, 1
shl ebx, 7
or ebx, eax
movzx eax, byte [rdx + 3]
mov dword [rsp - 0x18], edi
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
mov dword [rsp - 0x3c], 0x3205e583
movzx eax, byte [rdx + 6]
shl edi, 7
shl edi, 1
or edi, eax
xchg rdi, rdi
movzx eax, byte [rdx + 7]
shl edi, 8
or edi, eax
mov r11, r11
mov eax, dword [rcx + 4]
test eax, eax
jle 0x1400925e4
mov dword [rsp - 0x24], 0x6895e37c
xchg rsi, r8
mov r8, qword [rcx + 8]
xchg rsi, r8
lea ebp, [rax - 1]
mov dword [rsp - 0x2c], edi
shr ebp, 1
inc ebp
xchg rdx, r9
mov r9, rsi
xchg r9, rdx
mov ecx, edi
mov dword [rsp - 0x28], 0x61395c4a
call fcn.140092b8c
xor ebx, eax
lea rdx, [rsi + 0xc]
mov dword [rsp - 0x10], ebx
mov ecx, ebx
call fcn.140092b8c
xor edi, eax
nop
add rsi, 0x43fba81e
sub rsi, 0x43fba806
sub rbp, 1
xchg rcx, rcx
jne 0x14009259d
lea rax, [r14 + 7]
mov ecx, 0x7c2a0275
sub ecx, 0x13274117
xor ecx, 0x66e7c799
add ecx, 0x2383d6c0
xor ecx, 0x3368dd83
mov byte [rax - 4], dil
mov dword [rsp - 0x20], 0x488b73af
mov byte [rax], bl
dec rax
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 3
shr edi, 2
shr edi, 2
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x3c], 0x27a2d7c4
jne 0x140092605
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
xchg rbx, rbp
mov rbx, qword [rsp + 0x38]
xchg rbx, rbp
mov rsi, qword [rsp + 0x40]
xchg rdi, rcx
mov rcx, qword [rsp + 0x48]
xchg rdi, rcx
sub rsp, 0xffffffffffffffe0
pop r14
mov dword [rsp - 0x1c], 0x50cc8938
ret
Function at 0x140092848
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
mov rbp, rbp
lea rbp, [rsp - 0x47]
add rsp, 0x15c4bf0e
sub rsp, 0x15c4bfae
movdqa xmm0, xmmword [0x140001e00]
xor edi, edi
mov dword [rsp - 0x14], 0x63832b07
movdqa xmm1, xmmword [0x140001db0]
xchg r8, rbx
mov r8, rdx
xchg r8, rbx
xchg rbp, rsp
movdqu xmmword [rsp - 0x39], xmm0
xchg rsp, rbp
xchg r9, rsi
mov r9, rcx
xchg r9, rsi
mov edx, edi
xchg r15, r15
movdqa xmm0, xmmword [0x140001e60]
mov r8d, edi
xchg rbp, rcx
movdqu xmmword [rcx - 0x29], xmm1
xchg rcx, rbp
movdqa xmm1, xmmword [0x140001dc0]
xchg rsp, rbp
movdqu xmmword [rsp - 0x19], xmm0
xchg rsp, rbp
xchg rbp, rcx
movdqu xmmword [rcx - 9], xmm1
xchg rbp, rcx
mov ecx, edx
xchg r8, r8
lea r8, [r8 + 4]
mov eax, 0x3655de83
add eax, 0x32008e56
xor eax, 0x2095bc12
sub eax, 0x7ed25cd
sub eax, 0x30bc7a20
inc rdx
mov r15, r15
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov dword [rsp - 0x44], ebx
jb 0x1400928ee
cmp dword [rsi + 4], 8
jne 0x1400929b2
mov dword [rsp - 0x44], 0xca74fe1
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
mov r14, r14
shl cx, 1
shl cx, 1
shl cx, 2
shl cx, 2
shl cx, 1
shl cx, 1
or cx, ax
mov r9, r9
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140092946
mov dword [rsp - 0x30], edi
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x20], 0x434d0b5b
xchg rcx, r11
mov r11, rsi
xchg r11, rcx
call fcn.140092670
mov dword [rsp - 0x28], 0x28d3bfcf
jmp 0x140092a7c
cmp dword [rsi], edi
jle 0x140092a7c
mov r12, r12
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x6ee462fa
xor r8d, 0x438ef45
add r8d, 0xc1e2057
sub r8d, 0x198bb4d
xor r8d, 0x7561f2cd
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
nop
sub rbx, 0x13be3eff
add rbx, 0x13be3f01
shl ax, 8
xchg rbx, rbx
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
mov dword [rsp - 0x28], edi
jne 0x1400929e6
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov r15, r15
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140092670
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
mov dword [rsp - 0x24], 0x2bd79503
sub r8d, r14d
lea rdx, [rbp + 0x67]
neg r8d
sub r8d, 0xfffffff8
neg r8d
xchg rsi, r14
mov rcx, r14
xchg rsi, r14
call fcn.140092670
mov dword [rsp - 0x30], ebp
inc edi
sub r14d, 0xfffffff8
cmp edi, dword [rsi]
jl 0x1400929c0
mov dword [rsp - 0x2c], ebx
xor eax, eax
lea r11, [rsp + 0xa0]
xchg r9, rbx
mov r9, qword [r11 + 0x28]
xchg r9, rbx
lea rdi, [rbp + 7]
xchg r14, r14
xchg rsp, rsi
mov rsp, qword [r11 + 0x30]
xchg rsi, rsp
lea ecx, [rax + 0x40]
mov rbp, rbp
rep stosb byte [rdi], al
mov rsp, r11
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
ret
Function at 0x140092b3c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
xchg rdx, rdx
je 0x140092b84
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
mov r9, r9
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov dword [rsp - 0x28], 0x3469edc5
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
cmovb r11d, ecx
mov dword [rsp - 0x14], 0x3b719a8a
shr edx, 1
jne 0x140092b49
mov eax, r10d
xchg r12, r12
ret
Function at 0x1400988c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xchg r14, r10
mov qword [rsp], r14
xchg r14, r10
xchg r11, rbp
mov qword [rsp + 8], rbp
xchg r11, rbp
xor r11, r11
mov r12, r12
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
xchg rdx, rdx
cmp r10, r11
bnd jae 0x14009893a
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov dword [rsp - 0x3c], 0x2e50a472
mov byte [r11], 0x3e
xor byte [r11], 0x7b
sub byte [r11], 0x34
add byte [r11], 0x3d
xor byte [r11], 0x4e
cmp r10, r11
mov dword [rsp - 0x10], 0x32e3f300
bnd jne 0x140098909
xchg r10, rbp
mov rbp, qword [rsp]
xchg r10, rbp
xchg rsi, r11
mov rsi, qword [rsp + 8]
xchg r11, rsi
nop
sub rsp, 0x10f37301
add rsp, 0x10f37311
bnd ret
Function at 0x14009dd94
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rax
mov rdi, qword [rcx + 0xf8]
xchg rdi, rax
xor r8d, r8d
mov r9, r9
mov r9, rdx
test rax, rax
je 0x14009de04
mov ecx, r8d
mov rbp, rbp
mov edx, 0x5a7abfc7
sub edx, 0x17f807b3
add edx, 0x2b475ede
sub edx, 0x2439b2c5
sub edx, 0x3976334f
rol edx, cl
mov dword [rsp - 0x20], 0x527663fb
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
mov dword [rsp - 0x10], esi
inc r8
cmp r8, 0x20
jb 0x14009ddb1
mov r11, r11
mov al, 0
add al, 0x29
sub al, 0x1d
sub al, 0xb
ret
mov rax, qword [rcx + 0x100]
test rax, rax
je 0x14009de3c
xchg rsi, rsi
xchg rsp, rax
movups xmm0, xmmword [rsp]
xchg rsp, rax
movups xmmword [rdx], xmm0
mov dword [rsp - 0x34], ebp
xchg rsp, rax
movups xmm1, xmmword [rsp + 0x10]
xchg rsp, rax
movups xmmword [rdx + 0x10], xmm1
mov dword [rsp - 0x44], esi
jmp 0x14009ddfb
xorps xmm0, xmm0
mov dword [rsp - 0x38], ebx
xor al, al
xchg rdx, r12
movups xmmword [r12], xmm0
xchg r12, rdx
xchg rdx, r8
movups xmmword [r8 + 0x10], xmm0
xchg r8, rdx
ret
Function at 0x1400b47a8
Capabilities:
Encode data using xor

Disassembly:
xchg r13, r11
mov r13, rsp
xchg r11, r13
mov qword [r11 + 8], rbx
xchg rsi, r14
mov qword [r11 + 0x18], r14
xchg rsi, r14
xchg rdi, r13
mov qword [r11 + 0x20], r13
xchg r13, rdi
push r14
mov r14, r14
sub rsp, 0x40
mov r8, qword [0x1401404c8]
lea rdx, [r11 + 0x10]
mov dword [rsp - 0x24], ebp
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov dword [rsp + 0x58], 0x5d9cb22f
xor dword [rsp + 0x58], 0x19626ffd
xor dword [rsp + 0x58], 0x33d6191d
xor dword [rsp + 0x58], 0x13fc5336
sub dword [rsp + 0x58], 0x64d497e9
movabs rcx, 0xc2463090651bdeff
add rcx, 0x160e7bee
sub rcx, 0x4930ee28
add rcx, 0x7fffffff
add rcx, 0x5b8e3e8
movabs rax, 0x2dfb4dc251d47020
xor rax, 0x3c42721f
xor rax, 0x58e18df6
add rax, 0x5c9b9855
add r8, rcx
mov r8, r8
lea rcx, [r11 - 0x28]
xor r8, rax
not r8
xchg rbx, rbx
ror r8, 0xd
ror r8, 9
ror r8, 0xa
ror r8, 2
ror r8, 1
call r8
xchg rsi, rsi
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg rdi, r8
mov qword [rbx], r8
xchg rdi, r8
xor esi, esi
xchg rcx, rdi
movups xmmword [rcx], xmm0
xchg rdi, rcx
xchg rdi, rbx
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rdi
xchg rbx, rdi
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rdi
test eax, eax
jne 0x1400b48c3
mov rdx, rdx
mov qword [rbx + 0x38], rsi
jmp 0x1400b49fb
lea rax, [rsp + 0x20]
mov dword [rsp - 0x18], edi
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov dword [rsp - 0x3c], 0x298cdc7e
jne 0x1400b48d0
xchg r14, r9
mov qword [rbx + 0x38], r9
xchg r14, r9
cmp qword [rbx], rdi
xchg r12, r12
je 0x1400b490a
xchg rcx, r13
mov r13, qword [rbx]
xchg rcx, r13
call fcn.140097490
cmp r14, 0x18
jbe 0x1400b4948
mov dword [rsp - 0xc], esp
lea rcx, [r14 + r14]
call fcn.140097730
mov qword [rbx], rax
mov dword [rsp - 0x2c], ebx
test rax, rax
jne 0x1400b4955
xchg rdi, r12
mov qword [rbx], r12
xchg r12, rdi
xchg rsi, r11
mov rcx, r11
xchg rsi, r11
jmp 0x1400b497a
mov qword [rbx], rdi
xchg r11, r11
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xorps xmm0, xmm0
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
xchg r10, rax
movups xmmword [r10 + 0x10], xmm0
xchg r10, rax
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
xchg rcx, r15
mov r15, qword [rbx]
xchg rcx, r15
mov edx, 0x525125a7
sub edx, 0x1c988f5b
xor edx, 0x4680ab38
xor edx, 0x6b6d251a
cmp qword [rbx + 0x38], rsi
jbe 0x1400b49fb
mov dword [rsp - 0x28], 0x5fc4796d
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x44], 0x4016d299
mov r9d, 0x3ac5dd68
add r9d, 0x3ae7cb60
sub r9d, 0x19ef5994
sub r9d, 0x5bbe4e35
and ax, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [r8 + rcx]
mov r10, r10
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
xchg rbp, rbp
jb 0x1400b49ab
xchg r11, rsi
mov r11, qword [rsp + 0x60]
xchg rsi, r11
xchg r8, rax
mov r8, rbx
xchg r8, rax
mov rbx, qword [rsp + 0x50]
xchg rdi, r15
mov r15, qword [rsp + 0x68]
xchg r15, rdi
neg rsp
add rsp, 0xffffffffffffffc0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret