joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rsi
mov rsi, rcx
xchg rdi, rsi
lea rbx, [rdx + 0x32]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x71
xor byte [rbx + rax], 0x32
xor byte [rbx + rax], 2
add byte [rbx + rax], 0x10
add byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x7b
inc rax
cmp rax, 0x60
jb 0x14007cf5d
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cfb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x34]
xchg rbx, r15
mov rdx, r15
xchg rbx, r15
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0xe
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x6e
inc rax
cmp rax, 0x64
jb 0x14007cfe6
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d040
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x38]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x2b
add byte [rbx + rax], 0xa
add byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 5
sub byte [rbx + rax], 0x1b
inc rax
cmp rax, 0x6e
jb 0x14007d06d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
push rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0x4e]
xchg rdx, r8
mov r8, rbx
xchg r8, rdx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x29
inc rax
cmp rax, 0x98
jb 0x14007d103
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d150
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x56]
xchg r14, rbx
mov rdx, r14
xchg rbx, r14
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x17
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x29
xor byte [rbx + rax], 1
inc rax
cmp rax, 0xa8
jb 0x14007d18c
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rax
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret

Function at 0x14007d1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x35
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x22
inc rax
cmp rax, 0xb0
jb 0x14007d20f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rdx
xchg qword [rsp + 0x10], rdi
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0x70]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 5
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x41
inc rax
cmp rax, 0xdc
jb 0x14007d295
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d2e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x32
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x44
inc rax
cmp rax, 0xde
jb 0x14007d30d
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d370
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x76]
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0xe
add byte [rbx + rax], 0x41
xor byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 0xea
jb 0x14007d3ac
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
ret

Function at 0x14007d400
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x7c]
xchg rsi, rbx
mov rdx, rsi
xchg rbx, rsi
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x64
sub byte [rbx + rax], 3
xor byte [rbx + rax], 0x72
add byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x57
inc rax
cmp rax, 0xf4
jb 0x14007d436
xchg r10, rdi
mov rax, r10
xchg r10, rdi
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
push rax
push rbx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x9a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab30
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x58
xor byte [rbx + rax], 2
add byte [rbx + rax], 0x64
xor byte [rbx + rax], 0x70
inc rax
cmp rax, 0x130
jb 0x14007d4e5
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x7e
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x14
jb 0x14007d55f
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d5b0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
mov qword [rsp + 0x10], rdx
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 0xe]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x38
add byte [rbx + rax], 5
sub byte [rbx + rax], 0x5f
inc rax
cmp rax, 0x18
jb 0x14007d5e7
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r12, rdi
mov r12, rcx
xchg r12, rdi
lea rbx, [rdx + 0xe]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab30
nop
xor eax, eax
mov byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x59
add byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 6
sub byte [rbx + rax], 0x12
inc rax
cmp rax, 0x1a
jb 0x14007d67c
xchg rdi, r13
mov rax, r13
xchg rdi, r13
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140083fc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x14008410a
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r14, rax
movups xmmword [r14], xmm0
xchg r14, rax
mov qword [r9 + r8 - 0x70], r10
mov qword [r9 + r8 - 0x68], r10
movups xmm0, xmmword [r8 - 0x80]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r10, r8
movups xmm1, xmmword [r10 - 0x70]
xchg r10, r8
xorps xmm0, xmm0
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm1
xchg rsi, rax
mov qword [r8 - 0x70], r10
add rax, 0x48
mov qword [r8 - 0x68], 0x67858083
xor qword [r8 - 0x68], 0x76f400d1
xor qword [r8 - 0x68], 0x300ae16d
xor qword [r8 - 0x68], 0xb1b312a
add qword [r8 - 0x68], 0x2622893f
xor qword [r8 - 0x68], 0x2c696fe4
sub qword [r8 - 0x68], 0x7a7eeaee
add qword [r8 - 0x68], 0x284189b1
xor qword [r8 - 0x68], 0x2aae5574
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r10, rbx
mov qword [r9 + r8 - 0x50], rbx
xchg rbx, r10
mov qword [r9 + r8 - 0x48], r10
movups xmm0, xmmword [r8 - 0x60]
xchg r9, r14
movups xmmword [r14 + r8 - 0x60], xmm0
xchg r14, r9
xchg r8, r15
movups xmm1, xmmword [r15 - 0x50]
xchg r15, r8
movups xmmword [r9 + r8 - 0x50], xmm1
xchg r10, r11
mov qword [r8 - 0x50], r11
xchg r11, r10
mov qword [r8 - 0x48], 0xc411543
xor qword [r8 - 0x48], 0x794b0fa9
sub qword [r8 - 0x48], 0x62369093
add qword [r8 - 0x48], 0x48efc9ed
xor qword [r8 - 0x48], 0x1d28274f
add qword [r8 - 0x48], 0xbc715fb
xor qword [r8 - 0x48], 0x52b28901
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083fe4
ret

Function at 0x140084240
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbp
mov rax, rbp
xchg rbp, r8
cmp rcx, rdx
je 0x14008430e
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
movups xmm0, xmmword [r8 - 0x38]
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
xchg r8, rdi
movups xmm1, xmmword [rdi - 0x28]
xchg r8, rdi
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
mov qword [r8 - 0x28], r10
nop
add rax, 0x248bfa4f
sub rax, 0x248bfa2f
mov qword [r8 - 0x20], 0x42da0c78
xor qword [r8 - 0x20], 0x5d16387b
sub qword [r8 - 0x20], 0x1c4122f2
add qword [r8 - 0x20], 0x4153de83
xor qword [r8 - 0x20], 0x66d8769f
add qword [r8 - 0x20], 0x4cfbaddf
xor qword [r8 - 0x20], 0x11a56294
sub qword [r8 - 0x20], 0x3b5371e5
sub qword [r8 - 0x20], 0x4353b292
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008426a
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e6f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x41
xor byte [rcx + rax + 0xa], 0x46
xor byte [rcx + rax + 0xa], 0x41
sub byte [rcx + rax + 0xa], 0x38
add byte [rcx + rax + 0xa], 0x12
xor byte [rcx + rax + 0xa], 0x6d
xor byte [rcx + rax + 0xa], 0x4d
inc rax
cmp rax, 0x10
jb 0x14008e6f2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401791a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rbx, rsi
mov rsi, rcx
xchg rsi, rbx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
add r9, 0xfffffffffffffffe
mov eax, 0x2967ede3
xor eax, 0x6bc74d7e
xor eax, 0x756ae7ee
sub eax, 0x133797ba
add eax, 0x223df9a5
xor eax, 0x2c0b3e49
add eax, 0x168ddbe
xor eax, 0x43de79b2
xor eax, 0xe356c1aa
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
nop
sub r8w, 0x24a1
add r8w, 0x24d1
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1401791c6
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
movups xmmword [rbx], xmm0
xchg r10, r8
mov qword [rbx + 0x10], r8
xchg r8, r10
xchg r15, r10
mov qword [rbx + 0x18], r15
xchg r10, r15
cmp r9, rax
jne 0x1401792c9
xchg r15, r10
mov qword [rbx + 0x10], r15
xchg r10, r15
xchg rbx, r10
mov rax, r10
xchg r10, rbx
mov qword [rbx + 0x18], 0x14ef6404
xor qword [rbx + 0x18], 0x36af6a38
xor qword [rbx + 0x18], 0x4c59a60e
sub qword [rbx + 0x18], 0x4827a54e
add qword [rbx + 0x18], 0x478ad265
sub qword [rbx + 0x18], 0x6bce167b
add qword [rbx + 0x18], 0x421fb96c
add qword [rbx + 0x18], 0x29bc6128
sub qword [rbx + 0x18], 0x6d8ad95b
mov word [rbx], r10w
add rsp, 0x60
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rsp + 0x52]
xchg r8, r9
mov rdx, r8
xchg r8, r9
sub r8, r9
mov rcx, rbx
sar r8, 1
call fcn.14007ed40
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x60
push rcx
push rax
push rcx
push rcx
push rcx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x40], rbx
pop rcx
pop rcx
pop rdx
pop rcx
pop rcx
pop rcx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140194160
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r12, r10
mov r12, rdx
xchg r12, r10
xchg r15, r11
mov r15, rcx
xchg r11, r15
mov dword [rsp + 0x30], 0x636dd8d4
sub dword [rsp + 0x30], 0x508c5ad1
xor dword [rsp + 0x30], 0x521e46cb
xor dword [rsp + 0x30], 0x41d05fe
sub dword [rsp + 0x30], 0x32faa4d8
sub dword [rsp + 0x30], 0xa188c9f
add dword [rsp + 0x30], 0x2abcc84f
add dword [rsp + 0x30], 0xc46b22e8
mov dword [rsp + 0x36], 0x2e5e6cf2
add dword [rsp + 0x36], 0x3986c271
sub dword [rsp + 0x36], 0x3a73afc0
sub dword [rsp + 0x36], 0x8a28bf3
add dword [rsp + 0x36], 0x1b4ee2ba
xor dword [rsp + 0x36], 0xbf442930
mov dword [rsp + 0x3a], 0x71adbe3d
sub dword [rsp + 0x3a], 0x515e085d
add dword [rsp + 0x3a], 0xd286224
sub dword [rsp + 0x3a], 0x2584a524
sub dword [rsp + 0x3a], 0x495bb25
add dword [rsp + 0x3a], 0xfc0147a2
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140194224
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
xchg r9, rcx
mov qword [rsp + 0x20], rcx
xchg r9, rcx
xchg r8, rbp
mov r9, rbp
xchg r8, rbp
lea r8, [rsp + 0x36]
mov rdx, r10
xchg rsi, rcx
mov rsi, r11
xchg rsi, rcx
call fcn.1401942c0
nop
mov byte [rsp + rbx + 0x36], 3
xor byte [rsp + rbx + 0x36], 0x3b
add byte [rsp + rbx + 0x36], 0x45
sub byte [rsp + rbx + 0x36], 0x57
add byte [rsp + rbx + 0x36], 0x14
sub byte [rsp + rbx + 0x36], 0x19
sub byte [rsp + rbx + 0x36], 0x21
inc rbx
cmp rbx, 8
jb 0x14019427c
add rsp, 0x40
nop
xchg qword [rsp], rbx
add rsp, 8
ret
Function at 0x140198570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r15
mov qword [rsp + 0x20], r15
xchg r15, r9
xchg r12, r8
mov qword [rsp + 0x18], r12
xchg r12, r8
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
xchg rbx, r8
mov r8, r9
xchg r8, rbx
mov rsi, rdx
xchg rcx, r12
mov r9, r12
xchg r12, rcx
xor ebp, ebp
test rdx, rdx
jne 0x1401985fa
mov eax, ebp
jmp 0x14019863f
mov eax, 0x156e71d
add eax, 0x62510c07
add eax, 0x1a043e79
sub eax, 0x70ed5b8b
add eax, 0x21d460c9
xor eax, 0x6550e9c8
xor eax, 0x4bc3855e
cmp word [rdx], ax
je 0x14019862e
mov rax, rbp
jmp 0x14019863f
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x745a4a87
sub ecx, 0x730fa743
add ecx, 0x39791b13
add ecx, 0x241be45d
sub ecx, 0x4378cb22
sub ecx, 0x1536c120
sub ecx, 0x6301467
cmp word [rax + 0x18], cx
jne 0x140198783
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x140198783
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198749
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x14019873d
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rcx, r12
mov r12, qword [rbx + 0x38]
xchg rcx, r12
test rcx, rcx
je 0x14019880c
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198749
xchg r8, rsi
mov rsi, qword [rsp + 0xb0]
xchg rsi, r8
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401986b0
xchg rcx, r14
mov r14, qword [rbx + 0x38]
xchg r14, rcx
test rcx, rcx
je 0x140198772
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg r9, rbp
mov qword [rbx + 0x38], r9
xchg rbp, r9
mov al, 0x1f
xor al, 0x40
sub al, 8
xor al, 0x61
add al, 0xa
sub al, 0x3f
jmp 0x1401987ac
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg r9, rcx
test rcx, rcx
je 0x1401987aa
xchg r8, rax
mov r8, qword [rcx]
xchg r8, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
push rax
push rcx
push rbx
push rax
push rdx
xchg qword [rsp + 0x28], r15
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
push rdx
push rcx
push rdx
push rcx
xchg qword [rsp + 0x20], rbp
add rsp, 0x28
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.1401fda82
nop
int3
Function at 0x1401aad60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdx, rcx
mov r11, rcx
xchg rdx, rcx
mov r10, rcx
test rdx, rdx
je 0x1401aadd8
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aadcb
movzx eax, byte [r10]
test bl, bl
je 0x1401aadad
lea rcx, [r9 - 1]
xchg r9, rdx
mov r9, rdx
xchg r9, rdx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aad9c
jmp 0x1401aadcb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aadbc
inc r10
sub r11, 1
jne 0x1401aad7e
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401b0150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x4a424501
sub r9d, 0x32c03f
xor r9d, 0x73d82bf8
sub r9d, 0x3d55762
xor r9d, 0x35ba66c4
add r9d, 0x475e6333
sub r9d, 0x4b1691df
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b01e3
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b019e
mov ecx, dword [r10]
jmp 0x1401b031c
cmp ecx, 0x4e0
jb 0x1401b031c
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x73159b17
sub ebx, 0x64302e06
xor ebx, 0x4e2dad17
xor ebx, 0x5c8dfabb
sub ebx, 0x1af7644f
add ebx, 0x1f4ad4ff
sub ebx, 0x2098aa8a
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0226
lea r11, [r10 + 0xd50]
mov ebx, 0x58de91a6
sub ebx, 0x4aaf7072
xor ebx, 0xfa5bb9
add ebx, 0x42a5abd3
xor ebx, 0x624f22f0
sub ebx, 0x17fb3b57
xor ebx, 0x1b38c8b5
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b029e
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 7
shr ecx, 3
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 2
shl eax, 2
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 8
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x10
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
ret