joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006324c
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg r9, rbx
mov qword [rsp + 0x18], rsi
push rbp
mov dword [rsp - 0x24], edi
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
mov rbp, rsp
mov dword [rsp - 0x28], 0x34bcd5ca
nop
add rsp, 0x73e23ae4
sub rsp, 0x73e23b44
movabs rsi, 0x5def00202772c834
add rsi, 0x4c6e3b6b
sub rsi, 0xc5d1439
sub rsi, 0x649b8c81
xor rsi, 0x38c61fa7
xchg r11, rcx
mov rbx, r11
xchg rcx, r11
cmp qword [rcx + 0x30], rsi
jne 0x14006345f
mov rbp, rbp
xor r14d, r14d
mov dword [rbp - 0x40], 0x5b53b28d
xor dword [rbp - 0x40], 0x29e70ba3
sub dword [rbp - 0x40], 0x6fc0c066
sub dword [rbp - 0x40], 0x2c9f82b
mov dword [rbp - 0x3c], 0x727474be
xor dword [rbp - 0x3c], 0x73438369
add dword [rbp - 0x3c], 0xe47074f
add dword [rbp - 0x3c], 0x1038a9e2
sub dword [rbp - 0x3c], 0x1f8ca8a9
mov dword [rbp - 0x38], 0x489e462c
sub dword [rbp - 0x38], 0x30334fd0
add dword [rbp - 0x38], 0x6271205c
sub dword [rbp - 0x38], 0x7ab5160c
mov dword [rbp - 0x34], 0x10ef211a
xor dword [rbp - 0x34], 0x43900631
sub dword [rbp - 0x34], 0x1791d431
add dword [rbp - 0x34], 0x2c806e47
xor dword [rbp - 0x34], 0x6815c15b
mov dword [rbp - 0x30], 0x609d3959
xor dword [rbp - 0x30], 0x7d49984f
add dword [rbp - 0x30], 0xe146a70
sub dword [rbp - 0x30], 0x9045fc6
sub dword [rbp - 0x30], 0x22baaace
mov dword [rbp - 0x2c], 0x34fe5375
xor dword [rbp - 0x2c], 0x465758bd
xor dword [rbp - 0x2c], 0x2aadfb88
xor dword [rbp - 0x2c], 0x3b34499c
xor dword [rbp - 0x2c], 0x6316b999
mov qword [rbp + 0x20], r14
mov r15, r15
xchg rsi, rax
mov rsi, qword [rbp + 0x20]
xchg rsi, rax
mov rcx, qword [rbp + 0x20]
mov dword [rsp - 0x3c], edi
mov edx, 0x4d91c965
add edx, 0x2a50c61b
sub edx, 0x6ddbdc03
xor edx, 0x402ffda1
xchg rbx, rax
mov rbx, qword [rbp + 0x20]
xchg rbx, rax
and cl, 3
shl cl, 3
mov rcx, rcx
shr edx, cl
movzx ecx, dl
xor cx, word [rbp + rax*2 - 0x40]
mov rax, qword [rbp + 0x20]
xchg rbx, rbx
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x20]
inc rax
mov rbx, rbx
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
cmp rax, 0xc
xchg r8, r8
jb 0x140063398
xor edx, edx
mov word [rbp - 0x10], r14w
lea rcx, [rbp - 0x28]
mov r11, r11
call fcn.140076a70
mov r8, rax
lea rdi, [rbp - 0x28]
xor eax, eax
mov dword [rsp - 0x18], 0x516feb4a
xor r8, rsi
mov qword [rbx + 0x30], r8
xor r8, rsi
xchg rcx, rcx
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
je 0x140063469
lea rdx, [0x1400db7c0]
mov r15, r15
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.140067ad0
mov dword [rsp - 0x34], edi
test al, al
setne al
jmp 0x140063469
mov al, 0x41
add al, 0x38
sub al, 0x16
add al, 0x10
sub al, 0x72
lea r11, [rsp + 0x60]
xchg r15, rbx
mov r15, qword [r11 + 0x28]
xchg r15, rbx
mov rsi, qword [r11 + 0x30]
xchg r14, rsp
mov r14, r11
xchg rsp, r14
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400634a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x34], 0x41eff7d6
mov qword [rsp + 0x18], rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rsi, 0x5def002000cc0fa8
add rsi, 0x6baa025f
xor rsi, 0x37b8104b
sub rsi, 0x219f850a
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
cmp qword [rcx + 0x28], rsi
jne 0x14006369e
mov eax, 0x79929cf
add eax, 0x784690b7
sub eax, 0x57e41b93
add eax, 0x284f0ca6
sub eax, 0x504aaae9
mov dword [rbp - 0x30], 0x6db3a124
sub dword [rbp - 0x30], 0xdc04759
sub dword [rbp - 0x30], 0x19eb99c
add dword [rbp - 0x30], 0x20162612
xor dword [rbp - 0x30], 0x7e48c6d2
mov word [rbp - 0x20], ax
xchg rdx, rdx
xor r14d, r14d
mov dword [rbp - 0x2c], 0x52fd4540
sub dword [rbp - 0x2c], 0x1c017920
sub dword [rbp - 0x2c], 0x2b806637
xor dword [rbp - 0x2c], 0xb0265a5
mov dword [rbp - 0x28], 0x1e26097
add dword [rbp - 0x28], 0x619206c0
xor dword [rbp - 0x28], 0x5356cc37
xor dword [rbp - 0x28], 0x25b4ff1f
sub dword [rbp - 0x28], 0x15365391
mov dword [rbp - 0x24], 0x33bb4d5a
xor dword [rbp - 0x24], 0x5b337483
sub dword [rbp - 0x24], 0x70dd906
xor dword [rbp - 0x24], 0x615c609e
xchg r14, r8
mov qword [rbp + 0x20], r8
xchg r14, r8
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x20]
mov edx, 0x4984208b
xor edx, 0x5e9b9aa3
xor edx, 0x2426f681
add edx, 0x412b07f4
sub edx, 0x2a3b05c1
mov rax, qword [rbp + 0x20]
xchg rcx, rcx
and cl, 3
shl cl, 2
shl cl, 1
shr edx, cl
movzx ecx, dl
mov dword [rsp - 0x2c], esp
xor cx, word [rbp + rax*2 - 0x30]
xchg r13, rax
mov r13, qword [rbp + 0x20]
xchg r13, rax
mov word [rbp + rax*2 - 0x1e], cx
mov r13, r13
mov rax, qword [rbp + 0x20]
inc rax
xchg r14, rax
mov qword [rbp + 0x20], r14
xchg r14, rax
mov rax, qword [rbp + 0x20]
cmp rax, 9
jb 0x1400635bd
xchg r11, r11
xor edx, edx
mov word [rbp - 0xc], r14w
lea rcx, [rbp - 0x1e]
call fcn.140076a70
mov dword [rsp - 0x10], 0x6efbdcab
xchg r8, r13
mov r13, rax
xchg r13, r8
lea rdi, [rbp - 0x1e]
mov rbx, rbx
xor eax, eax
xor r8, rsi
xchg r8, rsp
mov qword [rbx + 0x28], rsp
xchg rsp, r8
xor r8, rsi
mov dword [rsp - 0x34], 0x455a58da
lea ecx, [rax + 9]
rep stosb byte [rdi], al
je 0x1400636a6
lea rdx, [0x1400db020]
mov rbx, rbx
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
call fcn.14006bad0
test al, al
setne al
mov dword [rsp - 0x34], esi
jmp 0x1400636a6
mov al, 0x15
xor al, 0x31
xor al, 0x55
sub al, 0x70
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
xchg rsi, rdx
mov rdx, qword [r11 + 0x30]
xchg rdx, rsi
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400636d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rsi
mov qword [rsp + 0x18], rdi
xchg rsi, rdi
push rbp
mov dword [rsp - 0x38], 0x1e2ac6e6
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
xchg rbp, r14
mov r14, rsp
xchg rbp, r14
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rsi, 0x5def002010861a60
add rsi, 0x10e91544
sub rsi, 0x13fa6251
add rsi, 0xadaf5a0
add rsi, 0x21deba4f
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
cmp qword [rcx + 0x38], rsi
jne 0x1400638ea
xor r14d, r14d
mov dword [rsp - 0x10], edi
mov dword [rbp - 0x30], 0x741ef685
sub dword [rbp - 0x30], 0xd8949fc
add dword [rbp - 0x30], 0xcd34d9d
sub dword [rbp - 0x30], 0x732af998
mov dword [rbp - 0x2c], 0x36a5d5a3
add dword [rbp - 0x2c], 0x44880152
xor dword [rbp - 0x2c], 0x5e1636c8
xor dword [rbp - 0x2c], 0x799e6d89
sub dword [rbp - 0x2c], 0x5c6d8d6a
mov dword [rbp - 0x28], 0x1e0e9d06
add dword [rbp - 0x28], 0x5db0f8db
xor dword [rbp - 0x28], 0x8c8a003
sub dword [rbp - 0x28], 0x11950a89
xor dword [rbp - 0x28], 0x61982bf1
mov dword [rbp - 0x24], 0x11ec1917
add dword [rbp - 0x24], 0xdd22347
sub dword [rbp - 0x24], 0x1438f64
xor dword [rbp - 0x24], 0x712c20ba
sub dword [rbp - 0x24], 0x6f288c39
mov dword [rbp - 0x20], 0x5029d7db
xor dword [rbp - 0x20], 0x3cbb3022
sub dword [rbp - 0x20], 0x54ef713b
xor dword [rbp - 0x20], 0x1781760e
mov qword [rbp + 0x20], r14
mov r8, r8
mov rax, qword [rbp + 0x20]
xchg rcx, r10
mov r10, qword [rbp + 0x20]
xchg rcx, r10
mov edx, 0x2495ed2e
xor edx, 0x3f18846b
sub edx, 0x199a9acf
xor edx, 0x13ce055a
add edx, 0x37ec83b0
xchg rsp, rax
mov rsp, qword [rbp + 0x20]
xchg rsp, rax
and cl, 3
mov dword [rsp - 0x40], 0x1d9cc277
shl cl, 1
shl cl, 1
shl cl, 1
shr edx, cl
movzx ecx, dl
xor cx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x28], 0x18c6e180
mov rax, qword [rbp + 0x20]
mov word [rbp + rax*2 - 0x1c], cx
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
inc rax
mov r11, r11
xchg r13, rax
mov qword [rbp + 0x20], r13
xchg r13, rax
xchg r9, rax
mov r9, qword [rbp + 0x20]
xchg r9, rax
cmp rax, 0xa
mov rdi, rdi
jb 0x1400637fb
xor edx, edx
mov word [rbp - 8], r14w
lea rcx, [rbp - 0x1c]
mov dword [rsp - 0x1c], edx
call fcn.140076a70
xchg r8, rax
mov rax, r8
xchg r8, rax
lea rdi, [rbp - 0x1c]
xchg r8, r8
xor eax, eax
xor r8, rsi
xchg r8, rcx
mov qword [rbx + 0x38], rcx
xchg r8, rcx
xor r8, rsi
lea ecx, [rax + 0xa]
mov r15, r15
rep stosb byte [rdi], al
je 0x1400638f2
lea rdx, [0x1400db040]
xchg r14, rcx
mov r14, r8
xchg rcx, r14
call fcn.14006be20
test al, al
mov dword [rsp - 0x3c], 0x137b4e49
setne al
jmp 0x1400638f2
mov al, 0x38
sub al, 0x19
sub al, 0xe
sub al, 0x10
lea r11, [rsp + 0x50]
mov dword [rsp - 0x20], ebx
xchg r15, rbx
mov r15, qword [r11 + 0x28]
xchg r15, rbx
xchg r9, rsi
mov r9, qword [r11 + 0x30]
xchg r9, rsi
mov rsp, r11
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140063930
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg r9, rsi
push rbp
mov dword [rsp - 0x2c], 0x65e1cdb2
push rdi
nop
push 0x30c1013f
mov qword [rsp], r14
xchg rbp, r8
mov r8, rsp
xchg r8, rbp
nop
add rsp, 0x52bf3bfc
sub rsp, 0x52bf3c4c
movabs rsi, 0x5def00204cdaec9f
sub rsi, 0x15e97d7d
sub rsi, 0x2407b664
xor rsi, 0x62bd7228
sub rsi, 0x36264d54
mov rbx, rcx
cmp qword [rcx + 0x20], rsi
jne 0x140063b66
mov dword [rsp - 0x14], 0x991ee1d
mov eax, 0x5815b590
xor eax, 0x24ff5d39
sub eax, 0x44b96d44
sub eax, 0x38317b20
mov dword [rbp - 0x30], 0x6785a1eb
sub dword [rbp - 0x30], 0x13d27666
xor dword [rbp - 0x30], 0x33606961
sub dword [rbp - 0x30], 0x60ad4255
mov word [rbp - 0x1c], ax
xchg r9, r9
xor r14d, r14d
mov dword [rbp - 0x2c], 0x1a46b13d
add dword [rbp - 0x2c], 0x1b2c744c
xor dword [rbp - 0x2c], 0x10578956
sub dword [rbp - 0x2c], 0x24feac93
mov dword [rbp - 0x28], 0x570419c6
add dword [rbp - 0x28], 0x1744c7d5
xor dword [rbp - 0x28], 0x2732ac11
sub dword [rbp - 0x28], 0xdd00422
xor dword [rbp - 0x28], 0x3bd749d8
mov dword [rbp - 0x24], 0x58ff9659
xor dword [rbp - 0x24], 0x760d0ea0
xor dword [rbp - 0x24], 0x7659d357
xor dword [rbp - 0x24], 0x22c85397
sub dword [rbp - 0x24], 0x79ff181e
mov dword [rbp - 0x20], 0x4d41b618
xor dword [rbp - 0x20], 0x2b6f07fe
xor dword [rbp - 0x20], 0x79ed3f9e
xor dword [rbp - 0x20], 0x4248f480
sub dword [rbp - 0x20], 0x5d697a40
mov qword [rbp + 0x20], r14
xchg rdx, rax
mov rdx, qword [rbp + 0x20]
xchg rdx, rax
xchg rcx, r13
mov r13, qword [rbp + 0x20]
xchg rcx, r13
mov edx, 0x7c291bef
xor edx, 0x42edf53e
add edx, 0x1db32c20
sub edx, 0x3204bfc1
xor edx, 0x605a15ec
xchg r8, rax
mov r8, qword [rbp + 0x20]
xchg r8, rax
and cl, 3
mov dword [rsp - 0x18], ecx
shl cl, 2
shl cl, 1
shr edx, cl
mov r10, r10
movzx ecx, dl
xor cx, word [rbp + rax*2 - 0x30]
mov rax, qword [rbp + 0x20]
xchg rsi, rsi
mov word [rbp + rax*2 - 0x1a], cx
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
inc rax
mov dword [rsp - 0x2c], esp
xchg r9, rax
mov qword [rbp + 0x20], r9
xchg r9, rax
mov rax, qword [rbp + 0x20]
xchg r11, r11
cmp rax, 0xb
jb 0x140063a78
xor edx, edx
mov r14, r14
mov word [rbp - 4], r14w
lea rcx, [rbp - 0x1a]
call fcn.140076a70
xchg r9, r9
xchg r8, rsi
mov rsi, rax
xchg rsi, r8
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x30], edi
xor eax, eax
xor r8, rsi
xchg rsp, r8
mov qword [rbx + 0x20], rsp
xchg r8, rsp
xor r8, rsi
xchg r11, r11
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
je 0x140063b70
lea rdx, section..data
mov dword [rsp - 0x3c], esp
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.14006c23c
mov dword [rsp - 0x14], 0x3ce1e454
test al, al
setne al
jmp 0x140063b70
mov al, 0x63
xor al, 0x1b
sub al, 0x2d
add al, 0x1f
xor al, 0x6b
lea r11, [rsp + 0x50]
xchg rbx, rbp
mov rbp, qword [r11 + 0x28]
xchg rbp, rbx
xchg rsi, rcx
mov rcx, qword [r11 + 0x30]
xchg rcx, rsi
xchg rsi, rsp
mov rsi, r11
xchg rsi, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0x2c], 0x5beda9df
ret
Function at 0x14006e76c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x14000b508]
mov dword [rsp - 0x20], esi
sub r10, rcx
xchg rcx, rbp
mov r8, rbp
xchg rcx, rbp
lea rax, [r9 + r8]
mov rcx, rcx
mov ecx, r9d
mov edx, 0x322e1a9c
xor edx, 0x766e9355
xor edx, 0x6d7472c4
add edx, 0x5688284
xor edx, 0x150217a4
inc r9
mov dword [rsp - 0x28], ebp
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov dword [rsp - 0xc], esi
jb 0x14006e786
xchg r10, rax
mov r10, r8
xchg r10, rax
ret
Function at 0x14006f66c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], 0x1cc484e
xchg rcx, rbp
mov qword [rsp + 8], rbp
xchg rcx, rbp
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
xchg r15, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x34dc8a40
sub rsp, 0x34dc8a60
xchg r10, rbx
mov r10, rcx
xchg rbx, r10
mov r13d, r8d
mov r9d, 0x7adb21eb
sub r9d, 0x319c190d
add r9d, 0x1593202e
sub r9d, 0x5ece290c
xchg rdx, r13
mov r12, r13
xchg rdx, r13
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff17008f2f
add rcx, 0x1e4821d5
add rcx, 0x49e1ac23
add rcx, 0x7fffffff
xor rcx, 0xd5a2d9
popf
pushf
mov eax, 0x3e8594ce
xor eax, 0x224c7d0c
add eax, 0x81f9236
xor eax, 0x330b354e
xor eax, 0x17e24eb2
popf
cmovb r9d, r13d
mov dword [rsp - 0x44], edi
mul r9
cmovo rax, rcx
xchg rcx, r11
mov r11, rax
xchg rcx, r11
call fcn.140083d30
lea r15d, [r13 + 0xfffff]
mov dword [rsp - 0x18], 0x695a1a4e
xor esi, esi
shr r15d, 0x11
shr r15d, 1
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x5b23d1b7
xor ebx, 0x662a1aa7
add ebx, 0x2e6af1dd
sub ebx, 0x6b74bcec
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x30], 0x73cff363
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14006f8ac
mov eax, 0x542a84ed
xor eax, 0xa3bbcc4
add eax, 0x1b304ff6
sub eax, 0x5e4fcf21
sub eax, 0x1ae1b8fe
xchg r12, rcx
mov r12, qword [rsp + 0x60]
xchg rcx, r12
mov r14d, esi
xchg r8, r8
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov dword [rsp - 0x14], 0xcd8b69
sub edi, r14d
mov rdx, rbp
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x18], ecx
mov r8d, edi
call fcn.14007cfd0
test al, al
mov dword [rsp - 0x38], 0x3ff59610
je 0x14006f8aa
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 2
mov dword [rsp - 0x30], 0x3562573b
test edi, edi
je 0x14006f886
mov r15d, dword [rsp + 0x70]
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
lea eax, [r14 + r8]
xchg r8, r8
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xchg rcx, rcx
xor edx, 0x7c32534
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
mov dword [rsp - 0x20], 0x1fd6ac80
jb 0x14006f84f
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x365fea89
xor eax, 0x4692c1cc
xor eax, 0x68eeb159
sub eax, 0x18139a1c
cmp esi, r15d
jb 0x14006f7d9
jmp 0x14006f8ac
xor bl, bl
xchg r14, rbp
mov rcx, r14
xchg r14, rbp
call fcn.140083d40
mov rbp, rbp
mov al, bl
xchg rbx, r9
mov r9, qword [rsp + 0x68]
xchg rbx, r9
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov dword [rsp - 0x28], esp
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400700b0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rbp, rsi
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
mov qword [rsp + 0x18], rsi
xchg r11, r11
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x4effc016
mov qword [rsp], r15
nop
add rsp, 0x11ca7e14
sub rsp, 0x11ca7e34
xchg r12, rcx
mov r15, r12
xchg r12, rcx
mov r14d, r8d
mov r9d, 0x7e4c10bc
sub r9d, 0x4d69aafb
sub r9d, 0x204708ce
sub r9d, 0x10975cf3
xchg rdi, rdx
mov r12, rdi
xchg rdx, rdi
cmp r8d, r9d
mov rbx, rbx
pushf
movabs rcx, 0xffffffff20ca09ed
add rcx, 0x30b30d24
xor rcx, 0x396822a6
add rcx, 0x7fffffff
add rcx, 0x17eaca49
popf
pushf
mov eax, 0x51593cd5
sub eax, 0x4095d05d
add eax, 0x13f893a8
add eax, 0x4bdc4112
sub eax, 0x7098412e
popf
cmovb r9d, r14d
mov dword [rsp - 0x1c], 0x1e27ab27
mul r9
cmovo rax, rcx
xchg rcx, r14
mov r14, rax
xchg r14, rcx
call fcn.140083d30
mov r13d, dword [r15 + 0x18]
mov dword [rsp - 0x3c], 0x5ede34ad
lea ebp, [r14 + 0xfffff]
shr ebp, 0x13
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x38], edx
xchg r15, rax
mov rsi, r15
xchg r15, rax
mov ebx, 0x318a61aa
add ebx, 0x3cec4ba4
xor ebx, 0x2e3bca69
add ebx, 0x112f7cb7
xor ebx, 0x517ce3df
test ebp, ebp
je 0x1400702d9
mov dword [rsp - 0x1c], ebx
mov eax, 0x65d8635b
xor eax, 0x2eb573c2
xor eax, 0x49f389ce
sub eax, 0x28e9957
mov r9d, edi
mov r8d, r14d
mov rsp, rsp
shl r9d, 0xd
shl r9d, 4
shl r9d, 1
shl r9d, 2
sub r8d, r9d
mov dword [rsp - 0x2c], esi
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x2c], 0x5a1e2289
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x14007028d
mov dword [rsp - 0x24], 0x6e86b375
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
xchg rsp, rsp
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x7c32534
mov dword [rdx], eax
mov dword [rsp - 0x30], 0x699023ec
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x140070260
xchg rdx, r8
mov r8, rsi
xchg rdx, r8
xchg rcx, rdi
mov rdi, r15
xchg rcx, rdi
call fcn.14007d330
test al, al
je 0x1400702d7
mov r12, r12
add edi, ebx
mov eax, 0xef8311a
sub eax, 0x90e0ea3
add eax, 0x28c8aff9
add eax, 0x3089c347
sub eax, 0x5f2c95b7
cmp edi, ebp
jb 0x14007020e
jmp 0x1400702d9
xor bl, bl
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140083d40
xchg rcx, rbp
mov rcx, qword [rsp + 0x58]
xchg rcx, rbp
mov al, bl
mov r12, r12
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
nop
add rsp, 0x1db88323
sub rsp, 0x1db88303
pop r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140070440
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x14], edi
mov qword [rsp + 0x10], rbp
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg r15, rsi
xchg rdi, r11
mov qword [rsp + 0x20], r11
xchg rdi, r11
nop
mov qword [rsp - 8], r14
sub rsp, 8
movsxd rbx, dword [rcx + 0x3c]
xchg r8, r8
xor ebp, ebp
add rbx, rcx
xchg rdi, rsp
mov rsp, rdx
xchg rsp, rdi
xchg r14, rcx
mov rcx, r14
xchg r14, rcx
movzx r9d, bp
movzx eax, word [rbx + 0x14]
mov dword [rsp - 0xc], ebp
lea r8, [rbx + 0x18]
movzx r11d, word [rbx + 6]
add r8, rax
mov r10d, dword [rbx + 0xb0]
xchg rcx, rcx
cmp bp, r11w
jae 0x14007050e
mov eax, dword [r8 + 8]
test eax, eax
xchg r14, r14
jne 0x1400704cb
mov eax, dword [r8 + 0x10]
mov edx, dword [r8 + 0xc]
cmp r10d, edx
mov dword [rsp - 0x34], 0x796c3368
jb 0x1400704ee
add eax, edx
cmp r10d, eax
xchg r12, r12
jb 0x140070635
inc r9w
nop
add r8, 0x531814e
sub r8, 0x5318126
cmp r9w, r11w
xchg rbx, rbx
jb 0x1400704b8
xchg rbp, r13
mov r10, r13
xchg rbp, r13
sub rdi, qword [rbx + 0x30]
mov dword [rsp - 0x38], 0x102f5e76
mov esi, dword [rbx + 0xb4]
mov ebx, ebp
test esi, esi
mov dword [rsp - 0x2c], 0xe4a0f3e
je 0x14007068e
nop dword [rax + rax]
movsxd rcx, dword [r14 + 0x3c]
xchg rsp, rsp
lea rdx, [r14 + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov dword [rsp - 0x2c], 0x4a1cbb50
movzx r8d, bp
movzx eax, word [rcx + r14 + 0x14]
movzx ecx, word [rcx + r14 + 6]
add rdx, rax
mov rsp, rsp
cmp bp, cx
jae 0x1400705cd
mov eax, dword [rdx + 8]
test eax, eax
mov dword [rsp - 0x28], 0x20a69fcb
jne 0x14007058e
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
xchg r13, r13
cmp r11d, r9d
jb 0x1400705ad
add eax, r9d
cmp r11d, eax
xchg rdx, rdx
jb 0x14007064a
inc r8w
nop
add rdx, 0x2c7d2210
sub rdx, 0x2c7d21e8
cmp r8w, cx
jb 0x140070578
xchg r13, r13
mov rdx, rbp
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
neg rax
sub rax, 0xfffffffffffffff8
neg rax
add r10, 8
xchg r12, r12
shr rax, 1
test eax, eax
je 0x14007067f
mov dword [rsp - 0x38], esp
mov r8d, eax
nop dword [rax]
movzx eax, word [r10]
mov rbx, rbx
mov ecx, eax
shr ecx, 7
shr ecx, 5
cmp ecx, 3
xchg rbp, rbp
je 0x140070663
cmp ecx, 0xa
jne 0x14007066e
and eax, 0xfff
mov dword [rsp - 0x38], edx
add qword [rax + rdx], rdi
jmp 0x14007066e
mov eax, dword [r8 + 0x14]
sub rax, rdx
add rax, r14
mov r12, r12
add r10, rax
jmp 0x140070517
mov edx, dword [rdx + 0x14]
sub rdx, r9
add rdx, r14
mov dword [rsp - 0x24], 0xdcd99e
add rdx, r11
jmp 0x1400705d0
and eax, 0xfff
mov r15, r15
add dword [rax + rdx], edi
sub r10, 0xfffffffffffffffe
sub r8, 1
mov rdi, rdi
jne 0x1400705ff
add ebx, dword [r9]
cmp ebx, esi
jb 0x140070540
mov dword [rsp - 0x20], ecx
mov rbx, qword [rsp + 0x10]
xchg rcx, rbp
mov rcx, qword [rsp + 0x18]
xchg rbp, rcx
xchg rsi, rcx
mov rcx, qword [rsp + 0x20]
xchg rcx, rsi
mov rdi, qword [rsp + 0x28]
xchg r13, r13
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140071f90
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
mov r8, r8
push r15
nop
sub rsp, 0xcc99b8
add rsp, 0xcc9998
movzx eax, word [rcx]
mov dword [rsp - 0x18], 0x24fd394f
mov r15d, edx
xor eax, 0x7c32534
xchg rsi, r12
mov r12, rcx
xchg r12, rsi
cmp eax, 0x7c37f79
xchg rbx, rbx
jne 0x140072156
movsxd rcx, dword [rcx + 0x3c]
mov eax, dword [rcx + rsi]
xchg r14, r14
xor eax, 0x7c32534
cmp eax, 0x7c36064
jne 0x140072156
mov edx, dword [rcx + rsi + 0x88]
mov r8, r8
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140071eb0
mov rbp, rbp
mov rcx, rsi
xchg r14, r13
mov r13, rax
xchg r14, r13
mov edx, dword [rax + 0x20]
call fcn.140071eb0
mov r10, r10
mov edx, dword [r14 + 0x24]
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
mov r12, rax
mov dword [rsp - 0x10], esi
call fcn.140071eb0
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg rdx, rdx
xchg rdx, rax
mov r13, rdx
xchg rdx, rax
call fcn.140071eb0
xor edi, edi
xchg r14, r14
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140072156
xchg rbp, rbp
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
call fcn.140071eb0
mov dword [rsp - 0x30], ebp
mov ecx, 0x7112c8ab
xor ecx, 0x501fb022
add ecx, 0x4e1bbda0
xor ecx, 0x59e27fe9
add ecx, 0xc934b63f
xchg r14, rax
mov rbx, r14
xchg r14, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140072134
mov dword [rsp - 0x18], ecx
nop dword [rax]
xchg rsi, rbx
mov rdx, rsi
xchg rsi, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x2d8c8ccf
xor r8d, 0x1a9bf19f
xor r8d, 0x59c7006b
sub r8d, 0x6ed07d3a
inc rbx
call fcn.14007a560
cmp byte [rbx], 0
mov dword [rsp - 0x14], 0x2e9ebcdd
jne 0x1400720ee
mov ecx, dword [rsp + 0x60]
not ecx
mov dword [rsp - 0x24], 0x58d75a1c
cmp ecx, r15d
je 0x1400721af
inc edi
mov rbx, rbx
cmp edi, dword [r14 + 0x18]
jb 0x1400720a0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x40], esp
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx eax, word [r13 + rdi*2]
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + rax*4]
mov rdi, rdi
xchg rcx, rbx
mov rbx, rsi
xchg rcx, rbx
call fcn.140071eb0
jmp 0x140072158