joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073f51
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg rsp, rsp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r15
add rsp, 0xffffffffffffffa0
lea rdi, [rcx + 8]
mov dword [rsp - 0x24], edi
xchg r9, rdx
mov r15, r9
xchg r9, rdx
xchg rsi, rdi
mov qword [rcx], rsi
xchg rsi, rdi
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov rcx, rdi
mov rsp, rsp
xor edx, edx
mov r8d, 0x62b5d99c
sub r8d, 0x21281242
xor r8d, 0x26c85a95
xor r8d, 0x3a837429
sub r8d, 0x5dc6e8e6
call fcn.140098cf0
mov dword [rsp - 0x2c], esp
mov rax, qword [r15 + 0x38]
xchg r9, rax
mov qword [rbx + 0x108], r9
xchg r9, rax
mov rcx, qword [rbx]
lea rsi, [rax + 1]
cmp rcx, rdi
xchg rdi, rdi
je 0x140073ea6
call fcn.1400986e0
cmp rsi, 0x80
mov r12, r12
jbe 0x140073ede
lea rcx, [rsi + rsi]
call fcn.1400989b0
mov qword [rbx], rax
xchg rdx, rdx
test rax, rax
jne 0x140073ee8
mov qword [rbx], rdi
mov dword [rsp - 0x10], 0x6ec1854e
jmp 0x1400740b7
mov qword [rbx], rdi
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xor edx, edx
mov qword [rsp + 0x88], r14
xchg r13, r13
mov r8d, 0x4689f52f
sub r8d, 0x29b12831
add r8d, 0x55cadb77
xor r8d, 0x72a3a975
mov rcx, rax
call fcn.140098cf0
mov r14, qword [rbx]
mov dword [rsp - 0x14], 0x9a17cbc
test r14, r14
je 0x1400740ac
mov rsi, qword [r15]
mov dword [rsp - 0x28], 0x17f69479
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg r11, rbp
mov qword [rsp + 0x80], r11
xchg rbp, r11
mov rbp, qword [r15 + 0x38]
lea rcx, [rsp + 0x20]
xchg r8, rax
mov qword [rsp + 0x20], r8
xchg r8, rax
xchg rdi, rsp
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rbp + 1]
xchg rsp, r12
movups xmmword [r12 + 0x38], xmm0
xchg r12, rsp
xchg r13, rsp
movups xmmword [r13 + 0x48], xmm0
xchg r13, rsp
call fcn.14001794c
mov rsi, rsi
mov edx, 0xa3e309a
add edx, 0x23bb488c
add edx, 0x502cabe7
xor edx, 0x2e7d32ea
test rbp, rbp
mov dword [rsp - 0x10], 0x3ca80f95
je 0x14007401a
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
sub rsi, rax
xchg r8, rdx
mov rdx, rbp
xchg rdx, r8
mov r9d, 0x6fe5be6
add r9d, 0x6490f38b
sub r9d, 0x5db86b9
xor r9d, 0x65b3c847
nop dword [rax]
nop dword [rax + rax]
movzx ecx, dx
mov r15, r15
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rsi + rdi - 2]
mov dword [rsp - 0x34], ecx
mov word [rdi - 2], cx
sub r8, 1
jne 0x140073fee
xor ecx, ecx
mov dword [rsp - 0xc], 0x66d413d
mov word [rax + rbp*2], cx
xchg rbp, rcx
mov rbp, r14
xchg rcx, rbp
mov rdx, qword [rbx + 0x108]
xchg r15, r8
mov r15, qword [rsp + 0x20]
xchg r8, r15
inc rdx
mov dword [rsp - 0x2c], 0x38500f57
call fcn.140099780
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x80]
mov dword [rsp - 0x2c], 0x573d5095
cmp rcx, rax
jne 0x1400740a7
lea rdi, [rsp + 0x28]
mov rsp, rsp
xor eax, eax
mov ecx, 0x457be665
xor ecx, 0x2f2dd641
add ecx, 0x74b4114
sub ecx, 0x20346e58
sub ecx, 0x516d02b0
rep stosb byte [rdi], al
xchg r12, r12
jmp 0x1400740ac
call fcn.1400986e0
mov r14, qword [rsp + 0x88]
mov rbx, rbx
mov rax, rbx
mov rbx, qword [rsp + 0x90]
nop
add rsp, 0x712cc481
sub rsp, 0x712cc421
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x14007e668
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
mov rcx, rcx
sub r10, rcx
xchg r8, rcx
mov rcx, r8
xchg r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x61a19b4c
sub edx, 0x1e77357c
xor edx, 0x502c7eec
add edx, 0x18c14213
inc r9
mov dword [rsp - 0x18], 0xfd2854e
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
mov dword [rsp - 0x1c], 0x40513713
cmp r9, 0x10
jb 0x14007e681
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x14007f544
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push r10
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov rbx, rcx
mov r13d, r8d
xchg r8, r8
mov r9d, 0x63e7f8c7
sub r9d, 0x2271ff65
sub r9d, 0x2e816861
xor r9d, 0x291966cd
sub r9d, 0x3be9f7cc
mov r12, rdx
mov dword [rsp - 0x24], ebp
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff1dc7cfff
add rcx, 0x388e6137
sub rcx, 0x4a6e3255
add rcx, 0x73263124
add rcx, 0x7fffffff
add rcx, 0xf1cffb
popf
pushf
mov eax, 0x3c560017
sub eax, 0x38050c04
add eax, 0x32575f21
xor eax, 0x36a85330
popf
cmovb r9d, r13d
mov dword [rsp - 0x28], 0x813b16d
mul r9
cmovo rax, rcx
xchg rcx, r14
mov r14, rax
xchg rcx, r14
call fcn.140098590
xchg r11, r11
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0xd
shr r15d, 2
shr r15d, 1
shr r15d, 3
shr r15d, 1
xchg rbp, r8
mov r8, rax
xchg rbp, r8
mov eax, dword [rbx + 0x18]
mov r10, r10
mov ebx, 0x3ed29850
add ebx, 0x22c0666c
sub ebx, 0x8c19c95
xor ebx, 0x58d16226
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x30], edx
test r15d, r15d
je 0x14007f764
mov eax, 0x2791f8b0
xor eax, 0x1ab4fdff
add eax, 0x1f27387d
sub eax, 0x5c3c3dcc
xchg r10, rcx
mov r10, qword [rsp + 0x60]
xchg rcx, r10
mov r14d, esi
mov dword [rsp - 0x24], esp
shl r14d, 0x11
shl r14d, 1
shl r14d, 1
shl r14d, 1
mov edi, r13d
sub edi, r14d
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
cmp edi, eax
mov dword [rsp - 0x3c], 0x503028
cmova edi, eax
mov r8d, edi
call fcn.140092920
mov dword [rsp - 0x44], edi
test al, al
je 0x14007f762
shr edi, 2
mov r11, r11
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
je 0x14007f73b
mov r15d, dword [rsp + 0x70]
mov dword [rsp - 0xc], ebx
mov r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
xor edx, dword [r9]
mov dword [rsp - 0x2c], 0x157e4fa
add r8d, ebx
xor edx, 0x528a073c
lea r9, [r9 + 4]
mov r8, r8
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14007f703
mov r15d, dword [rsp + 0x78]
mov dword [rsp - 0x24], ebx
add esi, ebx
mov eax, 0x2d8777c
xor eax, 0x4ce46dac
add eax, 0xa8e96c0
sub eax, 0x58bab190
cmp esi, r15d
xchg r15, r15
jb 0x14007f691
jmp 0x14007f764
xor bl, bl
xchg rcx, rbp
mov rbp, rcx
xchg rcx, rbp
call fcn.1400985a0
mov dword [rsp - 0x10], 0x38b94b1a
mov al, bl
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14007ffec
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
xchg rbp, r12
mov qword [rsp + 0x10], r12
xchg r12, rbp
mov qword [rsp + 0x18], rsi
xchg r15, r15
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov rdx, rdx
nop
sub rsp, 0x40110bba
add rsp, 0x40110b9a
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
mov r14d, r8d
mov r9d, 0x43666fc8
xor r9d, 0x6ac9e706
xor r9d, 0x496d9073
sub r9d, 0x60be18bd
xchg r11, r12
mov r11, rdx
xchg r12, r11
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff005fb578
add rcx, 0x78e10506
sub rcx, 0x5dda5310
xor rcx, 0x7f5dc13a
add rcx, 0x7fffffff
xor rcx, 0x1bc459ac
popf
pushf
mov eax, 0x22f5c0a7
add eax, 0x51db76fa
xor eax, 0x10dfa006
sub eax, 0x640e97a3
popf
cmovb r9d, r14d
mov dword [rsp - 0x20], ebp
mul r9
cmovo rax, rcx
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.140098590
mov dword [rsp - 0x44], 0x6ab706b0
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xf
shr ebp, 4
shr ebp, 1
xor edi, edi
xchg r14, rax
mov rsi, r14
xchg r14, rax
mov ebx, 0x26aed8d7
add ebx, 0x36fbdeab
add ebx, 0x15f002a1
sub ebx, 0x2be923b9
sub ebx, 0x47b19669
test ebp, ebp
je 0x140080216
mov r14, r14
mov eax, 0x33e759e4
sub eax, 0x143ff241
add eax, 0x49de5d53
sub eax, 0x4f106bde
xor eax, 0x1a655918
mov r9d, edi
xchg rbx, rbx
mov r8d, r14d
shl r9d, 0xf
shl r9d, 1
shl r9d, 1
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
xchg r8, r8
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x18], 0x518515fb
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x1400801c2
xchg r11, r11
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
mov r11, r11
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x528a073c
mov dword [rdx], eax
mov r10, r10
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x140080197
xchg r15, r15
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov rcx, r15
xchg rsp, rsp
call fcn.140092d10
test al, al
je 0x14008020c
add edi, ebx
mov dword [rsp - 0x28], 0x5f37f398
mov eax, 0x2bedef19
xor eax, 0x79494dc5
sub eax, 0x9183ec
sub eax, 0x52031ef0
cmp edi, ebp
xchg rcx, rcx
jb 0x140080141
jmp 0x140080216
xor bl, bl
mov dword [rsp - 0x30], 0x3c07142
mov rcx, rsi
call fcn.1400985a0
mov rbp, qword [rsp + 0x58]
mov al, bl
mov dword [rsp - 0x44], ebx
xchg r14, rbx
mov r14, qword [rsp + 0x50]
xchg r14, rbx
mov rsi, qword [rsp + 0x60]
xchg r8, r8
nop
sub rsp, 0x26d0414e
add rsp, 0x26d0416e
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x38], 0x15ba69de
pop rdi
ret
Function at 0x140082cb0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0xc], 0x1ca2a28c
xchg r12, rsi
mov qword [rsp + 0x18], r12
xchg r12, rsi
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg rdi, r11
push r14
mov r13, r13
nop
add rsp, 0x5ade355f
sub rsp, 0x5ade357f
movsxd rbx, dword [rcx + 0x3c]
xchg r8, r8
xchg rdi, r8
mov r8, rdx
xchg rdi, r8
xchg rcx, r10
mov rsi, r10
xchg rcx, r10
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140084a10
mov dword [rsp - 0x2c], ebx
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rbp, rbp
mov r10, rax
mov ebx, r14d
test ebp, ebp
je 0x140082e8a
mov rsp, rsp
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov dword [rsp - 0x20], 0x165602ec
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov dword [rsp - 0x1c], 0x725b8ba2
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x38], 0x2625f3cf
jae 0x140082dce
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140082d98
mov dword [rsp - 0x40], 0x2d3f8697
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x140082db8
mov dword [rsp - 0x24], ecx
add eax, r9d
cmp r11d, eax
jb 0x140082e39
mov rbx, rbx
inc r8w
add rdx, 0x28
cmp r8w, cx
mov dword [rsp - 0x3c], ebp
jb 0x140082d82
xchg rdi, r8
mov rdi, r14
xchg r8, rdi
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg r13, r13
add rax, 0xfffffffffffffff8
sub r10, 0xfffffffffffffff8
shr rax, 1
test eax, eax
xchg r13, r13
je 0x140082e7c
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x38], 0x4fde2f7d
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xb
shr ecx, 1
cmp ecx, 3
je 0x140082e53
mov rbp, rbp
cmp ecx, 0xa
jne 0x140082e60
and eax, 0xfff
add qword [rax + r8], rdi
mov r12, r12
jmp 0x140082e60
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov dword [rsp - 0x44], 0xb0677bc
add r8, rsi
add r8, r11
jmp 0x140082dd7
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x38], esp
nop
add r10, 0x54e1d05b
sub r10, 0x54e1d059
sub rdx, 1
xchg r13, r13
jne 0x140082e08
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140082d41
mov rsi, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg r10, rsi
mov r10, qword [rsp + 0x40]
xchg r10, rsi
mov rdi, qword [rsp + 0x48]
nop
sub rsp, 0x169df408
add rsp, 0x169df428
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140084a10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
mov dword [rsp - 0x2c], 0x3e64ebdf
xor r9d, r9d
add r8, rcx
mov r10d, edx
mov rsp, rsp
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
mov dword [rsp - 0x34], 0x788af09b
add rax, r8
cmp r9w, r11w
jae 0x140084ab2
mov rcx, rcx
nop dword [rax]
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x140084a71
mov r13, r13
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x140084a8b
mov r13, r13
add ecx, edx
cmp r10d, ecx
jb 0x140084aba
inc r9w
mov dword [rsp - 0xc], esp
nop
sub rax, 0x5bf6417
add rax, 0x5bf643f
cmp r9w, r11w
jb 0x140084a60
mov dword [rsp - 0x18], 0x71be0cde
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
xchg r10, r10
mov rbx, qword [rsp + 8]
add rax, r10
ret
Function at 0x140084ad0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg r8, rbx
push rbp
mov dword [rsp - 0x34], 0x41d0e75d
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
push r12
mov dword [rsp - 0x40], ecx
push r11
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov r12, r12
sub rsp, 0x20
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x2c], 0x13031b7f
xor eax, 0x528a073c
mov rsi, rcx
cmp eax, 0x528a5d71
jne 0x140084c7f
mov dword [rsp - 0x2c], 0x110c339e
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x528a073c
cmp eax, 0x528a426c
mov dword [rsp - 0x3c], ecx
jne 0x140084c7f
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084a10
mov rcx, rsi
mov dword [rsp - 0x2c], 0x1d6e63f2
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.140084a10
mov r14, r14
mov edx, dword [r14 + 0x24]
xchg rcx, rbx
mov rbx, rsi
xchg rbx, rcx
xchg r13, r12
mov r13, rax
xchg r13, r12
call fcn.140084a10
mov edx, dword [r14 + 0x1c]
xchg r11, rsi
mov rcx, r11
xchg r11, rsi
xchg r13, rdx
mov rdx, rax
xchg r13, rdx
call fcn.140084a10
mov dword [rsp - 0x24], 0x311f3703
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x30], 0x3bb58de9
jbe 0x140084c7f
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140084a10
mov ecx, 0x5b4c7a87
sub ecx, 0x3298f0c9
add ecx, 0x143605b8
xor ecx, 0x6bda2c9a
add ecx, 0xa8cc5c13
mov rbx, rax
mov dword [rsp - 0x44], ebx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140084c65
nop dword [rax]
mov dword [rsp - 0x30], edx
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x6eee2065
sub r8d, 0x633922bf
xor r8d, 0x869e233
xor r8d, 0x3dd1f94
inc rbx
mov dword [rsp - 0x10], 0x6c4c4798
call fcn.14008dd20
cmp byte [rbx], 0
jne 0x140084c21
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x2c], ebp
not ecx
cmp ecx, r15d
je 0x140084cc9
inc edi
mov rbp, rbp
cmp edi, dword [r14 + 0x18]
jb 0x140084bd7
xor eax, eax
mov dword [rsp - 0x44], 0x5323c25a
xchg rbp, rbx
mov rbp, qword [rsp + 0x68]
xchg rbx, rbp
add rsp, 0x20
pop r15
xchg r9, r9
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
mov r15, r15
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, rdi
mov rdi, rsi
xchg rcx, rdi
xchg r13, rax
mov r13, qword [rsp + 0x70]
xchg r13, rax
mov edx, dword [rax + rdx*4]
mov r12, r12
call fcn.140084a10
jmp 0x140084c89
Function at 0x140084d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x52d5bd2f
sub rsp, 0x52d5bd4f
movzx eax, word [rcx]
mov r8, r8
mov edi, edx
xor eax, 0x528a073c
xchg r10, rbx
mov r10, rcx
xchg rbx, r10
cmp eax, 0x528a5d71
jne 0x140084dbe
mov rdx, rdx
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x528a073c
cmp eax, 0x528a426c
mov dword [rsp - 0xc], 0xdd942b2
jne 0x140084dbe
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084a10
mov dword [rsp - 0x14], edx
sub edi, dword [rax + 0x10]
cmp edi, dword [rax + 0x14]
jae 0x140084dbe
mov edx, dword [rax + 0x1c]
mov dword [rsp - 0x38], 0x1b66ead9
mov rcx, rbx
call fcn.140084a10
mov rcx, rbx
mov edx, dword [rax + rdi*4]
mov dword [rsp - 0x14], ebx
mov rbx, qword [rsp + 0x30]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.140084a10
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x40], 0x3a535776
xor eax, eax
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140089080
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp - 0x10], ecx
mov qword [rsp + 0x70], rsi
xchg rsi, r13
mov r13, qword [rcx + 0x38]
xchg rsi, r13
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x38], 0xb10aebf
mov qword [rsp + 0x20], rax
xchg rsp, r13
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x44], ecx
xchg r11, rsp
movups xmmword [r11 + 0x38], xmm0
xchg rsp, r11
xchg rsp, r13
movups xmmword [r13 + 0x48], xmm0
xchg r13, rsp
call fcn.14001794c
xchg rbx, rbx
mov edx, 0x4436fb20
xor edx, 0x2343f77
sub edx, 0x3f5429a0
xor edx, 0x5e3ae482
xor edx, 0x8cf69d2
test rsi, rsi
mov rdx, rdx
je 0x14008918f
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x34], edi
mov r8, rsi
mov r9d, 0x7440201c
sub r9d, 0x1026ab79
sub r9d, 0x296bc956
sub r9d, 0x3aadaa4e
nop dword [rax]
mov rbx, rbx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov rdi, rdi
ror edx, 5
ror edx, 3
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x38], esi
mov word [rdi - 2], cx
sub r8, 1
jne 0x140089164
xor ecx, ecx
mov r10, r10
mov word [rax + rsi*2], cx
xchg r9, rcx
mov r9, qword [rsp + 0x20]
xchg rcx, r9
call fcn.140089230
xchg rcx, r14
mov r14, qword [rsp + 0x20]
xchg rcx, r14
mov ebx, eax
mov rdx, rdx
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov r14, r14
jne 0x14008920c
xor eax, eax
lea rdi, [rsp + 0x28]
xchg rsi, rsi
mov ecx, 0x4d7956fd
add ecx, 0x22da8bff
sub ecx, 0x498ea6fd
sub ecx, 0x26c53bcf
rep stosb byte [rdi], al
xchg rdx, rdx
mov eax, ebx
mov rbx, qword [rsp + 0x78]
nop
sub rsp, 0x21eadf38
add rsp, 0x21eadf98
pop rdi
ret
call fcn.1400986e0
mov eax, ebx
xchg rdi, rdi
xchg r15, rbx
mov r15, qword [rsp + 0x78]
xchg r15, rbx
add rsp, 0x60
mov dword [rsp - 0x2c], ebx
pop rdi
ret
Function at 0x14008a726
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg r11, rsp
mov qword [r11 + 0x20], rbx
mov dword [rsp - 0x30], 0x341509d
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
mov rbx, qword [rcx]
mov dword [rsp - 0x28], edi
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov r10, r10
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg r13, rsi
mov qword [r11 + 0x10], r13
xchg r13, rsi
xchg rsi, r12
mov r12, qword [rcx + 0x38]
xchg rsi, r12
lea rcx, [r11 - 0x48]
mov rbx, rbx
xchg r13, r14
mov qword [r11 + 0x18], r13
xchg r13, r14
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg rdi, rsp
movups xmmword [rdi + 0x38], xmm0
xchg rdi, rsp
xchg r10, rsp
movups xmmword [r10 + 0x48], xmm0
xchg r10, rsp
call fcn.14001794c
mov dword [rsp - 0x40], esi
mov edx, 0x3baa2799
xor edx, 0x546a78a8
xor edx, 0xf6e0001
xor edx, 0x30f548d7
test rsi, rsi
mov dword [rsp - 0x30], edi
je 0x14008a77d
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rsi, r8
mov rsi, r8
xchg rsi, r8
mov r9d, 0xe2d819b
add r9d, 0x47c78ae
xor r9d, 0x76f65330
sub r9d, 0x645fa87a
nop word [rax + rax]
movzx ecx, dx
xchg r9, r9
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 5
ror edx, 2
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x10], esp
sub r8, 1
jne 0x14008a750
xor ecx, ecx
mov r8d, ebp
mov dword [rsp - 0x3c], esp
mov word [rax + rsi*2], cx
xchg r14, r11
mov rdx, r11
xchg r11, r14
mov rcx, qword [rsp + 0x20]
mov r10, r10
call fcn.14008a860
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov dword [rsp - 0x40], ebp
xchg r14, r11
mov r11, qword [rsp + 0x80]
xchg r11, r14
lea rax, [rsp + 0x28]
mov dword [rsp - 0x34], edx
xchg rsi, r12
mov r12, qword [rsp + 0x78]
xchg rsi, r12
xchg r9, rbp
mov r9, qword [rsp + 0x70]
xchg rbp, r9
cmp rcx, rax
jne 0x14008a82a
xchg r9, r9
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x7c9deb21
sub ecx, 0x28c43425
xor ecx, 0x7a3699e8
xor ecx, 0x29ef2f24
rep stosb byte [rdi], al
mov dword [rsp - 0x38], 0x2d0d72f0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400986e0
mov dword [rsp - 0xc], edi
mov eax, ebx
xchg rbx, r11
mov r11, qword [rsp + 0x88]
xchg rbx, r11
nop
sub rsp, 0x1abbe9c3
add rsp, 0x1abbea23
pop rdi
mov dword [rsp - 0x34], ecx
ret
Function at 0x14008a860
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x20], ecx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
xor edx, edx
mov dword [rsp - 0x10], edi
lea rcx, [rsp + 0x30]
mov r8d, 0x1d44efa7
xor r8d, 0x23a5c9bb
sub r8d, 0x280e3607
sub r8d, 0x16d2ee0d
call fcn.140098cf0
mov rax, qword gs:[0x60]
xchg r14, r14
xchg r8, rdi
mov rdi, qword [rax + 0x18]
xchg r8, rdi
mov rax, qword [r8 + 0x10]
mov dword [rsp - 0x1c], edx
mov r8, qword [rax]
test r8, r8
je 0x14008ab09
mov r9, r9
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008ab09
mov dword [rsp - 0x18], esi
mov edx, 0xd84ef48
xor edx, 0x6658ed2b
xor edx, 0x5fd0b14b
xor edx, 0x69431acf
sub edx, 0x5d4fa8e3
lea rcx, [rsp + 0x30]
mov rsp, rsp
lea r9d, [rdx - 1]
call fcn.1400998b0
mov edx, 0xc3b73bc
add edx, 0x2b554c38
sub edx, 0x2fcebdbf
sub edx, 0x7c201d9
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x3c], 0x3e5182fe
call fcn.1400999b0
test rax, rax
je 0x14008aad5
mov dword [rsp - 0x30], ebx
xor ecx, ecx
xchg rdi, r8
mov rdx, r8
xchg r8, rdi
mov word [rax], cx
xchg rdx, rdx
movabs rcx, 0x449a138c06c4e378
add rcx, 0x56fe44e0
sub rcx, 0x1d06a3fb
add rcx, 0x18df78c0
mov rax, qword [0x140142690]
ror rax, 0x10
ror rax, 7
ror rax, 6
ror rax, 1
ror rax, 2
ror rax, 2
ror rax, 1
sub rax, rcx
xchg r11, r11
movabs rcx, 0x2a9dd4011eeb8ec4
add rcx, 0x3b48b7
add rcx, 0x57c4b86b
sub rcx, 0x55d8da2f
add rcx, 0x7fffffff
add rcx, 0x2a862752
rol rax, 0xc
rol rax, 7
rol rax, 0xf
rol rax, 0xa
xor rax, rcx
movabs rcx, 0x657610334af8152b
xor rcx, 0x54bbcca
xor rcx, 0x31005cf5
add rcx, 0x38f7f779
sub rax, rcx
mov dword [rsp - 0x44], esi
lea rcx, [rsp + 0x20]
call rax
mov r10, qword [0x140142680]
mov dword [rsp - 0x30], 0x7fe19805
lea r8, [rsp + 0x20]
movabs rcx, 0xfc338c6f67a522d8
sub rcx, 0x6d309ef
sub rcx, 0x5962e950
add rcx, 0x76cc7e92
sub rcx, 0x35816d59
lea rdx, [rsp + 0x260]
mov r9, r9
add r10, rcx
mov r9, rbx
ror r10, 3
ror r10, 9
ror r10, 3
ror r10, 2
ror r10, 1
ror r10, 1
lea rcx, [rsp + 0x30]
mov r12, r12
not r10
rol r10, 4
rol r10, 2
rol r10, 5
rol r10, 0xc
rol r10, 1
rol r10, 1
rol r10, 1
rol r10, 1
call r10
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x20], 0x6b5c21fa
sub rsp, 0x28875aa5
add rsp, 0x28875ce5
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x351b7f91
add eax, 0x171d4f60
add eax, 0x124b935d
add eax, 0x617b9db3
mov rbx, qword [rsp + 0x250]
add rsp, 0x16d7f5b2
sub rsp, 0x16d7f372
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xchg r10, rbx
mov r10, qword [rsp + 0x250]
xchg rbx, r10
mov eax, 0x5a31b054
xor eax, 0x12ac605
xor eax, 0x4a86f00b
xor eax, 0xd19d876f
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret