joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086c60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x140086c83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x140086c70
mov byte [rcx + 7], 0
ret

Function at 0x140086c90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x140086cb8
xor eax, eax
mov r8d, 0x2a77
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x140086ca0
mov byte [rcx + 0x68], 0
ret

Function at 0x140086cc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140086ce8
xor eax, eax
mov r8d, 0x2a77
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x140086cd0
mov byte [rcx + 0x22], 0
ret

Function at 0x140086cf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140086d18
xor eax, eax
mov r8d, 0x2a77
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xd
jb 0x140086d00
mov byte [rcx + 0x1c], 0
ret

Function at 0x140086d20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140086d43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140086d30
mov byte [rcx + 4], 0
ret

Function at 0x140086d50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140086d73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140086d60
mov byte [rcx + 0x1d], 0
ret

Function at 0x140086d80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140086da3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x140086d90
mov byte [rcx + 0x14], 0
ret

Function at 0x140086db0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140086dd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140086dc0
mov byte [rcx + 9], 0
ret

Function at 0x140086df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5b], 0
je 0x140086e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5a
jb 0x140086e00
mov byte [rcx + 0x5b], 0
ret

Function at 0x140086e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140086e43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x140086e30
mov byte [rcx + 0x16], 0
ret

Function at 0x140086e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x57], 0
je 0x140086e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x56
jb 0x140086e60
mov byte [rcx + 0x57], 0
ret

Function at 0x140086e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140086ea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140086e90
mov byte [rcx + 0x12], 0
ret
Function at 0x140086eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x52], 0
je 0x140086ed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x51
jb 0x140086ec0
mov byte [rcx + 0x52], 0
ret

Function at 0x140086ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140086f03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140086ef0
mov byte [rcx + 0xe], 0
ret

Function at 0x140086f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140086f33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140086f20
mov byte [rcx + 0xb], 0
ret

Function at 0x140086f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140086f63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140086f50
mov byte [rcx + 3], 0
ret

Function at 0x140086fd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140086ff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x140086fe0
mov byte [rcx + 6], 0
ret

Function at 0x140087170
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x140087193
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x140087180
mov byte [rcx + 0x1f], 0
ret

Function at 0x1400871a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400871c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400871b0
mov byte [rcx + 5], 0
ret

Function at 0x1400871d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400871f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400871e0
mov byte [rcx + 8], 0
ret

Function at 0x140087200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140087228
xor eax, eax
mov r8d, 0x2a77
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 4
jb 0x140087210
mov byte [rcx + 0xa], 0
ret

Function at 0x14008b280
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1406c9e84]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406c9e88]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x78
ret
Function at 0x14008b310
Capabilities:
Write file on windows

Disassembly:
push rbx
mov eax, 0x1070
call fcn.140238120
sub rsp, rax
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov eax, dword [0x1406c9e84]
mov rbx, rcx
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x48], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406c9e88]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x1070
pop rbx
ret

Function at 0x14008dca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14008dd01
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14008dcc0
mov ecx, dword [r10]
jmp 0x14008ddea
cmp ecx, 0x4e0
jb 0x14008ddea
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14008dd20
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14008dd70
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14008ebd0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14008ec60
mov r11, rax
cmp byte [rax + 0xc], 0
jne 0x14008ec42
lea rcx, [rax + 0x10]
xor r8d, r8d
nop dword [rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x14008ec27
lea r9d, [rax + 2]
cmp edx, r9d
je 0x14008ec27
cmp edx, eax
je 0x14008ec2f
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x14008ec20
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14008ebf0
add eax, 5
cmp edx, eax
jne 0x14008ec35
xor dword [rcx], r9d
inc dword [r11]
jmp 0x14008ebf0
lea eax, [r8 + 0x77]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x14008ebf0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400933f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rcx
mov byte [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140093586
mov ebp, 0x5a4d
cmp word [rax], bp
jne 0x140093586
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
cmp dword [rbx], 0x4550
jne 0x140093586
movzx eax, word [rbx + 0x14]
lea rdi, [rbx + 0x18]
mov r8, rsi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
add rdi, rax
call fcn.1400935b0
mov r11, qword [rsp + 0x30]
test r11, r11
je 0x140093586
mov rax, qword [rsp + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140093586
cmp word [r11], bp
jne 0x140093572
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
jne 0x140093572
mov eax, dword [rbx + 8]
cmp dword [rcx + 8], eax
jne 0x140093572
movzx edx, word [rcx + 6]
cmp dx, word [rbx + 6]
jne 0x140093572
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
xor bl, bl
xor r9d, r9d
mov ebp, edx
test edx, edx
je 0x140093559
mov r8, r14
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140093503
inc rax
test ecx, ecx
jne 0x1400934f0
test edx, edx
jne 0x140093510
test dword [rdi + 0x24], 0x20000000
jne 0x140093522
inc r9d
add rdi, 0x28
add r10, 0x28
cmp r9d, ebp
jl 0x1400934e0
jmp 0x140093559
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x140093559
mov edx, dword [rdi + 0xc]
mov r9d, eax
mov r8d, dword [r10 + 0x14]
add rdx, rsi
add r8, r11
mov eax, 1
nop
movzx ecx, byte [r8]
lea r8, [r8 + 1]
cmp byte [rdx], cl
lea rdx, [rdx + 1]
movzx ebx, bl
cmovne ebx, eax
sub r9, rax
jne 0x140093540
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x140093588
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402376c0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140093dd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.140094010
xor ebx, ebx
mov r11, rax
cmp byte [rax + 0xc], bl
jne 0x140093e52
lea rcx, [rax + 0x10]
mov r8d, ebx
nop dword [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x140093e37
lea r9d, [rax + 2]
cmp edx, r9d
je 0x140093e37
cmp edx, eax
je 0x140093e3f
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x140093e30
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140093e00
add eax, 5
cmp edx, eax
jne 0x140093e45
xor dword [rcx], r9d
inc dword [r11]
jmp 0x140093e00
lea eax, [r8 - 0x77]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x140093e00
mov edi, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call fcn.140093f80
mov r11, rax
cmp byte [rax + 9], bl
jne 0x140093ef0
mov r8d, ebx
nop
mov edx, dword [r11 + 4]
mov r9d, dword [r11]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x140093e8e
movsxd rax, r8d
inc dl
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x140093e70
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x140093ea6
movsxd rax, r8d
add dl, 2
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x140093e70
cmp r9d, edx
je 0x140093edb
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x140093ec3
movsxd rax, r8d
add dl, 3
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x140093e70
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x140093ee7
movsxd rax, r8d
add dl, 4
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x140093e70
movsxd rdx, r8d
lea eax, [r8 - 0x77]
xor byte [rdx + r11 + 0xa], al
inc r8d
cmp r8d, 1
jb 0x140093e70
mov rcx, rsi
mov byte [r11 + 9], 1
call fcn.1400883a0
mov rdx, rax
lea r8, [r11 + 0xa]
mov r9d, edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1400940a0
mov r11, rax
cmp byte [rax + 0xc], bl
jne 0x140093f6f
lea rcx, [rax + 0x10]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x140093f57
lea r8d, [rax + 2]
cmp edx, r8d
je 0x140093f57
cmp edx, eax
je 0x140093f5f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x140093f50
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140093f20
add eax, 5
cmp edx, eax
jne 0x140093f64
xor dword [rcx], r8d
inc dword [r11]
jmp 0x140093f20
lea eax, [rbx - 0x77]
xor dword [rcx], eax
inc ebx
add rcx, 4
cmp ebx, 1
jb 0x140093f20
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400989f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
test rax, rax
je 0x140098a7a
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r9, qword [rbx]
cmp r9, rbx
je 0x140098a7a
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
mov r10d, 0x811c9dc5
movzx ecx, word [r9 + 0x58]
shr rcx, 1
lea r11, [rax + rcx*2]
cmp rax, r11
je 0x140098a72
nop dword [rax + rax]
movsx ecx, byte [rax]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add rax, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp rax, r11
jne 0x140098a40
cmp r10d, 0xa62a3b3b
je 0x140098a82
mov r9, qword [r9]
cmp r9, rbx
jne 0x140098a20
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rax, qword [r9 + 0x30]
mov rbx, qword [rsp + 8]
ret

Function at 0x140098c70
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140098d4d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140098d4d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140098cba
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140098cc2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140098d4d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140098d45
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140098d10
cmp r10d, 0xbf21a4fa
je 0x140098d64
inc r9
cmp r9, rbx
jb 0x140098cf0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140098d4f
Function at 0x140098d80
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140098e5d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140098e5d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140098dca
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140098dd2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140098e5d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140098e55
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140098e20
cmp r10d, 0x97085561
je 0x140098e74
inc r9
cmp r9, rbx
jb 0x140098e00
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140098e5f

Function at 0x140098e90
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140098f6d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140098f6d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140098eda
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140098ee2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140098f6d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140098f65
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140098f30
cmp r10d, 0x3d71f40a
je 0x140098f84
inc r9
cmp r9, rbx
jb 0x140098f10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140098f6f
Function at 0x140098fa0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14009907d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14009907d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140098fea
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140098ff2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14009907d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140099075
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140099040
cmp r10d, 0xe054604a
je 0x140099094
inc r9
cmp r9, rbx
jb 0x140099020
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14009907f

Function at 0x1400990b0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14009918d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14009918d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x1400990fa
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140099102
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14009918d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140099185
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140099150
cmp r10d, 0xddeaabca
je 0x1400991a4
inc r9
cmp r9, rbx
jb 0x140099130
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14009918f