joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067d3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
mov qword [rsp + 0x20], rdi
push rbp
xchg rbp, rdx
mov rdx, rsp
xchg rbp, rdx
nop
sub rsp, 0x5c076d35
add rsp, 0x5c076cd5
movabs rbx, 0x6eb140cb29ad5a37
xor rbx, 0x4639c5a0
sub rbx, 0x1d37370
xor rbx, 0xf244198
xchg rcx, r15
mov rdi, r15
xchg rcx, r15
cmp qword [rcx + 0x30], rbx
jne 0x140067f3e
xchg r10, r10
xor esi, esi
mov dword [rbp - 0x40], 0x4b23ce53
add dword [rbp - 0x40], 0x2945ac43
sub dword [rbp - 0x40], 0x4f15e0eb
xor dword [rbp - 0x40], 0x256e9991
mov dword [rbp - 0x3c], 0x3bc61871
sub dword [rbp - 0x3c], 0x2b21507a
add dword [rbp - 0x3c], 0x14682aa9
xor dword [rbp - 0x3c], 0x2547f2c1
mov dword [rbp - 0x38], 0x53082148
sub dword [rbp - 0x38], 0x33d92ecb
xor dword [rbp - 0x38], 0x71016440
xor dword [rbp - 0x38], 0x6e1f9636
mov dword [rbp - 0x34], 0x7fdddeda
sub dword [rbp - 0x34], 0x3fdf2c96
add dword [rbp - 0x34], 0x12c3a159
sub dword [rbp - 0x34], 0x788ec42
xor dword [rbp - 0x34], 0x4b21677f
mov dword [rbp - 0x30], 0x22f1bc14
add dword [rbp - 0x30], 0x1f71eebb
xor dword [rbp - 0x30], 0x7be41d98
sub dword [rbp - 0x30], 0x394ab702
mov dword [rbp - 0x2c], 0x65263ec6
sub dword [rbp - 0x2c], 0x140f0271
sub dword [rbp - 0x2c], 0x1df7933c
xor dword [rbp - 0x2c], 0x31a5d7db
sub dword [rbp - 0x2c], 0x2747e47
xchg rsi, r11
mov qword [rbp + 0x10], r11
xchg rsi, r11
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
xchg r8, rcx
mov r8, qword [rbp + 0x10]
xchg rcx, r8
mov rax, qword [rbp + 0x10]
xchg rdi, rdi
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x62a947d0
sub eax, 0x1d3a654c
sub eax, 0x304f07a3
add eax, 0x14f77e9a
shr eax, cl
mov dword [rsp - 0x18], 0x33f7e12b
movzx ecx, al
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x2c], esi
inc rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
xchg r12, r12
cmp rax, 0xc
jb 0x140067e69
xor edx, edx
mov word [rbp - 0x10], si
mov r14, r14
lea rcx, [rbp - 0x28]
call fcn.140089ef0
mov rdx, rax
xchg rdi, rdi
mov r8, rax
xor eax, eax
xor rdx, rbx
xchg rdx, rdx
xchg rdx, rsi
mov qword [rdi + 0x30], rsi
xchg rdx, rsi
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov r10, r10
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140067f48
xchg rdi, rdi
lea rdx, [0x1401402c0]
xchg r10, rcx
mov r10, r8
xchg r10, rcx
call fcn.14006c938
mov dword [rsp - 0x44], ebp
test al, al
setne al
jmp 0x140067f48
mov al, 0x23
sub al, 4
sub al, 0x13
add al, 9
sub al, 0x14
lea r11, [rsp + 0x60]
mov r15, r15
mov rbx, qword [r11 + 0x18]
xchg rbx, rsi
mov rbx, qword [r11 + 0x20]
xchg rbx, rsi
xchg rsp, rdi
mov rsp, qword [r11 + 0x28]
xchg rdi, rsp
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140067f7c
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg rsi, r13
mov qword [rsp + 0x20], rdi
push rbp
mov dword [rsp - 0x44], edi
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
nop
add rsp, 0x63960216
sub rsp, 0x63960266
movabs rbx, 0x6eb140cb1ae2e101
add rbx, 0x629551cb
sub rbx, 0x637f923a
add rbx, 0x48eccd2d
xchg r9, rcx
mov rdi, r9
xchg rcx, r9
cmp qword [rcx + 0x28], rbx
jne 0x14006816e
mov r12, r12
mov eax, 0x19bd7482
add eax, 0x36c21fa9
sub eax, 0x2efdc453
xor eax, 0x2181cfcf
mov dword [rbp - 0x30], 0x29ea2992
add dword [rbp - 0x30], 0x1139ea79
sub dword [rbp - 0x30], 0xbdffe86
sub dword [rbp - 0x30], 0x2f0f1551
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rbp - 0x2c], 0x2aebbd2
add dword [rbp - 0x2c], 0x50051635
sub dword [rbp - 0x2c], 0x360b7009
xor dword [rbp - 0x2c], 0x1cb1618c
mov dword [rbp - 0x28], 0x153aaeca
add dword [rbp - 0x28], 0x161b813e
add dword [rbp - 0x28], 0x336c42b5
sub dword [rbp - 0x28], 0x5e4b7274
mov dword [rbp - 0x24], 0x27c3063b
xor dword [rbp - 0x24], 0x5e14b27f
sub dword [rbp - 0x24], 0x2d1e3a29
sub dword [rbp - 0x24], 0x4c7379a8
xchg rdx, rsi
mov qword [rbp + 0x10], rdx
xchg rsi, rdx
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
xchg rcx, rsp
mov rsp, qword [rbp + 0x10]
xchg rcx, rsp
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x417083a0
add eax, 0x2c848636
sub eax, 0x6cf86f11
add eax, 0x56d023e6
xor eax, 0x7ddbe7d0
shr eax, cl
movzx ecx, al
mov rbp, rbp
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
inc rax
mov dword [rsp - 0x2c], 0x1ce67ede
mov qword [rbp + 0x10], rax
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
cmp rax, 9
jb 0x140068085
mov r11, r11
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
call fcn.140089ef0
mov dword [rsp - 0x10], 0x794ebeb6
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
xor eax, eax
mov rsp, rsp
xor rdx, rbx
mov qword [rdi + 0x28], rdx
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
mov r10, r10
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140068178
mov dword [rsp - 0x24], esp
lea rdx, [0x140140810]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.140070a34
test al, al
mov dword [rsp - 0x10], ebp
setne al
jmp 0x140068178
mov al, 0x39
xor al, 0x3e
xor al, 0x7d
xor al, 0xf
sub al, 0x74
mov rbx, qword [rsp + 0x68]
xchg rsi, r13
mov r13, qword [rsp + 0x70]
xchg rsi, r13
mov rdi, qword [rsp + 0x78]
nop
sub rsp, 0x1dda07e5
add rsp, 0x1dda0835
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400681a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x2c], esi
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
xchg r9, r9
xchg rdx, rsp
mov rbp, rdx
xchg rsp, rdx
add rsp, 0xffffffffffffffb0
movabs rbx, 0x6eb140cb0dbcb0f0
add rbx, 0x4ad45231
add rbx, 0x6fbe8c5
xor rbx, 0x3d698659
xchg rsp, rdi
mov rsp, rcx
xchg rsp, rdi
cmp qword [rcx + 0x38], rbx
jne 0x140068397
xchg rdi, rdi
xor esi, esi
mov dword [rbp - 0x30], 0x29b05a9b
xor dword [rbp - 0x30], 0x3221a300
add dword [rbp - 0x30], 0x5929cb19
sub dword [rbp - 0x30], 0x184a4998
sub dword [rbp - 0x30], 0x5c487af3
mov dword [rbp - 0x2c], 0x133bf99
add dword [rbp - 0x2c], 0x2a0884b2
add dword [rbp - 0x2c], 0xea4df53
xor dword [rbp - 0x2c], 0x39b923ea
mov dword [rbp - 0x28], 0x703c4c14
sub dword [rbp - 0x28], 0x515214a8
xor dword [rbp - 0x28], 0x1ae960bd
sub dword [rbp - 0x28], 0x39657c2
mov dword [rbp - 0x24], 0x78bd46e7
xor dword [rbp - 0x24], 0x169d864d
sub dword [rbp - 0x24], 0x2dd2aad0
xor dword [rbp - 0x24], 0x6fb51c14
sub dword [rbp - 0x24], 0x2fad0995
mov dword [rbp - 0x20], 0x14b33ffd
add dword [rbp - 0x20], 0xcba19e0
xor dword [rbp - 0x20], 0x3bfbe59e
xor dword [rbp - 0x20], 0x38e87d9b
sub dword [rbp - 0x20], 0x2249c1c1
mov qword [rbp + 0x10], rsi
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
xchg rdi, rcx
mov rdi, qword [rbp + 0x10]
xchg rcx, rdi
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x28], edx
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x1c], 0x4d76a1bc
mov eax, 0x67755ff8
sub eax, 0x60da5bee
add eax, 0x15886138
add eax, 0xdf3f439
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
xchg rbx, rbx
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r14, r14
xchg r10, rax
mov qword [rbp + 0x10], r10
xchg r10, rax
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
cmp rax, 0xa
xchg r11, r11
jb 0x1400682b0
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
mov dword [rsp - 0x20], esp
call fcn.140089ef0
xchg rdx, rsp
mov rsp, rax
xchg rdx, rsp
xchg r9, rax
mov r8, r9
xchg r9, rax
xor eax, eax
mov dword [rsp - 0x38], 0x31055cf6
xor rdx, rbx
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov r9, r9
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400683a1
mov rsi, rsi
lea rdx, [0x140140830]
xchg rbp, r8
mov rcx, rbp
xchg rbp, r8
call fcn.140070e80
mov dword [rsp - 0x1c], 0x43fd02a6
test al, al
setne al
jmp 0x1400683a1
mov al, 0x35
add al, 0x27
xor al, 0x4e
sub al, 0xa
sub al, 7
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg r13, rbx
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400683cc
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg r10, rbx
mov qword [rsp + 0x18], rsi
xchg r9, rdi
mov qword [rsp + 0x20], r9
xchg rdi, r9
push rbp
xchg r8, rbp
mov r8, rsp
xchg r8, rbp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x6eb140cb0f6a6dd5
xor rbx, 0x2459751f
add rbx, 0x322b2662
xor rbx, 0x3fbb5293
xchg r10, rcx
mov rdi, r10
xchg r10, rcx
cmp qword [rcx + 0x20], rbx
mov rdi, rdi
jne 0x1400685d9
mov eax, 0x2a857ff3
sub eax, 0xd0c8052
xor eax, 0x52ed9af1
xor eax, 0x4f95652b
mov dword [rbp - 0x30], 0x40d8e6cd
xor dword [rbp - 0x30], 0x5de1573
xor dword [rbp - 0x30], 0x378fc7ef
sub dword [rbp - 0x30], 0x6b20a0c1
xor dword [rbp - 0x30], 0x75993b8
mov word [rbp - 0x1c], ax
xor esi, esi
mov rsp, rsp
mov dword [rbp - 0x2c], 0x4e1c8d5a
sub dword [rbp - 0x2c], 0x3eefd22c
xor dword [rbp - 0x2c], 0x69438bc2
sub dword [rbp - 0x2c], 0x62a6937e
sub dword [rbp - 0x2c], 0x3829cfc
mov dword [rbp - 0x28], 0x12efe90
add dword [rbp - 0x28], 0x10e96cb
xor dword [rbp - 0x28], 0x7228b8d9
sub dword [rbp - 0x28], 0x6fab2d6b
mov dword [rbp - 0x24], 0x14b42083
xor dword [rbp - 0x24], 0x22ce37f3
xor dword [rbp - 0x24], 0x1aeaae49
xor dword [rbp - 0x24], 0x297f3669
xor dword [rbp - 0x24], 0x5eb8f75
mov dword [rbp - 0x20], 0x467c24a8
sub dword [rbp - 0x20], 0x335bbc6b
xor dword [rbp - 0x20], 0x1b261fb2
add dword [rbp - 0x20], 0x5a939ffc
xor dword [rbp - 0x20], 0x62af1794
mov qword [rbp + 0x10], rsi
xchg rsp, rsp
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
xchg r9, rcx
mov r9, qword [rbp + 0x10]
xchg r9, rcx
mov rax, qword [rbp + 0x10]
and cl, 3
mov r11, r11
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x72b4730c
sub eax, 0xaf8950a
xor eax, 0x6b0b6fcf
add eax, 0x1d66a7ae
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x18], ecx
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x14], edx
inc rax
xchg rdi, rax
mov qword [rbp + 0x10], rdi
xchg rdi, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
mov dword [rsp - 0x24], edx
jb 0x140068504
xor edx, edx
mov word [rbp - 4], si
mov r10, r10
lea rcx, [rbp - 0x1a]
call fcn.140089ef0
mov rdx, rax
xchg rsi, r8
mov rsi, rax
xchg rsi, r8
xor eax, eax
mov dword [rsp - 0x20], 0x3537deaf
xor rdx, rbx
xchg r9, rdx
mov qword [rdi + 0x20], r9
xchg rdx, r9
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x2c], ebp
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400685e3
mov dword [rsp - 0x18], edx
lea rdx, [0x140140298]
mov rcx, r8
call fcn.1400712b4
test al, al
mov r14, r14
setne al
jmp 0x1400685e3
mov al, 0x1b
sub al, 0xa
add al, 0x3e
xor al, 6
sub al, 0x48
mov rbx, qword [rsp + 0x68]
xchg rbp, rsi
mov rbp, qword [rsp + 0x70]
xchg rsi, rbp
mov rdi, qword [rsp + 0x78]
xchg rsi, rsi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rbp
ret
Function at 0x14007320e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x55bdebe2
add rsp, 0x55bdeb82
lea rax, [rcx + 8]
xchg r15, rbx
mov qword [rsp + 0x70], r15
xchg r15, rbx
xchg rbp, rax
mov qword [rcx], rbp
xchg rbp, rax
xorps xmm0, xmm0
mov dword [rsp - 0x10], esi
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg r10, rcx
mov rsi, r10
xchg r10, rcx
xchg rbp, r12
mov qword [rsp + 0x78], r12
xchg r12, rbp
movups xmmword [rax + 0x10], xmm0
mov r8, r8
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
xchg r13, rax
movups xmmword [r13 + 0x30], xmm0
xchg r13, rax
xchg rbp, rax
movups xmmword [rbp + 0x40], xmm0
xchg rbp, rax
movups xmmword [rax + 0x50], xmm0
mov dword [rsp - 0x20], ebx
xchg rbp, rax
movups xmmword [rbp + 0x60], xmm0
xchg rbp, rax
xchg r13, rax
movups xmmword [r13 + 0x70], xmm0
xchg r13, rax
xchg r11, rbp
mov r11, qword [rdx + 0x38]
xchg rbp, r11
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
mov dword [rsp - 0x2c], 0x7c9fcd
xchg rdx, rsp
movups xmmword [rdx + 0x28], xmm0
xchg rdx, rsp
lea rdx, [rbp + 1]
mov r15, r15
xchg rbp, rsp
movups xmmword [rbp + 0x38], xmm0
xchg rsp, rbp
xchg rsp, r15
movups xmmword [r15 + 0x48], xmm0
xchg r15, rsp
call fcn.140017b44
mov dword [rsp - 0xc], edx
mov edx, 0x52f468e9
xor edx, 0x78efdb16
xor edx, 0x5c4898cf
xor edx, 0x5c44724b
test rbp, rbp
mov rcx, rcx
je 0x14007336d
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rdi, r9
mov rdi, rbp
xchg r9, rdi
mov r8d, 0x58eaa76d
sub r8d, 0x1ffaff62
add r8d, 0x1ea3ecd7
sub r8d, 0x579393e3
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg r13, r13
and cx, r8w
ror edx, 2
ror edx, 3
ror edx, 2
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r9, 1
mov dword [rsp - 0x2c], 0x58a7d77e
jne 0x140073339
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov dword [rsp - 0x20], edi
xchg rsi, rbx
mov rcx, rbx
xchg rsi, rbx
xchg rdx, rcx
mov rcx, qword [rsp + 0x20]
xchg rcx, rdx
call fcn.14008fd40
mov dword [rsp - 0x44], 0x848cc0a
xchg r13, rcx
mov r13, qword [rsp + 0x20]
xchg rcx, r13
lea rax, [rsp + 0x28]
mov dword [rsp - 0xc], esi
xchg rdi, rbp
mov rdi, qword [rsp + 0x78]
xchg rbp, rdi
xchg r11, rbx
mov r11, qword [rsp + 0x70]
xchg rbx, r11
cmp rcx, rax
xchg r9, r9
jne 0x14007341c
xor eax, eax
lea rdi, [rsp + 0x28]
mov rsi, rsi
mov ecx, 0x15ab1d1e
xor ecx, 0x578c1ec3
xor ecx, 0x2e93bee7
sub ecx, 0x5e08e5a3
xor ecx, 0xeabd7a7
rep stosb byte [rdi], al
mov dword [rsp - 0xc], edi
xchg rsp, rax
mov rsp, rsi
xchg rsp, rax
xchg rsi, r10
mov r10, qword [rsp + 0x80]
xchg r10, rsi
sub rsp, 0xffffffffffffffa0
xchg r13, r13
pop rdi
ret
call fcn.140097780
xchg r10, rax
mov r10, rsi
xchg r10, rax
xchg r10, rsi
mov r10, qword [rsp + 0x80]
xchg r10, rsi
add rsp, 0x60
mov rsi, rsi
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007dba0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001900]
mov dword [rsp - 0x2c], edx
sub r10, rcx
mov r8, rcx
lea rax, [r9 + r8]
xchg r15, r15
mov ecx, r9d
mov edx, 0xf8c28b0
add edx, 0x2fae183b
sub edx, 0x4085af0
add edx, 0x26f35323
xor edx, 0x458d581d
inc r9
rol edx, cl
xor dl, byte [r10 + rax]
xchg rbx, rbx
mov byte [rax], dl
cmp r9, 0x10
jb 0x14007dbb4
mov r13, r13
xchg r14, rax
mov r14, r8
xchg r14, rax
ret

Function at 0x14007ea70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
xchg rbx, rbx
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
push 0x1b90480c
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
mov rbx, rcx
mov r13d, r8d
mov dword [rsp - 0x24], 0x77d5ab5e
mov r9d, 0x2a060378
xor r9d, 0x5d59daf2
xor r9d, 0x54584804
xor r9d, 0x67bff0d4
sub r9d, 0x44b4615a
mov r12, rdx
cmp r8d, r9d
mov dword [rsp - 0x24], ebx
pushf
movabs rcx, 0xffffffff132b8c5d
add rcx, 0x3270da34
sub rcx, 0x3e0bf8ac
add rcx, 0x7fffffff
add rcx, 0x786f921b
popf
pushf
mov eax, 0x5f63c613
xor eax, 0x7bb35712
sub eax, 0x17d41abb
xor eax, 0xcfc7642
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x3c], ebx
cmovo rax, rcx
mov rcx, rax
call fcn.140097620
lea r15d, [r13 + 0xfffff]
mov dword [rsp - 0x20], ecx
xor esi, esi
shr r15d, 5
shr r15d, 0xf
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x18c021ed
sub ebx, 0x11b6a651
add ebx, 0x618e12f1
sub ebx, 0x68978e8c
mov dword [rsp + 0x70], eax
xchg r11, r11
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007ec7d
mov eax, 0xa52d8b6
add eax, 0x436b480b
xor eax, 0x16051e38
sub eax, 0x5ae0449f
sub eax, 0xcafa5a
xchg r10, rcx
mov r10, qword [rsp + 0x60]
xchg r10, rcx
mov r14d, esi
shl r14d, 0xe
shl r14d, 3
shl r14d, 1
shl r14d, 1
shl r14d, 1
mov edi, r13d
sub edi, r14d
mov dword [rsp - 0x2c], 0x70e6c72f
mov rdx, rbp
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x28], esi
mov r8d, edi
call fcn.140091b10
test al, al
je 0x14007ec7b
mov dword [rsp - 0xc], ebp
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
je 0x14007ec4f
xchg rdx, rdx
mov r15d, dword [rsp + 0x70]
mov r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
mov dword [rsp - 0x20], 0x10924664
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x7a8c338e
lea r9, [r9 + 4]
mov dword [rsp - 0x20], ecx
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14007ec17
mov r15d, dword [rsp + 0x78]
xchg r14, r14
add esi, ebx
mov eax, 0x4d39b635
sub eax, 0x4c136830
add eax, 0x98f1746
xor eax, 0xaa5654b
cmp esi, r15d
jb 0x14007ebaa
mov dword [rsp - 0x40], 0x65bf018b
jmp 0x14007ec7d
xor bl, bl
xchg rcx, r10
mov r10, rbp
xchg rcx, r10
call fcn.140097630
mov al, bl
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x10], 0x1fd3928f
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov rsp, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
pop r12
pop rdi
mov rsp, rsp
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14007f458
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0xc], esi
mov qword [rsp + 0x10], rbp
xchg rsi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rsi
nop
push 0x6fb9a20d
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
push 0x787e6272
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg rbx, r15
mov rbx, rcx
xchg r15, rbx
mov r14d, r8d
mov r9d, 0x4ce9987c
sub r9d, 0xa8410d8
sub r9d, 0x3bbe3e73
add r9d, 0x34183475
sub r9d, 0x3abb7da6
xchg rdx, r12
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff5c85b744
add rcx, 0x613a61
xor rcx, 0x50622f2c
add rcx, 0x7fffffff
add rcx, 0x737b2177
popf
pushf
mov eax, 0x2f8968bb
xor eax, 0x3f388a55
sub eax, 0x1300946
xor eax, 0xf81d9ac
popf
cmovb r9d, r14d
xchg rsi, rsi
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140097620
mov r13d, dword [r15 + 0x18]
mov r9, r9
lea ebp, [r14 + 0xfffff]
shr ebp, 0x13
shr ebp, 1
xor edi, edi
xchg rbx, rsi
mov rbx, rax
xchg rsi, rbx
mov ebx, 0x508e196f
add ebx, 0x2846073c
xor ebx, 0x3e1b2420
sub ebx, 0x46cf048a
test ebp, ebp
mov r8, r8
je 0x14007f663
mov eax, 0x519dfbf6
add eax, 0x2227330a
sub eax, 0x580c75cd
sub eax, 0x1ba8b933
mov r9d, edi
mov r8d, r14d
shl r9d, 1
shl r9d, 0xd
shl r9d, 3
shl r9d, 2
shl r9d, 1
sub r8d, r9d
mov r12, r12
cmp r8d, eax
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov r14, r14
xor r10d, r10d
shr r11d, 2
test r11d, r11d
mov dword [rsp - 0x38], esp
je 0x14007f613
xchg rdx, rdi
mov rdi, rsi
xchg rdx, rdi
lea ecx, [r9 + r10]
mov eax, r13d
mov dword [rsp - 0x34], 0xde0c750
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x7a8c338e
xchg rdx, rdx
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14007f5e2
mov dword [rsp - 0x24], edx
xchg rsi, rdi
mov rdx, rdi
xchg rdi, rsi
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call fcn.140091ee0
test al, al
mov dword [rsp - 0x2c], ecx
je 0x14007f661
add edi, ebx
mov eax, 0x7a6bb570
sub eax, 0x787fd808
xor eax, 0xc71ca
xor eax, 0x47db826b
sub eax, 0x462c2ec9
cmp edi, ebp
jb 0x14007f594
mov r12, r12
jmp 0x14007f663
xor bl, bl
xchg rsi, rdx
mov rcx, rdx
xchg rdx, rsi
call fcn.140097630
mov dword [rsp - 0x3c], esi
xchg r12, rbp
mov r12, qword [rsp + 0x58]
xchg rbp, r12
mov al, bl
xchg r9, r9
mov rbx, qword [rsp + 0x50]
xchg r9, rsi
mov r9, qword [rsp + 0x60]
xchg r9, rsi
nop
sub rsp, 0x6c11030c
add rsp, 0x6c11032c
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
ret
Function at 0x140081fc0
Capabilities:
Enumerate pe sections

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rbp
mov r11, r11
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x18], edx
xchg rcx, rdx
mov rdi, rcx
xchg rdx, rcx
xchg rbx, rsi
mov rbx, rcx
xchg rsi, rbx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140083da0
mov dword [rsp - 0x20], ebp
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg r12, r10
mov r12, rax
xchg r10, r12
mov ebx, r14d
mov dword [rsp - 0xc], 0x58b97130
test ebp, ebp
je 0x1400821a3
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg rsp, rsp
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x18], 0x5c055df5
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x38], edi
cmp r14w, cx
jae 0x1400820e3
mov eax, dword [rdx + 8]
mov dword [rsp - 0x38], 0x253b2dba
test eax, eax
jne 0x1400820a3
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
xchg r11, r11
cmp r11d, r9d
jb 0x1400820c2
add eax, r9d
xchg r8, r8
cmp r11d, eax
jb 0x14008215c
inc r8w
mov dword [rsp - 0x30], ebp
nop
add rdx, 0x3e0c3880
sub rdx, 0x3e0c3858
cmp r8w, cx
jb 0x14008208d
xchg r10, r14
mov r8, r10
xchg r14, r10
mov eax, dword [r10 + 4]
mov rsp, rsp
lea r9, [r10 + 4]
neg rax
sub rax, 0xfffffffffffffff8
neg rax
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
mov dword [rsp - 0x3c], 0x94f63c4
test eax, eax
je 0x140082195
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x28], ecx
movzx eax, word [r10]
mov ecx, eax
shr ecx, 7
shr ecx, 4
shr ecx, 1
cmp ecx, 3
je 0x140082171
cmp ecx, 0xa
mov dword [rsp - 0x10], ecx
jne 0x14008217e
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x14008217e
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov rcx, rcx
add r8, r11
jmp 0x1400820ec
and eax, 0xfff
mov dword [rsp - 0x28], ebx
add dword [rax + r8], edi
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
xchg rbx, rbx
jne 0x14008212a
add ebx, dword [r9]
cmp ebx, ebp
mov r13, r13
jb 0x140082055
mov rbx, qword [rsp + 0x30]
xchg rbp, r14
mov r14, qword [rsp + 0x38]
xchg rbp, r14
xchg r9, rsi
mov r9, qword [rsp + 0x40]
xchg r9, rsi
mov rdi, qword [rsp + 0x48]
mov rsi, rsi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140083da0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov dword [rsp - 0x3c], 0x267e5f71
mov r10d, edx
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
movzx eax, word [r8 + 0x14]
xchg rbx, rbx
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
cmp r9w, r11w
mov rdx, rdx
jae 0x140083e1e
nop dword [rax]
mov ecx, dword [rax + 8]
test ecx, ecx
xchg r8, r8
jne 0x140083df7
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
cmp r10d, edx
mov dword [rsp - 0x3c], ecx
jb 0x140083e0d
add ecx, edx
cmp r10d, ecx
jb 0x140083e2c
mov rsp, rsp
inc r9w
add rax, 0x28
cmp r9w, r11w
jb 0x140083dea
xchg rbp, rbp
xor eax, eax
xchg rbx, r12
mov r12, qword [rsp + 8]
xchg rbx, r12
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
xchg r12, r12
add rax, rbx
mov rbx, qword [rsp + 8]
add rax, r10
ret