joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f9bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x40], 0x191cafb8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rdi
mov qword [rsp], rbp
xchg rbp, r14
mov r14, rsp
xchg rbp, r14
sub rsp, 0x50
movabs rbx, 0x313d6bef5699b7a4
sub rbx, 0x1682bf30
add rbx, 0x2f45933e
sub rbx, 0x6511936a
xor rbx, 0x3ae8b71f
mov rdi, rcx
mov rcx, rcx
cmp qword [rcx + 0x28], rbx
jne 0x14005fbb1
mov eax, 0x28f9b126
xor eax, 0x74fd6db8
sub eax, 0x295b263b
add eax, 0x170648dd
sub eax, 0x49afff04
mov dword [rbp - 0x30], 0x664a38bb
sub dword [rbp - 0x30], 0x193b4430
xor dword [rbp - 0x30], 0x3670e798
sub dword [rbp - 0x30], 0x35b74460
xor dword [rbp - 0x30], 0x45ddceac
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rbp - 0x2c], 0x543baf3b
add dword [rbp - 0x2c], 0x20f70a7a
sub dword [rbp - 0x2c], 0x43e10d9c
xor dword [rbp - 0x2c], 0x3d0a50ba
sub dword [rbp - 0x2c], 0xc3efbe7
mov dword [rbp - 0x28], 0x47a0b44b
xor dword [rbp - 0x28], 0x726921a2
add dword [rbp - 0x28], 0x2807d8bf
sub dword [rbp - 0x28], 0x255f2d92
sub dword [rbp - 0x28], 0x381940b4
mov dword [rbp - 0x24], 0x16cc3e77
xor dword [rbp - 0x24], 0x4882c8e6
sub dword [rbp - 0x24], 0x4eb13eac
sub dword [rbp - 0x24], 0xf5bb728
xchg rsi, rbx
mov qword [rbp + 0x10], rbx
xchg rsi, rbx
mov rax, qword [rbp + 0x10]
xchg rbx, rbx
xchg rcx, r12
mov r12, qword [rbp + 0x10]
xchg r12, rcx
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
and cl, 3
mov rbx, rbx
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
xchg rbx, rbx
mov eax, 0x6cd1efd
xor eax, 0x69f09b1f
sub eax, 0x2c31b3e5
xor eax, 0x6dd2a6ad
shr eax, cl
xchg rsp, rsp
movzx ecx, al
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov r8, r8
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
inc rax
mov r11, r11
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 9
jb 0x14005fad0
mov r8, r8
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
call fcn.140075150
xchg r13, r13
xchg rdx, rsp
mov rsp, rax
xchg rsp, rdx
xchg rsi, r8
mov rsi, rax
xchg rsi, r8
xor eax, eax
mov r11, r11
xor rdx, rbx
xchg rdx, rsi
mov qword [rdi + 0x28], rsi
xchg rsi, rdx
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
xchg rdx, rdx
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14005fbbb
lea rdx, [0x1400d9920]
xchg r10, r10
mov rcx, r8
call fcn.1400685f0
test al, al
xchg rsi, rsi
setne al
jmp 0x14005fbbb
mov al, 0x19
add al, 0x1c
xor al, 0x29
xor al, 0x36
xor al, 0x2b
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x2c], 0x22b229a2
xchg r15, rdi
mov r15, qword [rsp + 0x78]
xchg rdi, r15
nop
sub rsp, 0x7ac99d87
add rsp, 0x7ac99dd7
pop rbp
ret
Function at 0x14005fbec
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg rbx, r15
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
xchg rdi, rbp
mov qword [rsp + 0x20], rbp
xchg rbp, rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rdx, rsp
mov rbp, rdx
xchg rsp, rdx
nop
sub rsp, 0x7bf76e1
add rsp, 0x7bf7691
movabs rbx, 0x313d6bef72158273
sub rbx, 0x60c2283
xor rbx, 0x3f947ac6
add rbx, 0xdaec134
sub rbx, 0x30a99713
xchg rdi, r11
mov r11, rcx
xchg r11, rdi
cmp qword [rcx + 0x38], rbx
jne 0x14005fde9
mov dword [rsp - 0x14], edx
xor esi, esi
mov dword [rbp - 0x30], 0x41fb6c
add dword [rbp - 0x30], 0x6310b06b
sub dword [rbp - 0x30], 0x1e36d565
xor dword [rbp - 0x30], 0x451cd670
mov dword [rbp - 0x2c], 0x6c0fc03e
sub dword [rbp - 0x2c], 0x496e8407
xor dword [rbp - 0x2c], 0x1e2adf55
sub dword [rbp - 0x2c], 0x3c2fe2a8
mov dword [rbp - 0x28], 0x21f2309e
add dword [rbp - 0x28], 0x3d1bdd68
xor dword [rbp - 0x28], 0x3325346f
sub dword [rbp - 0x28], 0x6be83a45
mov dword [rbp - 0x24], 0x15c32a4e
add dword [rbp - 0x24], 0x40d46ddf
sub dword [rbp - 0x24], 0x31a7893f
xor dword [rbp - 0x24], 0x24ba0e19
mov dword [rbp - 0x20], 0x477bae20
sub dword [rbp - 0x20], 0x1cb55e68
xor dword [rbp - 0x20], 0x5aa5883e
sub dword [rbp - 0x20], 0x7048c74a
mov qword [rbp + 0x10], rsi
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x40], edx
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x501af54
xor eax, 0x226ab0b8
add eax, 0x4313b131
sub eax, 0x2bbd558b
sub eax, 0xfe80442
shr eax, cl
movzx ecx, al
mov r13, r13
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xor cx, dx
mov r15, r15
mov word [rbp + rax*2 - 0x1c], cx
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
inc rax
mov qword [rbp + 0x10], rax
mov dword [rsp - 0x40], ebx
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
cmp rax, 0xa
jb 0x14005fd06
mov dword [rsp - 0x30], ebp
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
mov dword [rsp - 0x1c], 0x47090283
call fcn.140075150
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
xor eax, eax
mov dword [rsp - 0x10], esi
xor rdx, rbx
xchg rdx, rsp
mov qword [rdi + 0x38], rsp
xchg rsp, rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov dword [rsp - 0x1c], edx
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14005fdf1
lea rdx, [0x1400d9940]
mov rbx, rbx
mov rcx, r8
call fcn.140068a10
test al, al
setne al
mov r11, r11
jmp 0x14005fdf1
mov al, 0x3e
sub al, 0x32
add al, 0xd
xor al, 0x18
xchg rcx, rbx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffb0
mov dword [rsp - 0x24], 0x6f330a00
pop rbp
ret
Function at 0x14005fe14
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
xchg rdi, r10
mov qword [rsp + 0x20], r10
xchg rdi, r10
push rbx
mov qword [rsp], rbp
xchg rbp, r8
mov r8, rsp
xchg rbp, r8
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x313d6bef59732d25
xor rbx, 0x1fa60aa4
xor rbx, 0x2eac890c
sub rbx, 0x37d75f36
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x20], rbx
xchg r9, r9
jne 0x140060047
mov eax, 0xab989ae
add eax, 0x5bc550f9
sub eax, 0x22249eac
xor eax, 0x1e6c5343
sub eax, 0x5a366803
mov dword [rbp - 0x30], 0x73720a7e
xor dword [rbp - 0x30], 0x33fc8120
add dword [rbp - 0x30], 0x3d98c8db
xor dword [rbp - 0x30], 0x7f7d8f56
sub dword [rbp - 0x30], 0x13bdb6c
mov word [rbp - 0x1c], ax
mov dword [rsp - 0x2c], 0x5fbe46fa
xor esi, esi
mov dword [rbp - 0x2c], 0x2c318e55
xor dword [rbp - 0x2c], 0x5d6fdc09
sub dword [rbp - 0x2c], 0x469e53e0
xor dword [rbp - 0x2c], 0x2afdfec0
mov r8d, 0x69b34509
sub r8d, 0x32cf1a71
sub r8d, 0x160f1efd
add r8d, 0x4dfc5c4d
sub r8d, 0x6ed167e5
mov dword [rbp - 0x28], 0x2ac0b952
sub dword [rbp - 0x28], 0x4494ef5
sub dword [rbp - 0x28], 0x148bc1b3
sub dword [rbp - 0x28], 0x11a7a86e
mov dword [rbp - 0x24], 0x62374a96
sub dword [rbp - 0x24], 0x4aeccb5d
xor dword [rbp - 0x24], 0x7d8da009
sub dword [rbp - 0x24], 0x6ac7de45
mov dword [rbp - 0x20], 0x3b532245
sub dword [rbp - 0x20], 0xc6cc0fe
add dword [rbp - 0x20], 0x38bc3992
add dword [rbp - 0x20], 0x13c87421
sub dword [rbp - 0x20], 0x7b500ec6
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov rcx, rcx
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, r8b
shl cl, 3
mov dword [rsp - 0x3c], 0x5800b30c
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x16f69c2f
add eax, 0x3fa385ed
xor eax, 0x11b4c692
xor eax, 0x81c71ef
xor eax, 0x61ebe231
shr eax, cl
xchg r15, r15
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg rbp, rbp
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
cmp rax, 0xb
xchg rbx, rbx
jb 0x14005ff70
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
mov dword [rsp - 0x14], 0x7d003df6
call fcn.140075150
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov rbp, rbp
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
mov dword [rsp - 0x44], edx
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140060051
xchg r8, r8
lea rdx, [0x1400d93a8]
xchg r8, rbx
mov rcx, rbx
xchg r8, rbx
call fcn.140068e4c
mov r9, r9
test al, al
setne al
jmp 0x140060051
mov al, 0x49
xor al, 0xa
sub al, 0x3c
add al, 5
xor al, 0xd
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x10], ebx
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
xchg rbp, rbp
pop rbp
ret
Function at 0x14006b51c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov dword [rsp - 0x18], edx
lea r10, [0x14000b4c8]
sub r10, rcx
xchg r8, rsi
mov rsi, rcx
xchg rsi, r8
lea rax, [r9 + r8]
mov ecx, r9d
mov dword [rsp - 0x40], 0x37c27c9a
mov edx, 0x25a406b8
xor edx, 0x4e5ce77f
sub edx, 0x32305d10
sub edx, 0x1a2d811d
inc r9
rol edx, cl
mov dword [rsp - 0x44], edx
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov r15, r15
jb 0x14006b536
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x14006c404
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r14, rcx
mov qword [rsp + 8], r14
xchg r14, rcx
push rbp
mov dword [rsp - 0x18], ecx
nop
push 0x220968fe
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov rbx, rbx
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x1714279c
add rsp, 0x1714277c
mov rbx, rcx
mov r13d, r8d
mov dword [rsp - 0x20], 0x4cb75243
mov r9d, 0x37eb7c22
sub r9d, 0x3fbf891
add r9d, 0x1ba7dd90
xor r9d, 0x4f936121
xchg rdx, r13
mov r12, r13
xchg rdx, r13
cmp r8d, r9d
mov dword [rsp - 0x24], 0xacf3849
pushf
movabs rcx, 0xffffffff21ed7abe
add rcx, 0x34d57ed2
sub rcx, 0x84d5cea
add rcx, 0x7fffffff
add rcx, 0x318a635a
popf
pushf
mov eax, 0x4a226748
xor eax, 0x2efbcfb5
sub eax, 0x3d99a5ad
sub eax, 0x1026d170
sub eax, 0x171931dc
popf
cmovb r9d, r13d
mul r9
cmovo rax, rcx
mov r8, r8
xchg rcx, r13
mov r13, rax
xchg rcx, r13
call fcn.14007fa60
lea r15d, [r13 + 0xfffff]
xor esi, esi
mov dword [rsp - 0x34], 0x552562b5
shr r15d, 2
shr r15d, 7
shr r15d, 0xb
mov rbp, rax
mov dword [rsp - 0x40], esi
mov eax, dword [rbx + 0x18]
mov ebx, 0x30d17a8d
sub ebx, 0x1decdd0a
add ebx, 0x227bede7
add ebx, 0x959795e
xor ebx, 0x3eba04c9
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x1c], 0x1f8846bc
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14006c63d
mov eax, 0x627dcc2f
add eax, 0x1922e685
sub eax, 0x288edf90
sub eax, 0x4dc8c292
sub eax, 0x5391092
xchg rcx, r15
mov r15, qword [rsp + 0x60]
xchg r15, rcx
mov r14d, esi
mov rbp, rbp
shl r14d, 0xb
shl r14d, 1
shl r14d, 2
shl r14d, 3
shl r14d, 3
mov edi, r13d
sub edi, r14d
mov r12, r12
xchg rbp, rdx
mov rbp, rdx
xchg rdx, rbp
cmp edi, eax
xchg r15, r15
cmova edi, eax
mov r8d, edi
call fcn.14004bd90
mov r11, r11
test al, al
je 0x14006c637
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 2
xchg r13, r13
test edi, edi
je 0x14006c610
mov r15d, dword [rsp + 0x70]
xchg r9, r8
mov r8, rbp
xchg r9, r8
lea eax, [r14 + r8]
mov dword [rsp - 0x1c], edx
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x525c63e7
mov dword [rsp - 0x14], ebx
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14006c5db
mov dword [rsp - 0xc], ebp
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x322d3ca2
add eax, 0x40944e02
sub eax, 0x40d6e34e
sub eax, 0x31daa756
cmp esi, r15d
jb 0x14006c566
xchg r9, r9
jmp 0x14006c63d
xor bl, bl
mov dword [rsp - 0x44], edi
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.14007fa70
mov al, bl
mov r11, r11
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14006d004
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rbp, rdx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x34], 0x2923f2f1
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
mov qword [rsp], r14
nop
push 0x5c921d58
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
mov r14d, r8d
mov dword [rsp - 0x34], 0x1e01bbf9
mov r9d, 0x7ce41e46
sub r9d, 0x527d296b
xor r9d, 0x5d6ae8e8
sub r9d, 0x77081c33
xchg rdx, r13
mov r12, r13
xchg rdx, r13
cmp r8d, r9d
mov dword [rsp - 0x1c], edx
pushf
movabs rcx, 0xffffffff20a94cb7
add rcx, 0x473bdfa4
sub rcx, 0xd5f1e05
add rcx, 0x7fffffff
xor rcx, 0x2579f1aa
popf
pushf
mov eax, 0x2abafea7
add eax, 0x4ef08815
sub eax, 0x1f0c203b
sub eax, 0x38da547f
xor eax, 0x21c51206
popf
cmovb r9d, r14d
mov dword [rsp - 0x40], ebp
mul r9
cmovo rax, rcx
mov rcx, rax
call fcn.14007fa60
xchg rdi, rdi
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 1
shr ebp, 3
shr ebp, 7
shr ebp, 6
shr ebp, 2
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x30], ebp
xchg r8, rax
mov rsi, r8
xchg r8, rax
mov ebx, 0x705e962e
sub ebx, 0x3475c58d
sub ebx, 0x31facd19
xor ebx, 0x7566fbc8
sub ebx, 0x7c88f83f
test ebp, ebp
mov dword [rsp - 0x40], 0x36d7458d
je 0x14006d218
mov eax, 0x5b7ac943
sub eax, 0x584231b9
add eax, 0x36784efe
xor eax, 0x39a0e688
mov r9d, edi
mov r15, r15
mov r8d, r14d
shl r9d, 0x13
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0x20], edi
cmp r8d, eax
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xchg r12, r12
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
xchg r8, r8
je 0x14006d1d0
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
mov dword [rsp - 0x24], 0x6fe3f62b
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x525c63e7
mov dword [rdx], eax
xchg r13, r13
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14006d1a3
mov rdx, rsi
mov dword [rsp - 0x20], ebp
mov rcx, r15
call fcn.14004c180
test al, al
mov dword [rsp - 0x44], esi
je 0x14006d216
add edi, ebx
mov eax, 0x4dfd8241
sub eax, 0x14ef4ebc
sub eax, 0x131323e4
sub eax, 0x5c80010
sub eax, 0x20230f91
cmp edi, ebp
jb 0x14006d161
mov rsi, rsi
jmp 0x14006d218
xor bl, bl
xchg rbp, rcx
mov rbp, rsi
xchg rbp, rcx
call fcn.14007fa70
mov dword [rsp - 0xc], ebx
xchg rbp, r9
mov r9, qword [rsp + 0x58]
xchg r9, rbp
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov dword [rsp - 0x1c], edx
nop
add rsp, 0x7fe78b92
sub rsp, 0x7fe78b72
pop r15
mov r8, r8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14006ea10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rsp, rsp
xchg rsi, rbp
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xchg r13, r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x63d02b73
add rsp, 0x63d02b53
movsxd rbx, dword [rcx + 0x3c]
mov r14, r14
mov rdi, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.1400703f0
mov r15, r15
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg r12, r10
mov r12, rax
xchg r10, r12
mov ebx, r14d
xchg r13, r13
test ebp, ebp
je 0x14006ebc1
nop dword [rax]
xchg r13, r13
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov dword [rsp - 0x28], ecx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov r10, r10
cmp r14w, cx
jae 0x14006eb0c
mov eax, dword [rdx + 8]
test eax, eax
mov dword [rsp - 0x34], 0x3d8a467b
jne 0x14006ead6
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x30], edx
jb 0x14006eaf7
add eax, r9d
cmp r11d, eax
jb 0x14006eb81
mov dword [rsp - 0x38], ebx
inc r8w
add rdx, 0x28
cmp r8w, cx
xchg rbp, rbp
jb 0x14006eac0
xchg r8, r14
mov r14, r8
xchg r14, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg rcx, rcx
nop
sub rax, 0x45c9319b
add rax, 0x45c93193
sub r10, 0xfffffffffffffff8
mov rdx, rdx
shr rax, 1
test eax, eax
je 0x14006ebb3
mov edx, eax
mov r8, r8
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xb
shr ecx, 1
cmp ecx, 3
je 0x14006eb96
mov dword [rsp - 0x10], 0x217bc08b
cmp ecx, 0xa
jne 0x14006eba2
and eax, 0xfff
add qword [rax + r8], rdi
mov dword [rsp - 0x28], edi
jmp 0x14006eba2
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
xchg rbx, rbx
add r8, r11
jmp 0x14006eb15
and eax, 0xfff
xchg rsp, rsp
add dword [rax + r8], edi
add r10, 2
sub rdx, 1
mov rbp, rbp
jne 0x14006eb4a
add ebx, dword [r9]
cmp ebx, ebp
xchg r15, r15
jb 0x14006ea90
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, r12
mov r12, qword [rsp + 0x40]
xchg r12, rsi
xchg rdi, r12
mov r12, qword [rsp + 0x48]
xchg r12, rdi
nop
add rsp, 0x720cac7a
sub rsp, 0x720cac5a
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400704b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
mov dword [rsp - 0x2c], edi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0x36665ca7
mov qword [rsp], r13
push r14
mov rbx, rbx
push r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x525c63e7
mov r11, r11
xchg r14, rsi
mov r14, rcx
xchg r14, rsi
cmp eax, 0x525c39aa
mov r14, r14
jne 0x140070669
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x525c63e7
mov dword [rsp - 0x30], esp
cmp eax, 0x525c26b7
jne 0x140070669
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400703f0
mov rbx, rbx
xchg r9, rcx
mov r9, rsi
xchg r9, rcx
xchg r14, rcx
mov rcx, rax
xchg rcx, r14
mov edx, dword [rax + 0x20]
mov dword [rsp - 0xc], 0x247265a3
call fcn.1400703f0
mov edx, dword [r14 + 0x24]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
xchg r12, rdi
mov rdi, rax
xchg r12, rdi
call fcn.1400703f0
mov r14, r14
mov edx, dword [r14 + 0x1c]
xchg rsp, rcx
mov rsp, rsi
xchg rcx, rsp
xchg r14, rax
mov r13, r14
xchg r14, rax
call fcn.1400703f0
mov dword [rsp - 0x30], ebp
xor edi, edi
xchg rcx, rax
mov qword [rsp + 0x70], rcx
xchg rcx, rax
cmp dword [r14 + 0x18], edi
jbe 0x140070669
mov r11, r11
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, r14
mov rcx, r14
xchg rsi, r14
call fcn.1400703f0
mov dword [rsp - 0x18], 0x5e39768a
mov ecx, 0x5236d473
add ecx, 0x654c68e
sub ecx, 0x235dbc44
xor ecx, 0xcad22142
mov rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov r14, r14
je 0x14007064f
nop dword [rax]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x1a0ec55e
add r8d, 0x459a0c8d
xor r8d, 0x6914761d
add r8d, 0x10f360e3
sub r8d, 0x47b008d8
inc rbx
mov rdi, rdi
call fcn.140078ce0
cmp byte [rbx], 0
jne 0x140070604
mov ecx, dword [rsp + 0x60]
xchg rdi, rdi
not ecx
cmp ecx, r15d
je 0x1400706a4
mov r9, r9
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400705bd
xor eax, eax
xchg rbx, rbx
xchg r14, rbx
mov r14, qword [rsp + 0x68]
xchg rbx, r14
add rsp, 0x20
mov dword [rsp - 0x24], 0x3f2a59e5
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
xchg rbx, rbx
pop rbp
ret
movzx edx, word [r13 + rdi*2]
mov r9, r9
mov rcx, rsi
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x44], edi
call fcn.1400703f0
jmp 0x14007066e
Function at 0x140074ea0
Capabilities:
Access peb ldr_data

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
mov dword [rsp + 0x18], r8d
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x240
mov r12, r12
xchg r12, rbx
mov r12, rdx
xchg rbx, r12
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
xor edx, edx
xchg r14, r14
lea rcx, [rsp + 0x30]
mov r8d, 0x52163221
xor r8d, 0x2a655434
sub r8d, 0x70869e2d
xor r8d, 0x79869d35
xor r8d, 0x7e6a58d5
call fcn.140080180
mov rbx, rbx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg r8, r9
mov r9, qword [rax]
xchg r8, r9
test r8, r8
mov dword [rsp - 0x34], esp
je 0x140075113
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x140075113
mov dword [rsp - 0x20], edi
mov edx, 0x3070095e
add edx, 0x402c4b39
sub edx, 0x68a8574c
xor edx, 0x12e5eeab
xor edx, 0x151612e4
lea rcx, [rsp + 0x30]
mov rsi, rsi
lea r9d, [rdx - 1]
call fcn.140080a00
mov edx, 0x3957efd1
add edx, 0x53c633d
xor edx, 0x2286b122
add edx, 0x5975e4c9
xor edx, 0x7588c6a9
lea rcx, [rsp + 0x30]
xchg rdi, rdi
call fcn.140080ad0
test rax, rax
je 0x1400750db
mov dword [rsp - 0x10], ecx
xor ecx, ecx
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
mov word [rax], cx
movabs rcx, 0x599f59e1135a47fc
xor rcx, 0x4e77e609
add rcx, 0x1a130caa
sub rcx, 0x54c2a598
add rcx, 0x3415e8e8
mov r8, qword [0x1400d97a0]
mov dword [rsp - 0x28], 0x4ff58179
movabs rax, 0xfe32e23e2295134b
add rax, 0x103f1bb3
xor rax, 0x53adf377
add rax, 0x7fffffff
sub rax, 0x38f21c18
add r8, rcx
lea rcx, [rsp + 0x20]
xor r8, rax
mov dword [rsp - 0x40], esp
not r8
call r8
mov rax, qword [0x1400d9790]
lea r8, [rsp + 0x20]
mov dword [rsp - 0x1c], 0x3d543599
not rax
lea rdx, [rsp + 0x260]
movabs rcx, 0x5654b11e74518fa6
sub rcx, 0x55a40b9
sub rcx, 0x4beffec4
add rcx, 0x7fffffff
xor rcx, 0x134a978a
mov r9, rbx
sub rax, rcx
mov dword [rsp - 0x20], 0x4df79aa7
movabs rcx, 0x219ad33c7c772db1
sub rcx, 0x6790dabd
add rcx, 0x2eba5881
sub rcx, 0x3def661c
add rcx, 0x74c51e43
not rax
rol rax, 0x1e
rol rax, 6
rol rax, 6
rol rax, 1
rol rax, 1
not rax
add rax, rcx
xchg rbx, rbx
lea rcx, [rsp + 0x30]
call rax
xchg rbx, r8
mov r8, qword [rsp + 0x250]
xchg r8, rbx
add rsp, 0x240
mov dword [rsp - 0xc], 0x639e2c2f
pop rdi
ret
mov eax, 0x70f1e562
xor eax, 0xf0e2dbc
sub eax, 0x5d2dc909
sub eax, 0x1f6f2c17
add eax, 0xbc9d2c43
xchg rbx, r12
mov r12, qword [rsp + 0x250]
xchg rbx, r12
sub rsp, 0xfffffffffffffdc0
pop rdi
mov dword [rsp - 0x2c], 0x73d41158
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x38815e95
sub eax, 0x1667a1e8
add eax, 0x1f0f8ce9
add eax, 0x7ed6b79f
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret