joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a59c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
xchg rsi, r9
mov qword [rsp + 0x18], r9
xchg r9, rsi
xchg rdi, r11
mov qword [rsp + 0x20], r11
xchg rdi, r11
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg r8, rsp
mov rbp, r8
xchg rsp, r8
nop
sub rsp, 0x39457d88
add rsp, 0x39457d38
movabs rbx, 0x739865643ebb3951
add rbx, 0x964a2f2
xor rbx, 0x4e350c2d
add rbx, 0x2be69961
xchg r14, rcx
mov rdi, r14
xchg rcx, r14
cmp qword [rcx + 0x20], rbx
xchg rbp, rbp
jne 0x14006a7b6
mov eax, 0x598d9573
sub eax, 0x4bf85922
xor eax, 0xb1e4bd3
sub eax, 0x68b76bd
mov dword [rbp - 0x30], 0x387f056a
add dword [rbp - 0x30], 0x79c6ef8
xor dword [rbp - 0x30], 0x44b285d5
xor dword [rbp - 0x30], 0xa3eeea6
sub dword [rbp - 0x30], 0xe8f1ecf
mov word [rbp - 0x1c], ax
mov r13, r13
xor esi, esi
mov dword [rbp - 0x2c], 0x25ece83a
add dword [rbp - 0x2c], 0x2d6e696d
add dword [rbp - 0x2c], 0xda05a0
xor dword [rbp - 0x2c], 0x5433578b
mov dword [rbp - 0x28], 0x3f4cafe4
sub dword [rbp - 0x28], 0x1b0b23c
xor dword [rbp - 0x28], 0x2aba1fdf
xor dword [rbp - 0x28], 0x7df585b1
sub dword [rbp - 0x28], 0x6a816749
mov dword [rbp - 0x24], 0x26d11476
add dword [rbp - 0x24], 0x116341f8
xor dword [rbp - 0x24], 0x57b2fb17
xor dword [rbp - 0x24], 0x6fc2ade2
mov dword [rbp - 0x20], 0x73975192
sub dword [rbp - 0x20], 0x72d0d9a0
add dword [rbp - 0x20], 0x77ca5d5c
sub dword [rbp - 0x20], 0x7884d4d9
xchg rsi, r15
mov qword [rbp + 0x10], r15
xchg rsi, r15
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x18], ebp
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x284ecb36
sub eax, 0x1327859
sub eax, 0x1215c43f
add eax, 0x2e7f15d1
add eax, 0x2723bba2
shr eax, cl
xchg r10, r10
movzx ecx, al
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg rbx, rbx
mov rax, qword [rbp + 0x10]
inc rax
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
cmp rax, 0xb
xchg r13, r13
jb 0x14006a6dd
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
mov rcx, rcx
call fcn.14008c3d0
mov rdx, rax
mov r8, rax
xchg r9, r9
xor eax, eax
xor rdx, rbx
xchg r14, rdx
mov qword [rdi + 0x20], r14
xchg r14, rdx
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x10], 0x1a7e9dc6
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x24], ebx
je 0x14006a7be
lea rdx, [0x140144298]
mov rcx, r8
call fcn.1400738c4
mov r9, r9
test al, al
setne al
jmp 0x14006a7be
mov al, 0x6a
xor al, 0x47
sub al, 0x1d
sub al, 0xf
xchg rbx, r12
mov r12, qword [rsp + 0x68]
xchg rbx, r12
mov rsi, qword [rsp + 0x70]
xchg rdx, rdi
mov rdx, qword [rsp + 0x78]
xchg rdx, rdi
add rsp, 0x50
mov dword [rsp - 0xc], 0x2f8e31f7
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400754ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x1c], 0x2579a27b
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
xchg rdi, rax
mov qword [rcx], rdi
xchg rdi, rax
xorps xmm0, xmm0
xchg r10, r10
movups xmmword [rax], xmm0
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
xchg rbp, r9
mov qword [rsp + 0x78], r9
xchg rbp, r9
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
xchg r10, r10
movups xmmword [rax + 0x20], xmm0
xchg r14, rax
movups xmmword [r14 + 0x30], xmm0
xchg r14, rax
xchg rsp, rax
movups xmmword [rsp + 0x40], xmm0
xchg rsp, rax
xchg r8, rax
movups xmmword [r8 + 0x50], xmm0
xchg r8, rax
movups xmmword [rax + 0x60], xmm0
xchg r9, rax
movups xmmword [r9 + 0x70], xmm0
xchg r9, rax
xchg rsi, rbp
mov rsi, qword [rdx + 0x38]
xchg rsi, rbp
lea rax, [rsp + 0x28]
xchg r10, rbx
mov r10, qword [rdx]
xchg r10, rbx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rbp + 1]
mov r11, r11
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140017ab0
mov dword [rsp - 0x10], 0x6936d71
mov edx, 0x6470e3aa
sub edx, 0x11b9ea1
xor edx, 0x1240691c
sub edx, 0x66bcc04
test rbp, rbp
xchg r13, r13
je 0x140075518
xchg r10, rax
mov rdi, r10
xchg r10, rax
sub rbx, rax
mov dword [rsp - 0xc], edi
mov r9, rbp
mov r8d, 0x1fd39b84
xor r8d, 0x55066a09
add r8d, 0x9499085
xor r8d, 0x1bfc55ad
sub r8d, 0x4fe3d6c0
nop word [rax + rax]
xchg r10, r10
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
mov dword [rsp - 0x20], ecx
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r8, r8
mov word [rdi - 2], cx
sub r9, 1
jne 0x1400754e9
xchg rdi, rdi
xor ecx, ecx
xchg r8, rbp
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
mov dword [rsp - 0x20], ecx
xchg r8, rcx
mov r8, rsi
xchg rcx, r8
xchg r14, rdx
mov r14, qword [rsp + 0x20]
xchg rdx, r14
call fcn.1400922d0
xchg r14, r14
xchg rcx, r15
mov r15, qword [rsp + 0x20]
xchg r15, rcx
lea rax, [rsp + 0x28]
xchg rbp, r11
mov r11, qword [rsp + 0x78]
xchg r11, rbp
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x1400755c8
mov dword [rsp - 0x20], ebp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x2b2c4680
xor ecx, 0x45ef33fb
sub ecx, 0x499a496e
add ecx, 0x5500966
sub ecx, 0x2a793543
rep stosb byte [rdi], al
xchg r12, r12
xchg rsi, r10
mov rax, r10
xchg r10, rsi
xchg rsi, r10
mov r10, qword [rsp + 0x80]
xchg rsi, r10
nop
add rsp, 0x43c889ea
sub rsp, 0x43c8898a
pop rdi
xchg r9, r9
ret
call fcn.140099eb0
xchg r14, rsi
mov rax, r14
xchg rsi, r14
xchg rcx, rsi
mov rcx, qword [rsp + 0x80]
xchg rsi, rcx
nop
add rsp, 0x988b469
sub rsp, 0x988b409
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007575e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
xchg r10, r10
push rsi
push rdi
push r15
mov dword [rsp - 0xc], ebx
add rsp, 0xffffffffffffffa0
lea rdi, [rcx + 8]
xchg r15, rdx
mov rdx, r15
xchg rdx, r15
mov qword [rcx], rdi
xchg r15, rbx
mov r15, rcx
xchg rbx, r15
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
xor edx, edx
mov dword [rsp - 0x40], ebx
mov r8d, 0x6931f86e
xor r8d, 0x78657272
add r8d, 0x29f11be1
sub r8d, 0x3b45a4fd
call fcn.14009a470
xchg rbx, rax
mov rbx, qword [r15 + 0x38]
xchg rbx, rax
xchg rdi, rax
mov qword [rbx + 0x108], rdi
xchg rdi, rax
xchg r15, rcx
mov r15, qword [rbx]
xchg rcx, r15
lea rsi, [rax + 1]
xchg rsp, rsp
cmp rcx, rdi
je 0x14007568d
call fcn.140099eb0
cmp rsi, 0x80
mov dword [rsp - 0x44], esp
jbe 0x1400756c3
lea rcx, [rsi + rsi]
call fcn.14009a150
xchg r15, rax
mov qword [rbx], r15
xchg r15, rax
test rax, rax
mov dword [rsp - 0x2c], ebp
jne 0x1400756c9
mov qword [rbx], rdi
jmp 0x140075873
mov qword [rbx], rdi
mov rax, rdi
xor edx, edx
xchg rbx, rbx
mov qword [rsp + 0x88], r14
mov r8d, 0x44575f6c
sub r8d, 0x1b29126b
add r8d, 0x351ad76f
sub r8d, 0x5e492370
mov rcx, rax
call fcn.14009a470
xchg r14, rdi
mov rdi, qword [rbx]
xchg r14, rdi
test r14, r14
mov r9, r9
je 0x140075865
mov rsi, qword [r15]
lea rax, [rsp + 0x28]
mov rbp, rbp
xorps xmm0, xmm0
mov qword [rsp + 0x80], rbp
mov rbp, qword [r15 + 0x38]
mov dword [rsp - 0x30], esp
lea rcx, [rsp + 0x20]
xchg rcx, rax
mov qword [rsp + 0x20], rcx
xchg rcx, rax
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp - 0x24], ebx
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140017ab0
xchg r13, r13
mov edx, 0x4723761c
xor edx, 0x15ab1459
xor edx, 0x3667927b
add edx, 0x5b96fd3
test rbp, rbp
je 0x1400757eb
mov r15, r15
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
sub rsi, rax
xchg rbp, r9
mov r8, r9
xchg rbp, r9
mov r9d, 0x1151a24c
xor r9d, 0x597d4628
xor r9d, 0x7f97ed9b
xor r9d, 0x37bb0900
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp - 0x20], 0x3b96f783
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x20], esi
ror edx, 1
ror edx, 7
xor cx, word [rsi + rdi - 2]
mov rcx, rcx
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400757be
xchg r8, r8
xor ecx, ecx
mov word [rax + rbp*2], cx
mov rcx, r14
mov rdx, qword [rbx + 0x108]
mov dword [rsp - 0x3c], 0x35860798
mov r8, qword [rsp + 0x20]
inc rdx
call fcn.14009aeb0
mov rsi, rsi
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x80]
cmp rcx, rax
mov dword [rsp - 0x3c], ebx
jne 0x14007585d
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x5bb13a21
sub ecx, 0x11a3d735
xor ecx, 0x5a3ab93d
add ecx, 0xc67d041
sub ecx, 0x1c9fabe2
rep stosb byte [rdi], al
jmp 0x140075865
call fcn.140099eb0
xchg rsi, rsi
xchg r14, rdx
mov rdx, qword [rsp + 0x88]
xchg r14, rdx
xchg r10, rbx
mov rax, r10
xchg r10, rbx
mov rbx, qword [rsp + 0x90]
nop
sub rsp, 0x5967217
add rsp, 0x5967277
nop
mov r15, qword [rsp]
add rsp, 8
pop rdi
pop rsi
mov rcx, rcx
ret
Function at 0x1400816a8
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg r10, rbp
mov qword [rsp + 0x10], r10
xchg rbp, r10
mov qword [rsp + 0x18], rsi
xchg rdx, rdx
push rdi
push r12
push r8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x5f05622b
sub rsp, 0x5f05624b
xchg r15, rcx
mov rcx, r15
xchg rcx, r15
mov r14d, r8d
mov dword [rsp - 0x44], esp
mov r9d, 0x3a0a98c9
xor r9d, 0x7675adcf
add r9d, 0x24025510
xor r9d, 0x2a2eedf9
sub r9d, 0x5aab67ef
mov r12, rdx
cmp r8d, r9d
mov r8, r8
pushf
movabs rcx, 0xffffffff74884b8e
sub rcx, 0x367e05b5
sub rcx, 0x111f6437
sub rcx, 0x1640cd89
add rcx, 0x7fffffff
add rcx, 0x6955ebe7
popf
pushf
mov eax, 0x665d3f0a
sub eax, 0x2411f11a
add eax, 0x244ef7f7
sub eax, 0x669a45e3
popf
cmovb r9d, r14d
mov dword [rsp - 0xc], 0x66ab195d
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140099d50
mov dword [rsp - 0x24], 0x6ec5e45f
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xf
shr ebp, 2
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x20], 0xb34ad37
xchg r15, rax
mov rsi, r15
xchg r15, rax
mov ebx, 0x71aa1c84
sub ebx, 0x18cf6e5
sub ebx, 0x3e02a4de
xor ebx, 0x321a80c0
test ebp, ebp
mov dword [rsp - 0x10], ecx
je 0x1400818d6
mov eax, 0x692f5318
xor eax, 0x62f447ee
add eax, 0x47d244c8
sub eax, 0x3920893
xor eax, 0x500b512b
mov r9d, edi
mov r14, r14
mov r8d, r14d
shl r9d, 1
shl r9d, 0xf
shl r9d, 1
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0x20], 0x4fa975f1
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
xchg r10, r10
xor r10d, r10d
shr r11d, 2
test r11d, r11d
xchg r10, r10
je 0x140081882
xchg rbp, rdx
mov rbp, rsi
xchg rbp, rdx
lea ecx, [r9 + r10]
mov dword [rsp - 0x34], edi
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x75b15a6d
mov dword [rsp - 0x10], ebp
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x140081854
mov dword [rsp - 0x40], esi
xchg rcx, rsi
mov rdx, rcx
xchg rcx, rsi
xchg r8, r15
mov rcx, r8
xchg r15, r8
call fcn.140094630
mov dword [rsp - 0x14], 0x784f2261
test al, al
je 0x1400818d0
add edi, ebx
mov eax, 0x4b35c508
xor eax, 0x457842e1
xor eax, 0x16f17026
xor eax, 0x18acf7cf
cmp edi, ebp
jb 0x140081800
mov dword [rsp - 0x38], edx
jmp 0x1400818d6
xor bl, bl
mov dword [rsp - 0x40], edi
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140099d60
xchg rdi, rdi
xchg r14, rbp
mov r14, qword [rsp + 0x58]
xchg rbp, r14
mov al, bl
mov dword [rsp - 0x24], esi
xchg rbx, r10
mov r10, qword [rsp + 0x50]
xchg rbx, r10
mov rsi, qword [rsp + 0x60]
mov dword [rsp - 0x24], edi
add rsp, 0x20
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
mov rsp, rsp
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140084480
Capabilities:
Enumerate pe sections

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rbp, r9
mov qword [rsp + 0x10], r9
xchg r9, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x2c], esp
mov qword [rsp + 0x20], rdi
nop
push 0x89ae8f9
mov qword [rsp], r14
nop
add rsp, 0x68ea3676
sub rsp, 0x68ea3696
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x20], ebx
xchg rcx, rdx
mov rdi, rcx
xchg rcx, rdx
xchg r14, rsi
mov r14, rcx
xchg rsi, r14
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0xc], 0x4ed1e54e
call fcn.140086250
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov rbp, rbp
mov r10, rax
mov ebx, r14d
test ebp, ebp
xchg rbp, rbp
je 0x14008466c
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg rbx, rbx
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x40], edx
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
xchg r12, r12
cmp r14w, cx
jae 0x140084592
mov eax, dword [rdx + 8]
test eax, eax
mov dword [rsp - 0xc], edi
jne 0x140084556
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov r12, r12
jb 0x140084575
add eax, r9d
cmp r11d, eax
jb 0x14008461b
xchg r8, r8
inc r8w
nop
add rdx, 0x289a55bc
sub rdx, 0x289a5594
cmp r8w, cx
jb 0x140084544
xchg r8, rsp
mov rsp, r14
xchg rsp, r8
mov eax, dword [r10 + 4]
mov rdx, rdx
lea r9, [r10 + 4]
nop
add rax, 0x2a9e0d26
sub rax, 0x2a9e0d2e
nop
sub r10, 0x485e34e4
add r10, 0x485e34ec
shr rax, 1
mov dword [rsp - 0x34], 0x3a08e24b
test eax, eax
je 0x14008465d
mov edx, eax
nop word [rax + rax]
mov r15, r15
movzx eax, word [r10]
mov ecx, eax
shr ecx, 4
shr ecx, 3
shr ecx, 3
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140084634
cmp ecx, 0xa
mov dword [rsp - 0x1c], 0x27882dfb
jne 0x140084641
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140084641
mov r8d, dword [rdx + 0x14]
xchg r14, r14
sub r8, r9
add r8, rsi
add r8, r11
mov dword [rsp - 0x34], edi
jmp 0x14008459b
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x3c], ecx
nop
sub r10, 0x389ed74e
add r10, 0x389ed750
sub rdx, 1
xchg rdi, rdi
jne 0x1400845e0
add ebx, dword [r9]
cmp ebx, ebp
mov dword [rsp - 0x10], ebp
jb 0x140084511
mov rbx, qword [rsp + 0x30]
xchg rbp, rdi
mov rdi, qword [rsp + 0x38]
xchg rbp, rdi
xchg r12, rsi
mov r12, qword [rsp + 0x40]
xchg rsi, r12
mov rdi, qword [rsp + 0x48]
nop
sub rsp, 0x4b7ba998
add rsp, 0x4b7ba9b8
pop r14
ret
Function at 0x140086320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
nop
push r13
mov qword [rsp], rsi
push rdi
mov r13, r13
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x6f924a8e
add rsp, 0x6f924a6e
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x34], 0x140f6e85
xor eax, 0x75b15a6d
xchg r14, rcx
mov rsi, r14
xchg r14, rcx
cmp eax, 0x75b10020
mov dword [rsp - 0x28], edx
jne 0x1400864d5
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x75b15a6d
mov dword [rsp - 0xc], ebx
cmp eax, 0x75b11f3d
jne 0x1400864d5
mov edx, dword [rdx + rcx + 0x88]
xchg r11, r11
call fcn.140086250
xchg rsi, rbp
mov rcx, rbp
xchg rbp, rsi
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.140086250
xchg r8, r8
mov edx, dword [r14 + 0x24]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.140086250
mov dword [rsp - 0x38], 0x1ca8dd6a
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r13, r12
mov r12, rax
xchg r12, r13
call fcn.140086250
xor edi, edi
xchg r15, rax
mov qword [rsp + 0x70], r15
xchg r15, rax
cmp dword [r14 + 0x18], edi
jbe 0x1400864d5
mov dword [rsp - 0x34], 0x21c628cf
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140086250
mov ecx, 0x3fd98b48
sub ecx, 0xccd1474
xor ecx, 0x1144bd3b
add ecx, 0xddb73410
xchg r11, rax
mov rbx, r11
xchg r11, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
xchg rbx, rbx
je 0x1400864bb
nop dword [rax]
xchg r14, rbx
mov rdx, r14
xchg rbx, r14
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x30], esi
mov r8d, 0x53c2f091
add r8d, 0xfdcc681
sub r8d, 0xe65f7ce
sub r8d, 0x3d6ee5cc
sub r8d, 0x17cad977
inc rbx
mov r12, r12
call fcn.14008f5a0
cmp byte [rbx], 0
jne 0x14008646b
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x34], ebp
not ecx
cmp ecx, r15d
je 0x14008651b
inc edi
xchg r12, r12
cmp edi, dword [r14 + 0x18]
jb 0x140086428
xor eax, eax
mov r8, r8
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg r14, rbx
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
mov r9, r9
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
mov r14, r14
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
mov rax, qword [rsp + 0x70]
xchg r14, r14
mov edx, dword [rax + rdx*4]
call fcn.140086250
jmp 0x1400864da
Function at 0x14008a8d5
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x44], 0x42eb8e1
push rdi
sub rsp, 0x60
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x18], 0x77e8423c
xorps xmm0, xmm0
xchg r12, rsi
mov qword [rsp + 0x70], r12
xchg rsi, r12
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r15, rax
mov qword [rsp + 0x20], r15
xchg r15, rax
xchg r10, rsp
movups xmmword [r10 + 0x28], xmm0
xchg rsp, r10
lea rdx, [rsi + 1]
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg r14, rsp
xchg rsp, rbx
movups xmmword [rbx + 0x48], xmm0
xchg rbx, rsp
call fcn.140017ab0
mov edx, 0x3873ba03
xor edx, 0x6b7d8ea0
xor edx, 0x43a6d4e3
sub edx, 0x102d0740
add edx, 0x6a2d8711
test rsi, rsi
je 0x14008a9b5
mov dword [rsp - 0x10], 0xaab46e8
mov rdi, rax
sub rbx, rax
mov r8, rsi
mov r9d, 0x44bcd5af
xor r9d, 0x2265f1ca
xor r9d, 0x220c8a1f
sub r9d, 0x44d5ad7b
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x18], 0x47aa347b
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 4
ror edx, 3
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov rsp, rsp
jne 0x14008a984
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
mov rdi, rdi
call fcn.14008aa70
xchg r12, rcx
mov r12, qword [rsp + 0x20]
xchg rcx, r12
mov ebx, eax
mov r13, r13
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14008aa37
mov rcx, rcx
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x2064286d
xor ecx, 0x5c1836c0
sub ecx, 0xc719291
sub ecx, 0x486cac1
xor ecx, 0x6b83c16b
rep stosb byte [rdi], al
mov eax, ebx
mov r10, r10
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x58169406
sub rsp, 0x581693a6
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099eb0
mov eax, ebx
xchg r10, r10
xchg r11, rbx
mov r11, qword [rsp + 0x78]
xchg r11, rbx
nop
add rsp, 0x6d4cb8ce
sub rsp, 0x6d4cb86e
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008bf66
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov rbx, rsp
xchg r11, rbx
mov qword [r11 + 0x20], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x7ecceaf6
sub rsp, 0x7ecceb56
mov rbx, qword [rcx]
mov r9, r9
lea rax, [r11 - 0x40]
xchg r13, rbp
mov qword [r11 + 8], r13
xchg r13, rbp
xorps xmm0, xmm0
mov dword [rsp - 0x18], esp
xchg rsi, rax
mov qword [r11 - 0x48], rsi
xchg rsi, rax
mov ebp, r8d
mov dword [rsp - 0x38], esi
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov dword [rsp - 0x10], edx
xchg r13, rdx
mov r14, r13
xchg r13, rdx
xchg r13, rsp
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x14], 0x5b910165
xchg rsp, r9
movups xmmword [r9 + 0x48], xmm0
xchg rsp, r9
call fcn.140017ab0
xchg r13, r13
mov edx, 0x249d4a33
sub edx, 0x1e347bae
xor edx, 0x465e29db
xor edx, 0x75c20163
add edx, 0x34b479d4
test rsi, rsi
mov rdx, rdx
je 0x14008bfd7
xchg r8, rdi
mov r8, rax
xchg r8, rdi
sub rbx, rax
xchg rcx, r8
mov rcx, rsi
xchg r8, rcx
mov r9d, 0x1c3787b1
add r9d, 0xa2adffc
xor r9d, 0x42e1c1e7
xor r9d, 0xcc9f75
sub r9d, 0x644f3840
nop word [rax + rax]
mov r8, r8
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 1
ror edx, 4
ror edx, 3
xor cx, word [rbx + rdi - 2]
mov rsi, rsi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008bfaa
mov dword [rsp - 0x20], ebp
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov rdx, rdx
xchg r14, rdx
mov r14, rdx
xchg rdx, r14
xchg rcx, rbp
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
call fcn.14008c0a0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r10, r10
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov rsp, rsp
xchg r12, rbp
mov r12, qword [rsp + 0x70]
xchg rbp, r12
cmp rcx, rax
mov dword [rsp - 0x24], esi
jne 0x14008c07a
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x44e19e07
add ecx, 0x2f8761be
xor ecx, 0x36d9a7f3
sub ecx, 0x21dc6eb3
xor ecx, 0x20d4e9b3
rep stosb byte [rdi], al
xchg r10, r10
mov eax, ebx
xchg rbx, r11
mov r11, qword [rsp + 0x88]
xchg r11, rbx
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099eb0
mov eax, ebx
xchg r15, r15
xchg rsi, rbx
mov rsi, qword [rsp + 0x88]
xchg rbx, rsi
add rsp, 0x60
pop rdi
ret
Function at 0x14008c0a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
xchg r14, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x39c9e53a
add rsp, 0x39c9e2fa
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
xchg r10, r10
mov r8d, 0x3260c420
add r8d, 0xc6a86c5
add r8d, 0x2405e771
sub r8d, 0x62d1304e
call fcn.14009a470
mov rax, qword gs:[0x60]
xchg r8, rbp
mov rbp, qword [rax + 0x18]
xchg rbp, r8
mov rax, qword [r8 + 0x10]
mov r8, qword [rax]
mov dword [rsp - 0x1c], ecx
test r8, r8
je 0x14008c38d
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x28], edi
je 0x14008c38d
mov edx, 0x3aa32f56
sub edx, 0x2acfca1d
add edx, 0x319c2cae
xor edx, 0x40c853d
sub edx, 0x456313d6
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.14009afe0
mov dword [rsp - 0x40], 0x28489a8b
mov edx, 0x68b6161
sub edx, 0x54e6c0
add edx, 0x6d0a8b68
xor edx, 0x73410655
lea rcx, [rsp + 0x30]
call fcn.14009b110
test rax, rax
mov dword [rsp - 0x40], edx
je 0x14008c352
xor ecx, ecx
xchg r10, rdx
mov r10, rdi
xchg rdx, r10
mov word [rax], cx
movabs rcx, 0xf9c696a17568960c
sub rcx, 0x1d7a1997
add rcx, 0x1451c5ab
sub rcx, 0x1f7d2ba6
sub rcx, 0x2c121aea
mov rax, qword [0x140144690]
not rax
mov dword [rsp - 0x40], esp
rol rax, 0x13
rol rax, 0xe
rol rax, 0xb
rol rax, 1
add rcx, rax
mov r12, r12
movabs rax, 0x6c5ff002438f3ba
add rax, 0x2968e2c2
add rax, 0x1c704803
add rax, 0x94712ed
add rax, 0x5d5c1377
xor rcx, rax
movabs rax, 0xd0dadc9438776121
xor rax, 0x3898d3ad
add rax, 0x2f7df7f3
add rax, 0x7fffffff
add rax, 0x6df79f7
ror rcx, 1
ror rcx, 2
ror rcx, 1
add rax, rcx
movabs rcx, 0x517a0a6d13cc4618
add rcx, 0x51b7caad
xor rcx, 0x525d2b86
add rcx, 0x61b51d4c
xor rax, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x18], 0xf9be1df
call rax
mov rax, qword [0x140144680]
lea r8, [rsp + 0x20]
not rax
mov rdx, rdx
lea rdx, [rsp + 0x260]
rol rax, 0x11
rol rax, 1
movabs rcx, 0x4e3e817223181311
sub rcx, 0x9df0b51
add rcx, 0x4769cfe2
sub rcx, 0x5e937302
add rcx, 0x7fffffff
add rcx, 0x5600eb06
xor rax, rcx
mov r15, r15
xchg r9, r11
mov r11, rbx
xchg r9, r11
movabs rcx, 0x49d15d72c54aabe
sub rcx, 0x4dd9986
add rcx, 0x192cf3df
xor rcx, 0x46354d22
add rax, rcx
movabs rcx, 0xc97464586e758fab
xor rcx, 0x6afb8211
add rcx, 0x36f1e86f
sub rcx, 0x1744ff68
xor rcx, 0x5328f319
rol rax, 0x1c
rol rax, 9
rol rax, 1
add rax, rcx
lea rcx, [rsp + 0x30]
call rax
mov dword [rsp - 0x24], ebx
xchg rbx, rsi
mov rsi, qword [rsp + 0x250]
xchg rsi, rbx
add rsp, 0x240
mov dword [rsp - 0x14], ecx
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x37328e24
xor eax, 0x1548773
add eax, 0x3a4f6aa8
xor eax, 0xb0b573fe
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg rbx, r13
sub rsp, 0x7a1c59b6
add rsp, 0x7a1c5bf6
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbx, rdx
mov rdx, qword [rsp + 0x250]
xchg rbx, rdx
mov eax, 0x73ae6002
sub eax, 0x52446066
add eax, 0x5d6d0723
add eax, 0x4128fa76
sub rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x3c], 0x3f95bbc4
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret