joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2e]
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x10
add byte [rbx + rax], 1
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x75
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x33
inc rax
cmp rax, 0x5a
jb 0x14007cdec
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rcx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
push rdi
sub rsp, 0x20
xchg rdi, r15
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x30]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x26
add byte [rbx + rax], 0xa
add byte [rbx + rax], 3
xor byte [rbx + rax], 0x61
add byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x4d
inc rax
cmp rax, 0x5c
jb 0x14007ce79
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ced0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 5
add byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x21
xor byte [rbx + rax], 0x7e
add byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x71
inc rax
cmp rax, 0x5e
jb 0x14007cef7
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rbx
push rcx
push rcx
push rbx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rbx
pop rcx
pop rcx
pop rbx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x32]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x44
add byte [rbx + rax], 0x2c
add byte [rbx + rax], 7
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x60
jb 0x14007cf93
xchg r13, rdi
mov rax, r13
xchg rdi, r13
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cff0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x56
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x1c
inc rax
cmp rax, 0x64
jb 0x14007d026
mov rax, rdi
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbp, rdi
mov rbp, rcx
xchg rbp, rdi
lea rbx, [rdx + 0x38]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x28
add byte [rbx + rax], 0x48
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x63
inc rax
cmp rax, 0x6e
jb 0x14007d0ab
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rdx
push rax
xchg qword [rsp + 0x18], rdi
pop rax
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d100
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x4e]
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0x19
add byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x17
inc rax
cmp rax, 0x98
jb 0x14007d133
mov rax, rdi
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rax
push rdx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x28], rdi
pop rcx
pop rcx
pop rdx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d190
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0x56]
mov rdx, rbx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x62
sub byte [rbx + rax], 0x6e
inc rax
cmp rax, 0xa8
jb 0x14007d1c5
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
push rax
push rax
push rdx
push rdx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rdx
pop rdx
pop rax
pop rax
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d220
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x40
add byte [rbx + rax], 0x14
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x10
inc rax
cmp rax, 0xb0
jb 0x14007d24d
xchg r15, rax
mov r15, rdi
xchg r15, rax
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d320
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r9, rdi
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x44
inc rax
cmp rax, 0xde
jb 0x14007d361
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x76]
xchg r13, rbx
mov rdx, r13
xchg r13, rbx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x5e
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x29
inc rax
cmp rax, 0xea
jb 0x14007d3ed
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d440
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x7c]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x23
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x11
inc rax
cmp rax, 0xf4
jb 0x14007d47b
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d4d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg rcx, r8
lea rbx, [rdx + 0x9a]
xchg rbx, r15
mov rdx, r15
xchg r15, rbx
call fcn.14007ab00
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x5a
xor byte [rbx + rax], 0x73
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x26
add byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x65
inc rax
cmp rax, 0x130
jb 0x14007d518
mov rax, rdi
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rbx
push rcx
xchg qword [rsp + 0x10], rdi
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d570
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0xc]
xchg rsi, rdx
mov rsi, rbx
xchg rdx, rsi
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0x5a
xor byte [rbx + rax], 0x5b
add byte [rbx + rax], 0xc
add byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0x5d
add byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x27
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x6d
inc rax
cmp rax, 0x14
jb 0x14007d5b1
xchg r13, rdi
mov rax, r13
xchg rdi, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rbx
push rdx
push rcx
push rcx
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d610
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, r9
mov r9, rbx
xchg r9, rdx
call fcn.14007ab00
nop
xor eax, eax
mov byte [rbx + rax], 0
add byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x18
jb 0x14007d645
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rbx
push rax
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret
Function at 0x140083f50
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rdi
mov rax, rdi
xchg rdi, r8
cmp rcx, rdx
je 0x1400840d0
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg rdi, r10
mov qword [r9 + r8 - 0x70], rdi
xchg rdi, r10
xchg rdx, r10
mov qword [r9 + r8 - 0x68], rdx
xchg r10, rdx
xchg r8, r11
movups xmm0, xmmword [r11 - 0x80]
xchg r11, r8
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg r8, r14
movups xmm1, xmmword [r14 - 0x70]
xchg r8, r14
xorps xmm0, xmm0
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm1
xchg rdi, rax
xchg r10, rcx
mov qword [r8 - 0x70], rcx
xchg r10, rcx
nop
sub rax, 0x59942f41
add rax, 0x59942f89
mov qword [r8 - 0x68], 0x1df6a117
sub qword [r8 - 0x68], 0x2ecb4ea
xor qword [r8 - 0x68], 0x7823312f
xor qword [r8 - 0x68], 0x38310bce
add qword [r8 - 0x68], 0xcc91790
xor qword [r8 - 0x68], 0x161641ce
xor qword [r8 - 0x68], 0x71f2af95
mov word [r8 - 0x80], r10w
xchg rsi, r9
movups xmmword [rsi + r8 - 0x60], xmm0
xchg rsi, r9
xchg r10, rbp
mov qword [r9 + r8 - 0x50], rbp
xchg r10, rbp
mov qword [r9 + r8 - 0x48], r10
xchg r8, rbx
movups xmm0, xmmword [rbx - 0x60]
xchg r8, rbx
xchg rdx, r9
movups xmmword [rdx + r8 - 0x60], xmm0
xchg r9, rdx
xchg r8, r13
movups xmm1, xmmword [r13 - 0x50]
xchg r13, r8
xchg r9, r11
movups xmmword [r11 + r8 - 0x50], xmm1
xchg r9, r11
xchg r10, r12
mov qword [r8 - 0x50], r12
xchg r10, r12
mov qword [r8 - 0x48], 0x33a93a1f
sub qword [r8 - 0x48], 0x16152f8b
xor qword [r8 - 0x48], 0x1f0724af
add qword [r8 - 0x48], 0x4a426f74
xor qword [r8 - 0x48], 0x7874047f
add qword [r8 - 0x48], 0x1b1f732e
add qword [r8 - 0x48], 0x1a4c478f
sub qword [r8 - 0x48], 0x14f3cedc
sub qword [r8 - 0x48], 0x551985aa
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083f76
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084200
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, r8
xchg rdx, rax
cmp rcx, rdx
je 0x1400842c2
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r14, rax
movups xmmword [r14], xmm0
xchg r14, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, rcx
mov qword [r8 + r9 - 0x20], rcx
xchg r10, rcx
xchg r12, r8
movups xmm0, xmmword [r12 - 0x38]
xchg r8, r12
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg r13, r8
movups xmm1, xmmword [r13 - 0x28]
xchg r8, r13
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm1
xchg rbp, rax
mov qword [r8 - 0x28], r10
nop
add rax, 0x68436662
sub rax, 0x68436642
mov qword [r8 - 0x20], 0x545aac45
add qword [r8 - 0x20], 0x29a9257d
xor qword [r8 - 0x20], 0x5096fbf6
sub qword [r8 - 0x20], 0x29a70ad9
add qword [r8 - 0x20], 0x2b15c07d
sub qword [r8 - 0x20], 0x3003dfd1
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140084228
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e730
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x47
xor byte [rcx + rax + 0xa], 0x39
sub byte [rcx + rax + 0xa], 0x22
xor byte [rcx + rax + 0xa], 0x1f
sub byte [rcx + rax + 0xa], 0x15
sub byte [rcx + rax + 0xa], 0x1b
sub byte [rcx + rax + 0xa], 0x13
inc rax
cmp rax, 0x10
jb 0x14008e732
ret

Function at 0x14008e850
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x69
add byte [rcx + rax + 0x14], 0x15
sub byte [rcx + rax + 0x14], 0x56
xor byte [rcx + rax + 0x14], 0x4a
sub byte [rcx + rax + 0x14], 0x13
sub byte [rcx + rax + 0x14], 0x4f
inc rax
cmp rax, 0x24
jb 0x14008e852
ret
Function at 0x1401947b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r10
mov rdx, r10
xchg r10, rdx
xchg r11, r15
mov r15, rcx
xchg r15, r11
mov word [rsp + 0x30], 0x4e10
sub word [rsp + 0x30], 0x18d9
add word [rsp + 0x30], 0x3610
add word [rsp + 0x30], 0x3dd
xor word [rsp + 0x30], 0xc1c
add word [rsp + 0x30], 0x93be
mov dword [rsp + 0x34], 0x50f51c5d
sub dword [rsp + 0x34], 0x3887f6c0
xor dword [rsp + 0x34], 0x6080f7ec
sub dword [rsp + 0x34], 0x60acb2a0
sub dword [rsp + 0x34], 0x12195a14
add dword [rsp + 0x34], 0x569b8e48
sub dword [rsp + 0x34], 0x294360ad
xor dword [rsp + 0x34], 0xcc300c09
mov byte [rsp + 0x32], 0x41
sub byte [rsp + 0x32], 0x33
add byte [rsp + 0x32], 0x43
add byte [rsp + 0x32], 0xc
sub byte [rsp + 0x32], 0x2d
add byte [rsp + 0x32], 0x3a
sub byte [rsp + 0x32], 0x1b
sub byte [rsp + 0x32], 0x35
add byte [rsp + 0x32], 0xdc
mov dword [rsp + 0x38], 0x358a1e1d
add dword [rsp + 0x38], 0x4a588209
sub dword [rsp + 0x38], 0x5dda42a4
xor dword [rsp + 0x38], 0x3012a313
add dword [rsp + 0x38], 0x1ddfa92d
add dword [rsp + 0x38], 0x43e9af7b
sub dword [rsp + 0x38], 0x73e357db
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x14019489f
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg rsi, rdx
mov rsi, r10
xchg rdx, rsi
mov rcx, r11
call fcn.140194cb0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x5f
sub byte [rsp + rbx + 0x34], 6
xor byte [rsp + rbx + 0x34], 0xf
xor byte [rsp + rbx + 0x34], 0x17
add byte [rsp + rbx + 0x34], 0x33
xor byte [rsp + rbx + 0x34], 0x53
xor byte [rsp + rbx + 0x34], 0x27
inc rbx
cmp rbx, 6
jb 0x1401948e9
add rsp, 0x40
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140199080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r11, r8
mov qword [rsp + 0x18], r11
xchg r8, r11
mov qword [rsp + 8], rcx
nop
push r11
mov qword [rsp], rbx
nop
push 0x5937b6bd
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r13
push r14
push r15
sub rsp, 0x58
xchg r12, r9
mov rbx, r12
xchg r9, r12
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
xchg rsi, r9
mov rsi, rcx
xchg rsi, r9
xor ebp, ebp
test rdx, rdx
jne 0x1401990f2
mov eax, ebp
jmp 0x140199138
mov eax, 0x30bfc3d2
add eax, 0x33bde999
sub eax, 0xfbc5c69
sub eax, 0x3507cbb9
xor eax, 0x4c795a26
sub eax, 0x53c08522
cmp word [rdx], ax
je 0x140199127
xchg rbp, r13
mov rax, r13
xchg rbp, r13
jmp 0x140199138
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x1d21f9e8
add ecx, 0x459e5905
sub ecx, 0x2434db9a
sub ecx, 0x3589a1de
add ecx, 0x4989e5d
sub ecx, 0xd9a71c7
cmp word [rax + 0x18], cx
jne 0x140199274
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x140199274
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140199240
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x140199234
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
xchg r9, r12
mov qword [rsp + 0x40], r12
xchg r9, r12
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140199301
xchg r11, rax
mov r11, qword [rcx]
xchg r11, rax
lea rdx, [rsp + 0xa8]
xchg rdx, r14
mov qword [rsp + 0x20], r14
xchg rdx, r14
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140199240
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401991a3
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140199263
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg r14, rbp
mov qword [rbx + 0x38], r14
xchg rbp, r14
mov al, 0x5c
sub al, 0x14
xor al, 0x67
add al, 0x29
xor al, 2
sub al, 0x59
jmp 0x140199299
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140199297
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rbp, r15
mov qword [rbx + 0x38], r15
xchg rbp, r15
xor al, al
add rsp, 0x58
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
push rax
push rbx
push rbx
push rdx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x38], r13
pop rcx
pop rcx
pop rdx
pop rdx
pop rbx
pop rbx
pop rax
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
push rcx
push rax
push rdx
push rax
push rbx
push rax
push rax
push rcx
xchg qword [rsp + 0x40], rbp
add rsp, 0x48
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
call fcn.1401fe392
nop
int3
Function at 0x140199b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rcx
mov qword [rsp], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdi, r14
mov r14, rdx
xchg rdi, r14
test rdx, rdx
jne 0x140199b9b
mov eax, ebx
jmp 0x140199bee
mov eax, 0x56d6a2bc
sub eax, 0xb009f5d
xor eax, 0x50229b5f
xor eax, 0x7da478f6
xor eax, 0x64eceb5d
xor eax, 0xd74e08e
xor eax, 0x3b18353
xor eax, 0x6eeb9170
sub eax, 0x62929eb9
cmp word [rdx], ax
je 0x140199bdd
xchg r14, rax
mov r14, rbx
xchg r14, rax
jmp 0x140199bee
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
mov qword [rsp + 0x50], rbp
mov ecx, 0x401f8e4f
sub ecx, 0x1919bffa
xor ecx, 0x2aaaf403
xor ecx, 0x688d49f0
xor ecx, 0x4edaad11
sub ecx, 0x2bf8dcac
xchg rsi, rcx
mov qword [rsp + 0x58], rcx
xchg rcx, rsi
xchg rbx, r12
mov qword [rsp + 0x60], rbx
xchg rbx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp word [rax + 0x18], cx
jne 0x140199caa
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140199caa
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140199caa
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076380
cmp eax, r13d
je 0x140199cfc
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140199c7a
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xchg r12, r9
mov r9, qword [rsp + 0x60]
xchg r12, r9
mov rsi, qword [rsp + 0x58]
xchg r14, rbp
mov r14, qword [rsp + 0x50]
xchg r14, rbp
add rsp, 0x30
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
push rcx
xchg qword [rsp + 8], rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov rax, rbp
jmp 0x140199cac
Function at 0x1401ab890
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
mov r10, rcx
test rdx, rdx
je 0x1401ab902
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab8f5
movzx eax, byte [r10]
test bl, bl
je 0x1401ab8d7
lea rcx, [r9 - 1]
xchg r9, rbx
mov rdx, rbx
xchg r9, rbx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab8c6
jmp 0x1401ab8f5
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab8e6
inc r10
sub r11, 1
jne 0x1401ab8a8
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]