joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cd10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x30]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x7a
xor byte [rbx + rax], 0x4b
add byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x17
inc rax
cmp rax, 0x5e
jb 0x14007cd46
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cd90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
push rbx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x32]
xchg rbx, rdi
mov rdx, rdi
xchg rdi, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x6a
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 8
add byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x35
inc rax
cmp rax, 0x60
jb 0x14007cdcd
xchg rcx, rdi
mov rax, rcx
xchg rdi, rcx
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce30
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x20
inc rax
cmp rax, 0x64
jb 0x14007ce5d
xchg rdi, r9
mov rax, r9
xchg rdi, r9
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007ceb0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x38]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0
sub byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x4d
inc rax
cmp rax, 0x6e
jb 0x14007ceec
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007cf40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x73
sub byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x12
add byte [rbx + rax], 0
add byte [rbx + rax], 0x73
xor byte [rbx + rax], 0x7f
sub byte [rbx + rax], 9
inc rax
cmp rax, 0x98
jb 0x14007cf7c
xchg r10, rdi
mov rax, r10
xchg r10, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007cfd0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x56]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x73
xor byte [rbx + rax], 0x30
add byte [rbx + rax], 5
sub byte [rbx + rax], 0x23
inc rax
cmp rax, 0xa8
jb 0x14007cffd
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rcx
push rax
push rax
push rax
push rcx
push rcx
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret

Function at 0x14007d060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x5d
xor byte [rbx + rax], 0x14
add byte [rbx + rax], 0xd
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x26
inc rax
cmp rax, 0xb0
jb 0x14007d090
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x59
add byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x56
inc rax
cmp rax, 0xdc
jb 0x14007d11c
mov rax, rdi
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rcx
push rbx
push rdx
push rax
push rdx
push rdx
xchg qword [rsp + 0x30], rdi
pop rdx
pop rdx
pop rax
pop rdx
pop rbx
pop rcx
add rsp, 8
ret
Function at 0x14007d170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x38
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x37
add byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x5c
inc rax
cmp rax, 0xde
jb 0x14007d1ac
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x76]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x56
add byte [rbx + rax], 3
sub byte [rbx + rax], 0x12
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x20
inc rax
cmp rax, 0xea
jb 0x14007d233
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rdx
push rax
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x7c]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x32
xor byte [rbx + rax], 4
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0xf4
jb 0x14007d2b6
xchg r8, rdi
mov rax, r8
xchg rdi, r8
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
push rax
push rcx
push rbx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rbx
pop rcx
pop rax
add rsp, 8
ret

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rcx
mov rdi, r8
xchg rcx, r8
lea rbx, [rdx + 0x9a]
xchg rbx, r9
mov rdx, r9
xchg rbx, r9
call fcn.14007aa00
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x14
inc rax
cmp rax, 0x130
jb 0x14007d354
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
push rax
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg r9, rcx
lea rbx, [rdx + 0xc]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x59
xor byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x14
jb 0x14007d3d7
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0xe]
xchg rdx, r10
mov r10, rbx
xchg r10, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 6
add byte [rbx + rax], 0x1f
sub byte [rbx + rax], 8
add byte [rbx + rax], 6
xor byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x11
add byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x68
inc rax
cmp rax, 0x18
jb 0x14007d45c
xchg rdx, rdi
mov rax, rdx
xchg rdx, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rcx
push rbx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x28], rdi
pop rcx
pop rdx
pop rdx
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
push rdi
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x12
add byte [rbx + rax], 0x4e
xor byte [rbx + rax], 9
sub byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x50
inc rax
cmp rax, 0x1a
jb 0x14007d4f3
xchg rsi, rdi
mov rax, rsi
xchg rsi, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rcx
push rcx
xchg qword [rsp + 0x20], rdi
pop rcx
pop rcx
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083cc0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, r8
mov rax, r15
xchg r8, r15
cmp rcx, rdx
je 0x140083e1a
xchg r9, rdx
mov rdx, rax
xchg rdx, r9
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
mov qword [r9 + r8 - 0x70], r10
xchg r10, rcx
mov qword [r9 + r8 - 0x68], rcx
xchg r10, rcx
xchg rsi, r8
movups xmm0, xmmword [rsi - 0x80]
xchg rsi, r8
xchg rbx, rax
movups xmmword [rbx], xmm0
xchg rbx, rax
movups xmm1, xmmword [r8 - 0x70]
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
mov qword [r8 - 0x70], r10
nop
sub rax, 0x584df6d
add rax, 0x584dfb5
mov qword [r8 - 0x68], 0x7852e580
sub qword [r8 - 0x68], 0x20340e66
sub qword [r8 - 0x68], 0x4112a41c
add qword [r8 - 0x68], 0x63c6f218
sub qword [r8 - 0x68], 0x198159e2
sub qword [r8 - 0x68], 0x36d402fd
sub qword [r8 - 0x68], 0xccfaad3
sub qword [r8 - 0x68], 0x1dae1d5d
mov word [r8 - 0x80], r10w
xchg r15, r9
movups xmmword [r15 + r8 - 0x60], xmm0
xchg r15, r9
mov qword [r9 + r8 - 0x50], r10
xchg r10, r15
mov qword [r9 + r8 - 0x48], r15
xchg r15, r10
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [r9 + r8 - 0x60], xmm0
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [r9 + r8 - 0x50], xmm1
xchg r10, r9
mov qword [r8 - 0x50], r9
xchg r10, r9
mov qword [r8 - 0x48], 0x187283f7
xor qword [r8 - 0x48], 0x686938df
sub qword [r8 - 0x48], 0x19d9a6f6
sub qword [r8 - 0x48], 0x265ac15f
add qword [r8 - 0x48], 0x684fec0
sub qword [r8 - 0x48], 0x268766b
add qword [r8 - 0x48], 0x454f781d
xor qword [r8 - 0x48], 0x79535342
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083cec
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083f40
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x14008400b
xchg r15, rax
mov r9, r15
xchg r15, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r12, r8
movups xmm0, xmmword [r12 - 0x38]
xchg r8, r12
movups xmmword [rax], xmm0
xchg r8, r14
movups xmm1, xmmword [r14 - 0x28]
xchg r8, r14
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm1
xchg rdx, rax
xchg r10, r15
mov qword [r8 - 0x28], r15
xchg r10, r15
sub rax, 0xffffffffffffffe0
mov qword [r8 - 0x20], 0x27214ee2
xor qword [r8 - 0x20], 0x39692ec
add qword [r8 - 0x20], 0x26bd1c57
xor qword [r8 - 0x20], 0xfa8e5a9
xor qword [r8 - 0x20], 0x17598adf
xor qword [r8 - 0x20], 0x1dd59b2d
xor qword [r8 - 0x20], 0x5dce1cf
xor qword [r8 - 0x20], 0x295d4bb4
sub qword [r8 - 0x20], 0x62d1a63e
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083f68
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e3b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x12
sub byte [rcx + rax + 0xa], 1
add byte [rcx + rax + 0xa], 0x51
xor byte [rcx + rax + 0xa], 9
xor byte [rcx + rax + 0xa], 0x38
add byte [rcx + rax + 0xa], 0x28
sub byte [rcx + rax + 0xa], 0x3a
xor byte [rcx + rax + 0xa], 0x41
inc rax
cmp rax, 0x10
jb 0x14008e3b2
ret

Function at 0x14008e4d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x38
xor byte [rcx + rax + 0x14], 0x54
sub byte [rcx + rax + 0x14], 0x18
xor byte [rcx + rax + 0x14], 0x2e
sub byte [rcx + rax + 0x14], 0x4d
sub byte [rcx + rax + 0x14], 0x26
add byte [rcx + rax + 0x14], 0x3e
add byte [rcx + rax + 0x14], 0x2c
xor byte [rcx + rax + 0x14], 0x71
inc rax
cmp rax, 0x24
jb 0x14008e4d2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140198290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r8, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, r8
mov qword [rsp + 8], rcx
push rdx
mov qword [rsp], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
xchg rbx, r9
mov r9, rbx
xchg rbx, r9
xchg rsi, rdx
mov rdx, rsi
xchg rdx, rsi
xchg rcx, r11
mov r9, r11
xchg rcx, r11
xor ebp, ebp
test rdx, rdx
jne 0x1401982fe
mov eax, ebp
jmp 0x14019834c
mov eax, 0x3e479fd
add eax, 0x221d068
add eax, 0x7668e503
sub eax, 0x55a40f3b
xor eax, 0x43e5e064
sub eax, 0x1d2f46ee
sub eax, 0x32980552
sub eax, 0x156719bc
cmp word [rdx], ax
je 0x14019833b
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x14019834c
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x40fb300f
xor ecx, 0xc233b6c
sub ecx, 0xa200a4a
add ecx, 0x3264a145
sub ecx, 0x4ac45a82
sub ecx, 0xb4bb2dc
xor ecx, 0x226fdd85
sub ecx, 0x3d63467a
cmp word [rax + 0x18], cx
jne 0x1401984a0
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401984a0
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198462
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x140198456
mov qword [rsp + 0xa8], rdx
xchg rdx, rcx
mov qword [rsp + 0x30], rdx
xchg rcx, rdx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140198534
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
xchg r14, rdx
mov qword [rsp + 0x20], r14
xchg r14, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198462
xchg r10, r8
mov r10, qword [rsp + 0xb0]
xchg r10, r8
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401983c3
xchg rcx, r14
mov r14, qword [rbx + 0x38]
xchg r14, rcx
test rcx, rcx
je 0x14019848f
cmp rcx, rbx
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
setne dl
call qword [rax + 0x20]
xchg rdx, rbp
mov qword [rbx + 0x38], rdx
xchg rdx, rbp
mov al, 0x42
add al, 0x23
xor al, 0x54
sub al, 0x30
xor al, 2
sub al, 2
jmp 0x1401984cf
xchg r15, rcx
mov r15, qword [rbx + 0x38]
xchg r15, rcx
test rcx, rcx
je 0x1401984cd
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r14, rbp
mov qword [rbx + 0x38], r14
xchg r14, rbp
xor al, al
add rsp, 0x58
nop
mov r15, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rbx
push rcx
xchg qword [rsp + 0x10], r12
add rsp, 0x18
nop
xchg qword [rsp], rdi
add rsp, 8
push rax
push rdx
push rax
push rax
push rcx
push rcx
xchg qword [rsp + 0x30], rsi
pop rcx
pop rcx
pop rax
pop rax
pop rdx
pop rax
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.1401fd512
nop
int3
Function at 0x140198d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
test rdx, rdx
jne 0x140198dc0
mov eax, ebx
jmp 0x140198e04
mov eax, 0x64f70c49
sub eax, 0xbef0150
add eax, 0x1c61f680
sub eax, 0x18ddcfcf
xor eax, 0x2898202a
sub eax, 0x7413b733
cmp word [rdx], ax
je 0x140198df3
xchg r13, rax
mov r13, rbx
xchg r13, rax
jmp 0x140198e04
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg r12, rbp
mov qword [rsp + 0x50], r12
xchg r12, rbp
mov ecx, 0x3d370471
sub ecx, 0x1e0b8372
add ecx, 0x32512017
xor ecx, 0x5f6488f0
add ecx, 0x28b08b81
sub ecx, 0xf49a4b9
sub ecx, 0x159ddf4a
sub ecx, 0x11e12f59
xchg rsi, r8
mov qword [rsp + 0x58], r8
xchg rsi, r8
xchg r12, r11
mov qword [rsp + 0x60], r11
xchg r11, r12
xchg r14, rdi
mov qword [rsp + 0x28], rdi
xchg rdi, r14
mov qword [rsp + 0x20], r15
cmp word [rax + 0x18], cx
jne 0x140198ed8
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140198ed8
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140198ed8
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076320
cmp eax, r13d
je 0x140198f53
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140198ea8
xor eax, eax
mov r15, qword [rsp + 0x20]
xchg rbp, r14
mov rbp, qword [rsp + 0x28]
xchg r14, rbp
xchg rdx, r12
mov rdx, qword [rsp + 0x60]
xchg rdx, r12
xchg r10, rsi
mov r10, qword [rsp + 0x58]
xchg rsi, r10
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
push rax
push rcx
push rbx
push rdx
push rax
push rcx
push rax
push rbx
xchg qword [rsp + 0x40], r13
pop rbx
pop rax
pop rcx
pop rax
pop rdx
pop rbx
pop rcx
pop rax
add rsp, 8
push rcx
push rax
push rdx
push rcx
push rax
push rdx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rbx
pop rdx
pop rax
pop rcx
pop rdx
pop rax
pop rcx
add rsp, 8
push rdx
push rcx
push rax
push rcx
push rax
push rdx
push rcx
xchg qword [rsp + 0x38], rbx
pop rcx
pop rdx
pop rax
pop rcx
pop rax
pop rcx
pop rdx
add rsp, 8
ret
mov rax, rbp
jmp 0x140198eda
Function at 0x1401aab00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, rsi
mov rsi, rcx
xchg rsi, r10
test rdx, rdx
je 0x1401aab7e
xchg rbx, rcx
mov qword [rsp], rcx
xchg rbx, rcx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aab71
movzx eax, byte [r10]
test bl, bl
je 0x1401aab53
lea rcx, [r9 - 1]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aab42
jmp 0x1401aab71
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aab62
inc r10
sub r11, 1
jne 0x1401aab24
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401afed0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x4c331239
add r9d, 0x1021b8b8
xor r9d, 0x6557b775
xor r9d, 0x58052476
sub r9d, 0x1c77d8f2
xor r9d, 0x448e8370
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401aff5c
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401aff17
mov ecx, dword [r10]
jmp 0x1401b00a1
cmp ecx, 0x4e0
jb 0x1401b00a1
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xa705c0a
xor ebx, 0x1360ac37
xor ebx, 0x4e002a8d
xor ebx, 0x3f0b8be3
xor ebx, 0x47d5ce0e
sub ebx, 0x1bddfbae
xor ebx, 0x62b2095e
sub ebx, 0x7142aa0e
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401affa5
lea r11, [r10 + 0xd50]
mov ebx, 0x25e5d0a3
add ebx, 0x18b20e11
add ebx, 0x3ad9c75f
sub ebx, 0x1094ac14
sub ebx, 0x3082d08c
add ebx, 0xe3fae1d
xor ebx, 0x51d4dd8c
sub ebx, 0x174d0890
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0023
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 7
shr ecx, 2
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 5
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 8
shl eax, 1
shl eax, 5
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 2
shr eax, 1
shr eax, 1
shr eax, 0xb
shr eax, 2
shr eax, 1
xor eax, edx
add rsp, 8
ret