joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069b74
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg rbx, r11
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x30], esi
mov qword [rsp + 0x20], rdi
push rbp
xchg rsp, rbp
mov rsp, rbp
xchg rbp, rsp
add rsp, 0xffffffffffffffb0
movabs rbx, 0x703a3e7f6ad0b747
add rbx, 0x659ff7f
add rbx, 0x2d864af
xor rbx, 0xdd57dfa
sub rbx, 0x71b13631
mov rdi, rcx
mov dword [rsp - 0x2c], 0x5f0da5a7
cmp qword [rcx + 0x38], rbx
jne 0x140069d6a
xor esi, esi
mov dword [rsp - 0x1c], ecx
mov dword [rbp - 0x30], 0x7c95622c
xor dword [rbp - 0x30], 0x4a438500
add dword [rbp - 0x30], 0xb6ac9cc
sub dword [rbp - 0x30], 0x420db0f1
mov dword [rbp - 0x2c], 0x6c2bcd4
xor dword [rbp - 0x2c], 0x1105ed50
add dword [rbp - 0x2c], 0x22804c10
sub dword [rbp - 0x2c], 0x3a379cc2
mov dword [rbp - 0x28], 0x582c29cd
sub dword [rbp - 0x28], 0x38cd30a7
add dword [rbp - 0x28], 0x102727c6
add dword [rbp - 0x28], 0x1f84b870
sub dword [rbp - 0x28], 0x4e9ad93b
mov dword [rbp - 0x24], 0x643763a0
add dword [rbp - 0x24], 0xa5e2f10
xor dword [rbp - 0x24], 0x7319981e
xor dword [rbp - 0x24], 0x1d8a0a31
mov dword [rbp - 0x20], 0x4c220032
xor dword [rbp - 0x20], 0x76d3cd71
xor dword [rbp - 0x20], 0x6019b230
sub dword [rbp - 0x20], 0x17f9845b
sub dword [rbp - 0x20], 0x42c6fadf
xchg rsi, r13
mov qword [rbp + 0x10], r13
xchg r13, rsi
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
mov rcx, qword [rbp + 0x10]
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
shl cl, 3
mov rbx, rbx
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x53ac1e47
add eax, 0x1706b362
sub eax, 0x3616aa17
sub eax, 0x1420f871
xor eax, 0x42ca6b74
shr eax, cl
xchg r14, r14
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov dword [rsp - 0x1c], 0x32a305cd
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r13, rax
mov qword [rbp + 0x10], r13
xchg r13, rax
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
cmp rax, 0xa
mov r15, r15
jb 0x140069c88
xor edx, edx
mov word [rbp - 8], si
mov dword [rsp - 0x28], edx
lea rcx, [rbp - 0x1c]
call fcn.14008b650
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
mov r12, r12
xor eax, eax
xor rdx, rbx
xchg rsp, rdx
mov qword [rdi + 0x38], rsp
xchg rsp, rdx
lea rdi, [rbp - 0x1c]
xchg rcx, rcx
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x34], edi
je 0x140069d74
lea rdx, [0x140142830]
xchg r13, r8
mov rcx, r13
xchg r8, r13
call fcn.1400725a0
test al, al
mov dword [rsp - 0x1c], 0x1a9da1ea
setne al
jmp 0x140069d74
mov al, 0x51
sub al, 0x24
xor al, 0x59
xor al, 0x1d
sub al, 0x68
mov rbx, qword [rsp + 0x68]
mov r8, r8
xchg r8, rsi
mov r8, qword [rsp + 0x70]
xchg rsi, r8
xchg rdi, rbp
mov rbp, qword [rsp + 0x78]
xchg rbp, rdi
nop
add rsp, 0x724d6338
sub rsp, 0x724d62e8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069dac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r15, r15
xchg rsi, r14
mov qword [rsp + 0x18], r14
xchg rsi, r14
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x20], 0x2b569bd1
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rsp, r9
mov rbp, r9
xchg r9, rsp
nop
add rsp, 0x5b6c7bba
sub rsp, 0x5b6c7c0a
movabs rbx, 0x703a3e7f02f4a2c3
add rbx, 0x58e83735
sub rbx, 0x15fbdec3
sub rbx, 0x1e5303ef
sub rbx, 0x1f68c6e8
mov rdi, rcx
cmp qword [rcx + 0x20], rbx
xchg r14, r14
jne 0x140069fe5
mov eax, 0x2b6dbe54
sub eax, 0x278d9717
xor eax, 0x2d125827
sub eax, 0x6c49233
sub eax, 0x282dec0a
mov dword [rbp - 0x30], 0x68ff244
add dword [rbp - 0x30], 0x6620a7b7
xor dword [rbp - 0x30], 0x6089412b
xor dword [rbp - 0x30], 0xc15d8d6
mov word [rbp - 0x1c], ax
xor esi, esi
mov dword [rsp - 0x30], 0x1cb86d6b
mov dword [rbp - 0x2c], 0x52588805
sub dword [rbp - 0x2c], 0x1c5cad4a
add dword [rbp - 0x2c], 0xbd242a0
sub dword [rbp - 0x2c], 0x1d8bd522
sub dword [rbp - 0x2c], 0x24344765
mov dword [rbp - 0x28], 0x2d4c966f
xor dword [rbp - 0x28], 0x37bb78d0
xor dword [rbp - 0x28], 0x2a0c5d2
add dword [rbp - 0x28], 0x116d9d9f
xor dword [rbp - 0x28], 0x29b3c935
mov dword [rbp - 0x24], 0x2022be11
sub dword [rbp - 0x24], 0x1c343050
add dword [rbp - 0x24], 0x5ab55ed0
xor dword [rbp - 0x24], 0x3e48a81f
sub dword [rbp - 0x24], 0x609f440b
mov dword [rbp - 0x20], 0x164408c7
add dword [rbp - 0x20], 0x1f442f44
add dword [rbp - 0x20], 0x2839a3bd
sub dword [rbp - 0x20], 0x567ea791
sub dword [rbp - 0x20], 0x71b3406
mov qword [rbp + 0x10], rsi
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
mov rcx, qword [rbp + 0x10]
xchg rbx, rbx
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
and cl, 3
mov dword [rsp - 0xc], 0x631e66a3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x50085992
sub eax, 0x33ac2444
xor eax, 0x6fe8ae3d
sub eax, 0x1103571e
shr eax, cl
mov r14, r14
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg r10, r10
mov rax, qword [rbp + 0x10]
inc rax
xchg r12, rax
mov qword [rbp + 0x10], r12
xchg r12, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
mov rsi, rsi
jb 0x140069eff
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
mov dword [rsp - 0x38], esi
call fcn.14008b650
xchg rbp, rdx
mov rbp, rax
xchg rdx, rbp
xchg rbp, rax
mov r8, rbp
xchg rbp, rax
xor eax, eax
xor rdx, rbx
xchg r9, r9
xchg rcx, rdx
mov qword [rdi + 0x20], rcx
xchg rcx, rdx
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x18], 0x19d745a6
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0xc], 0x54583454
je 0x140069fef
lea rdx, [0x140142298]
xchg r11, rcx
mov r11, r8
xchg r11, rcx
call fcn.14007295c
xchg rcx, rcx
test al, al
setne al
jmp 0x140069fef
mov al, 0x44
xor al, 0x48
add al, 0xd
add al, 0x34
xor al, 0x4c
xchg rbp, rbx
mov rbp, qword [rsp + 0x68]
xchg rbx, rbp
xchg rsi, r15
mov r15, qword [rsp + 0x70]
xchg r15, rsi
xchg rdi, rbx
mov rbx, qword [rsp + 0x78]
xchg rdi, rbx
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14007461e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x1c], esp
push rdi
add rsp, 0xffffffffffffffa0
lea rax, [rcx + 8]
mov dword [rsp - 0x28], 0x5d29f51a
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
xchg rsp, rax
movups xmmword [rsp], xmm0
xchg rsp, rax
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov qword [rsp + 0x78], rbp
mov dword [rsp - 0x28], 0x19c6eff5
xchg r10, rax
movups xmmword [r10 + 0x10], xmm0
xchg r10, rax
lea rcx, [rsp + 0x20]
xchg rdi, rax
movups xmmword [rdi + 0x20], xmm0
xchg rdi, rax
xchg r14, rax
movups xmmword [r14 + 0x30], xmm0
xchg r14, rax
xchg r11, rax
movups xmmword [r11 + 0x40], xmm0
xchg r11, rax
movups xmmword [rax + 0x50], xmm0
xchg r15, rax
movups xmmword [r15 + 0x60], xmm0
xchg r15, rax
xchg rbp, rax
movups xmmword [rbp + 0x70], xmm0
xchg rbp, rax
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rcx, rcx
xchg r9, rbx
mov r9, qword [rdx]
xchg r9, rbx
xchg rbp, rax
mov qword [rsp + 0x20], rbp
xchg rbp, rax
xchg rsp, r9
movups xmmword [r9 + 0x28], xmm0
xchg rsp, r9
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
xchg rsp, r14
movups xmmword [r14 + 0x48], xmm0
xchg r14, rsp
call fcn.140017954
mov dword [rsp - 0x24], ecx
mov edx, 0x5440a8f2
sub edx, 0x38b775b7
add edx, 0x1e9515ef
add edx, 0x2ca0437d
xor edx, 0x40fc8f2
test rbp, rbp
mov dword [rsp - 0x2c], ebp
je 0x14007476c
xchg rbp, rdi
mov rbp, rax
xchg rdi, rbp
sub rbx, rax
mov r9, rbp
xchg rdx, rdx
mov r8d, 0x6ed53387
sub r8d, 0x5ea493a3
add r8d, 0x88d3a0e
sub r8d, 0x18bdd8f3
nop word [rax + rax]
movzx ecx, dx
mov r10, r10
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 1
ror edx, 3
ror edx, 1
ror edx, 3
xor cx, word [rbx + rdi - 2]
mov rdx, rdx
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074736
mov dword [rsp - 0x30], 0x2b92a08e
xor ecx, ecx
xchg rbp, r8
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
xchg rsi, rsi
xchg r13, rcx
mov r13, rsi
xchg r13, rcx
mov rdx, qword [rsp + 0x20]
mov dword [rsp - 0x24], 0x99ec569
call fcn.140091600
xchg rcx, rdi
mov rdi, qword [rsp + 0x20]
xchg rcx, rdi
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov dword [rsp - 0x44], esp
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x140074811
xor eax, eax
xchg rbx, rbx
lea rdi, [rsp + 0x28]
mov ecx, 0x1e69e964
xor ecx, 0x6dac07c0
sub ecx, 0x484bd091
add ecx, 0x3233d324
sub ecx, 0x5dadf107
rep stosb byte [rdi], al
xchg rsi, r8
mov rax, r8
xchg r8, rsi
xchg rsi, rbx
mov rbx, qword [rsp + 0x80]
xchg rbx, rsi
nop
add rsp, 0x747d033e
sub rsp, 0x747d02de
pop rdi
ret
call fcn.140099230
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rcx, rsi
mov rcx, qword [rsp + 0x80]
xchg rsi, rcx
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007efa8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
xchg rcx, rcx
lea r10, [0x140001900]
sub r10, rcx
xchg rcx, r15
mov r8, r15
xchg rcx, r15
lea rax, [r9 + r8]
mov dword [rsp - 0x14], edi
mov ecx, r9d
mov edx, 0x5089ada0
xor edx, 0x4cadf56e
xor edx, 0x1c40dcd6
xor edx, 0x245b7e72
xor edx, 0x499ad786
inc r9
mov dword [rsp - 0x2c], edx
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
mov dword [rsp - 0x18], 0x217a9615
cmp r9, 0x10
jb 0x14007efc1
xchg r14, rax
mov r14, r8
xchg r14, rax
ret
Function at 0x14007fe4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rcx, r15
mov qword [rsp + 8], r15
xchg r15, rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
mov rbp, rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x4cc5648e
sub rsp, 0x4cc564ae
xchg rdx, rcx
mov rbx, rdx
xchg rcx, rdx
mov r13d, r8d
mov rcx, rcx
mov r9d, 0x2b4a9869
sub r9d, 0x1fbac25a
add r9d, 0x33f5ef56
xor r9d, 0x3f81c565
xchg rdx, r12
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff6a8777fe
xor rcx, 0x6b3643ce
add rcx, 0x64470d46
sub rcx, 0x604aa285
add rcx, 0x7fffffff
add rcx, 0x7a52610f
popf
pushf
mov eax, 0x1d410e57
add eax, 0x2647f6ee
sub eax, 0x427e2e74
xor eax, 0x70048ad2
sub eax, 0x710e5bff
popf
cmovb r9d, r13d
mov dword [rsp - 0x24], 0x65fcd1dd
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140099030
xchg r8, r8
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0x12
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x3509dd4c
add ebx, 0x397ec26c
xor ebx, 0xc4679a7
sub ebx, 0x62cee61e
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x28], ecx
test r15d, r15d
je 0x140080087
mov eax, 0x68030d0f
sub eax, 0x25fc9a49
add eax, 0x6005e03
xor eax, 0x767c3e5d
xor eax, 0x3e6aee94
xchg rdx, rcx
mov rdx, qword [rsp + 0x60]
xchg rdx, rcx
mov r14d, esi
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
xchg rbx, rbx
sub edi, r14d
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
cmp edi, eax
mov dword [rsp - 0x34], esi
cmova edi, eax
mov r8d, edi
call fcn.140093550
test al, al
mov dword [rsp - 0x30], 0x5cbe04b8
je 0x140080085
shr edi, 2
xor r8d, r8d
mov rdi, rdi
shr r14d, 2
test edi, edi
je 0x140080061
mov r15d, dword [rsp + 0x70]
mov dword [rsp - 0x24], 0x497dbb5d
xchg r9, r12
mov r12, rbp
xchg r12, r9
lea eax, [r14 + r8]
mov dword [rsp - 0x10], ebp
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x24096600
mov dword [rsp - 0x24], 0x6e815aa
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x140080029
xchg rbx, rbx
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x23579766
add eax, 0x5a6fff6
add eax, 0x26532dea
xor eax, 0x4f41c546
cmp esi, r15d
jb 0x14007ffb3
jmp 0x140080087
xor bl, bl
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.140099040
mov al, bl
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x28], 0x333a231e
add rsp, 0x20
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
xchg rdi, rdi
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140080ae4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x1c], 0x58c0ac60
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rbp, rcx
xchg rsi, r10
mov qword [rsp + 0x18], r10
xchg rsi, r10
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
push 0x45db9717
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push r12
mov qword [rsp], r15
nop
sub rsp, 0x157568d6
add rsp, 0x157568b6
xchg rcx, r14
mov r15, r14
xchg r14, rcx
mov r14d, r8d
mov r9d, 0x490490b3
sub r9d, 0x46a6bd5d
add r9d, 0x16fb7b30
xor r9d, 0x195d4e86
mov r12, rdx
cmp r8d, r9d
mov r10, r10
pushf
movabs rcx, 0xffffffff4ca4e1e4
sub rcx, 0x307d7860
xor rcx, 0x761fae7f
sub rcx, 0x4859039a
add rcx, 0x7fffffff
add rcx, 0x5e203b9f
popf
pushf
mov eax, 0x7b4433ff
sub eax, 0x3475b948
add eax, 0x1a1ff019
xor eax, 0x60ee6ad4
popf
cmovb r9d, r14d
mul r9
cmovo rax, rcx
mov dword [rsp - 0x28], edi
xchg rdi, rax
mov rcx, rdi
xchg rdi, rax
call fcn.140099030
mov dword [rsp - 0x3c], 0x61b3cd89
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0x10
shr ebp, 3
shr ebp, 1
xor edi, edi
mov rsi, rax
mov rsp, rsp
mov ebx, 0x3bc272de
sub ebx, 0x121908e
sub ebx, 0x1c81af00
sub ebx, 0x1e1f334f
test ebp, ebp
mov dword [rsp - 0x44], ecx
je 0x140080cfa
mov eax, 0x499f03e9
sub eax, 0xeeafb8a
sub eax, 0x2b24ac80
xor eax, 0xf9f5bdf
mov r9d, edi
mov r8d, r14d
mov dword [rsp - 0x28], esi
shl r9d, 5
shl r9d, 0xc
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x44], ebp
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xor r10d, r10d
mov dword [rsp - 0x30], esi
shr r11d, 2
test r11d, r11d
je 0x140080ca4
xchg rdx, r15
mov r15, rsi
xchg rdx, r15
lea ecx, [r9 + r10]
mov eax, r13d
mov dword [rsp - 0x14], esi
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x24096600
mov dword [rdx], eax
mov dword [rsp - 0x1c], edx
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x140080c77
xchg rbp, rbp
xchg r12, rdx
mov r12, rsi
xchg r12, rdx
mov rcx, r15
mov dword [rsp - 0x34], 0x7789afcd
call fcn.140093930
test al, al
je 0x140080cf8
mov dword [rsp - 0x40], 0x2a8fe842
add edi, ebx
mov eax, 0x477cdab6
add eax, 0x18cae34e
sub eax, 0x56984421
add eax, 0x185ee159
sub eax, 0x21fe5b3c
cmp edi, ebp
jb 0x140080c28
xchg rdi, rdi
jmp 0x140080cfa
xor bl, bl
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140099040
xchg r14, r14
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xchg rdx, rdx
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140083750
Capabilities:
Enumerate pe sections

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rbp, r9
mov qword [rsp + 0x10], r9
xchg rbp, r9
mov qword [rsp + 0x18], rsi
xchg r13, rdi
mov qword [rsp + 0x20], r13
xchg rdi, r13
push r14
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x34], esi
mov rdi, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov r15, r15
call fcn.1400854d0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov r13, r13
mov r10, rax
mov ebx, r14d
test ebp, ebp
je 0x140083917
mov dword [rsp - 0x14], esi
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0xc], 0x530a8784
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
xchg r9, r9
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov rsp, rsp
jae 0x140083848
mov eax, dword [rdx + 8]
test eax, eax
mov rsp, rsp
jne 0x140083808
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
xchg rdi, rdi
jb 0x140083828
add eax, r9d
cmp r11d, eax
jb 0x1400838cb
mov dword [rsp - 0x18], ecx
inc r8w
nop
add rdx, 0x31a7f738
sub rdx, 0x31a7f710
cmp r8w, cx
xchg r15, r15
jb 0x1400837f7
mov r8, r14
mov eax, dword [r10 + 4]
mov dword [rsp - 0x38], 0x5c1a0a7d
lea r9, [r10 + 4]
nop
sub rax, 0x312d50f1
add rax, 0x312d50e9
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
mov dword [rsp - 0x3c], 0x5e5e67bd
je 0x140083909
mov edx, eax
nop word [rax + rax]
xchg r10, r10
movzx eax, word [r10]
mov ecx, eax
shr ecx, 8
shr ecx, 2
shr ecx, 1
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x38], 0x37ed7990
je 0x1400838e1
cmp ecx, 0xa
jne 0x1400838ed
and eax, 0xfff
mov rsp, rsp
add qword [rax + r8], rdi
jmp 0x1400838ed
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x30], ebp
sub r8, r9
add r8, rsi
add r8, r11
jmp 0x14008384b
and eax, 0xfff
add dword [rax + r8], edi
mov r9, r9
nop
sub r10, 0x3bbde20f
add r10, 0x3bbde211
sub rdx, 1
jne 0x140083890
mov rsp, rsp
add ebx, dword [r9]
cmp ebx, ebp
jb 0x1400837c0
xchg rbp, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, r15
mov r15, qword [rsp + 0x40]
xchg r15, rsi
mov rdi, qword [rsp + 0x48]
xchg rbx, rbx
add rsp, 0x20
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400855a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
push 0x42ced69e
mov qword [rsp], rdi
push r10
mov qword [rsp], r12
push r13
nop
push 0xf1e3ae2
mov qword [rsp], r14
push r15
mov r13, r13
nop
add rsp, 0x5593f6ec
sub rsp, 0x5593f70c
movzx eax, word [rcx]
xchg rsi, rsi
mov r15d, edx
xor eax, 0x24096600
mov rsi, rcx
cmp eax, 0x24093c4d
mov dword [rsp - 0x20], 0x3e3b8654
jne 0x140085755
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x3c], 0x6ecc5517
xor eax, 0x24096600
cmp eax, 0x24092350
jne 0x140085755
mov dword [rsp - 0x34], 0x109a9ad
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400854d0
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
mov r14, rax
mov edx, dword [rax + 0x20]
mov dword [rsp - 0x2c], ebp
call fcn.1400854d0
mov edx, dword [r14 + 0x24]
xchg rcx, rdi
mov rdi, rsi
xchg rdi, rcx
mov r12, rax
xchg rcx, rcx
call fcn.1400854d0
mov edx, dword [r14 + 0x1c]
xchg rsi, r10
mov rcx, r10
xchg rsi, r10
xchg r13, r11
mov r11, rax
xchg r11, r13
call fcn.1400854d0
xor edi, edi
mov qword [rsp + 0x70], rax
mov r8, r8
cmp dword [r14 + 0x18], edi
jbe 0x140085755
nop dword [rax]
xchg rbp, rbp
mov edx, dword [r12 + rdi*4]
xchg r8, rsi
mov rcx, r8
xchg r8, rsi
call fcn.1400854d0
mov ecx, 0x7a86b45e
sub ecx, 0x2fbb5376
xor ecx, 0x2bd99078
xor ecx, 0x9eed0f6f
xchg r10, rax
mov rbx, r10
xchg r10, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x30], esp
cmp byte [rax], 0
je 0x14008573b
nop dword [rax]
mov rdx, rbx
xchg rsi, rsi
lea rcx, [rsp + 0x60]
mov r8d, 0x4869dddf
sub r8d, 0x17a1c347
sub r8d, 0x102fa074
add r8d, 0x8d55508
xor r8d, 0x296dcf2d
inc rbx
mov dword [rsp - 0x34], 0x3113ea5
call fcn.14008e8a0
cmp byte [rbx], 0
jne 0x1400856e9
mov dword [rsp - 0x28], 0x7a15209b
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
je 0x140085790
xchg r10, r10
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400856a5
xor eax, eax
xchg r11, r11
mov rbx, qword [rsp + 0x68]
nop
sub rsp, 0x75a4ad08
add rsp, 0x75a4ad28
pop r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0xc], ebp
pop rdi
pop rsi
pop rbp
mov r9, r9
ret
movzx edx, word [r13 + rdi*2]
xchg r15, rsi
mov rcx, r15
xchg rsi, r15
xchg r9, rax
mov r9, qword [rsp + 0x70]
xchg r9, rax
mov edx, dword [rax + rdx*4]
xchg rsp, rsp
call fcn.1400854d0
jmp 0x14008575a
Function at 0x140089b00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
xchg rbx, rbx
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp - 0x2c], edx
mov qword [rsp + 0x70], rsi
xchg rsi, r10
mov r10, qword [rcx + 0x38]
xchg rsi, r10
lea rcx, [rsp + 0x20]
xchg r13, r13
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg rsp, r11
movups xmmword [r11 + 0x38], xmm0
xchg rsp, r11
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x34], edi
call fcn.140017954
mov edx, 0x21ba6ed3
xor edx, 0xab3789c
sub edx, 0x166fc101
add edx, 0x4e17ef07
test rsi, rsi
xchg rsi, rsi
je 0x140089bf5
xchg r13, rax
mov rdi, r13
xchg r13, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x18], ebp
mov r9d, 0x34988121
add r9d, 0x3b35df05
sub r9d, 0xb480b5c
xor r9d, 0x5fe88396
sub r9d, 0x3b6ed65d
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0xc], 0x65454adb
and cx, r9w
ror edx, 1
ror edx, 6
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov r14, r14
sub r8, 1
jne 0x140089bc5
xor ecx, ecx
mov word [rax + rsi*2], cx
mov r10, r10
xchg rcx, r10
mov r10, qword [rsp + 0x20]
xchg rcx, r10
call fcn.140089cb0
mov r11, r11
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
xchg rbp, rbp
cmp rcx, rax
jne 0x140089c7e
xor eax, eax
mov rbx, rbx
lea rdi, [rsp + 0x28]
mov ecx, 0x30654478
add ecx, 0xe85a3fc
sub ecx, 0xc032a09
xor ecx, 0x63fee551
sub ecx, 0x51195b0a
rep stosb byte [rdi], al
mov dword [rsp - 0x30], 0x5457cf89
mov eax, ebx
xchg rbx, r9
mov r9, qword [rsp + 0x78]
xchg rbx, r9
add rsp, 0x60
mov dword [rsp - 0x34], ebx
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099230
mov dword [rsp - 0x14], ecx
mov eax, ebx
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x43b198e5
sub rsp, 0x43b19885
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008b246
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r13
mov r11, r13
xchg rsp, r13
mov qword [r11 + 0x20], rbx
mov dword [rsp - 0x28], 0x6af02453
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
xchg r12, r12
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
xchg rbp, rbx
mov qword [r11 + 8], rbx
xchg rbx, rbp
xorps xmm0, xmm0
xchg r13, rax
mov qword [r11 - 0x48], r13
xchg r13, rax
mov ebp, r8d
xchg rdx, rdx
mov qword [r11 + 0x10], rsi
xchg rsi, rdi
mov rdi, qword [rcx + 0x38]
xchg rsi, rdi
lea rcx, [r11 - 0x48]
xchg rsp, rsp
xchg r14, rsi
mov qword [r11 + 0x18], rsi
xchg rsi, r14
mov r14, rdx
mov dword [rsp - 0x44], ecx
xchg rsp, rbx
movups xmmword [rbx + 0x28], xmm0
xchg rbx, rsp
lea rdx, [rsi + 1]
xchg rsi, rsi
xchg rsp, r15
movups xmmword [r15 + 0x38], xmm0
xchg r15, rsp
movups xmmword [rsp + 0x48], xmm0
xchg rbx, rbx
call fcn.140017954
mov edx, 0x63b3516b
xor edx, 0x440262c4
add edx, 0xf0047bd
add edx, 0x9127292
add edx, 0x22ed5657
test rsi, rsi
mov r12, r12
je 0x14008b2bc
xchg rdi, rdx
mov rdx, rax
xchg rdx, rdi
sub rbx, rax
mov r11, r11
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x3717a3a6
xor r9d, 0x1edd1b53
add r9d, 0xf82b9f4
add r9d, 0x18865273
sub r9d, 0x51d3c45d
nop word [rax + rax]
xchg rsp, rsp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x2c], 0x3af10541
ror edx, 5
ror edx, 2
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rsi, rsi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008b288
mov rsp, rsp
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov rdx, r14
mov rsp, rsp
xchg r15, rcx
mov r15, qword [rsp + 0x20]
xchg r15, rcx
call fcn.14008b380
mov dword [rsp - 0x24], 0x24cbca68
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r14, qword [rsp + 0x80]
xchg rcx, rcx
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
mov r9, r9
jne 0x14008b35f
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x18], 0x33e3969a
mov ecx, 0x5a9416f2
xor ecx, 0x41846eec
add ecx, 0x535348a7
xor ecx, 0x6e63c0f5
rep stosb byte [rdi], al
mov dword [rsp - 0x2c], 0x3b606a15
mov eax, ebx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140099230
mov eax, ebx
xchg rsi, rsi
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret