joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006924c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rcx, rcx
xchg rsi, rbp
mov qword [rsp + 0x18], rbp
xchg rsi, rbp
mov qword [rsp + 0x20], rdi
push rbp
xchg rdx, rsp
mov rbp, rdx
xchg rdx, rsp
nop
add rsp, 0x52721cbc
sub rsp, 0x52721d0c
movabs rbx, 0x77ee73b41dbd1f55
add rbx, 0x5c252d1b
sub rbx, 0x33b3fc68
sub rbx, 0x2a532e6f
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x38], rbx
jne 0x14006944f
xor esi, esi
mov dword [rsp - 0x28], 0x74a55f5a
mov dword [rbp - 0x30], 0x72a17c82
sub dword [rbp - 0x30], 0x6a39a64
add dword [rbp - 0x30], 0x5f86aeb
sub dword [rbp - 0x30], 0x71c34cac
mov dword [rbp - 0x2c], 0x75ed0280
sub dword [rbp - 0x2c], 0x47810157
add dword [rbp - 0x2c], 0x9eb7880
add dword [rbp - 0x2c], 0x234cee44
sub dword [rbp - 0x2c], 0x5b4567b7
mov dword [rbp - 0x28], 0x3d467f9b
add dword [rbp - 0x28], 0xff00311
add dword [rbp - 0x28], 0x190171cf
xor dword [rbp - 0x28], 0x6640f400
mov dword [rbp - 0x24], 0x5ed124be
add dword [rbp - 0x24], 0x129b6a55
xor dword [rbp - 0x24], 0x7625f55
sub dword [rbp - 0x24], 0x75c5cfcb
mov dword [rbp - 0x20], 0x2e127b2b
xor dword [rbp - 0x20], 0x112fb25a
xor dword [rbp - 0x20], 0x6b3a5e47
sub dword [rbp - 0x20], 0x36c8882b
sub dword [rbp - 0x20], 0x1d100ea8
mov qword [rbp + 0x10], rsi
mov r13, r13
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x924c429
add eax, 0xc4d3b3f
add eax, 0x14f8859b
add eax, 0x47c77ba8
xor eax, 0x5f6743a4
shr eax, cl
mov dword [rsp - 0x34], 0x2f50ccc8
movzx ecx, al
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov dword [rsp - 0x10], 0x1acdfe3c
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
inc rax
mov dword [rsp - 0x38], 0x6ac58063
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xa
jb 0x14006935e
xchg r15, r15
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
xchg rcx, rcx
call fcn.14008b060
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
xor eax, eax
xor rdx, rbx
mov r11, r11
xchg r13, rdx
mov qword [rdi + 0x38], r13
xchg r13, rdx
lea rdi, [rbp - 0x1c]
mov dword [rsp - 0x10], 0x21644794
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069457
mov dword [rsp - 0x30], 0x280bed9a
lea rdx, [0x140142830]
mov rcx, r8
call fcn.140071ab0
test al, al
mov dword [rsp - 0x38], 0x45549292
setne al
jmp 0x140069457
mov al, 0x79
sub al, 0x24
xor al, 0x6a
sub al, 0x3e
mov rbx, qword [rsp + 0x68]
xchg rbx, rsi
mov rbx, qword [rsp + 0x70]
xchg rsi, rbx
mov rdi, qword [rsp + 0x78]
mov dword [rsp - 0x3c], 0x2e37906f
sub rsp, 0xffffffffffffffb0
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140069484
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg rsi, r13
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdx, rdi
push rbp
mov rbp, rsp
mov dword [rsp - 0x1c], ecx
sub rsp, 0x50
movabs rbx, 0x77ee73b43d993da1
sub rbx, 0x368055ef
add rbx, 0x58e77626
sub rbx, 0xbe9f27
sub rbx, 0x43669d18
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
cmp qword [rcx + 0x20], rbx
mov dword [rsp - 0x20], esi
jne 0x1400696b5
mov r8d, 0x6feb5e19
add r8d, 0x1ce6153
xor r8d, 0x39427a43
sub r8d, 0x48fbc52c
mov dword [rbp - 0x30], 0x277387f8
xor dword [rbp - 0x30], 0x15f44e0f
add dword [rbp - 0x30], 0xf30dd52
add dword [rbp - 0x30], 0xcd31b3
sub dword [rbp - 0x30], 0x425ad8a0
xor esi, esi
mov r9, r9
mov dword [rbp - 0x2c], 0x3e3ad235
add dword [rbp - 0x2c], 0x3d446f3d
sub dword [rbp - 0x2c], 0x6ec556fc
sub dword [rbp - 0x2c], 0x7d358ad
xor dword [rbp - 0x2c], 0x4a791f9
mov dword [rbp - 0x28], 0x4e65b37e
xor dword [rbp - 0x28], 0x6c6f4326
add dword [rbp - 0x28], 0x1b0f0f2c
sub dword [rbp - 0x28], 0x3ca9ff21
mov dword [rbp - 0x24], 0x3ae0b0e5
xor dword [rbp - 0x24], 0x70319ee0
add dword [rbp - 0x24], 0x2168fb48
sub dword [rbp - 0x24], 0x6c3728e6
lea eax, [r8 + 0x36]
mov dword [rbp - 0x20], 0x57ce8af2
sub dword [rbp - 0x20], 0x54d937dd
add dword [rbp - 0x20], 0x519bcaa5
sub dword [rbp - 0x20], 0x54621d4f
mov word [rbp - 0x1c], ax
mov dword [rsp - 0x14], esp
xchg rsi, r9
mov qword [rbp + 0x10], r9
xchg rsi, r9
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
mov rcx, qword [rbp + 0x10]
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
and cl, r8b
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov r12, r12
mov eax, 0x77b4aaf6
xor eax, 0x53d4f16d
sub eax, 0x12c504d2
xor eax, 0x50c62ac1
sub eax, 0x140838f9
shr eax, cl
mov dword [rsp - 0x30], 0x10c9f133
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov r8, r8
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
inc rax
xchg r11, r11
xchg r12, rax
mov qword [rbp + 0x10], r12
xchg r12, rax
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
cmp rax, 0xb
jb 0x1400695c6
mov dword [rsp - 0x38], 0x6b3fc5c
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
mov dword [rsp - 0x30], 0x4943f82b
call fcn.14008b060
xchg rsp, rax
mov rdx, rsp
xchg rsp, rax
xchg rcx, rax
mov r8, rcx
xchg rcx, rax
xor eax, eax
mov dword [rsp - 0x18], edx
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
mov dword [rsp - 0x18], esi
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400696bd
lea rdx, [0x140142298]
mov dword [rsp - 0x30], esp
xchg r8, r15
mov rcx, r15
xchg r8, r15
call fcn.140071e3c
test al, al
mov r11, r11
setne al
jmp 0x1400696bd
mov al, 0x17
add al, 0x19
add al, 0x44
sub al, 0x73
xchg rbx, r15
mov r15, qword [rsp + 0x68]
xchg r15, rbx
xchg rsi, r8
mov r8, qword [rsp + 0x70]
xchg rsi, r8
xchg rdi, rdx
mov rdx, qword [rsp + 0x78]
xchg rdx, rdi
nop
add rsp, 0x43936fa0
sub rsp, 0x43936f50
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140073ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x3c], ecx
push rdi
nop
sub rsp, 0x4dc2233f
add rsp, 0x4dc222df
lea rax, [rcx + 8]
xchg rdi, rdi
mov qword [rsp + 0x70], rbx
xchg rsi, rax
mov qword [rcx], rsi
xchg rsi, rax
xorps xmm0, xmm0
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
xchg r14, rsi
mov r14, rcx
xchg r14, rsi
mov qword [rsp + 0x78], rbp
mov dword [rsp - 0x30], ebx
xchg rsp, rax
movups xmmword [rsp + 0x10], xmm0
xchg rsp, rax
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x34], ecx
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
mov dword [rsp - 0xc], edi
xchg rsp, rax
movups xmmword [rsp + 0x50], xmm0
xchg rsp, rax
xchg r12, rax
movups xmmword [r12 + 0x60], xmm0
xchg r12, rax
xchg rsp, rax
movups xmmword [rsp + 0x70], xmm0
xchg rsp, rax
xchg rbp, r14
mov r14, qword [rdx + 0x38]
xchg r14, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x20], 0xb0dd13f
mov rbx, qword [rdx]
mov qword [rsp + 0x20], rax
xchg rsp, r15
movups xmmword [r15 + 0x28], xmm0
xchg rsp, r15
lea rdx, [rbp + 1]
mov dword [rsp - 0x40], edi
xchg rsp, rsi
movups xmmword [rsi + 0x38], xmm0
xchg rsi, rsp
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg rsp, r8
call fcn.14001795c
mov dword [rsp - 0x24], 0x60d45a8
mov edx, 0x26265248
add edx, 0x3a04fcc4
xor edx, 0x48453240
xor edx, 0x53b3e43
test rbp, rbp
mov dword [rsp - 0x1c], 0x5346a716
je 0x140073c19
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
mov r8d, 0x5680f212
sub r8d, 0x1f08afc3
add r8d, 0x2c5c8e27
sub r8d, 0x63d4cf77
nop word [rax + rax]
xchg r13, r13
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x20], edi
sub r9, 1
jne 0x140073bed
xor ecx, ecx
xchg rsp, r8
mov rsp, rbp
xchg r8, rsp
mov word [rax + rbp*2], cx
mov rcx, rsi
xchg r8, rdx
mov r8, qword [rsp + 0x20]
xchg rdx, r8
call fcn.140090f50
mov r13, r13
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
xchg r14, rbp
mov r14, qword [rsp + 0x78]
xchg r14, rbp
xchg rbp, rbx
mov rbp, qword [rsp + 0x70]
xchg rbp, rbx
cmp rcx, rax
jne 0x140073cb3
mov dword [rsp - 0x10], ebp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x1f87f3f3
xor ecx, 0x53399d90
sub ecx, 0x34278fd9
sub ecx, 0x3ec2cc9
sub ecx, 0x14aab191
rep stosb byte [rdi], al
xchg rdx, rdx
mov rax, rsi
xchg r15, rsi
mov r15, qword [rsp + 0x80]
xchg rsi, r15
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098ac0
mov rcx, rcx
xchg r13, rax
mov r13, rsi
xchg r13, rax
mov rsi, qword [rsp + 0x80]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007e7b8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001900]
sub r10, rcx
mov dword [rsp - 0x18], esi
mov r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x8ebc6d3
add edx, 0x157120a5
sub edx, 0x12dedd60
xor edx, 0x6e680e7d
sub edx, 0x4b14a2ab
inc r9
rol edx, cl
mov dword [rsp - 0x2c], ebx
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
xchg r13, r13
jb 0x14007e7cc
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x14007f710
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
xchg r14, rcx
mov qword [rsp + 8], r14
xchg r14, rcx
push rbp
xchg r12, r12
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x10], edx
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
nop
sub rsp, 0x20037a2e
add rsp, 0x20037a0e
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov r13d, r8d
mov rcx, rcx
mov r9d, 0x7c29427a
xor r9d, 0x1320c89a
sub r9d, 0x6b947dea
add r9d, 0x6fccd98a
xor r9d, 0x7345e680
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
mov rdi, rdi
pushf
movabs rcx, 0xffffffff064073cb
add rcx, 0x3fa345c7
sub rcx, 0x38588430
add rcx, 0x7fffffff
xor rcx, 0x7274ca9e
popf
pushf
mov eax, 0x5c410f91
xor eax, 0x2f74c605
xor eax, 0x44bc4f8
sub eax, 0x777e0d68
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x34], ebx
cmovo rax, rcx
xchg rcx, r9
mov r9, rax
xchg r9, rcx
call fcn.140098990
lea r15d, [r13 + 0xfffff]
xor esi, esi
mov r11, r11
shr r15d, 4
shr r15d, 4
shr r15d, 4
shr r15d, 2
shr r15d, 5
shr r15d, 1
xchg rbp, r13
mov r13, rax
xchg rbp, r13
mov eax, dword [rbx + 0x18]
mov ebx, 0x35c16e52
add ebx, 0x245e5232
add ebx, 0x2461f0fc
sub ebx, 0x3ef2b26d
xor ebx, 0x3f8eff12
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x2c], 0x708453d2
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007f962
mov dword [rsp - 0x28], 0x4f62d68b
mov eax, 0xbf6ff89
xor eax, 0x2af3e3a6
add eax, 0x3ca39515
sub eax, 0x5d98b144
xchg r13, rcx
mov r13, qword [rsp + 0x60]
xchg r13, rcx
mov r14d, esi
shl r14d, 3
shl r14d, 6
shl r14d, 6
shl r14d, 2
shl r14d, 2
shl r14d, 1
mov edi, r13d
sub edi, r14d
mov dword [rsp - 0xc], edx
xchg rdx, r15
mov r15, rbp
xchg r15, rdx
cmp edi, eax
mov rbx, rbx
cmova edi, eax
mov r8d, edi
call fcn.140092e10
mov dword [rsp - 0x20], ecx
test al, al
je 0x14007f960
shr edi, 1
shr edi, 1
xor r8d, r8d
mov r11, r11
shr r14d, 2
test edi, edi
je 0x14007f92c
mov r15d, dword [rsp + 0x70]
mov dword [rsp - 0x3c], ecx
xchg rcx, r9
mov rcx, rbp
xchg r9, rcx
lea eax, [r14 + r8]
xchg r8, r8
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x396d0ebe
xchg rdx, rdx
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg r8, r8
jb 0x14007f8fa
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov dword [rsp - 0x18], 0x7445a3f5
mov eax, 0x32e576a0
sub eax, 0x1895b434
add eax, 0x18436d54
add eax, 0x1e1eade8
sub eax, 0x50a1dda8
cmp esi, r15d
jb 0x14007f87e
mov r15, r15
jmp 0x14007f962
xor bl, bl
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.1400989a0
mov al, bl
xchg rbx, rbp
mov rbp, qword [rsp + 0x68]
xchg rbp, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
pop rsi
xchg r9, r9
pop rbp
ret
Function at 0x140080224
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rbp, r12
mov qword [rsp + 0x10], r12
xchg r12, rbp
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
push r15
mov dword [rsp - 0x10], ebp
nop
add rsp, 0x52fe5913
sub rsp, 0x52fe5933
xchg rcx, r14
mov r15, r14
xchg rcx, r14
mov r14d, r8d
mov r9d, 0x6d830109
xor r9d, 0x7a7e6bde
xor r9d, 0x599f15c6
xor r9d, 0x23de764
sub r9d, 0x4c5b9875
mov r12, rdx
mov dword [rsp - 0x24], ebp
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff59f46c4b
sub rcx, 0x3e593465
sub rcx, 0x101482b
add rcx, 0x7fffffff
xor rcx, 0x65661045
popf
pushf
mov eax, 0x6af1627
add eax, 0x14f867c8
add eax, 0x19c327e8
sub eax, 0x32110814
sub eax, 0x3599dbf
popf
cmovb r9d, r14d
mov r13, r13
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140098990
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
mov dword [rsp - 0x10], 0x72f4a98c
shr ebp, 0xe
shr ebp, 2
shr ebp, 2
shr ebp, 1
shr ebp, 1
xor edi, edi
mov rdi, rdi
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x1dc0c62e
add ebx, 0x5df08321
sub ebx, 0x6d1f10c9
sub ebx, 0xe923885
test ebp, ebp
mov r13, r13
je 0x140080442
mov eax, 0x39207a3a
sub eax, 0x6d27383
xor eax, 0x754a2a8
xor eax, 0x350aa41f
mov r9d, edi
mov r10, r10
mov r8d, r14d
shl r9d, 2
shl r9d, 1
shl r9d, 5
shl r9d, 8
shl r9d, 1
shl r9d, 2
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov r15, r15
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xchg r11, r11
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
xchg r11, r11
je 0x1400803f1
xchg rdx, r8
mov r8, rsi
xchg rdx, r8
lea ecx, [r9 + r10]
mov eax, r13d
xchg r10, r10
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x396d0ebe
mov rsi, rsi
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
xchg rsp, rsp
jb 0x1400803c6
xchg r13, rdx
mov r13, rsi
xchg r13, rdx
mov rcx, r15
call fcn.1400931e0
mov dword [rsp - 0x2c], 0x5640969b
test al, al
je 0x140080438
add edi, ebx
mov eax, 0x2fb8fd8c
add eax, 0x2f5f39ae
sub eax, 0x5630fc39
sub eax, 0x8d73b01
cmp edi, ebp
jb 0x14008036d
mov rbx, rbx
jmp 0x140080442
xor bl, bl
mov dword [rsp - 0x38], 0x66791ae0
mov rcx, rsi
call fcn.1400989a0
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rdx, rdx
xchg rbx, rdi
mov rdi, qword [rsp + 0x50]
xchg rbx, rdi
mov rsi, qword [rsp + 0x60]
nop
sub rsp, 0x32d002e6
add rsp, 0x32d00306
pop r15
mov dword [rsp - 0xc], 0x123d7928
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
xchg r14, r14
pop rdi
ret
Function at 0x140083090
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg r14, rbp
mov qword [rsp + 0x10], r14
xchg r14, rbp
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x62ac9abe
add rsp, 0x62ac9a9e
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x2c], 0x5997ca15
xchg r14, rdi
mov r14, rdx
xchg rdi, r14
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
mov edx, dword [rbx + rcx + 0xb0]
mov rbx, rbx
call fcn.140084e40
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
xchg r11, r11
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
mov dword [rsp - 0x38], edi
test ebp, ebp
je 0x140083258
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov r15, r15
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x18], 0x72367ab
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
xchg r10, r10
jae 0x1400831ae
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140083175
xchg r10, r10
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
xchg rbx, rbx
jb 0x140083199
add eax, r9d
cmp r11d, eax
jb 0x140083216
mov dword [rsp - 0x44], 0x6a4d2fcb
inc r8w
sub rdx, 0xffffffffffffffd8
cmp r8w, cx
mov rbp, rbp
jb 0x140083164
xchg rdx, r8
mov rdx, r14
xchg r8, rdx
mov eax, dword [r10 + 4]
xchg r12, r12
lea r9, [r10 + 4]
add rax, 0xfffffffffffffff8
sub r10, 0xfffffffffffffff8
shr rax, 1
xchg r12, r12
test eax, eax
je 0x14008324a
mov edx, eax
xchg r15, r15
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 1
shr ecx, 0xa
shr ecx, 1
cmp ecx, 3
xchg r8, r8
je 0x14008322b
cmp ecx, 0xa
jne 0x140083234
and eax, 0xfff
xchg r13, r13
add qword [rax + r8], rdi
jmp 0x140083234
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov r9, r9
add r8, rsi
add r8, r11
jmp 0x1400831b7
and eax, 0xfff
add dword [rax + r8], edi
add r10, 2
mov dword [rsp - 0x44], 0x7a3483a
sub rdx, 1
jne 0x1400831e3
add ebx, dword [r9]
xchg rbx, rbx
cmp ebx, ebp
jb 0x14008312d
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
xchg rbp, r10
mov r10, qword [rsp + 0x38]
xchg rbp, r10
xchg r9, rsi
mov r9, qword [rsp + 0x40]
xchg r9, rsi
xchg rdi, r11
mov r11, qword [rsp + 0x48]
xchg rdi, r11
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
mov dword [rsp - 0x28], esp
ret
Function at 0x140084e40
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
mov dword [rsp - 0x20], 0x17ad684
xor r9d, r9d
add r8, rcx
mov r10d, edx
xchg rsi, rsi
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movzx eax, word [r8 + 0x14]
mov r8, r8
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
mov r9, r9
cmp r9w, r11w
jae 0x140084ebf
nop dword [rax]
mov r9, r9
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x140084e97
mov ecx, dword [rax + 0x10]
xchg r15, r15
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x140084ea9
add ecx, edx
mov rsi, rsi
cmp r10d, ecx
jb 0x140084ecd
inc r9w
add rax, 0x28
mov dword [rsp - 0x24], 0x2bb98732
cmp r9w, r11w
jb 0x140084e8a
xor eax, eax
xchg r11, rbx
mov r11, qword [rsp + 8]
xchg rbx, r11
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
mov r10, r10
add rax, rbx
mov rbx, qword [rsp + 8]
add rax, r10
ret
Function at 0x140084ef0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov dword [rsp - 0x18], esp
push r14
push r9
mov qword [rsp], r15
nop
add rsp, 0x112a2021
sub rsp, 0x112a2041
movzx eax, word [rcx]
mov dword [rsp - 0x34], esp
mov r15d, edx
xor eax, 0x396d0ebe
xchg rsi, r8
mov r8, rcx
xchg r8, rsi
cmp eax, 0x396d54f3
jne 0x14008508a
movsxd rdx, dword [rcx + 0x3c]
mov r13, r13
mov eax, dword [rdx + rcx]
xor eax, 0x396d0ebe
cmp eax, 0x396d4bee
jne 0x14008508a
mov r14, r14
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084e40
mov rcx, rsi
mov dword [rsp - 0x18], 0x46cefa7
xchg r14, r12
mov r12, rax
xchg r14, r12
mov edx, dword [rax + 0x20]
call fcn.140084e40
xchg r14, r14
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg rdi, rax
mov r12, rdi
xchg rdi, rax
call fcn.140084e40
mov edx, dword [r14 + 0x1c]
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
xchg r8, rax
mov r13, r8
xchg r8, rax
call fcn.140084e40
xor edi, edi
xchg r12, r12
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x14008508a
nop dword [rax]
xchg r8, r8
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140084e40
mov dword [rsp - 0x3c], esi
mov ecx, 0x3ec3e093
sub ecx, 0xb849fd7
xor ecx, 0x42c7b1de
add ecx, 0x8e070e9d
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x34], ebp
cmp byte [rax], 0
je 0x14008506b
nop dword [rax]
xchg r12, rbx
mov rdx, r12
xchg rbx, r12
lea rcx, [rsp + 0x60]
mov r15, r15
mov r8d, 0x428b57fe
sub r8d, 0x41657f13
add r8d, 0x18b03ba2
xor r8d, 0x19d6148c
inc rbx
call fcn.14008e1e0
cmp byte [rbx], 0
xchg r13, r13
jne 0x140085027
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x3c], edi
je 0x1400850cb
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x18], ebx
jb 0x140084fe5
xor eax, eax
xchg rdx, rbx
mov rdx, qword [rsp + 0x68]
xchg rbx, rdx
sub rsp, 0xffffffffffffffe0
pop r15
mov dword [rsp - 0x18], ecx
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
mov dword [rsp - 0x40], 0x7ddb59c6
pop rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x10], 0x3b3266a0
mov rcx, rsi
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
xchg rcx, rcx
call fcn.140084e40
jmp 0x14008508c
Function at 0x140085100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
xchg r13, r13
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x6aa50cf1
add rsp, 0x6aa50cd1
movzx eax, word [rcx]
mov r9, r9
mov edi, edx
xor eax, 0x396d0ebe
xchg rbx, rsi
mov rsi, rcx
xchg rsi, rbx
cmp eax, 0x396d54f3
jne 0x1400851cd
mov dword [rsp - 0x3c], 0x1b7730e9
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x396d0ebe
cmp eax, 0x396d4bee
xchg r15, r15
jne 0x1400851cd
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084e40
mov dword [rsp - 0x24], 0x3d3d3b70
sub edi, dword [rax + 0x10]
cmp edi, dword [rax + 0x14]
jae 0x1400851cd
mov edx, dword [rax + 0x1c]
mov dword [rsp - 0x14], ebp
xchg rcx, rdx
mov rdx, rbx
xchg rcx, rdx
call fcn.140084e40
xchg r12, r12
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
mov edx, dword [rax + rdi*4]
mov dword [rsp - 0x18], 0x72cacff6
mov rbx, qword [rsp + 0x30]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.140084e40
mov rbx, qword [rsp + 0x30]
xor eax, eax
xchg rcx, rcx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
ret
Function at 0x140089593
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
mov rbx, qword [rcx]
mov dword [rsp - 0x18], ebx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rbx, rsi
mov qword [rsp + 0x70], rbx
xchg rbx, rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r14, r14
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg rsp, r8
movups xmmword [r8 + 0x38], xmm0
xchg rsp, r8
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.14001795c
mov dword [rsp - 0x10], edi
mov edx, 0x79dab82a
sub edx, 0x3715b638
sub edx, 0x32cccef0
xor edx, 0x419730d2
sub edx, 0x2119c0c1
test rsi, rsi
mov dword [rsp - 0x14], 0x50210a09
je 0x1400895e7
mov rdi, rax
sub rbx, rax
mov r8, rsi
xchg rsp, rsp
mov r9d, 0x15cc1385
add r9d, 0x59669bfa
sub r9d, 0x317bede2
xor r9d, 0x7b1e8b58
sub r9d, 0x46a849c6
nop dword [rax]
mov r12, r12
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
xchg r13, r13
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r9, r9
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400895bc
xor ecx, ecx
xchg r9, r9
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.1400896a0
xchg r12, r12
xchg rcx, r9
mov r9, qword [rsp + 0x20]
xchg r9, rcx
mov ebx, eax
xchg r9, r9
xchg rsi, rcx
mov rcx, qword [rsp + 0x70]
xchg rsi, rcx
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x38], esi
jne 0x140089678
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x755e0863
xor ecx, 0x2b48a1f3
sub ecx, 0xe56ce72
xor ecx, 0x4fbfdb2e
rep stosb byte [rdi], al
mov eax, ebx
mov dword [rsp - 0x18], 0x5efba82a
xchg r9, rbx
mov r9, qword [rsp + 0x78]
xchg rbx, r9
nop
sub rsp, 0x2830574c
add rsp, 0x283057ac
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098ac0
mov eax, ebx
mov rbx, rbx
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret