joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400851f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
push r13
push r14
mov rdi, rdi
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
movzx eax, word [rcx]
mov dword [rsp - 0x40], 0x761b36d9
mov r15d, edx
xor eax, 0x24fd0ef4
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
cmp eax, 0x24fd54b9
jne 0x14008539e
mov dword [rsp - 0x14], ecx
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x24fd0ef4
xchg r13, r13
cmp eax, 0x24fd4ba4
jne 0x14008539e
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085110
xchg r9, r9
mov rcx, rsi
xchg r14, rbx
mov rbx, rax
xchg rbx, r14
mov edx, dword [rax + 0x20]
mov dword [rsp - 0x38], esp
call fcn.140085110
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.140085110
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x14], esi
xchg rcx, r8
mov r8, rsi
xchg rcx, r8
mov r13, rax
mov dword [rsp - 0x40], ecx
call fcn.140085110
xor edi, edi
xchg r8, rax
mov qword [rsp + 0x70], r8
xchg r8, rax
cmp dword [r14 + 0x18], edi
jbe 0x14008539e
nop dword [rax]
mov r12, r12
mov edx, dword [r12 + rdi*4]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140085110
mov ecx, 0x67b7169b
xor ecx, 0x56201565
sub ecx, 0x15d1c84d
xor ecx, 0x5a16655f
add ecx, 0xbe2ca111
xchg rbx, r14
mov r14, rax
xchg rbx, r14
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140085384
mov r9, r9
nop dword [rax]
xchg rbx, rcx
mov rdx, rcx
xchg rcx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x70b285b2
sub r8d, 0x2d116f93
add r8d, 0x11f284da
sub r8d, 0x1167bd10
xor r8d, 0x442bdde8
inc rbx
mov dword [rsp - 0x44], 0x50008e1
call fcn.14008e550
cmp byte [rbx], 0
jne 0x140085334
mov ecx, dword [rsp + 0x60]
mov r14, r14
not ecx
cmp ecx, r15d
je 0x1400853e3
inc edi
mov rsi, rsi
cmp edi, dword [r14 + 0x18]
jb 0x1400852e9
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x20], 0x44b7ab8b
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
pop r14
mov dword [rsp - 0x38], 0x47b060a5
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
ret
movzx edx, word [r13 + rdi*2]
mov rbp, rbp
mov rcx, rsi
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
mov edx, dword [rax + rdx*4]
call fcn.140085110
mov dword [rsp - 0x18], ecx
jmp 0x1400853a0
Function at 0x140089805
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 0x10], r12
xchg r12, rbx
push rdi
mov dword [rsp - 0x3c], 0x19e01211
nop
sub rsp, 0x79bff681
add rsp, 0x79bff621
mov rbx, qword [rcx]
mov dword [rsp - 0x40], ecx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x14], 0x6e381494
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
xchg rcx, rcx
lea rdx, [rsi + 1]
xchg rsp, r12
movups xmmword [r12 + 0x38], xmm0
xchg rsp, r12
xchg rsp, r15
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.140017814
mov r10, r10
mov edx, 0x4d042e16
add edx, 0x26ea6c1e
sub edx, 0x3f827ea9
xor edx, 0x608b6d6b
test rsi, rsi
je 0x1400898f5
xchg rsi, rax
mov rdi, rsi
xchg rsi, rax
sub rbx, rax
mov r9, r9
mov r8, rsi
mov r9d, 0x6849140f
sub r9d, 0x4465160
sub r9d, 0x2a6f3a06
sub r9d, 0xa6ff627
sub r9d, 0x2f239183
nop dword [rax]
mov r11, r11
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x38], ebx
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov dword [rsp - 0x1c], 0x34668cb3
jne 0x1400898c4
xor ecx, ecx
mov word [rax + rsi*2], cx
mov r14, r14
mov rcx, qword [rsp + 0x20]
call fcn.1400899a0
mov rcx, qword [rsp + 0x20]
mov r8, r8
mov ebx, eax
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rbp, rsi
lea rax, [rsp + 0x28]
mov r13, r13
cmp rcx, rax
jne 0x140089970
xor eax, eax
mov rsi, rsi
lea rdi, [rsp + 0x28]
mov ecx, 0x37dc8aec
add ecx, 0x3339ca4b
xor ecx, 0x5e1ad51
sub ecx, 0x4f8f0bbb
sub ecx, 0x1f68ec7b
rep stosb byte [rdi], al
mov eax, ebx
xchg r14, r14
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098de0
mov dword [rsp - 0x38], ecx
mov eax, ebx
xchg rbx, rsi
mov rsi, qword [rsp + 0x78]
xchg rsi, rbx
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008aec0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg r11, rsp
mov qword [r11 + 0x20], rbx
xchg r14, r14
push rdi
nop
sub rsp, 0x535f3f84
add rsp, 0x535f3f24
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
xchg r11, r11
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov rcx, rcx
mov qword [r11 + 0x10], rsi
xchg r12, rsi
mov r12, qword [rcx + 0x38]
xchg rsi, r12
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
xchg rsp, r8
movups xmmword [r8 + 0x28], xmm0
xchg rsp, r8
lea rdx, [rsi + 1]
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg r14, rsp
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg r8, rsp
call fcn.140017814
mov edx, 0xa9766a4
add edx, 0x4ae41813
sub edx, 0x4b599219
add edx, 0x5fa5d590
xor edx, 0x3d20b4ce
test rsi, rsi
je 0x14008aff0
mov dword [rsp - 0xc], 0x59cdaac2
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg rsi, r11
mov r8, r11
xchg rsi, r11
mov r9d, 0x50cdb298
xor r9d, 0x7e884f1c
sub r9d, 0x16477e2c
sub r9d, 0x17fe7e59
nop word [rax + rax]
mov dword [rsp - 0x10], 0x4f85a701
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov rbp, rbp
ror edx, 1
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x30], esi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008afb9
xchg rbx, rbx
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rsi, rdx
mov rsi, r14
xchg rsi, rdx
xchg rcx, r11
mov r11, qword [rsp + 0x20]
xchg rcx, r11
call fcn.14008b0d0
mov dword [rsp - 0x3c], 0x518e26e5
xchg r9, rcx
mov r9, qword [rsp + 0x20]
xchg rcx, r9
mov ebx, eax
mov dword [rsp - 0x10], ecx
xchg r14, rdi
mov rdi, qword [rsp + 0x80]
xchg rdi, r14
lea rax, [rsp + 0x28]
mov r10, r10
xchg rsi, r15
mov r15, qword [rsp + 0x78]
xchg r15, rsi
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14008b0a1
xchg r9, r9
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x29d80c2f
xor ecx, 0x6010ce56
xor ecx, 0x4e00ad97
xor ecx, 0x7c86fde
rep stosb byte [rdi], al
mov eax, ebx
xchg rbx, r12
mov r12, qword [rsp + 0x88]
xchg r12, rbx
nop
sub rsp, 0x48348228
add rsp, 0x48348288
pop rdi
xchg r14, r14
ret
call fcn.140098de0
mov eax, ebx
mov rbx, qword [rsp + 0x88]
xchg rsi, rsi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x24], 0x43931f64
ret
Function at 0x14008b0d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov dword [rsp + 0x18], r8d
push rdi
add rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x3c], 0x2e917063
xchg rsp, rbx
mov rsp, rdx
xchg rbx, rsp
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x3b6e4610
xor r8d, 0x1c29db92
add r8d, 0x1a9d584
sub r8d, 0x28f170fe
call fcn.140099440
mov dword [rsp - 0x18], 0x2bba9da9
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rbx, rax
mov rbx, qword [r8 + 0x10]
xchg rbx, rax
xchg rbp, r8
mov rbp, qword [rax]
xchg rbp, r8
test r8, r8
xchg rdx, rdx
je 0x14008b362
mov r8, qword [r8 + 0x50]
test r8, r8
mov r15, r15
je 0x14008b362
mov edx, 0x20c6b752
xor edx, 0x5c1e3f8e
sub edx, 0x41a0482a
sub edx, 0x3b383fae
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov dword [rsp - 0x18], 0xebea34a
call fcn.140099f70
mov edx, 0x78f26adc
xor edx, 0x4e4bb353
add edx, 0x348a2fe1
sub edx, 0x6b440914
lea rcx, [rsp + 0x30]
call fcn.14009a080
mov dword [rsp - 0x20], 0x37a15cfc
test rax, rax
je 0x14008b32a
xor ecx, ecx
mov dword [rsp - 0x44], edx
xchg rbp, rdx
mov rbp, rdi
xchg rbp, rdx
mov word [rax], cx
mov rsi, rsi
movabs rcx, 0x674c1ec168c4fb87
add rcx, 0xe8c179d
xor rcx, 0x3d571dbe
add rcx, 0x270c50f0
sub rcx, 0x2288cf64
mov rax, qword [0x140141690]
mov dword [rsp - 0x38], 0x20b4373c
ror rax, 0xd
ror rax, 4
ror rax, 0x10
ror rax, 3
not rax
mov rdi, rdi
add rax, rcx
movabs rcx, 0xbf57003e2a6f14a5
xor rcx, 0x517adf19
xor rcx, 0x70a19cff
xor rcx, 0x104e675
xor rax, rcx
lea rcx, [rsp + 0x20]
call rax
mov dword [rsp - 0x10], edi
mov rax, qword [0x140141680]
lea r8, [rsp + 0x20]
ror rax, 0x1a
ror rax, 0x15
ror rax, 9
ror rax, 1
ror rax, 1
ror rax, 1
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x28], ecx
movabs rcx, 0x7ec6fd0e68e607b4
add rcx, 0x12feb700
sub rcx, 0x5737aebe
sub rcx, 0x44d56f2
xchg r9, rbx
mov rbx, r9
xchg r9, rbx
xor rax, rcx
movabs rcx, 0x23f3159529dc216a
sub rcx, 0x25570b1a
xor rcx, 0x4909cf94
add rcx, 0x294a8151
not rax
xchg r13, r13
ror rax, 4
ror rax, 3
ror rax, 3
ror rax, 2
add rax, rcx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x28], ebx
rol rax, 2
rol rax, 8
rol rax, 2
rol rax, 0xa
rol rax, 1
call rax
mov dword [rsp - 0x34], 0x4251e6c9
xchg rdi, rbx
mov rdi, qword [rsp + 0x250]
xchg rbx, rdi
add rsp, 0x240
xchg r12, r12
pop rdi
ret
mov eax, 0x712386d0
xor eax, 0xf622d55
xor eax, 0x1654195
sub eax, 0x1d84a732
add eax, 0x5e5fbd23
xchg r14, rbx
mov r14, qword [rsp + 0x250]
xchg rbx, r14
sub rsp, 0xfffffffffffffdc0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x250]
mov r8, r8
mov eax, 0x699e524d
xor eax, 0x1079e074
sub eax, 0x478bc14b
sub eax, 0x1bd0719
xor eax, 0xf09ee8e0
sub rsp, 0xfffffffffffffdc0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008e8d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142084], 0
mov dword [rsp - 0x34], 0x1e6dce7e
jne 0x14008e9e0
xor edx, edx
lea r8, [0x140142080]
mov rdx, rdx
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
xchg r12, r12
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
xchg r9, r9
inc edx
xor ecx, eax
mov eax, ecx
xchg r10, r10
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x20], 0x64fa4911
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r12, r12
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r9, r9
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x28], 0x20eaaab3
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], ecx
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x44], esi
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x18], 0x38d7bc23
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x28], ebx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rbp, rbp
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x3c], 0x513d98b6
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x20], edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x30], esi
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov r13, r13
cmp edx, 0x100
jb 0x14008e8fb
ret
Function at 0x140093cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x44], 0x415ccfb8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
nop
add rsp, 0x6466c92f
sub rsp, 0x6466c94f
movzx eax, byte [rdx + 1]
xchg rbx, rbx
xchg r8, rbp
mov r15, rbp
xchg r8, rbp
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
xchg rcx, rcx
mov r8d, dword [rcx + 4]
shl ebx, 1
shl ebx, 2
shl ebx, 3
shl ebx, 1
shl ebx, 1
dec r8d
mov dword [rsp - 0x2c], 0x371cba7a
or ebx, eax
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x10], esp
shl ebx, 3
shl ebx, 3
shl ebx, 2
or ebx, eax
movzx eax, byte [rdx + 3]
xchg r13, r13
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
xchg rbp, rbp
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 8
or edi, eax
mov dword [rsp - 0xc], 0x145e473f
movzx eax, byte [rdx + 7]
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x3c], 0x77a15f2a
test r8d, r8d
jle 0x140093e21
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
xchg rdi, rdi
movsxd rax, r8d
shr r14d, 1
inc r14d
xchg r15, r15
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
xchg r12, r12
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov r14, r14
xchg rdx, r11
mov r11, rsi
xchg r11, rdx
mov ecx, edi
xchg rsp, rsp
call fcn.140094570
xor ebx, eax
xchg rbp, r15
mov rdx, r15
xchg r15, rbp
mov ecx, ebx
mov dword [rsp - 0x28], ecx
call fcn.140094570
xor edi, eax
nop
sub rsi, 0x2f731f09
add rsi, 0x2f731ef1
nop
add rbp, 0x67a9790f
sub rbp, 0x67a97927
sub r14, 1
jne 0x140093dce
lea rax, [r15 + 7]
xchg rbp, rbp
mov ecx, 0x671ec1a3
sub ecx, 0x3393a667
xor ecx, 0x32e95284
add ecx, 0x7ab9a888
xor ecx, 0x7c1bf244
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
xchg r10, r10
shr ebx, 7
shr ebx, 1
shr edi, 1
shr edi, 4
shr edi, 2
shr edi, 1
sub rcx, 1
jne 0x140093e45
xchg rbx, rbp
mov rbp, qword [rsp + 0x40]
xchg rbp, rbx
xchg rbp, r12
mov r12, qword [rsp + 0x48]
xchg r12, rbp
mov rsi, qword [rsp + 0x50]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140093ea4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
xchg r11, r11
mov qword [rax + 8], rbx
xchg r8, rbp
mov qword [rax + 0x10], r8
xchg r8, rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x2c], ebx
mov r14, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov rdi, rdi
shl ebx, 1
shl ebx, 5
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 3
shl edi, 5
movzx eax, byte [rdx + 2]
shl ebx, 5
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x18], ecx
movzx eax, byte [rdx + 3]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
xchg r14, r14
movzx eax, byte [rdx + 6]
shl edi, 7
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 1
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x40], 0x1a6d88fa
test eax, eax
jle 0x140093f92
mov rsi, qword [rcx + 8]
lea ebp, [rax - 1]
mov dword [rsp - 0x34], ebp
shr ebp, 1
inc ebp
mov rdx, rsi
mov r10, r10
mov ecx, edi
call fcn.140094570
xor ebx, eax
lea rdx, [rsi + 0xc]
mov rdx, rdx
mov ecx, ebx
call fcn.140094570
xor edi, eax
neg rsi
add rsi, 0xffffffffffffffe8
neg rsi
sub rbp, 1
mov dword [rsp - 0x18], ecx
jne 0x140093f5b
lea rax, [r14 + 7]
mov ecx, 0x23dcdd88
add ecx, 0x6cdd5be
xor ecx, 0x33d9b3d4
xor ecx, 0x19730096
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x28], 0x32926a6
shr ebx, 7
shr ebx, 1
shr edi, 6
shr edi, 1
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x38], 0x1f642d86
jne 0x140093fad
mov rbx, qword [rsp + 0x30]
xchg rdi, rbp
mov rdi, qword [rsp + 0x38]
xchg rbp, rdi
xchg rdx, rsi
mov rdx, qword [rsp + 0x40]
xchg rdx, rsi
xchg r13, rdi
mov r13, qword [rsp + 0x48]
xchg rdi, r13
nop
add rsp, 0x7624949d
sub rsp, 0x7624947d
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140094204
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x10], 0x3fdc0409
push rbp
nop
push 0x6b7f6c6f
mov qword [rsp], rdi
push rax
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
mov dword [rsp - 0x20], esp
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001e10]
xor edi, edi
xchg rdi, rdi
movdqa xmm1, xmmword [0x140001e60]
xchg rbx, rbp
mov rbp, rdx
xchg rbx, rbp
movdqu xmmword [rbp - 0x39], xmm0
xchg r8, rcx
mov rsi, r8
xchg r8, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001dc0]
mov r10, r10
mov r8d, edi
xchg rbp, rdi
movdqu xmmword [rdi - 0x29], xmm1
xchg rdi, rbp
movdqa xmm1, xmmword [0x140001db0]
mov dword [rsp - 0x18], ecx
xchg rbx, rbp
movdqu xmmword [rbx - 0x19], xmm0
xchg rbx, rbp
xchg r9, rbp
movdqu xmmword [r9 - 9], xmm1
xchg rbp, r9
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x34], ebp
mov eax, 0x3edafe69
add eax, 0x404b5f41
sub eax, 0x5e8a1573
sub eax, 0x6e60757
inc rdx
rol eax, cl
xchg r9, r9
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov rsi, rsi
jb 0x1400942ac
cmp dword [rsi + 4], 8
jne 0x14009435d
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x20], 0xa53b899
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 5
shl cx, 1
shl cx, 1
shl cx, 1
or cx, ax
mov dword [rsp - 0x28], 0x67916d59
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x1400942ff
mov dword [rsp - 0x24], 0x14359a50
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg r8, rsi
mov rcx, r8
xchg r8, rsi
call fcn.14009401c
mov r13, r13
jmp 0x14009443c
cmp dword [rsi], edi
jle 0x14009443c
mov dword [rsp - 0x2c], ecx
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x58e51502
sub r8d, 0xc49a2be
sub r8d, 0x18d3804f
sub r8d, 0x2f6e15b5
sub r8d, 0x459dc3c
movzx eax, byte [rbx]
mov dword [rsp - 0x18], ebp
movzx ecx, byte [rbx + 1]
nop
add rbx, 0x91e90c3
sub rbx, 0x91e90c1
shl ax, 5
shl ax, 1
shl ax, 1
shl ax, 1
or cx, ax
mov dword [rsp - 0x14], esp
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
xchg r11, r11
jne 0x140094392
lea r9, [rbp + 7]
mov r8d, r14d
xchg r11, r11
lea rdx, [rbp + 0x67]
xchg rsi, rbx
mov rcx, rbx
xchg rsi, rbx
call fcn.14009401c
mov dword [rsp - 0x10], 0x766fe9ef
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
mov dword [rsp - 0x14], ebp
lea rdx, [rbp + 0x67]
nop
sub r8d, 0x50d79450
add r8d, 0x50d79448
xchg rbp, rcx
mov rbp, rsi
xchg rcx, rbp
call fcn.14009401c
mov r12, r12
inc edi
sub r14d, 0xfffffff8
cmp edi, dword [rsi]
jl 0x14009436c
xchg r8, r8
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rdi, rbx
mov rdi, qword [r11 + 0x28]
xchg rdi, rbx
lea rdi, [rbp + 7]
xchg r15, rsi
mov r15, qword [r11 + 0x30]
xchg r15, rsi
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg rsp, rdx
mov rdx, r11
xchg rsp, rdx
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14009451c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov dword [rsp - 0x1c], ecx
test edx, edx
je 0x140094569
lea ecx, [r11 + r11]
mov r9d, r10d
mov dword [rsp - 0x38], 0x6c10e6f7
xor r9d, r11d
mov r11d, ecx
test dl, 1
mov dword [rsp - 0x40], 0x14f29af4
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov r14, r14
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
mov dword [rsp - 0x30], edi
jne 0x14009452a
mov eax, r10d
ret
Function at 0x14009f798
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
xchg rdx, rsi
mov r9, rsi
xchg rsi, rdx
test rax, rax
je 0x14009f801
mov ecx, r8d
xchg rdi, rdi
mov edx, 0x1cc92134
sub edx, 0xb62ed25
sub edx, 0xe81170b
add edx, 0x16d123dc
rol edx, cl
xchg rsp, rsp
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
mov dword [rsp - 0x34], 0x1b1d10d5
inc r8
cmp r8, 0x20
jb 0x14009f7b4
mov dword [rsp - 0x30], esp
mov al, 0x7e
sub al, 0x17
sub al, 0x4c
sub al, 0x1a
ret
xchg r15, rax
mov r15, qword [rcx + 0x100]
xchg r15, rax
test rax, rax
je 0x14009f83d
mov r15, r15
xchg rcx, rax
movups xmm0, xmmword [rcx]
xchg rcx, rax
xchg rbp, rdx
movups xmmword [rbp], xmm0
xchg rdx, rbp
movups xmm1, xmmword [rax + 0x10]
xchg rdx, r13
movups xmmword [r13 + 0x10], xmm1
xchg r13, rdx
jmp 0x14009f7f8
xorps xmm0, xmm0
mov dword [rsp - 0x3c], ecx
xor al, al
movups xmmword [rdx], xmm0
xchg rsp, rdx
movups xmmword [rsp + 0x10], xmm0
xchg rsp, rdx
ret
Function at 0x1400b612c
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbp
mov rbp, rsp
xchg r11, rbp
xchg r15, rbx
mov qword [r11 + 8], r15
xchg rbx, r15
xchg r10, rsi
mov qword [r11 + 0x18], r10
xchg r10, rsi
xchg r15, rdi
mov qword [r11 + 0x20], r15
xchg rdi, r15
push r14
nop
sub rsp, 0x55732ebb
add rsp, 0x55732e7b
mov rax, qword [0x1401414c8]
mov dword [rsp - 0x1c], 0x65dcde57
lea rdx, [r11 + 0x10]
rol rax, 0x1a
rol rax, 0xa
rol rax, 0x15
rol rax, 2
rol rax, 1
mov rbx, rcx
mov dword [rsp - 0x1c], ecx
not rax
mov dword [rsp + 0x58], 0x2fc1b7b0
xor dword [rsp + 0x58], 0x779bd90f
sub dword [rsp + 0x58], 0x27a8d6b2
sub dword [rsp + 0x58], 0x30b197fd
ror rax, 0xc
ror rax, 5
ror rax, 3
ror rax, 4
ror rax, 1
movabs rcx, 0xc466267939e67778
add rcx, 0x2c13d431
sub rcx, 0xc6575ae
sub rcx, 0x4ca8da68
add rcx, 0x787901a7
add rax, rcx
xchg r15, r15
lea rcx, [r11 - 0x28]
not rax
rol rax, 2
not rax
mov r11, r11
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rdi
mov dword [rsp - 0x3c], 0x3ab6518e
xor esi, esi
xchg rdi, rbp
movups xmmword [rbp], xmm0
xchg rbp, rdi
xchg rdi, rbp
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rdi
xchg rdi, rsi
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rdi
test eax, eax
xchg rbx, rbx
jne 0x1400b6252
xchg rsi, rbp
mov qword [rbx + 0x38], rbp
xchg rbp, rsi
jmp 0x1400b6387
lea rax, [rsp + 0x20]
mov dword [rsp - 0x30], 0x69b1433a
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
jne 0x1400b6263
mov r12, r12
xchg rdx, r14
mov qword [rbx + 0x38], rdx
xchg rdx, r14
cmp qword [rbx], rdi
xchg rbx, rbx
je 0x1400b6295
mov rcx, qword [rbx]
call fcn.140098de0
mov r14, r14
cmp r14, 0x18
jbe 0x1400b62d9
lea rcx, [r14 + r14]
mov dword [rsp - 0x38], 0x58c39f8
call fcn.1400990f0
xchg r13, rax
mov qword [rbx], r13
xchg r13, rax
test rax, rax
jne 0x1400b62e6
mov qword [rbx], rdi
mov dword [rsp - 0x14], 0x123d7b4a
xchg rsi, r13
mov rcx, r13
xchg r13, rsi
jmp 0x1400b6308
mov qword [rbx], rdi
xchg r11, r11
xchg r14, rax
mov r14, rdi
xchg r14, rax
xorps xmm0, xmm0
xchg rsp, rsp
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rax
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
mov rcx, qword [rbx]
mov edx, 0x47cd4f49
add edx, 0x18702f7e
add edx, 0x46c66da
sub edx, 0xfc26ec1
cmp qword [rbx + 0x38], rsi
jbe 0x1400b6387
mov dword [rsp - 0x10], edx
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x40], 0x71870128
mov r9d, 0x128c152c
xor r9d, 0x247d3009
xor r9d, 0x994d68b
sub r9d, 0x3f65f2af
and ax, r9w
ror edx, 1
ror edx, 5
ror edx, 1
ror edx, 1
xor ax, word [r8 + rcx]
mov rdx, rdx
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
xchg r8, r8
cmp rsi, qword [rbx + 0x38]
jb 0x1400b6335
mov rsi, qword [rsp + 0x60]
xchg rdi, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
xchg rdi, r11
mov r11, qword [rsp + 0x68]
xchg r11, rdi
nop
sub rsp, 0x29b82728
add rsp, 0x29b82768
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400c8330
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rbp
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
nop
push r9
mov qword [rsp], rdi
push r15
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x6c5108e3
add rsp, 0x6c5108c3
movzx esi, word [rdx + 0x14]
mov dword [rsp - 0x14], 0x1be6dd0f
lea rbx, [rdx + 0x18]
movzx eax, word [rdx + 6]
mov r13, rcx
xchg rbp, rbp
add rbx, rsi
mov ecx, 0x1fe29845
add ecx, 0x507bdc24
sub ecx, 0x3ae05009
sub ecx, 0x357e245f
xchg r9, r15
mov r9, r15
xchg r9, r15
xchg r14, r8
mov r12, r14
xchg r8, r14
mov rdi, rdx
mov r9, r9
cmp cx, ax
jae 0x1400c843b
lea rbp, [rdx + 0x40]
mov dword [rsp - 0x40], 0x77dec0b5
add rbp, rsi
sub ax, cx
movzx r14d, ax
mov dword [rsp - 0x3c], 0x2cece09e
mov rdx, rbp
xchg rcx, rbp
mov rbp, r13
xchg rbp, rcx
call fcn.1400c9130
mov dword [rsp - 0x20], edi
test al, al
xchg r10, rbp
mov rcx, r10
xchg rbp, r10
cmove rcx, rbx
mov dword [rsp - 0x44], 0x5b4892b8
sub rbp, 0xffffffffffffffd8
xchg rcx, rdi
mov rbx, rdi
xchg rcx, rdi
sub r14, 1
jne 0x1400c83f5
xchg r12, r12
mov eax, dword [rsi + rdi + 0x24]
mov rdx, rbx
mov rcx, rdi
mov dword [r12], eax
mov dword [rsp - 0x30], edx
call fcn.1400858d0
add eax, dword [rbx + 0xc]
xchg rbx, r12
mov r12, qword [rsp + 0x50]
xchg rbx, r12
xchg rbp, r9
mov r9, qword [rsp + 0x58]
xchg rbp, r9
xchg rsi, r15
mov r15, qword [rsp + 0x60]
xchg rsi, r15
mov dword [r15], eax
mov rdx, rdx
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
mov dword [rsp - 0x38], esp
ret