joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400709a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r9, r9
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg rsi, r13
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
mov dword [rsp - 0x40], edx
xchg rbp, rdx
mov rdx, rsp
xchg rdx, rbp
add rsp, 0xffffffffffffffb0
xchg r11, r11
movabs rbx, 0xf36add42965856
add rbx, 0x1aa790ab
add rbx, 0x6de09c2
sub rbx, 0x4490d787
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x20], rbx
xchg rbx, rbx
jne 0x140070bd2
mov r14d, 0xc05d1fd
add r14d, 0xe1683ee
add r14d, 0x5a5725c0
sub r14d, 0x74737ba0
mov dword [rbp - 0x30], 0x59e7cca6
sub dword [rbp - 0x30], 0x3d9cb0c0
add dword [rbp - 0x30], 0x5975eef3
sub dword [rbp - 0x30], 0x75710a41
xor esi, esi
mov r11, r11
mov dword [rbp - 0x2c], 0x4603b91f
xor dword [rbp - 0x2c], 0x451f040e
add dword [rbp - 0x2c], 0x216b6cf9
sub dword [rbp - 0x2c], 0x10a17b11
sub dword [rbp - 0x2c], 0x13a5ae88
mov dword [rbp - 0x28], 0x216d47e1
sub dword [rbp - 0x28], 0x154b32e5
add dword [rbp - 0x28], 0x578c263a
sub dword [rbp - 0x28], 0x63a33a8f
mov dword [rbp - 0x24], 0x23ea790f
xor dword [rbp - 0x24], 0x52029f91
sub dword [rbp - 0x24], 0x11e1c784
sub dword [rbp - 0x24], 0x60041ef4
lea eax, [r14 + 0x6d]
mov dword [rbp - 0x20], 0x4dae9412
sub dword [rbp - 0x20], 0x46b14693
xor dword [rbp - 0x20], 0x40cefc88
xor dword [rbp - 0x20], 0x4667b158
mov word [rbp - 0x1c], ax
mov rdi, rdi
lea r8d, [r14 - 8]
mov qword [rbp + 0x20], rsi
mov rax, qword [rbp + 0x20]
xchg r8, rcx
mov r8, qword [rbp + 0x20]
xchg r8, rcx
xchg r13, rax
mov r13, qword [rbp + 0x20]
xchg r13, rax
and cl, r8b
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x1130c41b
sub eax, 0x384f130
xor eax, 0x156241ad
add eax, 0x144aa585
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x18], 0x3cd4c335
xchg rdi, rax
mov rdi, qword [rbp + 0x20]
xchg rdi, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov rcx, rcx
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
inc rax
mov dword [rsp - 0x28], ebp
xchg rcx, rax
mov qword [rbp + 0x20], rcx
xchg rcx, rax
xchg r11, rax
mov r11, qword [rbp + 0x20]
xchg r11, rax
cmp rax, r14
jb 0x140070ae3
xchg rcx, rcx
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.140086500
mov dword [rsp - 0x24], 0x59ce636b
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r12, r8
mov r12, rax
xchg r8, r12
xor rdx, rbx
xor eax, eax
mov rsp, rsp
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
xchg rdx, r14
mov rcx, rdx
xchg rdx, r14
rep stosb byte [rdi], al
cmp rdx, rbx
xchg rcx, rcx
je 0x140070bdc
lea rdx, [0x1400ee298]
xchg r9, rcx
mov r9, r8
xchg rcx, r9
call fcn.1400799fc
xchg rbx, rbx
test al, al
setne al
jmp 0x140070bdc
mov al, 0x23
xor al, 0x76
add al, 0xd
sub al, 0x33
sub al, 0x2e
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov dword [rsp - 0x44], 0x3e355863
xchg rdi, r11
mov rsp, rdi
xchg r11, rdi
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14007c01c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x14000b9d8]
mov dword [rsp - 0x10], esi
sub r10, rcx
xchg rbp, r8
mov rbp, rcx
xchg rbp, r8
lea rax, [r9 + r8]
mov ecx, r9d
mov rbx, rbx
mov edx, 0x620bdd41
sub edx, 0x457d6989
add edx, 0x10d29e9f
xor edx, 0x5080688d
inc r9
mov dword [rsp - 0x20], 0x789a2dfe
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
mov dword [rsp - 0x20], 0xfa2afcd
cmp r9, 0x10
jb 0x14007c036
xchg r8, rax
mov r8, rax
xchg r8, rax
ret
Function at 0x14007ced4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov rdx, rdx
xchg r9, rcx
mov qword [rsp + 8], r9
xchg r9, rcx
push rbp
mov dword [rsp - 0x30], 0x2e8fa53e
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x3c], ecx
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
push r15
add rsp, 0xffffffffffffffe0
xchg r14, r14
xchg rcx, r11
mov rbx, r11
xchg r11, rcx
mov r13d, r8d
xchg rbp, rbp
mov r9d, 0x7949fee8
xor r9d, 0x106c9fa7
sub r9d, 0x2a759c21
xor r9d, 0x27473ac6
sub r9d, 0x19e4ffe8
mov r12, rdx
cmp r8d, r9d
xchg r9, r9
pushf
movabs rcx, 0xffffffff678afea8
sub rcx, 0xb1befd6
sub rcx, 0x54d316fc
xor rcx, 0x7a6a0ac5
add rcx, 0x7fffffff
add rcx, 0x20e02ed
popf
pushf
mov eax, 0x310dea0d
xor eax, 0x77058c3c
add eax, 0x35a93dd3
sub eax, 0x4eebe36c
sub eax, 0x2cc5c094
popf
cmovb r9d, r13d
mov rcx, rcx
mul r9
cmovo rax, rcx
xchg rcx, r12
mov r12, rax
xchg rcx, r12
call fcn.140092ac0
mov r12, r12
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0x11
shr r15d, 2
shr r15d, 1
xchg r14, rax
mov rbp, r14
xchg r14, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x4d882026
xor ebx, 0x4c1bb58e
xor ebx, 0x8d19d55
sub ebx, 0x94208fc
mov dword [rsp + 0x70], eax
mov rsp, rsp
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007d10f
mov dword [rsp - 0x14], ecx
mov eax, 0x483c14db
xor eax, 0x6b20efc5
xor eax, 0x61e2da37
add eax, 0x2a251e26
sub eax, 0x6d133f4f
xchg rdi, rcx
mov rdi, qword [rsp + 0x60]
xchg rcx, rdi
mov r14d, esi
mov r14, r14
shl r14d, 8
shl r14d, 5
shl r14d, 2
shl r14d, 4
shl r14d, 1
mov edi, r13d
sub edi, r14d
mov dword [rsp - 0x2c], 0x10393219
mov rdx, rbp
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov dword [rsp - 0x38], 0xb82e6a6
call fcn.14008bce0
test al, al
je 0x14007d10a
shr edi, 2
mov dword [rsp - 0x44], esi
xor r8d, r8d
shr r14d, 2
test edi, edi
mov dword [rsp - 0x44], esi
je 0x14007d0d6
mov r15d, dword [rsp + 0x70]
xchg rsp, rbp
mov r9, rsp
xchg rbp, rsp
lea eax, [r14 + r8]
mov edx, r15d
mov rdi, rdi
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x29f44e3a
mov dword [rsp - 0x40], esp
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg r11, r11
jb 0x14007d0a3
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov rcx, rcx
mov eax, 0x20cca9e5
add eax, 0x56d7abc5
sub eax, 0x3b4e6ede
sub eax, 0x3d503fd
sub eax, 0x3870e2cf
cmp esi, r15d
jb 0x14007d029
mov dword [rsp - 0x18], 0x1fdb163b
jmp 0x14007d10f
xor bl, bl
xchg rsi, rsi
xchg r13, rcx
mov r13, rbp
xchg r13, rcx
call fcn.140092ad0
mov al, bl
xchg rsp, rsp
xchg rbx, rsi
mov rsi, qword [rsp + 0x68]
xchg rbx, rsi
add rsp, 0x20
mov r9, r9
pop r15
pop r14
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
pop rdi
mov dword [rsp - 0x20], ebx
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14007dab4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rbp, r11
mov qword [rsp + 0x10], r11
xchg rbp, r11
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov dword [rsp - 0x44], 0x41b08b9d
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
xchg r15, rdx
mov rdx, rcx
xchg rdx, r15
mov r14d, r8d
mov dword [rsp - 0x2c], 0x2638a8bc
mov r9d, 0x5b4b6484
sub r9d, 0x4d0d79d8
sub r9d, 0x201508d
sub r9d, 0xc389a1f
xchg r12, rdx
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
mov r15, r15
pushf
movabs rcx, 0xffffffff5a0144af
sub rcx, 0x42df38c6
add rcx, 0x2e635aa2
sub rcx, 0x3547d934
add rcx, 0x7fffffff
add rcx, 0x6fc272a9
popf
pushf
mov eax, 0x403eb95
sub eax, 0x760f1f
xor eax, 0x10b20815
add eax, 0x18e22c23
sub eax, 0x2c220082
popf
cmovb r9d, r14d
mov dword [rsp - 0x1c], 0x3bba8204
mul r9
cmovo rax, rcx
xchg rcx, r12
mov r12, rax
xchg r12, rcx
call fcn.140092ac0
mov r13d, dword [r15 + 0x18]
mov dword [rsp - 0x10], 0x26b896d
lea ebp, [r14 + 0xfffff]
shr ebp, 0xf
shr ebp, 4
shr ebp, 1
xor edi, edi
mov rsi, rax
mov dword [rsp - 0x2c], 0x3270619c
mov ebx, 0x16331e47
add ebx, 0x1ff093af
xor ebx, 0x2a0d8a01
add ebx, 0x3e9ae6d9
sub ebx, 0x5ac922cf
test ebp, ebp
mov dword [rsp - 0x44], 0x55315693
je 0x14007dcf3
mov eax, 0x75ec01b1
sub eax, 0x10a31f3a
sub eax, 0xe016988
xor eax, 0x2fdb4dce
xor eax, 0x788c3521
mov r9d, edi
xchg rbp, rbp
mov r8d, r14d
shl r9d, 0xa
shl r9d, 1
shl r9d, 3
shl r9d, 3
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
cmova r8d, eax
mov dword [rsp - 0xc], 0x6345b58f
shr r9d, 2
mov r11d, r8d
xor r10d, r10d
mov dword [rsp - 0x3c], 0x4551eeb3
shr r11d, 2
test r11d, r11d
je 0x14007dca3
xchg r9, r9
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
mov rbp, rbp
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x29f44e3a
mov dword [rsp - 0x2c], esp
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14007dc76
mov dword [rsp - 0x40], edx
xchg r8, rdx
mov r8, rsi
xchg r8, rdx
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call fcn.14008c120
test al, al
mov dword [rsp - 0x40], edi
je 0x14007dcf1
add edi, ebx
mov eax, 0x14624dc8
add eax, 0x492ab958
sub eax, 0x185de700
add eax, 0x108a4d1c
sub eax, 0x55a96d3c
cmp edi, ebp
xchg rdi, rdi
jb 0x14007dc1e
jmp 0x14007dcf3
xor bl, bl
xchg rbp, rcx
mov rbp, rsi
xchg rbp, rcx
call fcn.140092ad0
xchg rsi, rbp
mov rsi, qword [rsp + 0x58]
xchg rbp, rsi
mov al, bl
xchg rbx, rdx
mov rdx, qword [rsp + 0x50]
xchg rbx, rdx
xchg r9, rsi
mov r9, qword [rsp + 0x60]
xchg r9, rsi
add rsp, 0x20
mov dword [rsp - 0x30], 0x7307e83b
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov r14, r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007ebe0
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x7ed57bda
add rsp, 0x7ed57bca
mov dword [rsp + 0x20], 0x28302bb9
xor dword [rsp + 0x20], 0x3eae9a87
xor dword [rsp + 0x20], 0x328783d5
mov r8, rcx
mov byte [rsp + 0x24], 0x63
xor byte [rsp + 0x24], 0x4c
add byte [rsp + 0x24], 0x98
mov qword [rsp + 0x28], 0x35ba5927
add qword [rsp + 0x28], 0x15d504f4
sub qword [rsp + 0x28], 0x4b8f5e1b
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x8c4724b
sub edx, 0x53d1ee1
xor edx, 0x28c133ad
add edx, 0x1cdd804
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x14007ec47
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x22
xor byte [rsp + 7], 0x44
sub byte [rsp + 7], 0x66
popf
je 0x14007ecfd
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x14007ed00
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007ecf0
movzx eax, byte [rcx]
test al, al
jne 0x14007ecd4
jmp 0x14007ed00
inc r8
cmp byte [r8], 0
jne 0x14007ecbf
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0xc89f09
add ecx, 0x6976c99d
sub ecx, 0x6a3f68a1
rep stosb byte [rdi], al
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x14007ed30
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x53ede356
add rsp, 0x53ede346
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x14007eeee
mov dword [rsp + 0x28], 0x3969221a
xor dword [rsp + 0x28], 0x5b684fcd
xor dword [rsp + 0x28], 0x46185f3c
mov byte [rsp + 0x2c], 0x68
sub byte [rsp + 0x2c], 0x16
xor byte [rsp + 0x2c], 0x7b
add byte [rsp + 0x2c], 0x9e
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x105008dc
add edx, 0x367d48ab
xor edx, 0x7e0587f7
sub edx, 0xbb49da5
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x14007ed8b
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x14007ee0c
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007eeda
movzx eax, byte [rcx]
test al, al
jne 0x14007edf4
mov word [rsp + 0x20], 0x7124
sub word [rsp + 0x20], 0xce9
sub word [rsp + 0x20], 0x5b1f
add word [rsp + 0x20], 0x5c9a
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x17ab094d
xor edx, 0x4d36e1c4
xor edx, 0x541261e
sub edx, 0x32c895cc
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x14007ee3d
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x14007eebf
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007ef58
movzx eax, byte [rcx]
test al, al
jne 0x14007eea7
xor dl, dl
mov r8d, 0x62e86860
sub r8d, 0x58f82928
sub r8d, 0x9f03f35
jmp 0x14007eef9
mov r8d, 0x52e278b6
xor r8d, 0x71ae65db
sub r8d, 0x234c1d6c
mov dl, 0x1d
add dl, 0
add dl, 0x2d
sub dl, 0x49
test r8b, 2
je 0x14007ef20
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x2241c994
sub ecx, 0x159d9d8c
sub ecx, 0xca42c06
rep stosb byte [rdi], al
test r8b, 1
je 0x14007ef44
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x12a40c13
add ecx, 0x1ec8cb8a
xor ecx, 0x316cd798
rep stosb byte [rdi], al
movzx eax, dl
nop
add rsp, 0x6ce17db4
sub rsp, 0x6ce17da4
pop rdi
ret
mov r8d, 0x32500f22
add r8d, 0x2a785bb8
add r8d, 0x5ca4eac
sub r8d, 0x6292b983
jmp 0x14007eeee
Function at 0x14007fba0
Capabilities:
Encode data using xor

Disassembly:
push rdi
add rsp, 0xfffffffffffffff0
mov word [rsp + 0x20], 0x9ad
add word [rsp + 0x20], 0x6609
sub word [rsp + 0x20], 0xd9f
add word [rsp + 0x20], 0x39f
mov r8, rcx
mov qword [rsp + 0x28], 0x4912fedd
add qword [rsp + 0x28], 0xe9090c3
xor qword [rsp + 0x28], 0x47b5989d
sub qword [rsp + 0x28], 0x1016173d
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x60dc034d
sub edx, 0x2ac9aca2
xor edx, 0x1b066e60
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007fbf0
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x77
sub byte [rsp + 2], 0x51
xor byte [rsp + 2], 0x54
sub byte [rsp + 2], 0x72
test al, al
je 0x14007fc7a
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007fcb0
movzx eax, byte [rcx]
test al, al
jne 0x14007fc63
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x41510d13
xor ecx, 0x442a446
xor ecx, 0x4513a957
rep stosb byte [rdi], al
test dl, dl
jne 0x14007fcc0
mov byte [r8], al
lea rax, [r8 + 1]
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov dl, 0x21
add dl, 7
sub dl, 0x24
xor dl, 5
jmp 0x14007fc7c
mov rax, r8
sub rsp, 0xfffffffffffffff0
pop rdi
ret
Function at 0x14007fdc0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg r8, rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r13, r13
push r14
add rsp, 0xffffffffffffffe0
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x28], 0x770c28ca
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov r9, r9
call fcn.140081800
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov dword [rsp - 0x10], 0x38177217
xchg r10, rbx
mov rbx, rax
xchg rbx, r10
mov ebx, r14d
xchg r15, r15
test ebp, ebp
je 0x14007ff95
nop dword [rax]
xchg r9, r9
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov r9, r9
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
xchg rbx, rbx
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x20], 0x451940a8
jae 0x14007fec7
mov eax, dword [rdx + 8]
test eax, eax
mov dword [rsp - 0x2c], edi
jne 0x14007fe8d
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x40], 0x4cc6716d
cmp r11d, r9d
jb 0x14007feb1
add eax, r9d
xchg r12, r12
cmp r11d, eax
jb 0x14007ff4b
inc r8w
add rdx, 0x28
mov dword [rsp - 0x30], esp
cmp r8w, cx
jb 0x14007fe7b
mov r8, r14
mov eax, dword [r10 + 4]
mov dword [rsp - 0x3c], 0x7c4c1997
lea r9, [r10 + 4]
nop
add rax, 0x2f232350
sub rax, 0x2f232358
nop
add r10, 0xc89137e
sub r10, 0xc891376
shr rax, 1
test eax, eax
mov dword [rsp - 0x2c], 0x7a362d6e
je 0x14007ff87
mov edx, eax
nop word [rax + rax]
xchg r8, r8
movzx eax, word [r10]
mov ecx, eax
shr ecx, 8
shr ecx, 1
shr ecx, 2
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x3c], ecx
je 0x14007ff65
cmp ecx, 0xa
jne 0x14007ff6e
and eax, 0xfff
mov r10, r10
add qword [rax + r8], rdi
jmp 0x14007ff6e
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x28], 0x472c896f
add r8, r11
jmp 0x14007feca
and eax, 0xfff
add dword [rax + r8], edi
nop
sub r10, 0x5a579657
add r10, 0x5a579659
sub rdx, 1
jne 0x14007ff14
add ebx, dword [r9]
mov r15, r15
cmp ebx, ebp
jb 0x14007fe44
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rdi, rdi
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
nop
add rsp, 0x744f8879
sub rsp, 0x744f8859
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400818d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
mov dword [rsp - 0x1c], edi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
mov dword [rsp - 0x38], 0x53d31dfb
nop
push 0x364ee4e2
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov r15d, edx
xchg rsi, rsi
xor eax, 0x29f44e3a
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x29f41477
jne 0x140081a7f
mov dword [rsp - 0x38], esp
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x29f44e3a
cmp eax, 0x29f40b6a
xchg r13, r13
jne 0x140081a7f
mov edx, dword [rdx + rcx + 0x88]
call fcn.140081800
xchg rbp, rbp
xchg rdx, rcx
mov rdx, rsi
xchg rcx, rdx
xchg rdx, rax
mov r14, rdx
xchg rdx, rax
mov edx, dword [rax + 0x20]
call fcn.140081800
xchg rsi, rsi
mov edx, dword [r14 + 0x24]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.140081800
mov dword [rsp - 0x30], ebp
mov edx, dword [r14 + 0x1c]
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
xchg rsi, rax
mov r13, rsi
xchg rsi, rax
call fcn.140081800
xor edi, edi
mov dword [rsp - 0x14], 0x1a9915f
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140081a7f
nop dword [rax]
mov dword [rsp - 0x2c], edi
mov edx, dword [r12 + rdi*4]
xchg rsi, rbp
mov rcx, rbp
xchg rbp, rsi
call fcn.140081800
mov ecx, 0x2c20c7c1
sub ecx, 0x12fa493d
sub ecx, 0x9d1e5a9
xor ecx, 0x32010852
add ecx, 0xc2aa6f76
xchg r13, rax
mov rbx, r13
xchg r13, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov r8, r8
je 0x140081a60
nop dword [rax]
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
lea rcx, [rsp + 0x60]
xchg r15, r15
mov r8d, 0x114e250a
xor r8d, 0x60e6a14f
add r8d, 0x4782506
xor r8d, 0x7620a94a
inc rbx
call fcn.14008a100
mov rbp, rbp
cmp byte [rbx], 0
jne 0x140081a19
mov ecx, dword [rsp + 0x60]
mov r13, r13
not ecx
cmp ecx, r15d
je 0x140081ad2
mov dword [rsp - 0x10], 0x59ee5e6a
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400819d0
xor eax, eax
xchg r11, r11
xchg rbx, rdi
mov rdi, qword [rsp + 0x68]
xchg rdi, rbx
nop
add rsp, 0x34369dbd
sub rsp, 0x34369d9d
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
mov dword [rsp - 0x44], 0x76e19c89
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x10], esp
xchg rsi, r12
mov rcx, r12
xchg rsi, r12
xchg rdx, rax
mov rdx, qword [rsp + 0x70]
xchg rdx, rax
mov edx, dword [rax + rdx*4]
xchg rbp, rbp
call fcn.140081800
jmp 0x140081a84
Function at 0x140086280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov dword [rsp + 0x18], r8d
push rdi
xchg rbp, rbp
sub rsp, 0x240
mov rbx, rdx
xchg rdi, rbx
mov rbx, rcx
xchg rdi, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x38], ebx
mov r8d, 0x46d6d2a9
add r8d, 0x1c8aa6dc
sub r8d, 0x3b4d735a
sub r8d, 0x28140423
call fcn.1400931c0
mov rax, qword gs:[0x60]
xchg r8, r8
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov r8, qword [rax]
test r8, r8
xchg rcx, rcx
je 0x1400864bf
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x1400864bf
xchg rsi, rsi
mov edx, 0x14947c7
add edx, 0x40aaeb3b
add edx, 0xc11ac6a
sub edx, 0x4e05de68
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov r11, r11
call fcn.140093b90
mov edx, 0x40061bda
sub edx, 0x2c6de6ca
xor edx, 0x36743e0c
xor edx, 0x25ec0b40
lea rcx, [rsp + 0x30]
call fcn.140093c50
test rax, rax
xchg rdx, rdx
je 0x140086493
xor ecx, ecx
xchg rdx, r15
mov r15, rdi
xchg r15, rdx
mov word [rax], cx
mov dword [rsp - 0x18], 0x6870f3e5
movabs rcx, 0x6eebc25804dc562e
add rcx, 0x257d9a85
add rcx, 0x2229756f
add rcx, 0x359f8c2
add rcx, 0x417ea107
mov rax, qword [0x1400ee690]
mov dword [rsp - 0x44], 0x73a1f719
ror rax, 0x1b
ror rax, 2
ror rax, 7
ror rax, 4
ror rax, 1
ror rax, 1
not rax
mov rsp, rsp
rol rax, 1
rol rax, 2
rol rax, 2
not rax
xchg r9, r9
rol rax, 9
rol rax, 2
rol rax, 2
rol rax, 3
rol rax, 1
rol rax, 4
rol rax, 1
xor rax, rcx
lea rcx, [rsp + 0x20]
xchg r8, r8
call rax
movabs rcx, 0xe20b0cc64095da13
xor rcx, 0x5779b0c3
add rcx, 0x49f27782
add rcx, 0x5a05fca8
lea r8, [rsp + 0x20]
xchg rbp, rbp
add rcx, qword [0x1400ee680]
lea rdx, [rsp + 0x260]
ror rcx, 0x1e
ror rcx, 1
ror rcx, 1
ror rcx, 1
movabs rax, 0xfc2334a37586ffc2
sub rax, 0x8d7e1e4
sub rax, 0x58f308be
sub rax, 0x10deaa74
sub rax, 0x4a5fbe
add rax, rcx
mov r9, rbx
not rax
xchg rsi, rsi
lea rcx, [rsp + 0x30]
call rax
xchg r12, rbx
mov r12, qword [rsp + 0x250]
xchg rbx, r12
add rsp, 0x240
xchg r15, r15
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x6ea25c7e
xor eax, 0x1550b5e3
xor eax, 0x3eaf6598
add eax, 0x7aa273fc
mov rbx, qword [rsp + 0x250]
sub rsp, 0x29af466d
add rsp, 0x29af48ad
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x40847137
sub eax, 0x1d949344
xor eax, 0x6760b6cb
xor eax, 0x87dea0
add eax, 0x7af74b9d
sub rsp, 0xfffffffffffffdc0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140089460
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0x7a90c1f7
sub rsp, 0x7a90c427
mov rax, qword [0x1400ee450]
xchg r15, rbx
mov r15, rcx
xchg rbx, r15
movabs rcx, 0x49350d271c63e337
add rcx, 0x33fe56cf
sub rcx, 0x37fac33
add rcx, 0x7bf7591b
mov edx, 0x5e89cbe9
add edx, 0x13f30e79
sub edx, 0x11beb60
sub edx, 0x7160edfe
xor rax, rcx
xchg r9, r9
movabs rcx, 0x398d52ca4339eca6
sub rcx, 0xe50ef9e
sub rcx, 0x2e563cc3
add rcx, 0x4175835e
add rcx, 0x7fffffff
add rcx, 0x197b6616
add rax, rcx
movabs rcx, 0xde890dc3df81f0f
add rcx, 0x16777c41
xor rcx, 0x5e80057b
xor rcx, 0x22109e08
add rcx, 0x7fffffff
xor rcx, 0x5ec24e37
not rax
mov dword [rsp - 0xc], ebx
ror rax, 0x14
ror rax, 1
ror rax, 6
ror rax, 1
not rax
sub rax, rcx
mov dword [rsp - 0x34], esp
lea rcx, [rsp + 0x20]
rol rax, 9
rol rax, 0x17
rol rax, 1
call rax
lea rax, [rbx + 8]
mov dword [rsp - 0x20], 0x480fd47
xorps xmm0, xmm0
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff55b410b6
xor rdx, 0x5cd0f702
xor rdx, 0x3d05d240
add rdx, 0x7fffffff
xor rdx, 0x4b9eca0c
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rax
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
lea rax, [rsp + 0x20]
inc rdx
cmp word [rax + rdx*2], 0
mov r10, r10
jne 0x1400895a0
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
xchg rdx, r13
mov qword [rbx + 0x38], r13
xchg r13, rdx
call fcn.140016760
xchg rbx, rbx
xor r8d, r8d
mov ecx, 0x5973cbbf
add ecx, 0xedc4ba9
sub ecx, 0x169098e3
sub ecx, 0x24ab45ba
cmp qword [rbx + 0x38], r8
xchg rbp, rbp
jbe 0x140089661
lea r9, [rsp + 0x20]
mov r10d, 0x122b63cc
xor r10d, 0x5e16a515
add r10d, 0x2c396187
sub r10d, 0x78772761
sub r9, rax
mov dword [rsp - 0x38], 0x3803ee05
nop word [rax + rax]
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
mov r13, r13
ror ecx, 1
ror ecx, 7
xor dx, word [r9 + rax - 2]
mov dword [rsp - 0x18], 0x3bff59b2
inc r8
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x28], 0x1b3a5e7e
jb 0x140089627
xchg r8, rax
mov r8, rbx
xchg r8, rax
add rsp, 0x6d2ff6ce
sub rsp, 0x6d2ff49e
nop
mov rbx, qword [rsp]
add rsp, 8
ret