joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067a5c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r15, r15
mov qword [rsp + 0x18], rsi
xchg r9, rdi
mov qword [rsp + 0x20], r9
xchg r9, rdi
nop
push 0x2db9636
mov qword [rsp], rbp
mov rbp, rsp
mov dword [rsp - 0x1c], 0x3de9ad50
sub rsp, 0x60
movabs rbx, 0x407043dc4ce685e7
add rbx, 0xc033a21
add rbx, 0x14639eda
xor rbx, 0x3628285f
xor rbx, 0x4af40dd7
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x30], rbx
jne 0x140067c79
xor esi, esi
mov dword [rsp - 0x34], 0x7280023d
mov dword [rbp - 0x40], 0x572b5cfc
add dword [rbp - 0x40], 0x89bd926
xor dword [rbp - 0x40], 0x60da3075
sub dword [rbp - 0x40], 0x3ea10628
mov dword [rbp - 0x3c], 0xb0fe2b8
xor dword [rbp - 0x3c], 0x76064572
xor dword [rbp - 0x3c], 0x71b8d8c1
add dword [rbp - 0x3c], 0x1e809155
sub dword [rbp - 0x3c], 0x2ab9103d
mov dword [rbp - 0x38], 0x40f18ddf
add dword [rbp - 0x38], 0x1f32cf55
sub dword [rbp - 0x38], 0x528587df
sub dword [rbp - 0x38], 0xd2dd537
mov dword [rbp - 0x34], 0x4035f275
add dword [rbp - 0x34], 0x356f4ee0
xor dword [rbp - 0x34], 0x69e3d4f8
sub dword [rbp - 0x34], 0x1c1c9547
mov dword [rbp - 0x30], 0x65f2f13e
add dword [rbp - 0x30], 0x10ea9a00
sub dword [rbp - 0x30], 0x6ff9647a
sub dword [rbp - 0x30], 0x6682684
mov dword [rbp - 0x2c], 0x5351b221
xor dword [rbp - 0x2c], 0x482738ca
add dword [rbp - 0x2c], 0x4c5c9b58
xor dword [rbp - 0x2c], 0x280ff85f
sub dword [rbp - 0x2c], 0x4f68dde3
xchg r9, rsi
mov qword [rbp + 0x10], r9
xchg r9, rsi
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
mov dword [rsp - 0x3c], 0x2e45096e
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x5f6f6710
sub eax, 0x599ce606
add eax, 0x5806785
xor eax, 0x55ff3870
sub eax, 0x4658b891
shr eax, cl
mov dword [rsp - 0x28], edi
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov dword [rsp - 0x18], ebx
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
mov rsi, rsi
xchg r12, rax
mov qword [rbp + 0x10], r12
xchg r12, rax
mov rax, qword [rbp + 0x10]
xchg rbp, rbp
cmp rax, 0xc
jb 0x140067b98
xor edx, edx
mov dword [rsp - 0x18], esp
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
call fcn.140089b70
mov dword [rsp - 0x10], 0x4f9c4890
xchg rbx, rdx
mov rbx, rax
xchg rdx, rbx
mov r8, rax
xor eax, eax
xor rdx, rbx
mov dword [rsp - 0xc], 0x499d2044
xchg rsp, rdx
mov qword [rdi + 0x30], rsp
xchg rdx, rsp
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
xchg r9, r9
cmp rdx, rbx
je 0x140067c81
lea rdx, [0x1401402c0]
mov rcx, r8
mov r11, r11
call fcn.14006c074
test al, al
setne al
jmp 0x140067c81
mov al, 0x5b
sub al, 0x21
add al, 0x19
sub al, 0x52
lea r11, [rsp + 0x60]
mov r13, r13
xchg rbx, r9
mov r9, qword [r11 + 0x18]
xchg rbx, r9
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x14], 0x3d786a89
mov rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140067cb4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
xchg rsi, r11
mov qword [rsp + 0x18], r11
xchg r11, rsi
xchg rdi, r10
mov qword [rsp + 0x20], r10
xchg r10, rdi
push rbp
xchg rsp, rbp
mov rsp, rbp
xchg rbp, rsp
sub rsp, 0x50
xchg r10, r10
movabs rbx, 0x407043dc37782337
xor rbx, 0x6603588f
xor rbx, 0x1328bdfb
sub rbx, 0x30c24ad9
mov rdi, rcx
cmp qword [rcx + 0x28], rbx
mov rdx, rdx
jne 0x140067eb6
mov eax, 0x1c8af35d
xor eax, 0x344582ee
add eax, 0x4a860749
sub eax, 0x735578fa
mov dword [rbp - 0x30], 0x1182cf15
add dword [rbp - 0x30], 0x68c2c3ed
sub dword [rbp - 0x30], 0x1a3b966e
sub dword [rbp - 0x30], 0x553e1242
sub dword [rbp - 0x30], 0xa57ea31
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rsp - 0x44], 0x3eb7bc46
mov dword [rbp - 0x2c], 0x3121ce9b
add dword [rbp - 0x2c], 0x36818eb4
xor dword [rbp - 0x2c], 0x36ad1d30
xor dword [rbp - 0x2c], 0x5125404f
mov dword [rbp - 0x28], 0x77f9a55c
sub dword [rbp - 0x28], 0x176bec32
sub dword [rbp - 0x28], 0x4d668125
xor dword [rbp - 0x28], 0x13113859
mov dword [rbp - 0x24], 0x3c2ec942
add dword [rbp - 0x24], 0x371ccd6c
xor dword [rbp - 0x24], 0x5a4c2075
add dword [rbp - 0x24], 0x54652884
sub dword [rbp - 0x24], 0x7cf8df2e
xchg rsi, r11
mov qword [rbp + 0x10], r11
xchg r11, rsi
mov rax, qword [rbp + 0x10]
xchg rsp, rsp
xchg r10, rcx
mov r10, qword [rbp + 0x10]
xchg rcx, r10
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x7d777941
sub eax, 0x1ed6a821
sub eax, 0x49f49f0d
xor eax, 0x37770141
xor eax, 0x3b8e2b3c
shr eax, cl
movzx ecx, al
mov r9, r9
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x14], 0x538ca9fe
inc rax
mov qword [rbp + 0x10], rax
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 9
jb 0x140067dc6
mov dword [rsp - 0x28], ebx
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
call fcn.140089b70
xchg r8, r8
xchg rdx, rsp
mov rsp, rax
xchg rdx, rsp
xchg r15, r8
mov r15, rax
xchg r15, r8
xor eax, eax
xor rdx, rbx
xchg r15, r15
xchg rdx, r13
mov qword [rdi + 0x28], r13
xchg rdx, r13
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
mov dword [rsp - 0x44], 0xc7fefa7
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140067ec0
lea rdx, [0x140140810]
mov dword [rsp - 0x24], edi
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.140070764
test al, al
setne al
mov dword [rsp - 0x14], 0x484f885e
jmp 0x140067ec0
mov al, 0x4b
add al, 0x28
xor al, 0x74
xor al, 0x74
xor al, 0x72
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0xc], esi
mov rsi, qword [rsp + 0x70]
xchg rsi, rdi
mov rsi, qword [rsp + 0x78]
xchg rsi, rdi
nop
add rsp, 0x3d12218f
sub rsp, 0x3d12213f
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140067ef4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], esp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
push 0x7e6dda22
mov qword [rsp], rbp
mov rbp, rsp
mov dword [rsp - 0x24], 0x4fa2c601
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x407043dc71e394a3
sub rbx, 0x674e547b
add rbx, 0x1851e4ed
add rbx, 0x185283dc
sub rbx, 0x29a82d87
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
cmp qword [rcx + 0x38], rbx
mov dword [rsp - 0x40], 0x410cf5ba
jne 0x1400680f2
xor esi, esi
mov dword [rbp - 0x30], 0xa5cdd5
add dword [rbp - 0x30], 0x386e317b
sub dword [rbp - 0x30], 0x132ddfa8
sub dword [rbp - 0x30], 0x257e1f6c
mov dword [rbp - 0x2c], 0x211ce500
xor dword [rbp - 0x2c], 0x4a1a3bde
sub dword [rbp - 0x2c], 0x41f4756
sub dword [rbp - 0x2c], 0x58509530
sub dword [rbp - 0x2c], 0xe2d0222
mov dword [rbp - 0x28], 0x6c342cb2
xor dword [rbp - 0x28], 0x54cfb0a8
sub dword [rbp - 0x28], 0x37aa923e
sub dword [rbp - 0x28], 0x12509c2
mov dword [rbp - 0x24], 0x4f2375ba
add dword [rbp - 0x24], 0x19eff5fb
sub dword [rbp - 0x24], 0x48d39a78
add dword [rbp - 0x24], 0xc80055e
sub dword [rbp - 0x24], 0x2c43d620
mov dword [rbp - 0x20], 0x1fb02cea
sub dword [rbp - 0x20], 0x1f0d8902
add dword [rbp - 0x20], 0x44b736ea
xor dword [rbp - 0x20], 0x452ddad0
xchg r15, rsi
mov qword [rbp + 0x10], r15
xchg rsi, r15
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg rcx, rax
mov rcx, qword [rbp + 0x10]
xchg r15, r15
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
mov rbp, rbp
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x5be7fca2
add eax, 0xfbb05b7
add eax, 0x8ba0c0b
sub eax, 0x5c07f5f6
shr eax, cl
movzx ecx, al
mov r14, r14
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
xor cx, dx
mov dword [rsp - 0x18], 0x71be1671
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
cmp rax, 0xa
jb 0x140068015
xor edx, edx
xchg r15, r15
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.140089b70
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov r8, rax
xor eax, eax
xchg r8, r8
xor rdx, rbx
xchg rdx, r11
mov qword [rdi + 0x38], r11
xchg r11, rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
xchg rsi, rsi
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400680fa
mov rbp, rbp
lea rdx, [0x140140830]
xchg rcx, r13
mov r13, r8
xchg rcx, r13
call fcn.140070b1c
test al, al
mov dword [rsp - 0x1c], ebp
setne al
jmp 0x1400680fa
mov al, 0x41
sub al, 0x22
add al, 0x15
xor al, 0x35
xchg r9, rbx
mov r9, qword [rsp + 0x68]
xchg r9, rbx
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x28], 0x254d574d
mov rdi, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14006812c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg rbx, r12
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x44], ebp
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg rdi, r8
push rbp
xchg r15, r15
xchg rbp, r12
mov r12, rsp
xchg rbp, r12
sub rsp, 0x50
mov rcx, rcx
movabs rbx, 0x407043dc5b94eac9
sub rbx, 0x183d00e5
xor rbx, 0x73ff0095
add rbx, 0x1a0c566a
sub rbx, 0x3923c471
xchg rsi, rdi
mov rsi, rcx
xchg rdi, rsi
cmp qword [rcx + 0x20], rbx
xchg rbp, rbp
jne 0x140068340
mov eax, 0x3e0e5145
add eax, 0x566a430
add eax, 0x30dfd99f
sub eax, 0x7454cedb
mov dword [rbp - 0x30], 0x1f38f61a
add dword [rbp - 0x30], 0x3833672d
sub dword [rbp - 0x30], 0x54fe51d5
add dword [rbp - 0x30], 0x71bf1736
xor dword [rbp - 0x30], 0x745d2295
mov word [rbp - 0x1c], ax
xor esi, esi
mov dword [rsp - 0x3c], edx
mov dword [rbp - 0x2c], 0x730c2bbf
xor dword [rbp - 0x2c], 0x637e298c
add dword [rbp - 0x2c], 0x3a78c590
sub dword [rbp - 0x2c], 0x4a76c793
mov dword [rbp - 0x28], 0x547195d2
add dword [rbp - 0x28], 0x235b7c9c
sub dword [rbp - 0x28], 0x3b6f8f2f
sub dword [rbp - 0x28], 0x124c6484
sub dword [rbp - 0x28], 0x29e61eb9
mov dword [rbp - 0x24], 0x2fb8a4ce
sub dword [rbp - 0x24], 0x2cb5d753
add dword [rbp - 0x24], 0xeee984a
sub dword [rbp - 0x24], 0x11bb655e
mov dword [rbp - 0x20], 0x16fc264f
xor dword [rbp - 0x20], 0x2aa7d2e0
add dword [rbp - 0x20], 0x21aecf72
sub dword [rbp - 0x20], 0x5d96c417
mov qword [rbp + 0x10], rsi
xchg rsi, rsi
mov rax, qword [rbp + 0x10]
xchg r13, rcx
mov r13, qword [rbp + 0x10]
xchg r13, rcx
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov r12, r12
mov eax, 0x1d0809c6
xor eax, 0x78d41729
sub eax, 0x2167a115
sub eax, 0x2c1f656c
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
xchg r15, r15
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
inc rax
xchg r10, r10
xchg r12, rax
mov qword [rbp + 0x10], r12
xchg r12, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x3c], esi
cmp rax, 0xb
jb 0x14006825e
xor edx, edx
mov dword [rsp - 0x38], 0x3ca75a6a
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.140089b70
xchg r14, r14
mov rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
xchg rdi, rdi
xchg r13, rdx
mov qword [rdi + 0x20], r13
xchg rdx, r13
lea rdi, [rbp - 0x1a]
xchg r12, r12
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006834a
mov r13, r13
lea rdx, [0x140140298]
xchg rcx, r13
mov r13, r8
xchg r13, rcx
call fcn.140070de0
xchg r15, r15
test al, al
setne al
jmp 0x14006834a
mov al, 5
add al, 0x1a
add al, 0x53
xor al, 0x7e
sub al, 0xb
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
xchg rsi, rsi
xchg rdi, r15
mov r15, qword [rsp + 0x78]
xchg r15, rdi
nop
sub rsp, 0x1996315b
add rsp, 0x199631ab
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140072a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov r9, r9
nop
add rsp, 0x5d7e1778
sub rsp, 0x5d7e17d8
lea rax, [rcx + 8]
mov dword [rsp - 0x30], 0x17e0d0eb
xchg rdx, rbx
mov qword [rsp + 0x70], rdx
xchg rdx, rbx
mov qword [rcx], rax
mov r12, r12
xorps xmm0, xmm0
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
xchg r10, rbp
mov qword [rsp + 0x78], r10
xchg r10, rbp
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
xchg rcx, rax
movups xmmword [rcx + 0x20], xmm0
xchg rcx, rax
xchg r12, rax
movups xmmword [r12 + 0x30], xmm0
xchg r12, rax
xchg rbx, rax
movups xmmword [rbx + 0x40], xmm0
xchg rbx, rax
xchg r8, rax
movups xmmword [r8 + 0x50], xmm0
xchg r8, rax
xchg rdi, rax
movups xmmword [rdi + 0x60], xmm0
xchg rdi, rax
xchg r9, rax
movups xmmword [r9 + 0x70], xmm0
xchg r9, rax
xchg rbp, r13
mov r13, qword [rdx + 0x38]
xchg rbp, r13
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
xchg rcx, rax
mov qword [rsp + 0x20], rcx
xchg rcx, rax
xchg rsp, r9
movups xmmword [r9 + 0x28], xmm0
xchg rsp, r9
lea rdx, [rbp + 1]
mov r14, r14
xchg r9, rsp
movups xmmword [r9 + 0x38], xmm0
xchg rsp, r9
xchg r15, rsp
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.140017c38
mov edx, 0x10431fbb
xor edx, 0x5536baf9
add edx, 0x1982d240
sub edx, 0x46a35f14
test rbp, rbp
xchg rsp, rsp
je 0x140072bcc
xchg r14, rdi
mov r14, rax
xchg r14, rdi
sub rbx, rax
xchg r9, rdi
mov rdi, rbp
xchg rdi, r9
mov r8d, 0x67419a75
sub r8d, 0x2b659140
xor r8d, 0x2823b4dd
xor r8d, 0x60f26965
xor r8d, 0x730dd472
nop word [rax + rax]
xchg r11, r11
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 1
ror edx, 3
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r12, r12
mov word [rdi - 2], cx
sub r9, 1
jne 0x140072b9e
xor ecx, ecx
xchg rsp, rsp
xchg rbp, r8
mov rbp, r8
xchg r8, rbp
mov word [rax + rbp*2], cx
mov rbp, rbp
mov rcx, rsi
xchg rdx, r11
mov r11, qword [rsp + 0x20]
xchg r11, rdx
call fcn.14008f9a0
mov rcx, qword [rsp + 0x20]
xchg rdi, rdi
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
xchg rbx, r11
mov r11, qword [rsp + 0x70]
xchg r11, rbx
cmp rcx, rax
jne 0x140072c62
mov rbp, rbp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x3287dfa
add ecx, 0x5113a6c
xor ecx, 0x4afe24c4
add ecx, 0xad0c695
xor ecx, 0x4d986307
rep stosb byte [rdi], al
xchg rsi, r8
mov rax, r8
xchg r8, rsi
mov rsi, qword [rsp + 0x80]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140097490
xchg r15, rax
mov r15, rsi
xchg r15, rax
mov rsi, qword [rsp + 0x80]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x14007d4c0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
mov dword [rsp - 0x14], 0x67d9fb57
sub r10, rcx
mov r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
xchg rsp, rsp
mov edx, 0x2a882b51
xor edx, 0x34c7d66e
xor edx, 0x3571277d
add edx, 0x2fd2af3b
xor edx, 0x4b0bb9a3
inc r9
rol edx, cl
xor dl, byte [r10 + rax]
xchg rsp, rsp
mov byte [rax], dl
cmp r9, 0x10
jb 0x14007d4d8
mov rax, r8
mov dword [rsp - 0x20], esi
ret
Function at 0x14007e3d0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg r10, rbx
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
push rdi
mov dword [rsp - 0x44], 0x7de8e97d
push r12
push r15
mov qword [rsp], r13
push r14
mov r9, r9
push r15
sub rsp, 0x20
mov rbx, rcx
mov r13d, r8d
xchg r11, r11
mov r9d, 0x300adcc2
sub r9d, 0xb26ea4e
add r9d, 0x2bd28994
add r9d, 0x4d1e88c
sub r9d, 0x55846494
xchg rdx, r12
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff66728df8
sub rcx, 0x4547d3a5
xor rcx, 0x3a69a206
add rcx, 0x7fffffff
add rcx, 0x64bce7ab
popf
pushf
mov eax, 0x505c425f
sub eax, 0x3ea6cce4
xor eax, 0x45b49108
xor eax, 0x2564a583
sub eax, 0x716541ec
popf
cmovb r9d, r13d
mul r9
xchg rcx, rcx
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400972b0
mov dword [rsp - 0x44], 0x15a1497c
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0xe
shr r15d, 3
shr r15d, 1
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
xchg r14, r14
mov ebx, 0x33c63459
xor ebx, 0x598e0172
xor ebx, 0x49a8256f
sub ebx, 0x1fe937bf
sub ebx, 0x3f6d884
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x28], 0x12969216
test r15d, r15d
je 0x14007e5f8
mov eax, 0x50287a18
xor eax, 0x2c9ced8c
sub eax, 0x189174f1
sub eax, 0x641322a3
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0xc], ecx
mov r14d, esi
shl r14d, 8
shl r14d, 7
shl r14d, 3
shl r14d, 1
shl r14d, 1
mov edi, r13d
sub edi, r14d
xchg r10, rdx
mov r10, rbp
xchg r10, rdx
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x40], edi
mov r8d, edi
call fcn.140091750
test al, al
xchg r13, r13
je 0x14007e5f3
shr edi, 2
xor r8d, r8d
shr r14d, 2
mov r9, r9
test edi, edi
je 0x14007e5ba
mov r15d, dword [rsp + 0x70]
mov r9, rbp
mov rbx, rbx
lea eax, [r14 + r8]
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov dword [rsp - 0x10], 0x2ece96cb
xor edx, 0xa8323c2
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
mov dword [rsp - 0x40], 0x67c8e365
cmp r8d, edi
jb 0x14007e581
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov dword [rsp - 0xc], 0x6d10b88f
mov eax, 0x253295b4
add eax, 0x3c352041
xor eax, 0x23e1482d
xor eax, 0x779fa571
sub eax, 0x350958a9
cmp esi, r15d
mov dword [rsp - 0x44], 0x4208c4b0
jb 0x14007e518
jmp 0x14007e5f8
xor bl, bl
xchg rsp, rsp
xchg rcx, r14
mov r14, rbp
xchg r14, rcx
call fcn.1400972c0
mov al, bl
mov rdi, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg r14, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
mov r8, r8
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x30], esi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14007f0b8
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
xchg r13, rbp
mov qword [rsp + 0x10], r13
xchg r13, rbp
mov qword [rsp + 0x18], rsi
xchg rbp, rbp
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x20], 0x36b6e643
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
xchg r15, rsp
mov rsp, rcx
xchg r15, rsp
mov r14d, r8d
mov rdi, rdi
mov r9d, 0x42e88c8
xor r9d, 0x547da00a
sub r9d, 0xb1b62d5
sub r9d, 0x4533c5ed
xchg rdx, r12
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
xchg r14, r14
pushf
movabs rcx, 0xffffffff2d4eccc9
add rcx, 0x1a435fd8
add rcx, 0x32ff466f
sub rcx, 0x605a5894
add rcx, 0x7fffffff
add rcx, 0x65c8e584
popf
pushf
mov eax, 0x1915305e
add eax, 0x4a8929dc
add eax, 0x1a237997
xor eax, 0x7dc1d3d5
popf
cmovb r9d, r14d
mov dword [rsp - 0x3c], 0x3ce0b13
mul r9
cmovo rax, rcx
xchg rcx, r9
mov r9, rax
xchg r9, rcx
call fcn.1400972b0
mov r13d, dword [r15 + 0x18]
xchg rcx, rcx
lea ebp, [r14 + 0xfffff]
shr ebp, 0x10
shr ebp, 1
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor edi, edi
xchg rsi, rcx
mov rcx, rax
xchg rcx, rsi
mov ebx, 0xb1ad699
add ebx, 0x4e32d386
sub ebx, 0x56353131
xor ebx, 0x6a5f586c
sub ebx, 0x69472081
test ebp, ebp
je 0x14007f2cd
mov r11, r11
mov eax, 0x6b195869
add eax, 0x19b761e
sub eax, 0x253edc6c
sub eax, 0x4765f21b
mov r9d, edi
xchg rsi, rsi
mov r8d, r14d
shl r9d, 5
shl r9d, 3
shl r9d, 9
shl r9d, 2
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
xchg r9, r9
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x30], ecx
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x14007f27d
mov dword [rsp - 0x14], esp
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
mov rdi, rdi
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0xa8323c2
mov dword [rdx], eax
mov dword [rsp - 0x20], edx
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14007f251
mov r14, r14
xchg rsp, rdx
mov rsp, rsi
xchg rsp, rdx
xchg r14, rcx
mov r14, r15
xchg rcx, r14
call fcn.140091b90
test al, al
je 0x14007f2cb
xchg r10, r10
add edi, ebx
mov eax, 0x53f014c5
sub eax, 0x37115b51
add eax, 0x42f9a3a7
sub eax, 0xe96bb3e
sub eax, 0x5131a1dd
cmp edi, ebp
mov dword [rsp - 0x1c], esi
jb 0x14007f204
jmp 0x14007f2cd
xor bl, bl
mov rcx, rsi
call fcn.1400972c0
mov dword [rsp - 0x30], 0x57a978e7
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov dword [rsp - 0x44], edi
sub rsp, 0xffffffffffffffe0
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140081ce0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rbp
mov r8, r8
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rbx, rbx
push r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, r12
mov rdi, r12
xchg rdx, r12
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140083a30
mov dword [rsp - 0x1c], 0x6c8f5636
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rdx, rdx
mov r10, rax
mov ebx, r14d
test ebp, ebp
xchg r15, r15
je 0x140081ea3
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg rbx, rbx
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov dword [rsp - 0x44], ebx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x44], 0x51f324a7
cmp r14w, cx
jae 0x140081de4
mov eax, dword [rdx + 8]
test eax, eax
xchg rdx, rdx
jne 0x140081da5
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
xchg rcx, rcx
jb 0x140081dc4
add eax, r9d
cmp r11d, eax
mov rbp, rbp
jb 0x140081e56
inc r8w
nop
add rdx, 0x1ec124ad
sub rdx, 0x1ec12485
cmp r8w, cx
xchg r10, r10
jb 0x140081d94
mov r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x2c], 0x48a84bf
sub rax, 8
nop
sub r10, 0x2a7e4b3e
add r10, 0x2a7e4b46
shr rax, 1
mov dword [rsp - 0x34], esp
test eax, eax
je 0x140081e90
mov edx, eax
nop word [rax + rax]
xchg rdx, rdx
movzx eax, word [r10]
mov ecx, eax
shr ecx, 3
shr ecx, 9
cmp ecx, 3
xchg r14, r14
je 0x140081e70
cmp ecx, 0xa
jne 0x140081e79
mov r8, r8
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140081e79
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x14], 0x12a713ea
add r8, r11
jmp 0x140081de7
and eax, 0xfff
add dword [rax + r8], edi
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
mov rbp, rbp
jne 0x140081e24
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140081d5c
mov dword [rsp - 0x3c], 0x48cda227
mov rbx, qword [rsp + 0x30]
xchg r13, rbp
mov r13, qword [rsp + 0x38]
xchg rbp, r13
xchg r9, rsi
mov r9, qword [rsp + 0x40]
xchg rsi, r9
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret