joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400694bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], ebx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rsp, r15
mov rbp, r15
xchg r15, rsp
nop
sub rsp, 0x32e8fd1
add rsp, 0x32e8f71
movabs rbx, 0x55056d9c490343c1
sub rbx, 0x41d95f5
sub rbx, 0x18616f22
xor rbx, 0x11473ad8
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0x14], 0x256d346c
jne 0x1400696de
xor esi, esi
mov dword [rbp - 0x40], 0x4d710677
sub dword [rbp - 0x40], 0x4bbe0c62
add dword [rbp - 0x40], 0x704ace1d
xor dword [rbp - 0x40], 0x1df3b953
sub dword [rbp - 0x40], 0x6b90707c
mov dword [rbp - 0x3c], 0x3f658e7e
add dword [rbp - 0x3c], 0x20d3836a
sub dword [rbp - 0x3c], 0x5860ccb8
add dword [rbp - 0x3c], 0x6c0e320b
xor dword [rbp - 0x3c], 0x73bc77f9
mov dword [rbp - 0x38], 0x32de7197
xor dword [rbp - 0x38], 0x4578b518
sub dword [rbp - 0x38], 0x767b9c2f
xor dword [rbp - 0x38], 0x5b07e7ca
sub dword [rbp - 0x38], 0x59b9ced6
mov dword [rbp - 0x34], 0x78bb3238
sub dword [rbp - 0x34], 0x519d5f2
sub dword [rbp - 0x34], 0x3c263e5c
add dword [rbp - 0x34], 0x3dc4f146
xor dword [rbp - 0x34], 0x75490fb7
mov dword [rbp - 0x30], 0x69580395
sub dword [rbp - 0x30], 0x61f17d96
add dword [rbp - 0x30], 0x74b84dcd
sub dword [rbp - 0x30], 0x7ba0d342
mov dword [rbp - 0x2c], 0x6836b049
add dword [rbp - 0x2c], 0x93818f
sub dword [rbp - 0x2c], 0x5821c60f
sub dword [rbp - 0x2c], 0x10516af1
xchg r12, rsi
mov qword [rbp + 0x10], r12
xchg rsi, r12
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
xchg r11, r11
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
xchg r14, r14
mov eax, 0x493a254a
xor eax, 0x75b7fa19
sub eax, 0x123bce06
add eax, 0x11620957
shr eax, cl
movzx ecx, al
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
xor cx, dx
mov dword [rsp - 0x24], edi
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r13, rax
mov qword [rbp + 0x10], r13
xchg r13, rax
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
cmp rax, 0xc
jb 0x1400695fe
mov dword [rsp - 0x18], ecx
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
mov dword [rsp - 0x28], 0x15dccb0b
call fcn.14008bd40
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r15, rax
mov r8, r15
xchg r15, rax
xor eax, eax
xchg rbx, rbx
xor rdx, rbx
xchg r15, rdx
mov qword [rdi + 0x30], r15
xchg r15, rdx
lea rdi, [rbp - 0x28]
mov dword [rsp - 0x30], esp
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400696e6
xchg rbx, rbx
lea rdx, [0x1401432c0]
xchg r9, r8
mov rcx, r9
xchg r8, r9
call fcn.14006e018
xchg r14, r14
test al, al
setne al
jmp 0x1400696e6
mov al, 0x16
add al, 0x46
sub al, 9
sub al, 0x52
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov dword [rsp - 0x28], ebp
mov rsi, qword [r11 + 0x20]
xchg rdi, r12
mov r12, qword [r11 + 0x28]
xchg r12, rdi
xchg rsp, rdx
mov rdx, r11
xchg rsp, rdx
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069718
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x1c], 0x76023bb2
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
xchg rdi, rcx
mov qword [rsp + 0x20], rcx
xchg rcx, rdi
nop
push 0x18e9a483
mov qword [rsp], rbp
xchg rdx, rsp
mov rbp, rdx
xchg rdx, rsp
nop
sub rsp, 0x5cf98583
add rsp, 0x5cf98533
movabs rbx, 0x55056d9c16a95121
xor rbx, 0x7175f568
add rbx, 0x30b3d87
sub rbx, 0x52acec3d
add rbx, 0x25880edf
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
cmp qword [rcx + 0x28], rbx
jne 0x14006992b
mov eax, 0x69d7e397
xor eax, 0x1d16a9ed
add eax, 0x5dff072
sub eax, 0x7aa13a24
mov dword [rbp - 0x30], 0x202766e7
add dword [rbp - 0x30], 0x4a933483
xor dword [rbp - 0x30], 0x4893d2b0
xor dword [rbp - 0x30], 0x225f4931
mov word [rbp - 0x20], ax
mov dword [rsp - 0x14], 0x372716a4
xor esi, esi
mov dword [rbp - 0x2c], 0x79573eef
xor dword [rbp - 0x2c], 0x36bfabe6
sub dword [rbp - 0x2c], 0x5b659e8
sub dword [rbp - 0x2c], 0x3945c192
sub dword [rbp - 0x2c], 0x10e478be
mov dword [rbp - 0x28], 0x3b51e30d
sub dword [rbp - 0x28], 0x1dac15e8
add dword [rbp - 0x28], 0x21886771
xor dword [rbp - 0x28], 0x3f1a3400
mov dword [rbp - 0x24], 0x23e8bc7
add dword [rbp - 0x24], 0x262abf9e
xor dword [rbp - 0x24], 0x7380601
sub dword [rbp - 0x24], 0x2efa4c94
xchg rsi, rdi
mov qword [rbp + 0x10], rdi
xchg rdi, rsi
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x28], ebx
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x3c27bab0
add eax, 0x35a91087
xor eax, 0x4e9f9ce8
xor eax, 0x43727139
xor eax, 0x47893c42
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x24], 0x188832e3
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
xor cx, dx
xchg rbp, rbp
mov word [rbp + rax*2 - 0x1e], cx
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
inc rax
xchg r15, rax
mov qword [rbp + 0x10], r15
xchg r15, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x24], 0xf1a5d90
cmp rax, 9
jb 0x140069841
xor edx, edx
mov word [rbp - 0xc], si
mov dword [rsp - 0x28], edx
lea rcx, [rbp - 0x1e]
call fcn.14008bd40
mov rdx, rax
mov dword [rsp - 0x24], ebx
xchg rdx, rax
mov r8, rdx
xchg rdx, rax
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x28], rdx
mov dword [rsp - 0x18], 0x268bd8b9
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x24], esp
je 0x140069933
lea rdx, [0x140143810]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.140072194
mov dword [rsp - 0x18], 0x2f55034
test al, al
setne al
jmp 0x140069933
mov al, 0x59
xor al, 0x5d
add al, 0x42
sub al, 0x45
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg rbx, r14
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x14], ecx
mov rdi, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069964
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x3c], esi
xchg rbp, rsi
mov qword [rsp + 0x18], rbp
xchg rsi, rbp
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
xchg rdx, rdx
nop
add rsp, 0x18abb425
sub rsp, 0x18abb475
movabs rbx, 0x55056d9c6d9d6a6e
xor rbx, 0x37de070b
add rbx, 0x216f2d82
sub rbx, 0x1b691b84
sub rbx, 0x22867af1
mov rdi, rcx
mov rbx, rbx
cmp qword [rcx + 0x38], rbx
jne 0x140069b4d
xor esi, esi
mov dword [rbp - 0x30], 0x5dee2b4b
sub dword [rbp - 0x30], 0x1d753b14
sub dword [rbp - 0x30], 0x3bf09b2b
add dword [rbp - 0x30], 0x2630dd92
sub dword [rbp - 0x30], 0x2a4f31a8
mov dword [rbp - 0x2c], 0x37940785
sub dword [rbp - 0x2c], 0x18744d9a
add dword [rbp - 0x2c], 0x44d8ea37
sub dword [rbp - 0x2c], 0x541779c3
sub dword [rbp - 0x2c], 0xf982988
mov dword [rbp - 0x28], 0x7a2f99bc
sub dword [rbp - 0x28], 0x4c69c2de
sub dword [rbp - 0x28], 0x39c552a
sub dword [rbp - 0x28], 0x28975acb
sub dword [rbp - 0x28], 0x1642619
mov dword [rbp - 0x24], 0x310d8af8
add dword [rbp - 0x24], 0x4edff7bf
sub dword [rbp - 0x24], 0x195097de
sub dword [rbp - 0x24], 0x663dea3f
mov dword [rbp - 0x20], 0x1edde4dc
xor dword [rbp - 0x20], 0x2ad0494d
xor dword [rbp - 0x20], 0x61636ad6
sub dword [rbp - 0x20], 0x17ac7684
sub dword [rbp - 0x20], 0x3d4c4ffb
xchg rsi, r10
mov qword [rbp + 0x10], r10
xchg rsi, r10
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
xchg rdi, rdi
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x15bafdcb
xor eax, 0x7be63f0a
xor eax, 0x7d4beeac
add eax, 0x289cee37
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x20], ecx
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rdx, rdx
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
inc rax
xchg rsi, rax
mov qword [rbp + 0x10], rsi
xchg rsi, rax
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
cmp rax, 0xa
jb 0x140069a81
xor edx, edx
mov dword [rsp - 0x3c], edi
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008bd40
xchg rcx, rax
mov rdx, rcx
xchg rcx, rax
mov r8, rax
mov r9, r9
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
mov r13, r13
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069b55
xchg rsi, rsi
lea rdx, [0x140143830]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1400725e0
test al, al
setne al
xchg rdi, rdi
jmp 0x140069b55
mov al, 0xb
xor al, 0x25
sub al, 1
sub al, 0x2c
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x20], edx
xchg rsi, r8
mov r8, qword [rsp + 0x70]
xchg rsi, r8
xchg rdx, rdi
mov rdx, qword [rsp + 0x78]
xchg rdx, rdi
sub rsp, 0xffffffffffffffb0
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140069b84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r13, r13
push rbp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
nop
sub rsp, 0x4835b6f4
add rsp, 0x4835b6a4
movabs rbx, 0x55056d9c46d98e75
sub rbx, 0x49a6c1a
sub rbx, 0x3acd44ea
xor rbx, 0x6ae7051e
xor rbx, 0x5055dc1d
xchg r13, rcx
mov rdi, r13
xchg r13, rcx
cmp qword [rcx + 0x20], rbx
jne 0x140069d96
xchg r13, r13
mov eax, 0x4fe9400d
xor eax, 0x628b2cac
add eax, 0x12b0543c
sub eax, 0x4012c005
mov dword [rbp - 0x30], 0xd17e2f3
add dword [rbp - 0x30], 0x18a9fc7b
sub dword [rbp - 0x30], 0x1b92d11c
add dword [rbp - 0x30], 0x220040fa
sub dword [rbp - 0x30], 0x2bbd4e55
mov word [rbp - 0x1c], ax
mov dword [rsp - 0x3c], 0x66226051
xor esi, esi
mov dword [rbp - 0x2c], 0x30fde69c
xor dword [rbp - 0x2c], 0x20c67aec
xor dword [rbp - 0x2c], 0x1238dc4f
xor dword [rbp - 0x2c], 0x25440ee
mov dword [rbp - 0x28], 0x3cbae191
xor dword [rbp - 0x28], 0x7cba2200
sub dword [rbp - 0x28], 0x84aac4
sub dword [rbp - 0x28], 0x3f531805
mov dword [rbp - 0x24], 0x2cf363d9
add dword [rbp - 0x24], 0x3d5050db
xor dword [rbp - 0x24], 0x5f8679b9
add dword [rbp - 0x24], 0x42c77434
xor dword [rbp - 0x24], 0x789841c7
mov dword [rbp - 0x20], 0x1a0cd524
add dword [rbp - 0x20], 0x1fb4d65e
xor dword [rbp - 0x20], 0x6b68f32
sub dword [rbp - 0x20], 0x3f0123f0
xchg rsi, r12
mov qword [rbp + 0x10], r12
xchg r12, rsi
mov rax, qword [rbp + 0x10]
xchg r14, rcx
mov r14, qword [rbp + 0x10]
xchg rcx, r14
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
and cl, 3
shl cl, 3
mov dword [rsp - 0x28], edi
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x59286e52
add eax, 0x8a6f5ae
sub eax, 0x445f1c1f
add eax, 0x1985a41e
xor eax, 0xd41f15b
shr eax, cl
movzx ecx, al
mov r8, r8
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
inc rax
mov qword [rbp + 0x10], rax
mov rbx, rbx
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
jb 0x140069cb5
mov rdi, rdi
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.14008bd40
mov dword [rsp - 0x14], esp
xchg rdx, rbp
mov rbp, rax
xchg rdx, rbp
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov rbp, rbp
xor rdx, rbx
xchg rdx, rbp
mov qword [rdi + 0x20], rbp
xchg rbp, rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
mov rbx, rbx
cmp rdx, rbx
je 0x140069da0
lea rdx, [0x140143298]
xchg r10, r10
xchg rcx, rdx
mov rdx, r8
xchg rdx, rcx
call fcn.140072a34
mov dword [rsp - 0x34], ebx
test al, al
setne al
jmp 0x140069da0
mov al, 0x18
add al, 0x30
sub al, 0x23
xor al, 0x59
xor al, 0x7d
mov rbx, qword [rsp + 0x68]
xchg rsi, rdx
mov rdx, qword [rsp + 0x70]
xchg rdx, rsi
xchg rdi, r14
mov r14, qword [rsp + 0x78]
xchg r14, rdi
add rsp, 0x50
mov dword [rsp - 0x3c], ebx
pop rbp
ret
Function at 0x14007485c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov dword [rsp - 0x34], ebx
nop
sub rsp, 0x7d6f6147
add rsp, 0x7d6f60e7
lea rax, [rcx + 8]
mov r10, r10
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov qword [rsp + 0x78], rbp
mov dword [rsp - 0x1c], ecx
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rax
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x10], esi
xchg rbp, rax
movups xmmword [rbp + 0x20], xmm0
xchg rbp, rax
movups xmmword [rax + 0x30], xmm0
mov r8, r8
xchg r9, rax
movups xmmword [r9 + 0x40], xmm0
xchg r9, rax
xchg r13, rax
movups xmmword [r13 + 0x50], xmm0
xchg r13, rax
xchg r10, rax
movups xmmword [r10 + 0x60], xmm0
xchg r10, rax
movups xmmword [rax + 0x70], xmm0
mov dword [rsp - 0x18], 0x2a5aa6c7
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
xchg rbx, rsp
movups xmmword [rbx + 0x28], xmm0
xchg rbx, rsp
lea rdx, [rbp + 1]
xchg rdi, rsp
movups xmmword [rdi + 0x38], xmm0
xchg rdi, rsp
xchg r11, rsp
movups xmmword [r11 + 0x48], xmm0
xchg r11, rsp
call fcn.140017bbc
mov edx, 0x88d7ae1
xor edx, 0x3285ce7f
xor edx, 0x722ecc62
sub edx, 0x1c245080
add edx, 0xfb1f228
test rbp, rbp
je 0x1400748e6
mov rdx, rdx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x34], esi
xchg r15, r9
mov r15, rbp
xchg r15, r9
mov r8d, 0x37c6a6c8
xor r8d, 0x5f153269
xor r8d, 0x7734af39
add r8d, 0x5bfbf1dc
sub r8d, 0x7be32c75
nop word [rax + rax]
mov dword [rsp - 0xc], ebp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 3
ror edx, 5
xor cx, word [rbx + rdi - 2]
xchg r11, r11
mov word [rdi - 2], cx
sub r9, 1
jne 0x1400748b7
mov dword [rsp - 0x30], 0x79df3041
xor ecx, ecx
xchg rsp, r8
mov rsp, rbp
xchg rsp, r8
mov word [rax + rbp*2], cx
xchg r8, rsi
mov rcx, r8
xchg rsi, r8
mov rdx, qword [rsp + 0x20]
call fcn.140091ca0
mov dword [rsp - 0x20], 0x12b150a
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
xchg r8, rbp
mov r8, qword [rsp + 0x78]
xchg r8, rbp
xchg rbx, rcx
mov rcx, qword [rsp + 0x70]
xchg rbx, rcx
cmp rcx, rax
xchg r14, r14
jne 0x140074995
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x1c], 0x79373f2a
mov ecx, 0x4c434b87
xor ecx, 0xd0bda1a
add ecx, 0x14d4d020
sub ecx, 0x561d618d
rep stosb byte [rdi], al
xchg r12, r12
xchg rcx, rsi
mov rax, rcx
xchg rsi, rcx
xchg rsi, r15
mov r15, qword [rsp + 0x80]
xchg rsi, r15
sub rsp, 0xffffffffffffffa0
mov dword [rsp - 0x20], 0x70524a23
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400999a0
mov dword [rsp - 0x30], 0x571fce3
xchg rdx, rax
mov rdx, rsi
xchg rdx, rax
xchg rdi, rsi
mov rdi, qword [rsp + 0x80]
xchg rdi, rsi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007f50c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
xchg r13, r13
lea r10, [0x140001910]
sub r10, rcx
xchg r8, r10
mov r10, rcx
xchg r8, r10
lea rax, [r9 + r8]
xchg r15, r15
mov ecx, r9d
mov edx, 0x8dd3164
add edx, 0x549686bf
add edx, 0x334e3f8
xor edx, 0x20529e26
inc r9
rol edx, cl
mov dword [rsp - 0xc], ebp
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov dword [rsp - 0x30], esi
jb 0x14007f525
mov rax, r8
ret
Function at 0x1400803d8
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
mov dword [rsp - 0x34], esp
mov rbx, rcx
mov r13d, r8d
mov r9d, 0x4a96b60f
xor r9d, 0x13294857
sub r9d, 0x2f903400
xor r9d, 0x2a2bca58
mov r12, rdx
mov dword [rsp - 0x24], 0x1fbac974
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff16e1bbb8
xor rcx, 0x462390c1
sub rcx, 0x5e09fe4
xor rcx, 0x31938d76
add rcx, 0x7fffffff
add rcx, 0x48df91d
popf
pushf
mov eax, 0xa9f8112
xor eax, 0x5c53014b
xor eax, 0x460d3771
add eax, 0x259ccd0d
xor eax, 0x365e8431
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x3c], ebx
cmovo rax, rcx
xchg rcx, rdi
mov rdi, rax
xchg rdi, rcx
call fcn.1400997e0
lea r15d, [r13 + 0xfffff]
mov dword [rsp - 0x44], 0x4b6abbe3
xor esi, esi
shr r15d, 0xb
shr r15d, 7
shr r15d, 1
shr r15d, 1
xchg rdi, rbp
mov rdi, rax
xchg rbp, rdi
mov eax, dword [rbx + 0x18]
xchg r10, r10
mov ebx, 0x7e4a452d
xor ebx, 0x12e9b3d8
xor ebx, 0x606142f9
xor ebx, 0xcc2b40d
mov dword [rsp + 0x70], eax
mov rbx, rbx
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x140080616
mov eax, 0x4b7e6539
add eax, 0x25d3d567
xor eax, 0x1be4229
sub eax, 0x55cb05c8
sub eax, 0x1b1172c1
xchg rcx, r12
mov r12, qword [rsp + 0x60]
xchg rcx, r12
mov r14d, esi
shl r14d, 0x11
shl r14d, 1
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov dword [rsp - 0x40], ecx
sub edi, r14d
xchg rsp, rdx
mov rsp, rbp
xchg rdx, rsp
cmp edi, eax
cmova edi, eax
mov r10, r10
mov r8d, edi
call fcn.140093b90
test al, al
je 0x140080614
mov dword [rsp - 0xc], 0x5378cd1c
shr edi, 2
xor r8d, r8d
shr r14d, 2
xchg r11, r11
test edi, edi
je 0x1400805e8
mov r15d, dword [rsp + 0x70]
xchg r14, r9
mov r14, rbp
xchg r9, r14
lea eax, [r14 + r8]
mov dword [rsp - 0x1c], 0x3eeed176
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov dword [rsp - 0x44], ebp
xor edx, 0x2d12297d
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
mov r13, r13
jb 0x1400805b0
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x5582757d
xor eax, 0x52d18e74
xor eax, 0x5d33184d
xor eax, 0x509147c5
xor eax, 0xae1a481
cmp esi, r15d
jb 0x14008053f
mov r8, r8
jmp 0x140080616
xor bl, bl
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.1400997f0
mov dword [rsp - 0x3c], 0x39d7d435
mov al, bl
xchg r11, rbx
mov r11, qword [rsp + 0x68]
xchg rbx, r11
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0x3c], ebx
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
pop rsi
pop rbp
mov dword [rsp - 0x10], 0x4fd51f4a
ret
Function at 0x140080f8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
mov qword [rsp + 0x18], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push rbx
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r15, rcx
mov r14d, r8d
mov r9d, 0x754fb200
xor r9d, 0x646b96c8
xor r9d, 0x25973871
sub r9d, 0x676df94
sub r9d, 0x2e383d25
mov r12, rdx
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff2bfbe14d
add rcx, 0x341933aa
xor rcx, 0x369ab12a
sub rcx, 0x2ff5ed10
add rcx, 0x7fffffff
xor rcx, 0x59664733
popf
pushf
mov eax, 0x250eefc0
add eax, 0x56dade0b
sub eax, 0x1405bc7c
sub eax, 0x2f362727
xor eax, 0x38adea2c
popf
cmovb r9d, r14d
mov dword [rsp - 0x24], 0x35761ba7
mul r9
cmovo rax, rcx
xchg rcx, r15
mov r15, rax
xchg r15, rcx
call fcn.1400997e0
mov r13d, dword [r15 + 0x18]
mov dword [rsp - 0xc], 0x21e3052d
lea ebp, [r14 + 0xfffff]
shr ebp, 0x13
shr ebp, 1
xor edi, edi
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x3a0b0dd4
sub ebx, 0x13f9f8c8
sub ebx, 0x3f39316
xor ebx, 0x1f0d45dd
xor ebx, 0x3d10c42a
test ebp, ebp
mov rdx, rdx
je 0x14008119f
mov eax, 0x2ef600bd
sub eax, 0x270b9a46
add eax, 0xd4ff085
xor eax, 0x59f55d95
xor eax, 0x4cdf0b69
mov r9d, edi
mov rbx, rbx
mov r8d, r14d
shl r9d, 0xd
shl r9d, 6
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x28], 0x1d108828
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xchg rsp, rsp
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
mov dword [rsp - 0x40], ebx
je 0x140081155
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
lea ecx, [r9 + r10]
mov dword [rsp - 0x44], 0x426ffb47
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
mov dword [rsp - 0x44], 0x1c7f7225
xor eax, 0x2d12297d
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [rsp - 0x1c], ebp
cmp r10d, r11d
jb 0x14008111f
xchg rdx, r12
mov r12, rsi
xchg rdx, r12
mov rcx, r15
mov r8, r8
call fcn.140094010
test al, al
je 0x14008119d
mov dword [rsp - 0x34], esi
add edi, ebx
mov eax, 0x2dabb0a8
sub eax, 0x51c35ec
sub eax, 0x117eaa15
xor eax, 0x33b06a15
xor eax, 0x24b0bab2
cmp edi, ebp
jb 0x1400810ce
jmp 0x14008119f
xor bl, bl
mov rcx, rsi
xchg rsi, rsi
call fcn.1400997f0
xchg r13, rbp
mov r13, qword [rsp + 0x58]
xchg rbp, r13
mov al, bl
mov dword [rsp - 0x34], ebx
xchg rbp, rbx
mov rbp, qword [rsp + 0x50]
xchg rbx, rbp
mov rsi, qword [rsp + 0x60]
mov dword [rsp - 0x30], 0x4ca31160
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083d80
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rdx, rdx
mov qword [rsp + 0x10], rbp
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x10], edi
push r14
nop
sub rsp, 0x2d7b9123
add rsp, 0x2d7b9103
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdi
xchg rdi, r13
mov r13, rdx
xchg rdi, r13
xchg rsi, r14
mov r14, rcx
xchg rsi, r14
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140085b00
mov dword [rsp - 0x40], 0x54641bda
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rcx
mov rcx, rax
xchg r10, rcx
mov ebx, r14d
test ebp, ebp
je 0x140083f57
mov r9, r9
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x3c], ecx
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov dword [rsp - 0x38], 0x44601d05
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x30], 0x62f1050
jae 0x140083e8c
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140083e57
mov dword [rsp - 0x1c], esi
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x2c], ebx
jb 0x140083e77
add eax, r9d
cmp r11d, eax
xchg r15, r15
jb 0x140083f0d
inc r8w
sub rdx, 0xffffffffffffffd8
xchg rdx, rdx
cmp r8w, cx
jb 0x140083e45
xchg r14, r8
mov r14, r8
xchg r14, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x30], esp
neg rax
sub rax, 0xfffffffffffffff8
neg rax
nop
add r10, 0x10063ac9
sub r10, 0x10063ac1
shr rax, 1
test eax, eax
je 0x140083f44
mov dword [rsp - 0x1c], ebp
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
mov dword [rsp - 0x34], esi
shr ecx, 7
shr ecx, 2
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140083f27
mov rbx, rbx
cmp ecx, 0xa
jne 0x140083f33
and eax, 0xfff
add qword [rax + r8], rdi
mov rdi, rdi
jmp 0x140083f33
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x40], 0x60b520b1
add r8, r11
jmp 0x140083e95
and eax, 0xfff
add dword [rax + r8], edi
mov r13, r13
add r10, 2
sub rdx, 1
jne 0x140083ed1
mov rdi, rdi
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083e08
mov dword [rsp - 0x44], 0x53bbea8f
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
xchg rbp, r14
mov r14, qword [rsp + 0x38]
xchg r14, rbp
xchg r13, rsi
mov r13, qword [rsp + 0x40]
xchg r13, rsi
xchg r11, rdi
mov r11, qword [rsp + 0x48]
xchg r11, rdi
add rsp, 0x20
mov r12, r12
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret