joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074b9e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
lea rax, [rcx + 8]
xchg rbp, rbx
mov qword [rsp + 0x70], rbp
xchg rbp, rbx
mov qword [rcx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xchg r9, r9
mov rsi, rcx
xchg rbp, rdx
mov qword [rsp + 0x78], rdx
xchg rbp, rdx
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rax
lea rcx, [rsp + 0x20]
xchg rcx, rax
movups xmmword [rcx + 0x20], xmm0
xchg rcx, rax
xchg r11, rax
movups xmmword [r11 + 0x30], xmm0
xchg r11, rax
movups xmmword [rax + 0x40], xmm0
mov r14, r14
xchg rsi, rax
movups xmmword [rsi + 0x50], xmm0
xchg rsi, rax
xchg rdi, rax
movups xmmword [rdi + 0x60], xmm0
xchg rdi, rax
xchg rbx, rax
movups xmmword [rbx + 0x70], xmm0
xchg rbx, rax
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
xchg rdx, rdx
mov qword [rsp + 0x20], rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg rsp, r12
lea rdx, [rbp + 1]
xchg rsp, rcx
movups xmmword [rcx + 0x38], xmm0
xchg rsp, rcx
xchg rsi, rsp
movups xmmword [rsi + 0x48], xmm0
xchg rsp, rsi
call fcn.140017bb4
mov edx, 0x11c5e03b
add edx, 0x4bc30efa
sub edx, 0xc278de9
xor edx, 0x613f4304
test rbp, rbp
xchg r13, r13
je 0x140074cca
xchg rsi, rax
mov rdi, rsi
xchg rsi, rax
sub rbx, rax
xchg r10, r10
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
mov r8d, 0x1ba2c9c3
xor r8d, 0x7b36f655
xor r8d, 0x210b612e
sub r8d, 0x419f5db9
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x44], edx
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
xchg rcx, rcx
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074ca2
xor ecx, ecx
xchg rdi, rdi
xchg rdx, rbp
mov r8, rdx
xchg rbp, rdx
mov word [rax + rbp*2], cx
xchg r12, r12
xchg rcx, r15
mov r15, rsi
xchg r15, rcx
mov rdx, qword [rsp + 0x20]
mov dword [rsp - 0x30], 0x61865531
call fcn.140091b50
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov dword [rsp - 0x14], edi
xchg rbx, r9
mov r9, qword [rsp + 0x70]
xchg rbx, r9
cmp rcx, rax
xchg rcx, rcx
jne 0x140074d7b
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0xc], esp
mov ecx, 0x3d5ee875
add ecx, 0x12ef8f1a
sub ecx, 0x43092dc9
add ecx, 0x3e54c65f
xor ecx, 0x4b9a1015
rep stosb byte [rdi], al
mov rax, rsi
xchg rbp, rbp
mov rsi, qword [rsp + 0x80]
nop
sub rsp, 0x1b0af303
add rsp, 0x1b0af363
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099810
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rdi, rsi
mov rdi, qword [rsp + 0x80]
xchg rdi, rsi
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007f67c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
xchg rbp, rbp
lea r10, [0x140001900]
sub r10, rcx
xchg rcx, r8
mov rcx, r8
xchg r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov dword [rsp - 0x1c], esi
mov edx, 0x10287d5f
add edx, 0x44be3fd9
sub edx, 0x213b3b02
add edx, 0x1c0ba0d5
add edx, 0x1f1fe627
inc r9
mov r13, r13
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
xchg rdi, rdi
jb 0x14007f695
mov rax, r8
ret
Function at 0x140080598
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg r11, rbx
mov qword [rsp + 8], rcx
mov dword [rsp - 0x14], ebp
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push rbx
mov qword [rsp], r15
nop
sub rsp, 0x4f5de480
add rsp, 0x4f5de460
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov r13d, r8d
mov dword [rsp - 0x28], ebx
mov r9d, 0x6c064f1
add r9d, 0x95d5349
xor r9d, 0x2a835f6f
sub r9d, 0x3a9ae755
mov r12, rdx
mov r10, r10
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff50748b73
xor rcx, 0x3d2d2460
add rcx, 0x61f037f
add rcx, 0x6815695
add rcx, 0x7fffffff
add rcx, 0x605f6d9
popf
pushf
mov eax, 0x1635b7bd
add eax, 0x6395456f
xor eax, 0x41ca1d47
xor eax, 0x3800e06f
popf
cmovb r9d, r13d
mov dword [rsp - 0x44], esi
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400996c0
mov dword [rsp - 0x10], 0x359bea3c
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 0x12
shr r15d, 1
shr r15d, 1
mov rbp, rax
mov dword [rsp - 0x24], 0x111dff2c
mov eax, dword [rbx + 0x18]
mov ebx, 0x76129e4e
sub ebx, 0x54e8d187
xor ebx, 0x274228c0
xor ebx, 0x3d409b59
sub ebx, 0x3b2b7f5d
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x24], ecx
test r15d, r15d
je 0x1400807dc
mov eax, 0x21635ff5
add eax, 0x2f1ccc2
add eax, 0x45aa0c44
sub eax, 0x6240a5ca
xor eax, 0x7ae9331
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x38], 0x35050d61
mov r14d, esi
shl r14d, 6
shl r14d, 1
shl r14d, 4
shl r14d, 8
shl r14d, 1
mov edi, r13d
sub edi, r14d
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
cmp edi, eax
mov dword [rsp - 0x28], 0x423dd756
cmova edi, eax
mov r8d, edi
call fcn.140093a90
test al, al
mov dword [rsp - 0x24], esp
je 0x1400807da
shr edi, 1
shr edi, 1
xor r8d, r8d
mov dword [rsp - 0x14], 0x6f9ec29b
shr r14d, 2
test edi, edi
je 0x1400807b6
mov dword [rsp - 0x30], esp
mov r15d, dword [rsp + 0x70]
mov r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
xchg r8, r8
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x200d358f
lea r9, [r9 + 4]
mov dword [rsp - 0x30], 0x64046359
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14008077e
mov dword [rsp - 0x38], esp
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x592a56c0
add eax, 0x1672b618
xor eax, 0x37af40b1
sub eax, 0x58224c69
cmp esi, r15d
jb 0x140080705
jmp 0x1400807dc
xor bl, bl
xchg rdi, rcx
mov rdi, rbp
xchg rdi, rcx
call fcn.1400996d0
mov dword [rsp - 0xc], 0x4cb6ac42
mov al, bl
mov rbx, qword [rsp + 0x68]
nop
sub rsp, 0x4cb21cb1
add rsp, 0x4cb21cd1
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x20], ebx
pop r13
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140081070
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rbp
xchg r15, r15
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x34], ebx
nop
mov qword [rsp - 8], r14
sub rsp, 8
push rcx
mov qword [rsp], r15
nop
add rsp, 0x7f6c04d
sub rsp, 0x7f6c06d
mov r15, rcx
mov dword [rsp - 0x2c], 0x6c6908cc
mov r14d, r8d
mov r9d, 0x2bdad24d
add r9d, 0x1f344d45
add r9d, 0x1e1813a2
xor r9d, 0x4a89e9c3
xor r9d, 0x23aadaf7
mov r12, rdx
mov dword [rsp - 0x14], esi
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff67bdb9fa
xor rcx, 0x2030f260
add rcx, 0x26a6cf6e
sub rcx, 0x237d7f45
add rcx, 0x7fffffff
add rcx, 0x3549643d
popf
pushf
mov eax, 0x193063f7
sub eax, 0xa836931
add eax, 0x2295d9bb
xor eax, 0x3142d485
popf
cmovb r9d, r14d
mul r9
mov dword [rsp - 0x24], 0x7cc4c1c0
cmovo rax, rcx
mov rcx, rax
call fcn.1400996c0
mov dword [rsp - 0x34], 0x7bc4c20c
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0x13
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x28], edi
xchg r13, rax
mov rsi, r13
xchg r13, rax
mov ebx, 0x3d3b08eb
add ebx, 0x1cbb444d
sub ebx, 0x30f6357f
sub ebx, 0x290017b8
test ebp, ebp
je 0x14008128b
mov r15, r15
mov eax, 0x1b82327d
add eax, 0x1236aa1b
add eax, 0xf874813
sub eax, 0x3d3024ab
mov r9d, edi
mov r8d, r14d
mov dword [rsp - 0x38], 0x7161b76d
shl r9d, 5
shl r9d, 7
shl r9d, 1
shl r9d, 3
shl r9d, 2
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x1c], 0x447ebcd
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov dword [rsp - 0x44], ecx
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x14008123c
xchg r12, rsi
mov rdx, r12
xchg r12, rsi
lea ecx, [r9 + r10]
mov rbp, rbp
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xchg r14, r14
xor eax, 0x200d358f
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [rsp - 0x2c], ebp
cmp r10d, r11d
jb 0x140081210
xchg rdx, r15
mov r15, rsi
xchg r15, rdx
xchg rcx, r15
mov r15, rcx
xchg r15, rcx
call fcn.140093ee0
mov r8, r8
test al, al
je 0x140081289
add edi, ebx
mov eax, 0x4b6dbec7
add eax, 0x242d2b5e
xor eax, 0xbf6df25
xor eax, 0xe900b2b
sub eax, 0x6aec3e2b
cmp edi, ebp
mov r13, r13
jb 0x1400811af
jmp 0x14008128b
xor bl, bl
xchg r9, rcx
mov r9, rsi
xchg rcx, r9
call fcn.1400996d0
xchg rbp, rbp
mov rbp, qword [rsp + 0x58]
mov al, bl
xchg rbp, rbx
mov rbp, qword [rsp + 0x50]
xchg rbp, rbx
xchg r8, rsi
mov r8, qword [rsp + 0x60]
xchg rsi, r8
nop
add rsp, 0x2ac9ed75
sub rsp, 0x2ac9ed55
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
pop r12
mov dword [rsp - 0x10], esi
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083cb0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x10], 0x4742d6ee
mov qword [rsp + 0x10], rbp
xchg rsi, r10
mov qword [rsp + 0x18], r10
xchg r10, rsi
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
nop
push 0x70e1238e
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
xchg r13, rdi
mov r13, rdx
xchg r13, rdi
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
xchg rbp, rbp
call fcn.140085a00
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x38], 0x3075c737
mov ebp, dword [rbx + rsi + 0xb4]
xchg rsi, rax
mov r10, rsi
xchg rsi, rax
mov ebx, r14d
mov r12, r12
test ebp, ebp
je 0x140083e8d
nop dword [rax]
mov dword [rsp - 0xc], 0x2cff05ef
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov rsi, rsi
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
mov dword [rsp - 0x2c], ebx
add rdx, rax
cmp r14w, cx
jae 0x140083dc8
mov eax, dword [rdx + 8]
mov dword [rsp - 0xc], 0x467c41df
test eax, eax
jne 0x140083d88
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
xchg r15, r15
cmp r11d, r9d
jb 0x140083da7
add eax, r9d
mov r8, r8
cmp r11d, eax
jb 0x140083e44
inc r8w
nop
sub rdx, 0x18ffe3cb
add rdx, 0x18ffe3f3
cmp r8w, cx
mov dword [rsp - 0x30], esp
jb 0x140083d72
xchg r15, r14
mov r8, r15
xchg r14, r15
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x20], 0x708a9c30
sub rax, 8
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
xchg rbx, rbx
je 0x140083e7f
mov edx, eax
nop word [rax + rax]
xchg r12, r12
movzx eax, word [r10]
mov ecx, eax
shr ecx, 5
shr ecx, 2
shr ecx, 1
shr ecx, 2
shr ecx, 1
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x2c], edx
je 0x140083e5a
cmp ecx, 0xa
jne 0x140083e63
xchg rdx, rdx
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140083e63
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0xc], esp
add r8, r11
jmp 0x140083dd1
and eax, 0xfff
add dword [rax + r8], edi
nop
add r10, 0x7bc75ff3
sub r10, 0x7bc75ff1
sub rdx, 1
xchg rcx, rcx
jne 0x140083e08
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083d42
xchg r8, r8
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x20], ecx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140085a00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
mov dword [rsp - 0x34], 0x601e8425
add r8, rcx
mov r10d, edx
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
mov r9, r9
add rax, 0x18
add rax, r8
cmp r9w, r11w
mov dword [rsp - 0x30], esi
jae 0x140085a79
nop dword [rax]
mov ecx, dword [rax + 8]
test ecx, ecx
xchg r10, r10
jne 0x140085a52
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
mov rcx, rcx
cmp r10d, edx
jb 0x140085a67
add ecx, edx
xchg rcx, rcx
cmp r10d, ecx
jb 0x140085a89
inc r9w
add rax, 0x28
mov dword [rsp - 0x24], edx
cmp r9w, r11w
jb 0x140085a45
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x30], 0x352513fc
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
mov rbx, rbx
add rax, rbx
xchg rbp, rbx
mov rbp, qword [rsp + 8]
xchg rbp, rbx
add rax, r10
xchg rbp, rbp
ret
Function at 0x140085ab0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg r10, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
mov dword [rsp - 0xc], ebp
push rdi
push r12
push r13
mov dword [rsp - 0x38], 0x1f6748d
push r13
mov qword [rsp], r14
push rdi
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
movzx eax, word [rcx]
mov dword [rsp - 0x18], 0x6fb4e47e
mov r15d, edx
xor eax, 0x200d358f
xchg rsi, r15
mov r15, rcx
xchg rsi, r15
cmp eax, 0x200d6fc2
jne 0x140085c5e
xchg r13, r13
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x200d358f
cmp eax, 0x200d70df
mov r11, r11
jne 0x140085c5e
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085a00
xchg rcx, rsp
mov rsp, rsi
xchg rcx, rsp
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
xchg r11, r11
call fcn.140085a00
mov edx, dword [r14 + 0x24]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
xchg rbp, rax
mov r12, rbp
xchg rbp, rax
call fcn.140085a00
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
mov dword [rsp - 0x40], edi
xchg rdx, rax
mov r13, rdx
xchg rdx, rax
call fcn.140085a00
mov dword [rsp - 0x24], esi
xor edi, edi
xchg r9, rax
mov qword [rsp + 0x70], r9
xchg r9, rax
cmp dword [r14 + 0x18], edi
jbe 0x140085c5e
nop dword [rax]
mov dword [rsp - 0x34], ebx
mov edx, dword [r12 + rdi*4]
xchg r14, rcx
mov r14, rsi
xchg rcx, r14
call fcn.140085a00
mov r12, r12
mov ecx, 0x6cc1d257
sub ecx, 0x6651506
sub ecx, 0x26af6b51
xor ecx, 0x2960b1f
add ecx, 0xc2c4a6e0
mov rbx, rax
xchg r12, r12
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140085c3c
nop dword [rax]
xchg r14, r14
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x20], edx
mov r8d, 0x7b911ef6
sub r8d, 0x1b24967
sub r8d, 0x5d857925
add r8d, 0x1e437cec
xor r8d, 0x3a9cd957
inc rbx
call fcn.14008edb0
cmp byte [rbx], 0
mov dword [rsp - 0x14], ebx
jne 0x140085bef
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x40], 0x24fd51f1
je 0x140085caf
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140085ba4
xchg rdi, rdi
xor eax, eax
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg rbx, r13
add rsp, 0x20
xchg r14, r14
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0x24], ebp
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x34], 0x15c52672
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg r10, rax
mov r10, qword [rsp + 0x70]
xchg r10, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x24], esi
call fcn.140085a00
jmp 0x140085c60
Function at 0x140085ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
push rdi
nop
add rsp, 0x28403427
sub rsp, 0x28403447
movzx eax, word [rcx]
mov dword [rsp - 0xc], esi
mov edi, edx
xor eax, 0x200d358f
xchg rsi, rbx
mov rsi, rcx
xchg rsi, rbx
cmp eax, 0x200d6fc2
jne 0x140085d9e
xchg r10, r10
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x200d358f
cmp eax, 0x200d70df
xchg r13, r13
jne 0x140085d9e
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085a00
sub edi, dword [rax + 0x10]
mov dword [rsp - 0xc], edi
cmp edi, dword [rax + 0x14]
jae 0x140085d9e
mov edx, dword [rax + 0x1c]
xchg rsp, rbx
mov rcx, rsp
xchg rsp, rbx
call fcn.140085a00
mov dword [rsp - 0x28], 0x6656bf09
mov rcx, rbx
mov edx, dword [rax + rdi*4]
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
nop
add rsp, 0x2a1b333
sub rsp, 0x2a1b313
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.140085a00
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov r13, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008a0e3
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg r11, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rbx, r11
mov r11, qword [rcx]
xchg rbx, r11
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, r13
mov qword [rsp + 0x70], r13
xchg rsi, r13
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x30], ecx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rsp, rbp
movups xmmword [rbp + 0x28], xmm0
xchg rsp, rbp
lea rdx, [rsi + 1]
mov dword [rsp - 0x38], 0x10c5afe3
xchg r8, rsp
movups xmmword [r8 + 0x38], xmm0
xchg r8, rsp
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg rsp, r8
call fcn.140017bb4
mov rbp, rbp
mov edx, 0x14b6a4e4
add edx, 0x13f4658e
sub edx, 0x1feaf1c0
add edx, 0x279e0996
test rsi, rsi
je 0x14008a150
mov dword [rsp - 0x24], ecx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x18], 0x1158310
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0xb245a97
xor r9d, 0x37b8717
add r9d, 0x4fcb00c0
sub r9d, 0x582add41
nop dword [rax]
movzx ecx, dx
xchg r15, r15
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 1
ror edx, 3
ror edx, 3
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov rbp, rbp
sub r8, 1
jne 0x14008a122
xor ecx, ecx
xchg rbx, rbx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.14008a210
mov dword [rsp - 0x1c], 0x2927d571
xchg rcx, rdi
mov rdi, qword [rsp + 0x20]
xchg rcx, rdi
mov ebx, eax
mov dword [rsp - 0x18], 0x3377179a
xchg rbp, rsi
mov rbp, qword [rsp + 0x70]
xchg rbp, rsi
lea rax, [rsp + 0x28]
mov dword [rsp - 0x14], esi
cmp rcx, rax
jne 0x14008a1e1
xor eax, eax
mov dword [rsp - 0x24], ecx
lea rdi, [rsp + 0x28]
mov ecx, 0x52faf6f
add ecx, 0x1739854d
add ecx, 0x125bd4b1
sub ecx, 0x2ec5093d
rep stosb byte [rdi], al
mov dword [rsp - 0x14], edi
mov eax, ebx
xchg rcx, rbx
mov rcx, qword [rsp + 0x78]
xchg rcx, rbx
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140099810
mov eax, ebx
xchg r11, rbx
mov r11, qword [rsp + 0x78]
xchg rbx, r11
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008b6d0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov dword [rsp - 0x2c], 0x26b149ff
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x5c299cc1
sub rsp, 0x5c299d21
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
mov dword [rsp - 0x3c], edx
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov rdx, rdx
mov ebp, r8d
mov qword [r11 + 0x10], rsi
xchg r12, rsi
mov r12, qword [rcx + 0x38]
xchg rsi, r12
lea rcx, [r11 - 0x48]
xchg rsp, rsp
mov qword [r11 + 0x18], r14
xchg rdx, r8
mov r14, r8
xchg rdx, r8
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp - 0x1c], 0x547bd31a
lea rdx, [rsi + 1]
xchg rdx, rsp
movups xmmword [rdx + 0x38], xmm0
xchg rsp, rdx
movups xmmword [rsp + 0x48], xmm0
mov rdx, rdx
call fcn.140017bb4
mov edx, 0x583a197c
xor edx, 0x4bfe644a
add edx, 0x22063299
add edx, 0x16b36ccc
sub edx, 0x1c1ffa53
test rsi, rsi
je 0x14008b7fc
mov dword [rsp - 0xc], esp
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov rbx, rbx
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x3342eb56
xor r9d, 0x686ed58
xor r9d, 0x52178a87
sub r9d, 0x4045ddd7
sub r9d, 0x278dadb3
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x28], 0x1d3dad88
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 2
ror edx, 4
ror edx, 2
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
xchg rsp, rsp
sub r8, 1
jne 0x14008b7ca
xor ecx, ecx
mov dword [rsp - 0x28], esi
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rbx, rdx
mov rbx, r14
xchg rbx, rdx
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x20], 0x54f7c6b8
call fcn.14008b8e0
xchg rbx, rcx
mov rbx, qword [rsp + 0x20]
xchg rbx, rcx
mov ebx, eax
mov dword [rsp - 0x10], ebp
xchg r14, rbx
mov rbx, qword [rsp + 0x80]
xchg rbx, r14
lea rax, [rsp + 0x28]
mov rdx, rdx
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
cmp rcx, rax
jne 0x14008b8a7
mov dword [rsp - 0x44], 0x7b6859fe
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x3adfb827
sub ecx, 0x267dcada
xor ecx, 0x76d05d56
xor ecx, 0x62b1b02b
rep stosb byte [rdi], al
mov dword [rsp - 0x3c], 0x373e2592
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140099810
mov rbp, rbp
mov eax, ebx
xchg rdi, rbx
mov rdi, qword [rsp + 0x88]
xchg rbx, rdi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008b8e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
xchg r13, r13
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
mov rbx, rdx
xchg r12, r12
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x7241ca42
sub r8d, 0x21448534
xor r8d, 0x7bdbd199
sub r8d, 0x2ac66c60
sub r8d, 0x60262f
call fcn.140099df0
mov dword [rsp - 0x44], ecx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg r11, r8
mov r11, qword [rax]
xchg r11, r8
test r8, r8
mov dword [rsp - 0x38], edx
je 0x14008bb92
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x44], edx
je 0x14008bb92
mov edx, 0x47fcd395
sub edx, 0x40a0d153
add edx, 0x586a6ef
xor edx, 0xce2a835
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.14009a970
mov r10, r10
mov edx, 0x121c6b44
add edx, 0x1e7f368c
xor edx, 0x44cf951c
sub edx, 0x1e68bdd8
sub edx, 0x55eb7698
lea rcx, [rsp + 0x30]
call fcn.14009aa90
mov rdi, rdi
test rax, rax
je 0x14008bb5b
xor ecx, ecx
mov rdx, rdi
mov dword [rsp - 0x44], esp
mov word [rax], cx
movabs rcx, 0x67d30c672b24c1d5
xor rcx, 0x6856f88f
sub rcx, 0x69c1fad
sub rcx, 0x37dbae03
add rcx, 0x50d553f7
mov r8, qword [0x140142690]
movabs rax, 0x45fd9ccc13059067
xor rax, 0x1c4de819
add rax, 0x2f0f993c
add rax, 0x1af1b640
xor rax, 0x10389ab2
ror r8, 7
ror r8, 0x26
ror r8, 3
ror r8, 2
ror r8, 1
add r8, rcx
mov dword [rsp - 0x3c], esp
lea rcx, [rsp + 0x20]
xor r8, rax
ror r8, 0x21
ror r8, 2
ror r8, 1
ror r8, 2
ror r8, 1
ror r8, 1
call r8
mov rax, qword [0x140142680]
mov dword [rsp - 0x14], esp
lea r8, [rsp + 0x20]
not rax
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x44], 0x575dce20
movabs rcx, 0xfb715123e17cf96
xor rcx, 0x66d1ca8f
sub rcx, 0xe401c85
sub rcx, 0x429dab0d
add rcx, 0x29ba9770
mov r9, rbx
mov r8, r8
sub rax, rcx
movabs rcx, 0x2dd3471c35fc2312
xor rcx, 0x12a113e7
xor rcx, 0x133187f3
xor rcx, 0x6db763d3
xor rax, rcx
movabs rcx, 0x3bccafaa18d75935
xor rcx, 0x6f1fea21
sub rcx, 0x30154f19
xor rcx, 0xaa0ac92
sub rax, rcx
movabs rcx, 0x280ada03698a2972
sub rcx, 0x35a3178e
add rcx, 0x247b3443
xor rcx, 0x22b37b8e
not rax
mov dword [rsp - 0x40], edx
sub rax, rcx
lea rcx, [rsp + 0x30]
not rax
call rax
mov dword [rsp - 0x10], 0x7cf13096
xchg rbx, rsi
mov rsi, qword [rsp + 0x250]
xchg rsi, rbx
add rsp, 0x52c79ccf
sub rsp, 0x52c79a8f
pop rdi
ret
mov eax, 0x24c8475d
add eax, 0x41cb845e
xor eax, 0x55d6b503
xor eax, 0xf3457eb9
xchg rbx, rdx
mov rdx, qword [rsp + 0x250]
xchg rdx, rbx
sub rsp, 0xfffffffffffffdc0
mov r10, r10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbp, rbx
mov rbp, qword [rsp + 0x250]
xchg rbx, rbp
mov eax, 0x2c07620a
sub eax, 0x1be36b6f
xor eax, 0x18be58f1
add eax, 0xb76252cb
add rsp, 0x240
xchg r15, r15
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008f110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142c24], 0
jne 0x14008f212
xor edx, edx
mov r10, r10
lea r8, [0x140142c20]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov rsp, rsp
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0x28], ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x14], 0x6229dcac
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x44], 0x6f4d45ce
xor eax, ecx
mov ecx, eax
shr eax, 1
mov r15, r15
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov rsp, rsp
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov r8, r8
and eax, 1
neg eax
and eax, 0xedb88320
xchg r15, r15
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x24], esi
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x24], edx
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r12, r12
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rbp, rbp
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x30], 0x6c42d970
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x2c], edx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov r15, r15
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
xchg rbx, rbx
jb 0x14008f133
ret