joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053e30
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087606
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14049ff9c]
mov dword [rsp - 0x20], 0x3b1c1cfc
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
xchg rdi, rdi
ret

Function at 0x140053e40
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087637
xchg r13, r10
mov r13, rcx
xchg r10, r13
mov eax, dword [0x14049ffa0]
cmp qword [0x1404a0098], 0
jne 0x140087450
mov dword [rsp - 0x40], edi
syscall
ret

Function at 0x140053e50
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087661
xchg r10, r15
mov r15, rcx
xchg r10, r15
mov eax, dword [0x14049ffa4]
mov r8, r8
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
xchg r9, r9
ret

Function at 0x140053e60
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008768d
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x14049ffa8]
mov dword [rsp - 0x18], ebp
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
ret

Function at 0x140053e70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400875dd
xchg rcx, r9
mov r10, r9
xchg r9, rcx
mov eax, dword [0x14049ff98]
cmp qword [0x1404a0098], 0
xchg r13, r13
jne 0x140087450
syscall
ret

Function at 0x140053e80
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087b2f
mov r10, rcx
mov eax, dword [0x1404a001c]
cmp qword [0x1404a0098], 0
mov dword [rsp - 0x18], ebx
jne 0x140087450
syscall
ret

Function at 0x140053e90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400876b7
xchg r10, rbx
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x14049ffac]
mov r15, r15
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
ret

Function at 0x140053ea0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087560
xchg r10, rbx
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x14049ff8c]
mov dword [rsp - 0x14], esi
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
mov dword [rsp - 0x38], edx
ret

Function at 0x140053eb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087733
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x14049ffb8]
mov dword [rsp - 0x20], esi
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
ret

Function at 0x140053ee0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087d2b
add rsp, 0x78bff823
sub rsp, 0x78bff943
lea rcx, [0x1400874c6]
nop
sub rsp, 8
mov qword [rsp], rcx
push rbp
xchg rcx, rcx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
mov dword [rsp - 0x20], 0x45228800
push qword [0x1404a00a0]
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov ecx, 0x119f66d8
add ecx, 0x4cc3e82d
add ecx, 0x1897018
sub ecx, 0x2c64fe93
sub ecx, 0x3387c07a
rep movsq qword [rdi], qword [rsi]
mov dword [rsp - 0x20], 0xf7dee02
jmp qword [0x1404a0098]
xchg rcx, r14
mov r10, r14
xchg r14, rcx
mov eax, dword [0x1404a004c]
xchg r12, r12
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
ret

Function at 0x140053ef0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400875b1
xchg r10, r11
mov r11, rcx
xchg r10, r11
mov eax, dword [0x14049ff94]
xchg rbp, rbp
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
mov rbx, rbx
ret
Function at 0x140053f00
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087cae
xchg r10, r11
mov r11, rcx
xchg r11, r10
mov eax, dword [0x1404a0040]
cmp qword [0x1404a0098], 0
mov r15, r15
jne 0x140087450
syscall
ret

Function at 0x140053f10
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087c57
xchg rdx, rcx
mov r10, rdx
xchg rdx, rcx
mov eax, dword [0x1404a0038]
cmp qword [0x1404a0098], 0
xchg r12, r12
jne 0x140087450
syscall
ret

Function at 0x140053f20
Capabilities:
Execute syscall

Disassembly:
jmp 0x140087c80
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a003c]
cmp qword [0x1404a0098], 0
mov dword [rsp - 0x24], 0x47459db6
jne 0x140087450
syscall
ret

Function at 0x140053f30
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008758e
mov r10, rcx
mov eax, dword [0x14049ff90]
cmp qword [0x1404a0098], 0
xchg r14, r14
jne 0x140087450
syscall
ret

Function at 0x140053f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008775d
xchg r10, rsp
mov rsp, rcx
xchg r10, rsp
mov eax, dword [0x14049ffbc]
cmp qword [0x1404a0098], 0
mov dword [rsp - 0x34], 0x29f4e316
jne 0x140087450
syscall
ret
Function at 0x1400577e0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
push rbx
mov qword [rsp], rdi
sub rsp, 0x50
movabs rbx, 0x2d4c5ee5554712f7
xor rbx, 0x5093399e
add rbx, 0x3d55b3a8
xor rbx, 0x76add85b
add rbx, 0xc32095d
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x28], rbx
mov dword [rsp - 0x40], 0x67601ffc
jne 0x140057a1b
mov eax, 0xa67ba2f
xor eax, 0x1d8a25c6
add eax, 0x5a50ae54
xor eax, 0x723e4ed0
mov dword [rsp + 0x20], 0x2231527f
add dword [rsp + 0x20], 0x42fb407f
sub dword [rsp + 0x20], 0x233cfb93
xor dword [rsp + 0x20], 0x2b7cb30c
sub dword [rsp + 0x20], 0x6a8f2399
mov word [rsp + 0x30], ax
xchg r15, r15
xor r8d, r8d
mov dword [rsp + 0x24], 0x617bf841
add dword [rsp + 0x24], 0x10e1c54
xor dword [rsp + 0x24], 0x42576f5c
xor dword [rsp + 0x24], 0x20ea7b5f
mov dword [rsp + 0x28], 0x6a11937
xor dword [rsp + 0x28], 0x16b8b1ca
sub dword [rsp + 0x28], 0x8cdd0bb
add dword [rsp + 0x28], 0x3d8f4336
sub dword [rsp + 0x28], 0x44951ac5
mov dword [rsp + 0x2c], 0x75487363
xor dword [rsp + 0x2c], 0x3b9cef10
xor dword [rsp + 0x2c], 0x65b11182
sub dword [rsp + 0x2c], 0x2afd8d5a
xchg r10, r8
mov qword [rsp + 0x60], r10
xchg r10, r8
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
nop dword [rax + rax]
mov dword [rsp - 0x34], 0x31e7ae62
mov rcx, qword [rsp + 0x60]
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov r9, r9
mov eax, 0x51458a7c
add eax, 0x21f5a0b4
sub eax, 0x5c101142
xor eax, 0x6863f8a3
sub eax, 0x7a5578cc
shr eax, cl
mov dword [rsp - 0x44], edx
movzx ecx, al
xchg r12, rax
mov r12, qword [rsp + 0x60]
xchg r12, rax
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
inc rax
mov qword [rsp + 0x60], rax
xchg r13, r13
mov rax, qword [rsp + 0x60]
cmp rax, 9
jb 0x140057908
xor edx, edx
xchg r14, r14
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
call fcn.14007aca0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg rbx, rax
mov r8, rbx
xchg rbx, rax
xor rdx, rbx
mov dword [rsp - 0x44], ecx
xor eax, eax
mov qword [rdi + 0x28], rdx
lea rdi, [rsp + 0x32]
mov ecx, 0x3e9d21a4
add ecx, 0x34527c0f
sub ecx, 0x42bc0aae
add ecx, 0x303a8b08
sub ecx, 0x606e1e04
rep stosb byte [rdi], al
mov dword [rsp - 0x44], ebx
cmp rdx, rbx
je 0x140057a25
lea rdx, str.gem_
xchg r8, r10
mov rcx, r10
xchg r10, r8
call fcn.14006b250
test al, al
mov dword [rsp - 0x34], ebx
setne al
xchg rbx, rdi
mov rdi, qword [rsp + 0x68]
xchg rdi, rbx
nop
sub rsp, 0x589ad6ee
add rsp, 0x589ad73e
pop rdi
mov dword [rsp - 0x44], ebp
ret
mov al, 0xf
add al, 0x5c
xor al, 0x6f
add al, 0xa
sub al, 0xd
xchg rbx, r12
mov r12, qword [rsp + 0x68]
xchg r12, rbx
nop
sub rsp, 0x205cabf7
add rsp, 0x205cac47
pop rdi
mov dword [rsp - 0x34], ebp
ret
Function at 0x140058050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
push 0x38a96be4
mov qword [rsp], rdi
sub rsp, 0x50
xchg rsi, rsi
movabs rbx, 0x2d4c5ee549892b65
xor rbx, 0x4f0148d7
add rbx, 0x2bcb530
xor rbx, 0x26b731eb
add rbx, 0x11c3e79e
xchg r14, rcx
mov rdi, r14
xchg r14, rcx
cmp qword [rcx + 0x20], rbx
jne 0x1400582bf
mov dword [rsp - 0x2c], ebx
mov eax, 0x6237d9ea
sub eax, 0x3d256fc5
xor eax, 0x43a4335a
xor eax, 0x77cf29a8
xor eax, 0x11797048
mov dword [rsp + 0x20], 0x5b2d9fec
sub dword [rsp + 0x20], 0x5126c931
add dword [rsp + 0x20], 0x2f30a245
xor dword [rsp + 0x20], 0x6bfdf5f2
sub dword [rsp + 0x20], 0x52ca8c20
mov word [rsp + 0x34], ax
mov dword [rsp - 0x2c], ecx
xor r8d, r8d
mov dword [rsp + 0x24], 0x181129d9
xor dword [rsp + 0x24], 0x6fd73c53
sub dword [rsp + 0x24], 0x62dac8a0
xor dword [rsp + 0x24], 0x14834c7c
mov dword [rsp + 0x28], 0x518390b
add dword [rsp + 0x28], 0x65c055b8
xor dword [rsp + 0x28], 0x5dc74350
sub dword [rsp + 0x28], 0x36c4cca6
mov dword [rsp + 0x2c], 0x406ecb14
xor dword [rsp + 0x2c], 0x6c0dc6e5
add dword [rsp + 0x2c], 0x4b15f17e
sub dword [rsp + 0x2c], 0x774efeae
mov dword [rsp + 0x30], 0x5ed857b1
add dword [rsp + 0x30], 0x146f41b9
xor dword [rsp + 0x30], 0xc35ad28
xor dword [rsp + 0x30], 0x1ca9a04
sub dword [rsp + 0x30], 0x7eb4ad61
mov qword [rsp + 0x60], r8
mov dword [rsp - 0x1c], 0x1cb49629
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
xchg rbx, rcx
mov rbx, qword [rsp + 0x60]
xchg rbx, rcx
xchg r8, rax
mov r8, qword [rsp + 0x60]
xchg r8, rax
and cl, 3
mov dword [rsp - 0x20], 0x62ef9dc0
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x193d1775
xor eax, 0x76e16e6c
xor eax, 0x236c513
sub eax, 0x58384aa5
sub eax, 0x10bf08e4
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x40], 0x2417654a
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
xor cx, dx
mov dword [rsp - 0xc], ebp
mov word [rsp + rax*2 + 0x36], cx
xchg r12, rax
mov r12, qword [rsp + 0x60]
xchg r12, rax
inc rax
mov rbp, rbp
xchg r11, rax
mov qword [rsp + 0x60], r11
xchg r11, rax
mov rax, qword [rsp + 0x60]
xchg r13, r13
cmp rax, 0xb
jb 0x14005818e
xor edx, edx
mov dword [rsp - 0x20], 0x385e03cf
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
call fcn.14007aca0
mov dword [rsp - 0x18], 0x65299a9e
xchg rdx, rdi
mov rdi, rax
xchg rdi, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor rdx, rbx
mov dword [rsp - 0x1c], edi
xor eax, eax
xchg rsp, rdx
mov qword [rdi + 0x20], rsp
xchg rsp, rdx
lea rdi, [rsp + 0x36]
mov r15, r15
mov ecx, 0x7aae0493
xor ecx, 0x3700c099
sub ecx, 0x2e131af5
sub ecx, 0x1f9ba90a
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400582c7
mov dword [rsp - 0x14], edx
lea rdx, [0x14049f3c8]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.14006b7a0
test al, al
setne al
xchg r15, r15
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg rbx, r13
sub rsp, 0xffffffffffffffb0
pop rdi
mov dword [rsp - 0x28], ecx
ret
mov al, 0x1e
add al, 0x24
sub al, 4
xor al, 0x3f
xchg r10, rbx
mov r10, qword [rsp + 0x68]
xchg rbx, r10
add rsp, 0x50
xchg rbp, rbp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140072a20
Capabilities:
Encode data using xor

Disassembly:
push rdi
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
mov dword [rsp + 0x20], 0x455c6f88
add dword [rsp + 0x20], 0x2a5b0fc
sub dword [rsp + 0x20], 0x3a03bde3
mov r8, rcx
mov byte [rsp + 0x24], 0x22
add byte [rsp + 0x24], 0x46
xor byte [rsp + 0x24], 0x5a
add byte [rsp + 0x24], 0x5b
mov qword [rsp + 0x28], 0x7eef2e06
sub qword [rsp + 0x28], 0x489ac89d
add qword [rsp + 0x28], 0x311a0973
sub qword [rsp + 0x28], 0x676e6edc
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x52d962a9
sub edx, 0x26322c79
sub edx, 0x27b3cdaf
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x140072a90
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x5d
xor byte [rsp + 7], 0x1c
xor byte [rsp + 7], 0x28
sub byte [rsp + 7], 0x69
popf
je 0x140072b45
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x140072b48
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140072b38
movzx eax, byte [rcx]
test al, al
jne 0x140072b1c
jmp 0x140072b48
inc r8
cmp byte [r8], 0
jne 0x140072b07
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x720cd8fb
sub ecx, 0x1b38de8c
sub ecx, 0x3dc9bf64
xor ecx, 0x190a3b0e
rep stosb byte [rdi], al
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x140072b80
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x53d5ec70
add rsp, 0x53d5ec60
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x140072d3b
mov dword [rsp + 0x28], 0x594ced0
add dword [rsp + 0x28], 0x3e673d2d
sub dword [rsp + 0x28], 0x116d5fd7
xor dword [rsp + 0x28], 0x3f70ce87
mov byte [rsp + 0x2c], 0xe
xor byte [rsp + 0x2c], 0x60
xor byte [rsp + 0x2c], 0xe3
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x4146fc4c
sub edx, 0x686263f
xor edx, 0x663054ba
sub edx, 0x57fd1a36
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x140072bde
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x140072c5f
lea rcx, [rcx + 1]
cmp dil, al
je 0x140072d27
movzx eax, byte [rcx]
test al, al
jne 0x140072c47
mov word [rsp + 0x20], 0x2e15
xor word [rsp + 0x20], 0x254c
add word [rsp + 0x20], 0x2b57
xor word [rsp + 0x20], 0x34c
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x293ed295
add edx, 0x48d67182
sub edx, 0x6d21db96
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x140072c90
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x140072d0c
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x140072da5
movzx eax, byte [rcx]
test al, al
jne 0x140072cf4
xor dl, dl
mov r8d, 0x5d7eb1a5
xor r8d, 0x726e3c00
sub r8d, 0x2f108da2
jmp 0x140072d46
mov r8d, 0x55a08b2f
sub r8d, 0x4d724db3
sub r8d, 0x82e3d7b
mov dl, 0x3c
add dl, 0x11
sub dl, 0x2c
xor dl, 0x20
test r8b, 2
je 0x140072d6d
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x210baaf5
sub ecx, 0xff69c38
sub ecx, 0x11150ebb
rep stosb byte [rdi], al
test r8b, 1
je 0x140072d91
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x6c72bc03
xor ecx, 0x25753c19
sub ecx, 0x49078015
rep stosb byte [rdi], al
movzx eax, dl
nop
add rsp, 0x306cbc76
sub rsp, 0x306cbc66
pop rdi
ret
mov r8d, 0x37309fa8
xor r8d, 0x57d5cc39
xor r8d, 0x39d77b38
xor r8d, 0x593228aa
jmp 0x140072d3b
Function at 0x140073a10
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov word [rsp + 0x20], 0x7b44
xor word [rsp + 0x20], 0x1244
sub word [rsp + 0x20], 0x3304
mov r8, rcx
mov qword [rsp + 0x28], 0x5b7e772e
add qword [rsp + 0x28], 0x15aa7798
add qword [rsp + 0x28], 0x3db2808
sub qword [rsp + 0x28], 0x750416ce
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x60ae8607
sub edx, 0x4c37e9ad
sub edx, 0xf8333d9
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x140073a59
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x23
add byte [rsp + 2], 0x2b
sub byte [rsp + 2], 0x4e
test al, al
je 0x140073ade
lea rcx, [rcx + 1]
cmp dl, al
je 0x140073b0e
movzx eax, byte [rcx]
test al, al
jne 0x140073ac7
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x483cf070
sub ecx, 0x4650faa8
xor ecx, 0x1ebf5ca
rep stosb byte [rdi], al
test dl, dl
jne 0x140073b1e
mov byte [r8], al
lea rax, [r8 + 1]
sub rsp, 0xfffffffffffffff0
pop rdi
ret
mov dl, 0x49
add dl, 0xb
add dl, 0xd
xor dl, 0x60
jmp 0x140073ae0
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x140073c20
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rcx, rbp
mov qword [rsp + 0x18], rsi
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg rdi, r9
push r14
xchg rsi, rsi
nop
add rsp, 0x30c6ffeb
sub rsp, 0x30c7000b
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, rsi
mov rsi, rdx
xchg rdi, rsi
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x30], ebx
call fcn.140075620
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x44], esp
mov ebp, dword [rbx + rsi + 0xb4]
mov r10, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x20], esp
je 0x140073df3
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x38], ebx
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
xchg rdi, rdi
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x10], ebp
cmp r14w, cx
jae 0x140073d2a
mov eax, dword [rdx + 8]
xchg rdx, rdx
test eax, eax
jne 0x140073ce1
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x28], 0x76db3d4f
cmp r11d, r9d
jb 0x140073d05
add eax, r9d
mov r13, r13
cmp r11d, eax
jb 0x140073da8
inc r8w
mov dword [rsp - 0x20], 0x7ff399f3
nop
add rdx, 0x77b303
sub rdx, 0x77b2db
cmp r8w, cx
jb 0x140073cd0
xchg rbx, r14
mov r8, rbx
xchg rbx, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg r10, r10
nop
sub rax, 0x60ddd394
add rax, 0x60ddd38c
nop
add r10, 0x3174ace6
sub r10, 0x3174acde
shr rax, 1
test eax, eax
mov dword [rsp - 0xc], 0x3d0ca82d
je 0x140073de5
mov edx, eax
nop word [rax + rax]
xchg r13, r13
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xa
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140073dbd
cmp ecx, 0xa
mov rdi, rdi
jne 0x140073dce
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140073dce
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov r9, r9
add r8, r11
jmp 0x140073d33
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x10], 0x22c3fa3e
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
jne 0x140073d78
xchg rdx, rdx
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140073c9c
xchg r13, r13
mov rbx, qword [rsp + 0x30]
xchg r9, rbp
mov r9, qword [rsp + 0x38]
xchg r9, rbp
xchg r10, rsi
mov r10, qword [rsp + 0x40]
xchg rsi, r10
xchg rdi, r11
mov r11, qword [rsp + 0x48]
xchg r11, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400756f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
xchg r14, r14
push r13
nop
push 0x3d2eabbf
mov qword [rsp], r14
push rax
mov qword [rsp], r15
nop
add rsp, 0x5b955c91
sub rsp, 0x5b955cb1
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x28cb554b
mov rdi, rdi
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x28cb0f06
mov rdi, rdi
jne 0x1400758a6
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x18], 0x71bf9cb
xor eax, 0x28cb554b
cmp eax, 0x28cb101b
jne 0x1400758a6
mov dword [rsp - 0x24], 0x260af6fd
mov edx, dword [rdx + rcx + 0x88]
call fcn.140075620
mov rcx, rsi
mov r14, rax
xchg rsi, rsi
mov edx, dword [rax + 0x20]
call fcn.140075620
mov edx, dword [r14 + 0x24]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
mov r12, rax
call fcn.140075620
mov edx, dword [r14 + 0x1c]
xchg r13, r13
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg r14, rax
mov r13, r14
xchg r14, rax
call fcn.140075620
xor edi, edi
mov dword [rsp - 0x1c], esi
xchg rdi, rax
mov qword [rsp + 0x70], rdi
xchg rdi, rax
cmp dword [r14 + 0x18], edi
jbe 0x1400758a6
nop dword [rax]
mov dword [rsp - 0x38], 0x1153b672
mov edx, dword [r12 + rdi*4]
xchg rsi, rbp
mov rcx, rbp
xchg rbp, rsi
call fcn.140075620
mov ecx, 0x4deb9af8
sub ecx, 0x3d255efb
xor ecx, 0x90b05d1
xor ecx, 0x22085bab
add ecx, 0xc43a9a78
mov rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov dword [rsp - 0x10], ecx
je 0x140075888
nop dword [rax]
xchg rdx, r12
mov r12, rbx
xchg r12, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x5cc5bd66
sub r8d, 0x55998293
xor r8d, 0x6d8f4296
sub r8d, 0x122d5cbe
sub r8d, 0x58761b86
inc rbx
call fcn.140081970
cmp byte [rbx], 0
xchg r13, r13
jne 0x140075840
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov r13, r13
je 0x1400758e2
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x38], esi
jb 0x1400757fa
xor eax, eax
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg r10, rbx
sub rsp, 0xffffffffffffffe0
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0xc], 0x3a9503d4
call fcn.140075620
jmp 0x1400758a8
Function at 0x140079953
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rcx
mov qword [rsp], rdi
nop
sub rsp, 0x246c7dcb
add rsp, 0x246c7d6b
xchg rbp, rbx
mov rbp, qword [rcx]
xchg rbx, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x30], 0x2031a19d
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
mov r15, r15
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xchg rsp, r14
movups xmmword [r14 + 0x28], xmm0
xchg r14, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x38], 0x6ac89191
xchg rsi, rsp
movups xmmword [rsi + 0x48], xmm0
xchg rsi, rsp
call fcn.14000ed30
mov edx, 0x4c0c5c02
sub edx, 0x6506889
sub edx, 0x229793c4
sub edx, 0x1e30f734
test rsi, rsi
je 0x1400799a7
xchg rbp, rax
mov rdi, rbp
xchg rbp, rax
sub rbx, rax
xchg r8, r13
mov r13, rsi
xchg r13, r8
mov r9d, 0xb5cbf0c
add r9d, 0x95e876a
xor r9d, 0x20be123a
sub r9d, 0x3405534d
nop dword [rax]
movzx ecx, dx
mov rbx, rbx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 1
ror edx, 1
ror edx, 4
ror edx, 2
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0xc], ebp
sub r8, 1
jne 0x140079978
xor ecx, ecx
mov word [rax + rsi*2], cx
mov dword [rsp - 0x18], 0x19b83fa1
xchg rdi, rcx
mov rdi, qword [rsp + 0x20]
xchg rcx, rdi
call fcn.140079a70
xchg rdx, rdx
xchg rcx, r14
mov r14, qword [rsp + 0x20]
xchg rcx, r14
mov ebx, eax
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x38], 0x2d3e7624
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x140079a38
mov dword [rsp - 0x20], edx
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x6de11ace
add ecx, 0x889d224
sub ecx, 0x4ce09dc4
xor ecx, 0x298a4f1e
rep stosb byte [rdi], al
mov eax, ebx
mov dword [rsp - 0x24], edx
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x230ec3ac
sub rsp, 0x230ec34c
pop rdi
mov dword [rsp - 0x34], 0x7c949f44
ret
call fcn.140096230
mov r15, r15
mov eax, ebx
xchg rbx, r13
mov r13, qword [rsp + 0x78]
xchg rbx, r13
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x14], 0x5b010090
ret