joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074c1c
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x75f1c4d3
sub rsp, 0x75f1c533
lea rax, [rcx + 8]
xchg rbp, rbx
mov qword [rsp + 0x70], rbp
xchg rbp, rbx
xchg r12, rax
mov qword [rcx], r12
xchg r12, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rsi, rcx
mov rbx, rbx
xchg rbp, rdx
mov qword [rsp + 0x78], rdx
xchg rdx, rbp
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
lea rcx, [rsp + 0x20]
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
xchg rcx, rax
movups xmmword [rcx + 0x30], xmm0
xchg rcx, rax
xchg rdi, rax
movups xmmword [rdi + 0x40], xmm0
xchg rdi, rax
xchg rsi, rax
movups xmmword [rsi + 0x50], xmm0
xchg rsi, rax
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov dword [rsp - 0xc], 0x774b2441
xchg r13, rbp
mov r13, qword [rdx + 0x38]
xchg r13, rbp
lea rax, [rsp + 0x28]
xchg r15, r15
xchg rsp, rbx
mov rsp, qword [rdx]
xchg rsp, rbx
xchg r8, rax
mov qword [rsp + 0x20], r8
xchg r8, rax
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rcx, rsp
lea rdx, [rbp + 1]
mov dword [rsp - 0x24], ecx
xchg rcx, rsp
movups xmmword [rcx + 0x38], xmm0
xchg rsp, rcx
xchg rsp, rdi
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017924
xchg r8, r8
mov edx, 0x246ac2ad
xor edx, 0x23779a4d
add edx, 0x53b5a76f
sub edx, 0x2c23ad9c
test rbp, rbp
mov r12, r12
je 0x140074cb3
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
sub rbx, rax
mov r9, rbp
mov dword [rsp - 0x38], 0x75fd5501
mov r8d, 0x16d60ea9
xor r8d, 0x355862c2
add r8d, 0x1dccedeb
sub r8d, 0x3a64df0d
xor r8d, 0x6f67bb6
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x28], 0x159502c5
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
xchg rbp, rbp
sub r9, 1
jne 0x140074c85
xor ecx, ecx
xchg rcx, rbp
mov r8, rcx
xchg rbp, rcx
mov word [rax + rbp*2], cx
mov dword [rsp - 0x20], 0x4dd21433
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg r9, rdx
mov r9, qword [rsp + 0x20]
xchg r9, rdx
call fcn.140091d80
mov rcx, qword [rsp + 0x20]
xchg r10, r10
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
xchg rdx, rdx
jne 0x140074d5b
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x18], 0x4a4450a0
mov ecx, 0x44f326b8
xor ecx, 0x5a290e73
add ecx, 0x1ce9b625
xor ecx, 0x3bc3dec0
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, rsi
xchg rcx, rsi
mov rcx, qword [rsp + 0x80]
xchg rsi, rcx
nop
sub rsp, 0x303b957b
add rsp, 0x303b95db
pop rdi
mov dword [rsp - 0x1c], 0x2097eaf4
ret
call fcn.1400999d0
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rsi, r15
mov r15, qword [rsp + 0x80]
xchg r15, rsi
nop
add rsp, 0x55a29368
sub rsp, 0x55a29308
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007f694
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001900]
sub r10, rcx
mov r15, r15
xchg r8, rbp
mov rbp, rcx
xchg rbp, r8
lea rax, [r9 + r8]
mov dword [rsp - 0x30], 0x6deae7a7
mov ecx, r9d
mov edx, 0x658bfdf0
sub edx, 0xce08b40
xor edx, 0x4d3c48d7
add edx, 0x476acb3f
add edx, 0xb5d5002
inc r9
rol edx, cl
mov r14, r14
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
jb 0x14007f6ad
mov dword [rsp - 0x28], edx
mov rax, r8
ret

Function at 0x14008053c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg r11, rbx
xchg r9, rcx
mov qword [rsp + 8], r9
xchg rcx, r9
push rbp
mov dword [rsp - 0x40], 0x3f04686d
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
xchg rdx, rdx
nop
sub rsp, 0x687faa32
add rsp, 0x687faa12
mov rbx, rcx
xchg rcx, rcx
mov r13d, r8d
mov r9d, 0x964ecc1
add r9d, 0x3ad1f77e
add r9d, 0x1fd4aadf
sub r9d, 0x64078f1e
mov r12, rdx
cmp r8d, r9d
mov dword [rsp - 0x10], ebp
pushf
movabs rcx, 0xffffffff26b43815
add rcx, 0xa3f1a27
add rcx, 0x390f43d3
sub rcx, 0x21dbbfb2
add rcx, 0x7fffffff
xor rcx, 0x37d929a3
popf
pushf
mov eax, 0x7d740ac
add eax, 0x4eaa2036
sub eax, 0x41192769
add eax, 0x69cb1c19
sub eax, 0x7f33558e
popf
cmovb r9d, r13d
mul r9
cmovo rax, rcx
xchg r13, r13
xchg rcx, rdx
mov rdx, rax
xchg rdx, rcx
call fcn.140099880
lea r15d, [r13 + 0xfffff]
xor esi, esi
mov dword [rsp - 0x14], esp
shr r15d, 0x11
shr r15d, 1
shr r15d, 1
shr r15d, 1
mov rbp, rax
mov r12, r12
mov eax, dword [rbx + 0x18]
mov ebx, 0x2c62bee0
sub ebx, 0x1e061bb8
add ebx, 0x177d60a0
sub ebx, 0x25da03c7
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0xc], ebx
test r15d, r15d
je 0x140080755
mov eax, 0x6b56e16
add eax, 0x2252f269
xor eax, 0x4b62b97b
sub eax, 0x625ad904
mov rcx, qword [rsp + 0x60]
mov r14d, esi
shl r14d, 7
shl r14d, 7
shl r14d, 5
shl r14d, 1
mov edi, r13d
sub edi, r14d
xchg rbp, rcx
mov rdx, rcx
xchg rcx, rbp
cmp edi, eax
mov dword [rsp - 0xc], ebp
cmova edi, eax
mov r8d, edi
call fcn.140093d50
test al, al
mov rcx, rcx
je 0x140080753
shr edi, 1
shr edi, 1
xor r8d, r8d
xchg r9, r9
shr r14d, 2
test edi, edi
je 0x14008072c
xchg rbx, rbx
mov r15d, dword [rsp + 0x70]
xchg rbp, r9
mov rbp, r9
xchg r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
mov dword [rsp - 0x28], 0x371ae6e1
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x74376334
mov dword [rsp - 0x28], ecx
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x1400806f4
xchg rsi, rsi
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x6a807ee3
sub eax, 0x78ba921
xor eax, 0x7d61a612
xor eax, 0x1f8573d0
cmp esi, r15d
jb 0x14008068b
mov r9, r9
jmp 0x140080755
xor bl, bl
xchg rcx, r12
mov r12, rbp
xchg r12, rcx
call fcn.140099890
xchg r11, r11
mov al, bl
xchg r11, rbx
mov r11, qword [rsp + 0x68]
xchg r11, rbx
nop
sub rsp, 0x724c4046
add rsp, 0x724c4066
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
xchg rdi, rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x20], esp
ret
Function at 0x140081018
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov r12, r12
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
mov r12, r12
xchg rcx, r15
mov rcx, r15
xchg rcx, r15
mov r14d, r8d
mov dword [rsp - 0x24], 0x624eb265
mov r9d, 0x4ded7889
xor r9d, 0x7c161455
add r9d, 0x3cc79771
sub r9d, 0x24ea76b6
sub r9d, 0x49d48d97
xchg rdx, r12
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
mov dword [rsp - 0x28], esi
pushf
movabs rcx, 0xffffffff6ba084d3
sub rcx, 0x1e2f1f15
add rcx, 0x11bddbc0
add rcx, 0x7fffffff
add rcx, 0x20d0be82
popf
pushf
mov eax, 0x1620e53c
add eax, 0x29fae4ce
add eax, 0x2a70dfea
sub eax, 0x3bb19b2f
sub eax, 0x2edb0ec1
popf
cmovb r9d, r14d
mul r9
mov dword [rsp - 0x40], ebp
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140099880
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
mov rdx, rdx
shr ebp, 0xb
shr ebp, 6
shr ebp, 2
shr ebp, 1
xor edi, edi
mov rsi, rax
mov ebx, 0x7915a00
add ebx, 0x18d88460
xor ebx, 0x11bb0110
add ebx, 0x188ec48
sub ebx, 0x335bcbb7
test ebp, ebp
je 0x140081226
xchg rdx, rdx
mov eax, 0x733fc0f
xor eax, 0x1d40318d
xor eax, 0x2dbf5ecf
sub eax, 0x37bc934d
mov r9d, edi
mov r8d, r14d
mov r8, r8
shl r9d, 0x11
shl r9d, 2
shl r9d, 1
sub r8d, r9d
mov r15, r15
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov dword [rsp - 0x34], 0x694e3be2
mov r11d, r8d
xor r10d, r10d
shr r11d, 2
test r11d, r11d
xchg r11, r11
je 0x1400811da
xchg r10, rdx
mov r10, rsi
xchg rdx, r10
lea ecx, [r9 + r10]
mov dword [rsp - 0x40], ebp
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x74376334
mov r10, r10
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0x18], esi
jb 0x1400811ad
mov rdx, rsi
xchg rcx, rsi
mov rsi, r15
xchg rsi, rcx
call fcn.140094150
xchg rsi, rsi
test al, al
je 0x140081221
add edi, ebx
mov dword [rsp - 0xc], ebx
mov eax, 0x773f1dc2
xor eax, 0x4a004142
xor eax, 0x17a30cfe
xor eax, 0x2a8c507e
cmp edi, ebp
jb 0x140081161
mov dword [rsp - 0x34], esi
jmp 0x140081226
xor bl, bl
xchg r9, r9
mov rcx, rsi
call fcn.140099890
xchg r11, rbp
mov r11, qword [rsp + 0x58]
xchg rbp, r11
mov al, bl
xchg rdx, rdx
xchg rbx, r13
mov r13, qword [rsp + 0x50]
xchg r13, rbx
xchg rsi, r10
mov r10, qword [rsp + 0x60]
xchg rsi, r10
nop
add rsp, 0x4fb11cda
sub rsp, 0x4fb11cba
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140083de0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rsi
mov qword [rsp + 0x10], rbp
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg rdi, r11
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
xchg rsi, r12
mov r12, rcx
xchg r12, rsi
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x40], ecx
call fcn.140085b90
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov rsi, rsi
mov ebp, dword [rbx + rsi + 0xb4]
xchg r15, rax
mov r10, r15
xchg r15, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x10], 0x24d051b
je 0x140083f9e
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r9, r9
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
xchg r10, r10
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
jae 0x140083edf
xchg r14, r14
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140083eae
mov rcx, rcx
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x140083eca
mov rdx, rdx
add eax, r9d
cmp r11d, eax
jb 0x140083f50
inc r8w
xchg r11, r11
sub rdx, 0xffffffffffffffd8
cmp r8w, cx
jb 0x140083e9d
xchg r8, r14
mov r14, r8
xchg r14, r8
mov eax, dword [r10 + 4]
mov dword [rsp - 0xc], ebp
lea r9, [r10 + 4]
sub rax, 8
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
mov dword [rsp - 0x34], ebx
je 0x140083f90
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov rdx, rdx
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
je 0x140083f66
mov dword [rsp - 0x18], 0x5890e0ac
cmp ecx, 0xa
jne 0x140083f73
and eax, 0xfff
mov rsp, rsp
add qword [rax + r8], rdi
jmp 0x140083f73
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov dword [rsp - 0x1c], ecx
add r8, rsi
add r8, r11
jmp 0x140083ee8
and eax, 0xfff
mov dword [rsp - 0x2c], ebx
add dword [rax + r8], edi
nop
sub r10, 0x3dfe76d1
add r10, 0x3dfe76d3
sub rdx, 1
mov dword [rsp - 0x44], esp
jne 0x140083f19
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083e6b
mov rdi, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xchg rdi, r8
mov r8, qword [rsp + 0x48]
xchg r8, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140085c60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rsi
mov qword [rsp], rdi
push r13
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x383c190b
add rsp, 0x383c18eb
movzx eax, word [rcx]
mov rbx, rbx
mov r15d, edx
xor eax, 0x74376334
xchg r14, rcx
mov rsi, r14
xchg r14, rcx
cmp eax, 0x74373979
jne 0x140085e2b
movsxd rdx, dword [rcx + 0x3c]
xchg rbp, rbp
mov eax, dword [rdx + rcx]
xor eax, 0x74376334
cmp eax, 0x74372664
xchg r8, r8
jne 0x140085e2b
mov edx, dword [rdx + rcx + 0x88]
call fcn.140085b90
xchg rdx, rcx
mov rdx, rsi
xchg rcx, rdx
xchg r11, r14
mov r11, rax
xchg r11, r14
mov edx, dword [rax + 0x20]
mov rdi, rdi
call fcn.140085b90
mov edx, dword [r14 + 0x24]
xchg rsi, r8
mov rcx, r8
xchg r8, rsi
xchg r12, rbp
mov rbp, rax
xchg rbp, r12
call fcn.140085b90
mov dword [rsp - 0x40], ebp
mov edx, dword [r14 + 0x1c]
xchg rcx, r9
mov r9, rsi
xchg r9, rcx
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.140085b90
mov dword [rsp - 0x3c], ebx
xor edi, edi
xchg r10, rax
mov qword [rsp + 0x70], r10
xchg r10, rax
cmp dword [r14 + 0x18], edi
mov dword [rsp - 0x18], 0x78d34bc
jbe 0x140085e2b
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x38], 0x779d0995
xchg rbp, rcx
mov rbp, rsi
xchg rcx, rbp
call fcn.140085b90
mov ecx, 0x70673f45
sub ecx, 0x1b18bef2
add ecx, 0x5656781
add ecx, 0xa54c182b
xchg rdi, rbx
mov rdi, rax
xchg rdi, rbx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140085e0d
mov dword [rsp - 0x38], ebp
nop dword [rax]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
lea rcx, [rsp + 0x60]
mov r8d, 0x6144cda
xor r8d, 0x66373637
xor r8d, 0x65283124
xor r8d, 0x510d1697
xor r8d, 0x54065d5f
inc rbx
call fcn.14008efd0
cmp byte [rbx], 0
mov dword [rsp - 0x40], 0x668c461e
jne 0x140085dc0
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
xchg rsp, rsp
je 0x140085e76
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x18], esp
jb 0x140085d72
xor eax, eax
xchg rbx, rdx
mov rdx, qword [rsp + 0x68]
xchg rbx, rdx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
pop r14
mov dword [rsp - 0x28], edx
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
xchg rdx, rdx
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg r8, rsi
mov rcx, r8
xchg r8, rsi
xchg rbp, rax
mov rbp, qword [rsp + 0x70]
xchg rbp, rax
mov edx, dword [rax + rdx*4]
mov r10, r10
call fcn.140085b90
jmp 0x140085e2d
Function at 0x14008a393
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x6af463a8
sub rsp, 0x6af46408
mov rbx, qword [rcx]
mov dword [rsp - 0x20], 0x5ae46424
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
xchg rdx, rdx
xchg rdi, rsi
mov rdi, qword [rcx + 0x38]
xchg rdi, rsi
lea rcx, [rsp + 0x20]
xchg r14, r14
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
mov dword [rsp - 0x18], 0x118caa40
xchg rdx, rsp
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg r8, rsp
movups xmmword [r8 + 0x48], xmm0
xchg r8, rsp
call fcn.140017924
mov edx, 0x3d0aeb36
sub edx, 0x315900e3
add edx, 0x5c687b79
sub edx, 0x20453378
sub edx, 0x1925dfa1
test rsi, rsi
xchg rdx, rdx
je 0x14008a402
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x40], edx
mov r8, rsi
mov r9d, 0x61375703
sub r9d, 0x1c4eca71
sub r9d, 0x284abe0c
add r9d, 0x1476484a
sub r9d, 0x311415d1
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x18], 0xb2d9946
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 3
ror edx, 5
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov rbp, rbp
sub r8, 1
jne 0x14008a3d3
xor ecx, ecx
mov r15, r15
mov word [rax + rsi*2], cx
xchg rcx, r13
mov r13, qword [rsp + 0x20]
xchg r13, rcx
call fcn.14008a4d0
xchg r13, r13
xchg rcx, rbp
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
mov ebx, eax
xchg r15, rsi
mov r15, qword [rsp + 0x70]
xchg r15, rsi
lea rax, [rsp + 0x28]
mov dword [rsp - 0x3c], ebx
cmp rcx, rax
jne 0x14008a495
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x3c], ebp
mov ecx, 0x455ffe49
xor ecx, 0x548bec6e
xor ecx, 0x408127ae
sub ecx, 0x2b088738
sub ecx, 0x264cae21
rep stosb byte [rdi], al
xchg rsp, rsp
mov eax, ebx
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x1696fd7d
sub rsp, 0x1696fd1d
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400999d0
mov eax, ebx
mov dword [rsp - 0x38], ebx
xchg r9, rbx
mov r9, qword [rsp + 0x78]
xchg r9, rbx
nop
sub rsp, 0x14684735
add rsp, 0x14684795
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008b900
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbp
mov rbp, rsp
xchg r11, rbp
mov qword [r11 + 0x20], rbx
mov dword [rsp - 0x44], 0x57a4f36d
push rdi
sub rsp, 0x60
xchg rdi, rbx
mov rdi, qword [rcx]
xchg rbx, rdi
lea rax, [r11 - 0x40]
mov dword [rsp - 0x28], 0x72cf6beb
xchg rbx, rbp
mov qword [r11 + 8], rbx
xchg rbx, rbp
xorps xmm0, xmm0
mov dword [rsp - 0x28], 0x4d2c8326
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov qword [r11 + 0x10], rsi
mov rdi, rdi
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
xchg r14, rbx
mov qword [r11 + 0x18], rbx
xchg r14, rbx
mov r14, rdx
xchg r12, rsp
movups xmmword [r12 + 0x28], xmm0
xchg r12, rsp
lea rdx, [rsi + 1]
xchg rbx, rbx
xchg rsp, rdx
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg rsp, rdi
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017924
mov edx, 0x44355acd
xor edx, 0x2b36d952
sub edx, 0x63634f47
xor edx, 0x250f66eb
test rsi, rsi
mov rbx, rbx
je 0x14008ba24
mov rdi, rax
sub rbx, rax
mov rbp, rbp
mov r8, rsi
mov r9d, 0x20afdcf0
add r9d, 0x4764e153
sub r9d, 0x1fb1d84c
xor r9d, 0x5d758b0e
sub r9d, 0x15176dfa
nop word [rax + rax]
movzx ecx, dx
mov rbx, rbx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 3
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov dword [rsp - 0x24], 0xfd6f0c0
jne 0x14008b9ef
xor ecx, ecx
mov r8d, ebp
mov dword [rsp - 0x28], 0x4c331240
mov word [rax + rsi*2], cx
xchg r14, rcx
mov rdx, rcx
xchg r14, rcx
xchg rbp, rcx
mov rbp, qword [rsp + 0x20]
xchg rbp, rcx
call fcn.14008bb10
mov dword [rsp - 0x14], 0x18595c53
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg rsi, r14
mov rsi, qword [rsp + 0x80]
xchg r14, rsi
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
xchg rbp, r9
mov r9, qword [rsp + 0x70]
xchg rbp, r9
cmp rcx, rax
mov dword [rsp - 0x1c], esp
jne 0x14008bae5
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x3c], 0x5bd6d24e
mov ecx, 0x3ced933e
sub ecx, 0x129f3041
add ecx, 0xeb91a6f
add ecx, 0x1ce99914
xor ecx, 0x55f116b0
rep stosb byte [rdi], al
mov eax, ebx
xchg rbx, rdi
mov rdi, qword [rsp + 0x88]
xchg rdi, rbx
nop
sub rsp, 0x45c8777b
add rsp, 0x45c877db
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400999d0
mov eax, ebx
mov dword [rsp - 0x44], edx
xchg r11, rbx
mov r11, qword [rsp + 0x88]
xchg rbx, r11
nop
add rsp, 0x61824c9e
sub rsp, 0x61824c3e
pop rdi
ret
Function at 0x14008bb10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x30], 0x7aa002ca
xchg rdx, rsi
mov rbx, rsi
xchg rsi, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
mov rbp, rbp
lea rcx, [rsp + 0x30]
mov r8d, 0x47d39afd
xor r8d, 0x13e8cc91
add r8d, 0x29f2e66
sub r8d, 0x56da82ca
call fcn.14009a030
mov dword [rsp - 0x3c], 0x275120a9
mov rax, qword gs:[0x60]
xchg r13, r8
mov r13, qword [rax + 0x18]
xchg r8, r13
mov rax, qword [r8 + 0x10]
mov dword [rsp - 0x34], ecx
xchg r11, r8
mov r11, qword [rax]
xchg r8, r11
test r8, r8
je 0x14008bdf2
mov dword [rsp - 0x38], 0x140950a2
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008bdf2
xchg r10, r10
mov edx, 0x3337c094
sub edx, 0xba407f6
xor edx, 0x385824ba
add edx, 0x43dfbd8b
sub edx, 0x63ab58ab
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x40], 0x67d64344
lea r9d, [rdx - 1]
call fcn.14009ab50
mov edx, 0x7903634b
sub edx, 0x5ae76ad6
xor edx, 0x71027639
xor edx, 0x181414a3
sub edx, 0x770d9a93
lea rcx, [rsp + 0x30]
call fcn.14009ac50
test rax, rax
mov dword [rsp - 0x20], 0x6ea659f7
je 0x14008bdb6
xor ecx, ecx
xchg r13, rdx
mov r13, rdi
xchg rdx, r13
mov word [rax], cx
mov dword [rsp - 0x20], 0x518c09f4
movabs rcx, 0x273ef677188929e7
add rcx, 0x4b64c67f
xor rcx, 0x3d944275
sub rcx, 0x1b2464b
xor rcx, 0x4427a4e0
mov rax, qword [str._W4Ik6x]
rol rax, 2
rol rax, 4
rol rax, 3
rol rax, 2
rol rax, 1
rol rax, 1
xor rax, rcx
movabs rcx, 0x7aedce866b48262b
xor rcx, 0x2c45d58f
xor rcx, 0x6df86b8d
add rcx, 0x610cb6cd
ror rax, 0x12
ror rax, 0xd
ror rax, 1
ror rax, 5
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
movabs rcx, 0xeaba67c20742723d
add rcx, 0x733116e9
sub rcx, 0x2a265dd7
add rcx, 0x26e41d11
add rcx, 0x24ba0fa7
ror rax, 0x29
ror rax, 0xc
ror rax, 3
ror rax, 3
ror rax, 1
ror rax, 1
add rax, rcx
mov dword [rsp - 0x2c], 0x1985112c
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140143680]
lea r8, [rsp + 0x20]
mov dword [rsp - 0x14], 0x5df6cf8a
ror rax, 3
ror rax, 4
ror rax, 4
ror rax, 2
ror rax, 4
ror rax, 5
ror rax, 1
lea rdx, [rsp + 0x260]
mov rsi, rsi
movabs rcx, 0x678f0fee3686e1ae
xor rcx, 0x138b386e
add rcx, 0x923234
add rcx, 0x58fd0612
xchg rbx, rsp
mov r9, rsp
xchg rbx, rsp
add rax, rcx
mov dword [rsp - 0x34], 0x5dee5c8c
lea rcx, [rsp + 0x30]
ror rax, 4
ror rax, 1
not rax
mov r15, r15
call rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x250]
xchg rdi, rbx
sub rsp, 0x4088337b
add rsp, 0x408835bb
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x70b9b2e3
sub eax, 0x16d89dbd
sub eax, 0x588a039c
add eax, 0x31eddfbe
add eax, 0x8cbb0eb9
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg r13, rbx
sub rsp, 0xfffffffffffffdc0
xchg r11, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbx, r9
mov r9, qword [rsp + 0x250]
xchg rbx, r9
mov eax, 0x34977acc
add eax, 0x37c0aee9
xor eax, 0x6565382d
add eax, 0xb6c2ef9d
add rsp, 0x240
xchg r9, r9
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008f320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140143c24], 0
jne 0x14008f423
xor edx, edx
mov r12, r12
lea r8, [0x140143c20]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
xchg r13, r13
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
mov r15, r15
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x38], 0x77996138
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xchg r12, r12
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x44], 0x18896a6f
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x14], 0x59399ecb
shr ecx, 1
and eax, 1
neg eax
mov rcx, rcx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r12, r12
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg rdi, rdi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov r14, r14
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rsi, rsi
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x38], 0x52654963
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x34], ebp
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x38], 0x495c5e3f
cmp edx, 0x100
jb 0x14008f343
ret