joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
push rdi
mov dword [rsp - 0x18], edi
push r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov dword [rsp - 0xc], 0x43c23ddf
nop
add rsp, 0x339101c3
sub rsp, 0x339101e3
movzx eax, word [rcx]
mov r15d, edx
mov r12, r12
xor eax, 0x4dcc1598
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x4dcc4fd5
mov dword [rsp - 0x2c], 0x571485d4
jne 0x1400859ef
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x4dcc1598
mov rsp, rsp
cmp eax, 0x4dcc50c8
jne 0x1400859ef
mov edx, dword [rdx + rcx + 0x88]
mov rsi, rsi
call fcn.140085770
xchg rcx, r11
mov r11, rsi
xchg r11, rcx
mov r14, rax
xchg r9, r9
mov edx, dword [rax + 0x20]
call fcn.140085770
mov edx, dword [r14 + 0x24]
xchg r8, rcx
mov r8, rsi
xchg r8, rcx
xchg r10, rax
mov r12, r10
xchg r10, rax
call fcn.140085770
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x40], edx
mov rcx, rsi
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.140085770
xchg rdx, rdx
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x1400859ef
mov dword [rsp - 0x44], 0xedd0beb
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
xchg rbp, rbp
call fcn.140085770
mov ecx, 0x11f078c6
add ecx, 0x6717a594
sub ecx, 0x58eec82a
add ecx, 0xdfe6a9cf
mov rbx, rax
mov rbp, rbp
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x1400859cd
mov dword [rsp - 0x24], 0x44cbcc1f
nop dword [rax]
xchg rdx, r8
mov r8, rbx
xchg rdx, r8
lea rcx, [rsp + 0x60]
mov r8d, 0x5083365e
sub r8d, 0x2582ba09
add r8d, 0x1392258a
sub r8d, 0x3e92a1de
inc rbx
mov dword [rsp - 0x30], 0x65ed7fd9
call fcn.14008ea80
cmp byte [rbx], 0
jne 0x140085983
mov dword [rsp - 0x44], edi
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x20], 0x3b6784ab
je 0x140085a42
inc edi
cmp edi, dword [r14 + 0x18]
xchg r10, r10
jb 0x14008593f
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rdx, rdx
nop
sub rsp, 0x2879010c
add rsp, 0x2879012c
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov r9, r9
xchg rcx, r10
mov r10, rsi
xchg rcx, r10
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x2c], 0x65290dec
mov edx, dword [rax + rdx*4]
call fcn.140085770
jmp 0x1400859f1
Function at 0x140089ea3
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
push rdi
nop
sub rsp, 0x37fcc2d4
add rsp, 0x37fcc274
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x30], 0x12133ae
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r15, r15
xchg r9, rax
mov qword [rsp + 0x20], r9
xchg r9, rax
xchg r11, rsp
movups xmmword [r11 + 0x28], xmm0
xchg rsp, r11
lea rdx, [rsi + 1]
xchg r9, r9
xchg r8, rsp
movups xmmword [r8 + 0x38], xmm0
xchg rsp, r8
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.140017890
mov edx, 0x1235272c
xor edx, 0x37e42760
add edx, 0x4cf7ae57
sub edx, 0x407061ad
test rsi, rsi
mov dword [rsp - 0x20], 0x6de8ce81
je 0x140089f11
xchg rbx, rdi
mov rbx, rax
xchg rdi, rbx
sub rbx, rax
mov dword [rsp - 0x34], ebp
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x7f0acb89
sub r9d, 0x57ebcd35
xor r9d, 0x6a818225
sub r9d, 0x28120b72
sub r9d, 0x258d7000
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x40], 0x771388c9
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 2
ror edx, 5
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r13, r13
mov word [rdi - 2], cx
sub r8, 1
jne 0x140089ee0
xor ecx, ecx
mov dword [rsp - 0x3c], esi
mov word [rax + rsi*2], cx
xchg r13, rcx
mov r13, qword [rsp + 0x20]
xchg r13, rcx
call fcn.140089fc0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg rbp, rbp
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0xc], 0x2a9b70cd
jne 0x140089f8f
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x2d92dd24
xor ecx, 0x166cd462
xor ecx, 0x58a62324
xor ecx, 0x52c8c687
xor ecx, 0x3190ecd5
rep stosb byte [rdi], al
mov dword [rsp - 0x38], ecx
mov eax, ebx
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
mov dword [rsp - 0x34], 0x155dec9f
pop rdi
ret
call fcn.140099360
mov rcx, rcx
mov eax, ebx
xchg rbx, r13
mov r13, qword [rsp + 0x78]
xchg r13, rbx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008b4b6
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rdx
mov r11, rdx
xchg rsp, rdx
xchg rbx, r13
mov qword [r11 + 0x20], r13
xchg rbx, r13
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
mov rsi, rsi
xchg rbp, r15
mov qword [r11 + 8], r15
xchg rbp, r15
xorps xmm0, xmm0
mov r15, r15
xchg r9, rax
mov qword [r11 - 0x48], r9
xchg r9, rax
mov ebp, r8d
xchg rsi, r14
mov qword [r11 + 0x10], r14
xchg r14, rsi
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x10], esi
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov r14, rdx
mov dword [rsp - 0x14], 0x5bac35e4
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg r14, rsp
xchg rbp, rsp
movups xmmword [rbp + 0x48], xmm0
xchg rsp, rbp
call fcn.140017890
mov edx, 0x7448c733
xor edx, 0x4977becc
xor edx, 0x5e9214cf
xor edx, 0x6878b53f
add edx, 0x268274e7
test rsi, rsi
je 0x14008b516
mov dword [rsp - 0x3c], edi
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x18], ecx
xchg r8, r11
mov r11, rsi
xchg r8, r11
mov r9d, 0x7ecc3557
sub r9d, 0x73a8381
sub r9d, 0x114e5377
xor r9d, 0x66435ea0
nop word [rax + rax]
xchg rcx, rcx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
xchg rbx, rbx
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0xc], 0x74d57a81
sub r8, 1
jne 0x14008b4e8
xor ecx, ecx
mov dword [rsp - 0x14], 0x255d8883
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg r14, rdi
mov rdx, rdi
xchg rdi, r14
mov rcx, qword [rsp + 0x20]
call fcn.14008b600
mov dword [rsp - 0x3c], 0x744d8059
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg r11, rcx
mov ebx, eax
mov dword [rsp - 0x44], 0x492e71c6
xchg r14, r15
mov r15, qword [rsp + 0x80]
xchg r15, r14
lea rax, [rsp + 0x28]
mov r11, r11
xchg rbx, rsi
mov rbx, qword [rsp + 0x78]
xchg rsi, rbx
mov rbp, qword [rsp + 0x70]
mov dword [rsp - 0x2c], 0x537c1894
cmp rcx, rax
jne 0x14008b5e1
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x40], 0x1bb8c429
mov ecx, 0x55772d1f
xor ecx, 0x6686c818
add ecx, 0x2a1f598d
sub ecx, 0x5e113e64
rep stosb byte [rdi], al
mov dword [rsp - 0xc], 0x4436bb3
mov eax, ebx
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x4a6b7aec
sub rsp, 0x4a6b7a8c
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099360
mov rsi, rsi
mov eax, ebx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x14008b600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
mov dword [rsp + 0x18], r8d
mov r14, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x240
xchg rbx, r11
mov r11, rdx
xchg rbx, r11
mov rdi, rcx
mov rsp, rsp
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x10c4040a
sub r8d, 0xc3e7280
xor r8d, 0x150ffe47
sub r8d, 0x118a6dc5
call fcn.140099920
mov rax, qword gs:[0x60]
xchg r8, r9
mov r9, qword [rax + 0x18]
xchg r8, r9
xchg rbx, rax
mov rbx, qword [r8 + 0x10]
xchg rbx, rax
xchg r8, r9
mov r9, qword [rax]
xchg r8, r9
test r8, r8
je 0x14008b8a0
mov r8, qword [r8 + 0x50]
xchg rdx, rdx
test r8, r8
je 0x14008b8a0
mov edx, 0x4a618b89
sub edx, 0x3ebb080d
xor edx, 0x31de6fde
xor edx, 0x3a78eda6
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.14009a460
mov rdx, rdx
mov edx, 0x4fa2ed44
xor edx, 0xa9b708f
add edx, 0x17953a36
sub edx, 0x59192ced
sub edx, 0x3b5aab8
lea rcx, [rsp + 0x30]
call fcn.14009a570
test rax, rax
mov dword [rsp - 0x30], edx
je 0x14008b866
xor ecx, ecx
mov rdx, rdi
mov word [rax], cx
xchg rbx, rbx
movabs rcx, 0xd12b0777699d041b
xor rcx, 0x7506acac
add rcx, 0x1a0d9432
xor rcx, 0x2b1c56a2
add rcx, qword [0x140142690]
movabs rax, 0x3f790b6343d7972b
xor rax, 0x6c083f2c
xor rax, 0x30308684
xor rax, 0x76a7e922
add rax, 0x7fffffff
sub rax, 0x12ba95c1
ror rcx, 0x14
mov dword [rsp - 0x38], 0xeb2f25d
add rax, rcx
movabs rcx, 0x39b026c1349cd88e
xor rcx, 0x6e6bce85
xor rcx, 0x19cc4ab4
xor rcx, 0x6c3d28a7
add rcx, 0x7fffffff
sub rcx, 0x1f2fc996
not rax
ror rax, 3
ror rax, 1
not rax
add rax, rcx
lea rcx, [rsp + 0x20]
mov r15, r15
call rax
mov r10, qword [0x140142680]
lea r8, [rsp + 0x20]
not r10
mov rbx, rbx
lea rdx, [rsp + 0x260]
rol r10, 2
rol r10, 0x1d
rol r10, 4
rol r10, 2
rol r10, 1
movabs rcx, 0xfd97fb85222cb372
xor rcx, 0x19bb38f2
xor rcx, 0x1edde4c8
add rcx, 0x7fffffff
sub rcx, 0x167b4c3a
add r10, rcx
movabs rax, 0x7e82fbfa450be837
add rax, 0x2c59ff7a
xor rax, 0x2f9c5333
sub rax, 0x5053c672
add rax, 0x7fffffff
xor rax, 0x7d169b71
not r10
lea rcx, [rsp + 0x30]
xchg rsi, rsi
ror r10, 0xd
ror r10, 1
xchg r8, rbx
mov r9, r8
xchg r8, rbx
not r10
sub r10, rax
call r10
mov dword [rsp - 0x24], 0x2bc7ab03
mov rbx, qword [rsp + 0x250]
sub rsp, 0xfffffffffffffdc0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x6eee688b
add eax, 0x34f1332
xor eax, 0x327ae7fd
add eax, 0x7fb863c1
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg r13, rbx
add rsp, 0x48ef06ee
sub rsp, 0x48ef04ae
pop rdi
mov dword [rsp - 0x3c], 0x49a98c67
ret
xchg rbx, rdi
mov rdi, qword [rsp + 0x250]
xchg rbx, rdi
mov eax, 0x74b63852
sub eax, 0x4f020ccf
xor eax, 0x47f506bb
add eax, 0x15b07829
xor eax, 0xb7f1a454
sub rsp, 0xfffffffffffffdc0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008edd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142c24], 0
jne 0x14008eeed
xor edx, edx
mov dword [rsp - 0x20], esp
lea r8, [0x140142c20]
nop word [rax + rax]
mov ecx, edx
mov r9, r9
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x18], ebx
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov dword [rsp - 0x3c], 0x5484223a
mov eax, ecx
shr ecx, 1
and eax, 1
mov rbp, rbp
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x44], ebx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x40], esi
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x1c], 0x700865bc
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rdi, rdi
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x28], ebx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x34], 0x2efb2194
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x20], 0xa5ce3a
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x30], 0x780dfbee
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x20], 0x1013aeff
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], 0x6210150a
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x30], ecx
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008edf4
mov dword [rsp - 0x24], 0x5dbf35ac
ret
Function at 0x140094274
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r13
mov qword [rsp + 0x10], r13
xchg r13, rbp
xchg rsi, r9
mov qword [rsp + 0x18], r9
xchg rsi, r9
push rdi
mov r14, r14
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
xchg r14, r14
movzx eax, byte [rdx + 1]
xchg r15, r12
mov r12, r8
xchg r15, r12
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
xchg r15, r15
mov r8d, dword [rcx + 4]
shl ebx, 6
shl ebx, 2
dec r8d
xchg rdx, rdx
or ebx, eax
shl edi, 7
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x20], edi
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
or ebx, eax
mov rcx, rcx
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
mov dword [rsp - 0x10], 0x396566f5
shl edi, 3
shl edi, 5
or edi, eax
mov dword [rsp - 0x14], edi
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 3
shl edi, 1
or edi, eax
xchg rbx, rbx
test r8d, r8d
jle 0x1400943ac
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov dword [rsp - 0x2c], edi
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov dword [rsp - 0x38], ecx
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov r9, r9
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
call fcn.140094ae0
xchg rbx, rbx
xor ebx, eax
xchg rdx, rbp
mov rbp, rdx
xchg rdx, rbp
mov ecx, ebx
mov dword [rsp - 0x20], ebp
call fcn.140094ae0
xor edi, eax
neg rsi
sub rsi, 0xffffffffffffffe8
neg rsi
neg rbp
sub rbp, 0xffffffffffffffe8
neg rbp
sub r14, 1
mov dword [rsp - 0x14], ecx
jne 0x14009435f
lea rax, [r15 + 7]
mov ecx, 0x2e62bb7e
add ecx, 0x22400264
sub ecx, 0x1d9fe2be
add ecx, 0x1b8e3a11
sub ecx, 0x4e911531
mov byte [rax - 4], dil
mov dword [rsp - 0x34], 0x4204903d
mov byte [rax], bl
dec rax
shr ebx, 2
shr ebx, 2
shr ebx, 4
shr edi, 5
shr edi, 1
shr edi, 2
sub rcx, 1
mov r14, r14
jne 0x1400943cd
mov rbx, qword [rsp + 0x40]
xchg rbp, rdx
mov rdx, qword [rsp + 0x48]
xchg rbp, rdx
xchg rsi, r8
mov r8, qword [rsp + 0x50]
xchg rsi, r8
add rsp, 0x20
mov dword [rsp - 0x18], 0x4aca299d
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140094440
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg r15, r15
xchg rsp, rbx
mov qword [rax + 8], rsp
xchg rbx, rsp
mov qword [rax + 0x10], rbp
mov r10, r10
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x24], 0x761323cf
xchg r8, r14
mov r8, r14
xchg r8, r14
movzx ebx, byte [rdx]
xchg r14, r14
movzx edi, byte [rdx + 4]
shl ebx, 7
shl ebx, 1
or ebx, eax
shl edi, 8
movzx eax, byte [rdx + 2]
mov rsi, rsi
shl ebx, 3
shl ebx, 5
or ebx, eax
movzx eax, byte [rdx + 3]
mov r8, r8
shl ebx, 1
shl ebx, 6
shl ebx, 1
or ebx, eax
xchg r9, r9
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
mov dword [rsp - 0x18], edi
shl edi, 1
shl edi, 6
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x1c], 0x42736add
shl edi, 2
shl edi, 1
shl edi, 2
shl edi, 3
or edi, eax
mov eax, dword [rcx + 4]
test eax, eax
mov dword [rsp - 0x14], 0x709bfc45
jle 0x140094549
mov rsi, qword [rcx + 8]
lea ebp, [rax - 1]
shr ebp, 1
mov rbp, rbp
inc ebp
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
mov ecx, edi
call fcn.140094ae0
mov dword [rsp - 0x3c], 0x2ab3300a
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
xchg r13, r13
call fcn.140094ae0
xor edi, eax
sub rsi, 0xffffffffffffffe8
sub rbp, 1
xchg r13, r13
jne 0x14009450e
lea rax, [r14 + 7]
mov ecx, 0x1a9dcebc
add ecx, 0x195095c2
sub ecx, 0x300be1eb
xor ecx, 0x711d8579
xor ecx, 0x72ff07ee
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x38], 0x7a399f55
shr ebx, 3
shr ebx, 2
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 5
shr edi, 2
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x1c], 0x4dba6bb1
jne 0x14009456a
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg r10, r10
xchg r14, rsi
mov r14, qword [rsp + 0x40]
xchg r14, rsi
xchg rcx, rdi
mov rcx, qword [rsp + 0x48]
xchg rdi, rcx
nop
add rsp, 0x30b35167
sub rsp, 0x30b35147
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400947a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
push rbp
mov dword [rsp - 0x10], esp
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
lea rbp, [rsp - 0x47]
mov r13, r13
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001e10]
mov dword [rsp - 0x30], 0x3b39c11f
xor edi, edi
movdqa xmm1, xmmword [0x140001dc0]
xchg rdx, r15
mov rbx, r15
xchg r15, rdx
movdqu xmmword [rbp - 0x39], xmm0
mov r8, r8
xchg r12, rsi
mov r12, rcx
xchg r12, rsi
mov edx, edi
xchg r12, r12
movdqa xmm0, xmmword [0x140001da0]
mov r8d, edi
movdqu xmmword [rbp - 0x29], xmm1
mov rsp, rsp
movdqa xmm1, xmmword [0x140001db0]
xchg r8, rbp
movdqu xmmword [r8 - 0x19], xmm0
xchg rbp, r8
xchg rbp, r12
movdqu xmmword [r12 - 9], xmm1
xchg r12, rbp
mov ecx, edx
mov dword [rsp - 0x44], ecx
lea r8, [r8 + 4]
mov eax, 0x34fb74dc
sub eax, 0x2c3d3e5f
add eax, 0xcd8f66b
xor eax, 0x920bb0e
xor eax, 0x65faa285
inc rdx
rol eax, cl
mov dword [rsp - 0x34], 0x1d575211
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140094842
xchg r12, r12
cmp dword [rsi + 4], 8
jne 0x1400948ee
lea rdx, [rbp + 0x6d]
xchg rbx, rbx
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 5
shl cx, 2
shl cx, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov dword [rsp - 0x30], ebp
cmp rdi, 4
jl 0x14009489a
lea r9, [rbp + 7]
xchg r8, r8
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rcx, rdi
mov rdi, rsi
xchg rcx, rdi
call fcn.1400945e0
mov dword [rsp - 0x30], ecx
jmp 0x1400949bd
cmp dword [rsi], edi
mov rbx, rbx
jle 0x1400949bd
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x44], edi
mov r8d, 0x6d886ead
sub r8d, 0x10a91f9c
xor r8d, 0x335a3780
sub r8d, 0x6f85788d
movzx eax, byte [rbx]
mov dword [rsp - 0x28], 0x47e4b353
movzx ecx, byte [rbx + 1]
nop
add rbx, 0x53c75bfd
sub rbx, 0x53c75bfb
shl ax, 3
shl ax, 4
shl ax, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov rbp, rbp
sub r8, 1
jne 0x14009491f
lea r9, [rbp + 7]
xchg rbp, rbp
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
call fcn.1400945e0
mov dword [rsp - 0x10], 0x1c74cf04
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
mov rbx, rbx
lea rdx, [rbp + 0x67]
nop
add r8d, 0x5b9f873e
sub r8d, 0x5b9f8746
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400945e0
inc edi
add r14d, 8
xchg r8, r8
cmp edi, dword [rsi]
jl 0x1400948fc
xor eax, eax
xchg r13, r13
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
lea rdi, [rbp + 7]
mov r11, r11
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
mov rdx, rdx
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140094a90
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov dword [rsp - 0x24], 0x1c0cf2ad
je 0x140094ad9
lea ecx, [r11 + r11]
mov r9d, r10d
mov r11, r11
xor r9d, r11d
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov dword [rsp - 0x1c], ebp
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
mov dword [rsp - 0x2c], esi
cmovb r11d, ecx
shr edx, 1
jne 0x140094aa2
mov dword [rsp - 0x3c], edi
mov eax, r10d
ret
Function at 0x14009a790
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
mov qword [rsp], r10
mov dword [rsp - 0x44], 0xdc810e9
mov qword [rsp + 8], r11
xor r11, r11
lea r10, [rsp + 0x18]
sub r10, rax
mov dword [rsp - 0x20], ecx
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x14009a7f6
mov dword [rsp - 0x14], esi
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 0x4a
xor byte [r11], 9
add byte [r11], 0x39
xor byte [r11], 0x1f
sub byte [r11], 0x63
cmp r10, r11
mov dword [rsp - 0x30], ebp
bnd jne 0x14009a7d1
xchg rbx, r10
mov rbx, qword [rsp]
xchg r10, rbx
xchg rdx, r11
mov rdx, qword [rsp + 8]
xchg rdx, r11
nop
add rsp, 0x765bda47
sub rsp, 0x765bda37
bnd ret
Function at 0x14009fb38
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
mov dword [rsp - 0x34], esp
xchg r9, rbx
mov rbx, rdx
xchg r9, rbx
test rax, rax
mov dword [rsp - 0x40], 0x4e52ac2d
je 0x14009fba7
mov ecx, r8d
mov edx, 0x71b1d04f
sub edx, 0x39009721
xor edx, 0x2b78f075
xor edx, 0x6a84fc38
rol edx, cl
mov dword [rsp - 0x30], esp
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
mov r8, r8
inc r8
cmp r8, 0x20
jb 0x14009fb60
xchg rcx, rcx
mov al, 9
add al, 0x2b
add al, 0x28
sub al, 0x42
sub al, 0x19
ret
mov rax, qword [rcx + 0x100]
test rax, rax
je 0x14009fbe1
mov r12, r12
xchg r12, rax
movups xmm0, xmmword [r12]
xchg r12, rax
xchg r8, rdx
movups xmmword [r8], xmm0
xchg r8, rdx
movups xmm1, xmmword [rax + 0x10]
xchg rdx, r9
movups xmmword [r9 + 0x10], xmm1
xchg rdx, r9
jmp 0x14009fb9c
xorps xmm0, xmm0
mov rsi, rsi
xor al, al
movups xmmword [rdx], xmm0
xchg rdx, r8
movups xmmword [r8 + 0x10], xmm0
xchg r8, rdx
ret
Function at 0x1400b6750
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r14
mov r11, r14
xchg r14, rsp
xchg rbx, rdi
mov qword [r11 + 8], rdi
xchg rbx, rdi
xchg rsi, rbp
mov qword [r11 + 0x18], rbp
xchg rsi, rbp
xchg r15, rdi
mov qword [r11 + 0x20], r15
xchg r15, rdi
push r14
nop
sub rsp, 0x4cd5e2c6
add rsp, 0x4cd5e286
mov r8, qword [0x1401424c8]
mov dword [rsp - 0x24], 0x70811d9
lea rdx, [r11 + 0x10]
rol r8, 6
rol r8, 3
rol r8, 0xc
rol r8, 5
rol r8, 2
rol r8, 5
rol r8, 1
rol r8, 1
rol r8, 1
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0x23a4549d07ae9fa1
add rcx, 0x5f9b595e
xor rcx, 0x3129b8
xor rcx, 0x644538e4
add rcx, 0x4a97b0cb
mov dword [rsp + 0x58], 0x72e49aa4
xor dword [rsp + 0x58], 0x166b5d4a
add dword [rsp + 0x58], 0x1b27163
add dword [rsp + 0x58], 0x9d9e7a4
sub dword [rsp + 0x58], 0x701c20e5
add r8, rcx
mov dword [rsp - 0x40], 0x7a81d516
movabs rax, 0x6197437e00edd3da
add rax, 0x79820ce8
xor rax, 0x1a2e07e4
sub rax, 0x458947c
xor r8, rax
lea rcx, [r11 - 0x28]
not r8
mov dword [rsp - 0x18], 0x716c91f4
call r8
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg rdx, rdi
mov qword [rbx], rdx
xchg rdx, rdi
xor esi, esi
xchg r10, rdi
movups xmmword [r10], xmm0
xchg r10, rdi
xchg r11, rdi
movups xmmword [r11 + 0x10], xmm0
xchg r11, rdi
xchg r9, rdi
movups xmmword [r9 + 0x20], xmm0
xchg r9, rdi
test eax, eax
mov r14, r14
jne 0x1400b6895
mov qword [rbx + 0x38], rsi
jmp 0x1400b69ac
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
mov r12, r12
inc r14
cmp word [rax + r14*2], si
jne 0x1400b68a1
mov qword [rbx + 0x38], r14
mov r13, r13
cmp qword [rbx], rdi
je 0x1400b68cd
xchg rdi, rcx
mov rdi, qword [rbx]
xchg rdi, rcx
call fcn.140099360
cmp r14, 0x18
jbe 0x1400b6904
xchg rbp, rbp
lea rcx, [r14 + r14]
call fcn.140099620
mov qword [rbx], rax
test rax, rax
mov dword [rsp - 0x34], esi
jne 0x1400b690e
mov qword [rbx], rdi
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
jmp 0x1400b6931
mov qword [rbx], rdi
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xorps xmm0, xmm0
mov dword [rsp - 0x38], ebp
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
mov rcx, qword [rbx]
mov edx, 0x6b7a3ad6
sub edx, 0x48838743
xor edx, 0x37b3e548
add edx, 0x1d12f61b
cmp qword [rbx + 0x38], rsi
jbe 0x1400b69ac
mov rbx, rbx
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov r15, r15
mov r9d, 0x1685922e
add r9d, 0x4c2a45dc
sub r9d, 0xd603b05
sub r9d, 0x554f9c06
and ax, r9w
mov dword [rsp - 0x24], esi
ror edx, 3
ror edx, 5
xor ax, word [r8 + rcx]
inc rsi
xchg r11, r11
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x14], edi
jb 0x1400b695d
mov rsi, qword [rsp + 0x60]
xchg r13, rbx
mov rax, r13
xchg r13, rbx
xchg rbx, rsi
mov rsi, qword [rsp + 0x50]
xchg rsi, rbx
xchg rdi, r15
mov r15, qword [rsp + 0x68]
xchg rdi, r15
nop
sub rsp, 0x1cc3a029
add rsp, 0x1cc3a069
pop r14
mov dword [rsp - 0x14], 0x659fb623
ret