joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400689c0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x34], 0x13b19b4f
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
mov rbp, rsp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x42a81dbb33620ffb
sub rbx, 0xd3a54fc
xor rbx, 0x2a557a2
xor rbx, 0x1899988c
xor rbx, 0x45a67fbe
xchg rdi, r15
mov r15, rcx
xchg rdi, r15
cmp qword [rcx + 0x38], rbx
mov dword [rsp - 0x34], 0x60fff6f9
jne 0x140068bbd
xor esi, esi
mov dword [rbp - 0x30], 0x25c95b9
add dword [rbp - 0x30], 0x17c0d9ae
add dword [rbp - 0x30], 0x446035f9
sub dword [rbp - 0x30], 0x5e42a530
mov dword [rbp - 0x2c], 0x56f5a691
sub dword [rbp - 0x2c], 0x2869db02
xor dword [rbp - 0x2c], 0x4fd8641a
sub dword [rbp - 0x2c], 0x3de52816
sub dword [rbp - 0x2c], 0x234486c2
mov dword [rbp - 0x28], 0x12d6d207
xor dword [rbp - 0x28], 0x703d96e2
sub dword [rbp - 0x28], 0x3cdd7f75
sub dword [rbp - 0x28], 0x258ec55a
mov dword [rbp - 0x24], 0x7deff1ce
xor dword [rbp - 0x24], 0x6936fd58
sub dword [rbp - 0x24], 0x125c2ade
sub dword [rbp - 0x24], 0x240e0c8
mov dword [rbp - 0x20], 0x5ed78f7c
sub dword [rbp - 0x20], 0x2d6bff40
xor dword [rbp - 0x20], 0x294b1c50
xor dword [rbp - 0x20], 0x18078c62
xchg r12, rsi
mov qword [rbp + 0x10], r12
xchg r12, rsi
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
xchg rsi, rsi
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
and cl, 3
mov dword [rsp - 0x44], 0x55beda2c
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x5b3f6b71
sub eax, 0x104382f2
add eax, 0x342ad86b
sub eax, 0x26487588
shr eax, cl
movzx ecx, al
mov rsi, rsi
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
xchg rbp, rbp
mov rax, qword [rbp + 0x10]
inc rax
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xa
mov rcx, rcx
jb 0x140068ad7
xor edx, edx
mov word [rbp - 8], si
xchg r8, r8
lea rcx, [rbp - 0x1c]
call fcn.14008a9e0
xchg r13, rdx
mov r13, rax
xchg rdx, r13
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
mov dword [rsp - 0x38], 0x4f359c18
xchg r11, rdx
mov qword [rdi + 0x38], r11
xchg r11, rdx
lea rdi, [rbp - 0x1c]
mov dword [rsp - 0x24], 0x2334ebcd
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140068bc5
xchg rcx, rcx
lea rdx, [0x140142830]
xchg rsi, rcx
mov rsi, r8
xchg rsi, rcx
call fcn.14007188c
test al, al
mov dword [rsp - 0x24], esi
setne al
jmp 0x140068bc5
mov al, 0x45
xor al, 0x1d
add al, 0x22
sub al, 0x79
xchg rbx, r15
mov r15, qword [rsp + 0x68]
xchg rbx, r15
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
xchg r12, r12
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140068bec
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
mov qword [rsp + 0x18], rsi
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg rdi, r9
push rbp
xchg rsp, rdx
mov rbp, rdx
xchg rdx, rsp
nop
add rsp, 0xa7328ba
sub rsp, 0xa73290a
movabs rbx, 0x42a81dbb74396c4d
sub rbx, 0xc74fc03
sub rbx, 0x126a04bf
add rbx, 0x24629ee4
xchg rcx, rbx
mov rdi, rbx
xchg rcx, rbx
cmp qword [rcx + 0x20], rbx
jne 0x140068e0d
mov dword [rsp - 0x2c], ebx
mov eax, 0x2c1a9234
add eax, 0x47d944cc
xor eax, 0x4b6e95e9
add eax, 0x379e7dfc
sub eax, 0x703bc033
mov dword [rbp - 0x30], 0x2f1bdedf
xor dword [rbp - 0x30], 0x529c1a96
xor dword [rbp - 0x30], 0x68811183
xor dword [rbp - 0x30], 0x1525d5fb
mov word [rbp - 0x1c], ax
mov dword [rsp - 0x18], ebp
xor esi, esi
mov dword [rbp - 0x2c], 0x7282cd05
sub dword [rbp - 0x2c], 0x59cd4882
xor dword [rbp - 0x2c], 0x74c71f1f
xor dword [rbp - 0x2c], 0x6c469b27
mov dword [rbp - 0x28], 0x2780b8a5
sub dword [rbp - 0x28], 0x1718060b
add dword [rbp - 0x28], 0xbc5c878
sub dword [rbp - 0x28], 0x1bb67b04
mov dword [rbp - 0x24], 0x2b3c5592
sub dword [rbp - 0x24], 0x4d43ab8
add dword [rbp - 0x24], 0x3d4448f9
xor dword [rbp - 0x24], 0x63da633f
mov dword [rbp - 0x20], 0x74ff524
add dword [rbp - 0x20], 0x29aed2bd
add dword [rbp - 0x20], 0x1c44601f
xor dword [rbp - 0x20], 0x85ea56e
xor dword [rbp - 0x20], 0x453a8d68
mov qword [rbp + 0x10], rsi
xchg r10, r10
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
mov rsi, rsi
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x5a0978f9
add eax, 0x109e1965
sub eax, 0x3c45355d
add eax, 0x23e911b6
add eax, 0x692dcab
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x14], 0x2ae23dfa
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov dword [rsp - 0x18], 0x7acbe958
mov rax, qword [rbp + 0x10]
inc rax
xchg r14, rax
mov qword [rbp + 0x10], r14
xchg r14, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x10], 0x5202e7ed
cmp rax, 0xb
jb 0x140068d1b
xor edx, edx
mov word [rbp - 4], si
mov dword [rsp - 0x2c], 0x6ea85154
lea rcx, [rbp - 0x1a]
call fcn.14008a9e0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
mov dword [rsp - 0x18], 0x7b903fc0
xor rdx, rbx
xchg rdx, r12
mov qword [rdi + 0x20], r12
xchg r12, rdx
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x18], edi
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140068e17
mov dword [rsp - 0x3c], esi
lea rdx, [0x140142298]
xchg r11, rcx
mov r11, r8
xchg rcx, r11
call fcn.140071c78
mov dword [rsp - 0x20], 0x20bbf0d8
test al, al
setne al
jmp 0x140068e17
mov al, 0x3a
add al, 0xd
add al, 0x17
sub al, 0x53
sub al, 0xa
xchg r11, rbx
mov r11, qword [rsp + 0x68]
xchg rbx, r11
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x20], ecx
xchg r15, rdi
mov r15, qword [rsp + 0x78]
xchg r15, rdi
nop
sub rsp, 0x70bb6457
add rsp, 0x70bb64a7
pop rbp
ret
Function at 0x140073b1c
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
lea rax, [rcx + 8]
mov dword [rsp - 0x38], esp
xchg rbx, rdi
mov qword [rsp + 0x70], rdi
xchg rbx, rdi
mov qword [rcx], rax
xorps xmm0, xmm0
mov dword [rsp - 0x10], esp
movups xmmword [rax], xmm0
xchg rcx, r10
mov rsi, r10
xchg r10, rcx
mov qword [rsp + 0x78], rbp
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
lea rcx, [rsp + 0x20]
movups xmmword [rax + 0x20], xmm0
xchg r12, rax
movups xmmword [r12 + 0x30], xmm0
xchg r12, rax
movups xmmword [rax + 0x40], xmm0
xchg r8, rax
movups xmmword [r8 + 0x50], xmm0
xchg r8, rax
xchg r9, rax
movups xmmword [r9 + 0x60], xmm0
xchg r9, rax
xchg r10, rax
movups xmmword [r10 + 0x70], xmm0
xchg r10, rax
mov rbp, qword [rdx + 0x38]
xchg r10, r10
lea rax, [rsp + 0x28]
xchg rbp, rbx
mov rbp, qword [rdx]
xchg rbx, rbp
xchg r11, rax
mov qword [rsp + 0x20], r11
xchg r11, rax
xchg r9, rsp
movups xmmword [r9 + 0x28], xmm0
xchg rsp, r9
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x34], 0x536720e4
xchg rsp, rcx
movups xmmword [rcx + 0x48], xmm0
xchg rcx, rsp
call fcn.140017a38
mov edx, 0x620cfe55
add edx, 0xf849bc1
xor edx, 0x2d8542b8
add edx, 0x87d1927
xor edx, 0x3c4fbab7
test rbp, rbp
mov dword [rsp - 0x2c], 0x18a6f57d
je 0x140073bb4
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r9, rbx
mov rbx, rbp
xchg r9, rbx
mov r8d, 0x1ab90a96
xor r8d, 0x68f1c501
xor r8d, 0x695c253
sub r8d, 0x74dd0cc5
nop word [rax + rax]
mov dword [rsp - 0x38], 0x380a87a5
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
xchg r8, r8
ror edx, 4
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x28], 0x65143cf8
mov word [rdi - 2], cx
sub r9, 1
jne 0x140073b78
mov dword [rsp - 0x3c], 0x1d53f271
xor ecx, ecx
xchg r12, r8
mov r12, rbp
xchg r8, r12
mov word [rax + rbp*2], cx
xchg r15, rsi
mov rcx, r15
xchg r15, rsi
xchg rcx, rdx
mov rcx, qword [rsp + 0x20]
xchg rdx, rcx
call fcn.1400908d0
mov dword [rsp - 0x44], 0x28a09812
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
xchg rsp, rsp
cmp rcx, rax
jne 0x140073c5a
xor eax, eax
xchg r11, r11
lea rdi, [rsp + 0x28]
mov ecx, 0x5b6166b8
xor ecx, 0x1601d946
xor ecx, 0x5da0ab77
xor ecx, 0x42dbe586
xor ecx, 0x521bf13f
rep stosb byte [rdi], al
mov dword [rsp - 0x40], 0x119d0991
mov rax, rsi
xchg rsi, r13
mov r13, qword [rsp + 0x80]
xchg rsi, r13
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400984b0
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x80]
mov dword [rsp - 0x28], 0x709657f2
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007e460
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
sub r10, rcx
xchg rsp, rsp
xchg r9, rcx
mov r8, r9
xchg r9, rcx
lea rax, [r9 + r8]
mov ecx, r9d
xchg r8, r8
mov edx, 0x651aca4b
sub edx, 0x122a0abe
sub edx, 0x304f2afd
add edx, 0x1d8ef6b8
xor edx, 0x3658e29c
inc r9
mov dword [rsp - 0x44], 0x5730e596
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
mov dword [rsp - 0x20], 0x5dfe4a13
cmp r9, 0x10
jb 0x14007e479
mov rax, r8
ret

Function at 0x14007f3b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r11, rcx
mov qword [rsp + 8], r11
xchg rcx, r11
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
mov dword [rsp - 0xc], 0x1e6b99a3
push r15
sub rsp, 0x20
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
mov r13d, r8d
mov r9d, 0x777aaeb2
sub r9d, 0xec6f4ff
xor r9d, 0x15f7c1b
xor r9d, 0x69e8c5a8
mov r12, rdx
xchg r10, r10
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff46edece1
add rcx, 0x8cc8c5
xor rcx, 0x674715dc
add rcx, 0x7fffffff
add rcx, 0x5fc25f86
popf
pushf
mov eax, 0x40da96fc
add eax, 0x3ed68689
sub eax, 0x53ad7971
xor eax, 0x2c03a410
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x14], edx
cmovo rax, rcx
mov rcx, rax
call fcn.140098350
lea r15d, [r13 + 0xfffff]
mov dword [rsp - 0x2c], 0x588001ab
xor esi, esi
shr r15d, 0xb
shr r15d, 7
shr r15d, 1
shr r15d, 1
xchg rbp, rdx
mov rdx, rax
xchg rdx, rbp
mov eax, dword [rbx + 0x18]
mov dword [rsp - 0x40], 0x30faa96a
mov ebx, 0x5af620e4
sub ebx, 0x3e8271db
add ebx, 0x329a5a8c
sub ebx, 0x4f0e0994
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x44], ebp
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007f5c8
xchg rsp, rsp
mov eax, 0x28d7b9db
sub eax, 0x89009c5
sub eax, 0x19fbba4c
add eax, 0x3099d8c5
sub eax, 0x36d5ce8f
mov rcx, qword [rsp + 0x60]
xchg rdi, rdi
mov r14d, esi
shl r14d, 0x14
mov edi, r13d
xchg rcx, rcx
sub edi, r14d
xchg rdx, rbp
mov rbp, rdx
xchg rdx, rbp
cmp edi, eax
xchg rsp, rsp
cmova edi, eax
mov r8d, edi
call fcn.1400926a0
test al, al
mov rdx, rdx
je 0x14007f5c6
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
mov rsi, rsi
je 0x14007f59a
mov r15d, dword [rsp + 0x70]
xchg r10, r9
mov r10, rbp
xchg r10, r9
lea eax, [r14 + r8]
mov dword [rsp - 0x34], ebp
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x38171a3c
mov dword [rsp - 0x18], 0x2b695c7c
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14007f561
mov dword [rsp - 0xc], ebx
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x7b32a8a7
add eax, 0x1db3a8f
sub eax, 0x7107c730
sub eax, 0xbf61c06
cmp esi, r15d
jb 0x14007f4ff
mov dword [rsp - 0x20], 0xc02db12
jmp 0x14007f5c8
xor bl, bl
xchg r10, rbp
mov rcx, r10
xchg rbp, r10
call fcn.140098360
xchg r14, r14
mov al, bl
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x70005f27
sub rsp, 0x70005f07
pop r15
mov r13, r13
pop r14
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14007ff44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x20], 0x2b06362a
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
push 0x73ee78b7
mov qword [rsp], r13
nop
push 0x35c1b4c0
mov qword [rsp], r14
push rsi
mov qword [rsp], r15
nop
sub rsp, 0x698f65fa
add rsp, 0x698f65da
xchg r9, rcx
mov r15, r9
xchg rcx, r9
mov r14d, r8d
mov r9d, 0x278f5e46
add r9d, 0x47002d1c
sub r9d, 0x23311fec
sub r9d, 0x10cf6236
sub r9d, 0x3a8b0940
mov r12, rdx
xchg r14, r14
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff2bccb49d
sub rcx, 0x553cc0e
add rcx, 0x4be25494
sub rcx, 0x4478a183
add rcx, 0x7fffffff
add rcx, 0x521d6460
popf
pushf
mov eax, 0x4ab74d8d
xor eax, 0x3106521b
sub eax, 0x8e5e71
sub eax, 0x7b22c121
popf
cmovb r9d, r14d
xchg r13, r13
mul r9
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140098350
mov dword [rsp - 0x30], 0x4012b30f
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xc
shr ebp, 5
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor edi, edi
xchg rdi, rsi
mov rdi, rax
xchg rsi, rdi
mov ebx, 0x4d76055b
sub ebx, 0x39cb492f
add ebx, 0x6c3102a6
sub ebx, 0x665ebc66
sub ebx, 0x197d026b
test ebp, ebp
je 0x14008016f
mov dword [rsp - 0x3c], 0x4df92e28
mov eax, 0x13c6bc69
xor eax, 0x4f1eacd1
add eax, 0x16cc45d2
sub eax, 0x33d53970
sub eax, 0x3fbf1d1a
mov r9d, edi
mov dword [rsp - 0xc], 0x5f868332
mov r8d, r14d
shl r9d, 5
shl r9d, 7
shl r9d, 1
shl r9d, 2
shl r9d, 4
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov rsp, rsp
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xor r10d, r10d
shr r11d, 2
mov r10, r10
test r11d, r11d
je 0x140080120
xchg rsi, rbx
mov rdx, rbx
xchg rbx, rsi
lea ecx, [r9 + r10]
mov rdi, rdi
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
mov rsi, rsi
xor eax, 0x38171a3c
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov rdx, rdx
jb 0x1400800f5
xchg r14, rdx
mov r14, rsi
xchg r14, rdx
mov rcx, r15
xchg rsp, rsp
call fcn.140092a80
test al, al
je 0x14008016a
add edi, ebx
xchg r9, r9
mov eax, 0xe2b9e5a
add eax, 0x28e0e2c1
add eax, 0x1baa6b55
xor eax, 0x52a6ec70
cmp edi, ebp
jb 0x14008009f
mov dword [rsp - 0x10], 0x6a223a55
jmp 0x14008016f
xor bl, bl
mov rbp, rbp
mov rcx, rsi
call fcn.140098360
xchg rbp, r10
mov r10, qword [rsp + 0x58]
xchg r10, rbp
mov al, bl
mov rbx, qword [rsp + 0x50]
xchg rsi, r9
mov r9, qword [rsp + 0x60]
xchg r9, rsi
nop
sub rsp, 0x534970ce
add rsp, 0x534970ee
pop r15
mov dword [rsp - 0xc], esi
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
xchg r9, r9
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
mov dword [rsp - 0x1c], 0x59435935
ret
Function at 0x140082b10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r13
mov qword [rsp + 0x10], r13
xchg r13, rbp
mov qword [rsp + 0x18], rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rdi, rsi
push r11
mov qword [rsp], r14
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdx
xchg rcx, rcx
xchg rsi, r10
mov r10, rcx
xchg r10, rsi
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x14], ebx
call fcn.140084810
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x14], 0x417fa674
mov ebp, dword [rbx + rsi + 0xb4]
mov r10, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x14], 0x4c29ebb9
je 0x140082cd0
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x10], 0x22cc3056
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
xchg r10, r10
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x38], ebx
jae 0x140082c10
mov eax, dword [rdx + 8]
test eax, eax
xchg rdx, rdx
jne 0x140082bd6
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
xchg r12, r12
cmp r11d, r9d
jb 0x140082bfa
add eax, r9d
cmp r11d, eax
mov dword [rsp - 0x34], 0x68862918
jb 0x140082c88
inc r8w
sub rdx, 0xffffffffffffffd8
mov dword [rsp - 0x38], esp
cmp r8w, cx
jb 0x140082bc5
xchg r12, r8
mov r12, r14
xchg r12, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg rdi, rdi
nop
add rax, 0x1c2b59b7
sub rax, 0x1c2b59bf
add r10, 8
shr rax, 1
test eax, eax
xchg r9, r9
je 0x140082cbd
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov dword [rsp - 0x20], edx
mov ecx, eax
shr ecx, 9
shr ecx, 2
shr ecx, 1
cmp ecx, 3
mov r14, r14
je 0x140082c9e
cmp ecx, 0xa
jne 0x140082ca7
and eax, 0xfff
mov dword [rsp - 0x34], 0x1207da8f
add qword [rax + r8], rdi
jmp 0x140082ca7
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov dword [rsp - 0x20], ecx
add r8, rsi
add r8, r11
jmp 0x140082c19
and eax, 0xfff
add dword [rax + r8], edi
sub r10, 0xfffffffffffffffe
mov dword [rsp - 0x1c], 0x24f37df6
sub rdx, 1
jne 0x140082c4b
add ebx, dword [r9]
cmp ebx, ebp
mov dword [rsp - 0x10], 0x371fd75f
jb 0x140082b8d
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xchg rbp, rdx
mov rdx, qword [rsp + 0x38]
xchg rdx, rbp
xchg rbx, rsi
mov rbx, qword [rsp + 0x40]
xchg rbx, rsi
xchg r8, rdi
mov r8, qword [rsp + 0x48]
xchg rdi, r8
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0x10], ebx
pop r14
ret
Function at 0x1400848e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x5a1d6008
add rsp, 0x5a1d5fe8
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x38171a3c
mov rdx, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
cmp eax, 0x38174071
mov rdx, rdx
jne 0x140084aac
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x1c], ebx
xor eax, 0x38171a3c
cmp eax, 0x38175f6c
jne 0x140084aac
mov edx, dword [rdx + rcx + 0x88]
xchg r9, r9
call fcn.140084810
mov rcx, rsi
xchg r14, r12
mov r12, rax
xchg r14, r12
mov edx, dword [rax + 0x20]
mov dword [rsp - 0xc], 0x5a06a61c
call fcn.140084810
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg r10, rax
mov r12, r10
xchg r10, rax
call fcn.140084810
mov rbx, rbx
mov edx, dword [r14 + 0x1c]
xchg r13, rcx
mov r13, rsi
xchg r13, rcx
xchg rsi, rax
mov r13, rsi
xchg rsi, rax
call fcn.140084810
xor edi, edi
mov dword [rsp - 0x28], 0x63afa11d
xchg rsi, rax
mov qword [rsp + 0x70], rsi
xchg rsi, rax
cmp dword [r14 + 0x18], edi
jbe 0x140084aac
mov r8, r8
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, r13
mov r13, rsi
xchg r13, rcx
call fcn.140084810
mov ecx, 0x1e217973
sub ecx, 0x1bf3a8f5
add ecx, 0x45430aed
xor ecx, 0x62a89e3e
add ecx, 0xda27baaa
xchg rbp, rax
mov rbx, rbp
xchg rbp, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x40], 0x57b50c8c
cmp byte [rax], 0
je 0x140084a8e
nop dword [rax]
mov rdx, rbx
xchg rbp, rbp
lea rcx, [rsp + 0x60]
mov r8d, 0x25c1ae75
add r8d, 0x14525478
xor r8d, 0x6eac7f6
sub r8d, 0x11ae063d
sub r8d, 0x2b50bedd
inc rbx
mov r11, r11
call fcn.14008dc00
cmp byte [rbx], 0
jne 0x140084a41
mov dword [rsp - 0x3c], 0x5cbeacbb
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x44], ecx
je 0x140084af3
inc edi
cmp edi, dword [r14 + 0x18]
xchg r14, r14
jb 0x1400849f3
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
mov dword [rsp - 0x2c], edx
pop r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x28], ebx
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x20], edx
mov rcx, rsi
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x3c], 0x1eb89d9d
call fcn.140084810
jmp 0x140084aae
Function at 0x140084bf0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
xchg rdx, rdi
mov r10, rdi
xchg rdx, rdi
add r8, rcx
sub r10d, ecx
mov dword [rsp - 0x2c], edx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
mov r11, r11
add rax, r8
xor r9d, r9d
cmp r9w, r11w
jae 0x140084c61
mov dword [rsp - 0x14], ecx
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x140084c35
mov ecx, dword [rax + 0x10]
mov rcx, rcx
mov edx, dword [rax + 0x14]
cmp r10d, edx
jb 0x140084c47
add ecx, edx
xchg rsp, rsp
cmp r10d, ecx
jb 0x140084c55
inc r9w
sub rax, 0xffffffffffffffd8
mov dword [rsp - 0x28], ecx
jmp 0x140084c1e
mov eax, dword [rax + 0xc]
xchg rcx, rcx
sub eax, edx
add eax, r10d
ret
xor eax, eax
mov dword [rsp - 0x30], ebp
ret
Function at 0x140088f20
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
push rdi
add rsp, 0xffffffffffffffa0
xchg r13, r13
xchg r14, rbx
mov r14, qword [rcx]
xchg r14, rbx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, rsi
xchg rsi, r10
mov qword [rsp + 0x70], r10
xchg r10, rsi
xchg r13, rsi
mov r13, qword [rcx + 0x38]
xchg r13, rsi
lea rcx, [rsp + 0x20]
xchg rsi, rsi
mov qword [rsp + 0x20], rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg r12, rsp
lea rdx, [rsi + 1]
mov dword [rsp - 0x3c], ebp
xchg rsp, r9
movups xmmword [r9 + 0x38], xmm0
xchg r9, rsp
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x38], ebx
call fcn.140017a38
mov edx, 0xdd9c327
xor edx, 0x3449f823
add edx, 0x184d312c
sub edx, 0x4b778b0
xor edx, 0x15fbb8e2
test rsi, rsi
mov rbp, rbp
je 0x14008901e
mov rdi, rax
sub rbx, rax
xchg r8, r8
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x3c63adb9
add r9d, 0x1d12cba1
sub r9d, 0x1295b793
sub r9d, 0x46e0c0c8
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov r12, r12
and cx, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
xchg rcx, rcx
jne 0x140088ff3
xor ecx, ecx
mov word [rax + rsi*2], cx
mov dword [rsp - 0x14], 0x486458ae
xchg rcx, rbp
mov rbp, qword [rsp + 0x20]
xchg rbp, rcx
call fcn.1400890f0
mov dword [rsp - 0x28], 0x2a00776a
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg rsi, r15
mov r15, qword [rsp + 0x70]
xchg r15, rsi
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x1c], 0x611d2d0e
jne 0x1400890b3
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x5ede74ea
sub ecx, 0x1a55ff6b
sub ecx, 0x18148ab5
xor ecx, 0x509492e
sub ecx, 0x297aa3b4
rep stosb byte [rdi], al
mov eax, ebx
xchg rdx, rdx
xchg rbx, rcx
mov rcx, qword [rsp + 0x78]
xchg rcx, rbx
sub rsp, 0xffffffffffffffa0
mov rbp, rbp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400984b0
mov eax, ebx
mov dword [rsp - 0x20], 0x1f5e86b
xchg r10, rbx
mov r10, qword [rsp + 0x78]
xchg r10, rbx
nop
add rsp, 0x74b57ff7
sub rsp, 0x74b57f97
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret