joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ea1c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001900]
mov r9, r9
sub r10, rcx
xchg rcx, r12
mov r8, r12
xchg r12, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x44e3d111
xor edx, 0x4833f11e
sub edx, 0x91fc2a1
add edx, 0x76761443
inc r9
xchg r9, r9
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
xchg r12, r12
cmp r9, 0x10
jb 0x14007ea35
xchg rsp, rax
mov rsp, r8
xchg rsp, rax
ret
Function at 0x14007f8c4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
xchg rcx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rcx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
mov dword [rsp - 0x34], 0x4a8c552f
xchg r15, rcx
mov rbx, r15
xchg rcx, r15
mov r13d, r8d
xchg rcx, rcx
mov r9d, 0xe9677d7
xor r9d, 0x6f602101
sub r9d, 0x79c866b
sub r9d, 0x42a3ae9e
sub r9d, 0x17b221cd
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
mov rcx, rcx
pushf
movabs rcx, 0xffffffff04ea9ec1
add rcx, 0x16195e61
xor rcx, 0x4e205a49
add rcx, 0x7fffffff
add rcx, 0x2adc5895
popf
pushf
mov eax, 0xe15d57
add eax, 0x60221fd
add eax, 0x55c66c1e
sub eax, 0x257bf8c1
sub eax, 0x372df2ad
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x18], 0x761643
cmovo rax, rcx
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.1400987e0
lea r15d, [r13 + 0xfffff]
xor esi, esi
xchg rdi, rdi
shr r15d, 4
shr r15d, 1
shr r15d, 0xe
shr r15d, 1
mov rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x2df61dec
sub ebx, 0x2099c328
xor ebx, 0x620dc5dc
sub ebx, 0x64437b0b
sub ebx, 0xb0e240c
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x44], 0x5be11a6
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007faf8
mov eax, 0xdb51a80
add eax, 0x4d5dbd02
xor eax, 0x26bd337a
xor eax, 0x7dbfe4f8
xchg r9, rcx
mov r9, qword [rsp + 0x60]
xchg r9, rcx
mov r14d, esi
shl r14d, 0x14
mov rbx, rbx
mov edi, r13d
sub edi, r14d
mov rdx, rbp
mov dword [rsp - 0x34], edx
cmp edi, eax
cmova edi, eax
mov r8d, edi
call fcn.140092bd0
mov dword [rsp - 0x30], ebx
test al, al
je 0x14007faf6
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
mov dword [rsp - 0x20], edi
je 0x14007fac2
mov r15d, dword [rsp + 0x70]
xchg r9, rbp
mov rbp, r9
xchg r9, rbp
lea eax, [r14 + r8]
mov dword [rsp - 0x38], 0x45c04d18
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x6a9d6a96
mov rsp, rsp
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg rsp, rsp
jb 0x14007fa8b
mov r15d, dword [rsp + 0x78]
add esi, ebx
xchg rbx, rbx
mov eax, 0x54f1b016
xor eax, 0x5238913b
add eax, 0x4585cda5
add eax, 0x2b0d267c
sub eax, 0x774c154e
cmp esi, r15d
mov dword [rsp - 0x40], 0x300ee609
jb 0x14007fa29
jmp 0x14007faf8
xor bl, bl
xchg rcx, r9
mov r9, rbp
xchg rcx, r9
call fcn.1400987f0
mov al, bl
mov r8, r8
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x2b43c481
sub rsp, 0x2b43c461
pop r15
mov dword [rsp - 0x3c], 0x790db7d
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
xchg r12, r12
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400802c8
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x28], ebx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x9bb44cd
add rsp, 0x9bb44ad
xchg rdi, r15
mov rdi, rcx
xchg rdi, r15
mov r14d, r8d
mov dword [rsp - 0x34], edx
mov r9d, 0x1f618cab
add r9d, 0x15cd6de1
sub r9d, 0x4913333
sub r9d, 0x3099c759
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff48c8c963
sub rcx, 0x3849ae69
add rcx, 0x18dbf81f
add rcx, 0x7fffffff
xor rcx, 0x56a4ece7
popf
pushf
mov eax, 0x652a07bd
sub eax, 0x304b49e4
xor eax, 0x216ae3d1
sub eax, 0x15b45e04
popf
cmovb r9d, r14d
mul r9
xchg r15, r15
cmovo rax, rcx
xchg rdx, rax
mov rcx, rdx
xchg rdx, rax
call fcn.1400987e0
mov r13d, dword [r15 + 0x18]
mov dword [rsp - 0x18], edx
lea ebp, [r14 + 0xfffff]
shr ebp, 9
shr ebp, 0xb
xor edi, edi
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x56dc1db
add ebx, 0x3aa87fc8
sub ebx, 0xa38792a
sub ebx, 0x348425a7
sub ebx, 0x159a2d1
test ebp, ebp
xchg rbx, rbx
je 0x1400804dc
mov eax, 0x4fb2079c
xor eax, 0x3a0824e5
xor eax, 0x7c363f2c
xor eax, 0x5b4ad25b
sub eax, 0x52b6ce0e
mov r9d, edi
mov r8d, r14d
mov rbp, rbp
shl r9d, 1
shl r9d, 1
shl r9d, 4
shl r9d, 7
shl r9d, 6
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0x30], 0x496a6a42
cmp r8d, eax
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
xor r10d, r10d
mov dword [rsp - 0x3c], esi
shr r11d, 2
test r11d, r11d
je 0x14008048a
xchg r12, rsi
mov rdx, r12
xchg r12, rsi
lea ecx, [r9 + r10]
mov eax, r13d
xor eax, dword [r12 + rcx*4]
mov dword [rsp - 0x10], edx
add r10d, ebx
xor eax, 0x6a9d6a96
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov r8, r8
cmp r10d, r11d
jb 0x140080461
xchg rbx, rdx
mov rbx, rsi
xchg rbx, rdx
xchg r15, r11
mov rcx, r11
xchg r11, r15
call fcn.140092f90
mov r10, r10
test al, al
je 0x1400804da
add edi, ebx
mov dword [rsp - 0x40], 0x4661e76b
mov eax, 0x5db945c
add eax, 0x79492c2a
xor eax, 0x4521c86c
sub eax, 0x39f508ea
cmp edi, ebp
xchg r8, r8
jb 0x14008040b
jmp 0x1400804dc
xor bl, bl
mov rcx, rsi
mov r14, r14
call fcn.1400987f0
xchg rbp, rdx
mov rdx, qword [rsp + 0x58]
xchg rdx, rbp
mov al, bl
mov dword [rsp - 0x24], edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140082fa0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r10, r10
xchg r12, rsi
mov qword [rsp + 0x18], r12
xchg r12, rsi
xchg r13, rdi
mov qword [rsp + 0x20], r13
xchg rdi, r13
nop
push 0x64841179
mov qword [rsp], r14
nop
sub rsp, 0x4881fa8d
add rsp, 0x4881fa6d
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg rcx, r13
mov rsi, r13
xchg r13, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140084ce0
mov dword [rsp - 0x18], ecx
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rsp, rax
mov r10, rsp
xchg rsp, rax
mov ebx, r14d
mov r11, r11
test ebp, ebp
je 0x140083166
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov r10, r10
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x10], esi
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov r9, r9
jae 0x1400830a2
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14008306d
mov r15, r15
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14008308c
mov r8, r8
add eax, r9d
cmp r11d, eax
jb 0x14008311b
xchg r8, r8
inc r8w
add rdx, 0x28
cmp r8w, cx
mov dword [rsp - 0x30], esi
jb 0x14008305c
mov r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg r8, r8
sub rax, 8
nop
sub r10, 0x3aa03473
add r10, 0x3aa0347b
shr rax, 1
test eax, eax
xchg rdi, rdi
je 0x140083158
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov dword [rsp - 0x30], 0x3aada719
mov ecx, eax
shr ecx, 9
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140083130
mov dword [rsp - 0x14], 0x600ee3b0
cmp ecx, 0xa
jne 0x14008313c
and eax, 0xfff
xchg rcx, rcx
add qword [rax + r8], rdi
jmp 0x14008313c
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
xchg r13, r13
add r8, r11
jmp 0x1400830a5
and eax, 0xfff
add dword [rax + r8], edi
xchg r10, r10
nop
sub r10, 0x7f565ed1
add r10, 0x7f565ed3
sub rdx, 1
xchg rcx, rcx
jne 0x1400830d9
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083029
mov r11, r11
mov rbx, qword [rsp + 0x30]
xchg rsi, rbp
mov rsi, qword [rsp + 0x38]
xchg rsi, rbp
xchg rsi, rbx
mov rbx, qword [rsp + 0x40]
xchg rsi, rbx
xchg rdi, rbp
mov rbp, qword [rsp + 0x48]
xchg rdi, rbp
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140084db0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r14, r14
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
mov dword [rsp - 0x20], ebx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r14
mov rcx, rcx
nop
push 0x43c7bfd8
mov qword [rsp], r15
nop
add rsp, 0x2321c497
sub rsp, 0x2321c4b7
movzx eax, word [rcx]
mov dword [rsp - 0x40], esp
mov r15d, edx
xor eax, 0x6a9d6a96
xchg rbp, rsi
mov rbp, rcx
xchg rsi, rbp
cmp eax, 0x6a9d30db
jne 0x140084f7d
mov rcx, rcx
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x6a9d6a96
mov dword [rsp - 0x10], ebp
cmp eax, 0x6a9d2fc6
jne 0x140084f7d
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x2c], esp
call fcn.140084ce0
xchg rdi, rsi
mov rcx, rdi
xchg rsi, rdi
xchg rdi, r14
mov rdi, rax
xchg rdi, r14
mov edx, dword [rax + 0x20]
call fcn.140084ce0
mov dword [rsp - 0x30], 0x9932d59
mov edx, dword [r14 + 0x24]
xchg rsi, r10
mov rcx, r10
xchg rsi, r10
mov r12, rax
call fcn.140084ce0
mov r9, r9
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r13, r10
mov r10, rax
xchg r10, r13
call fcn.140084ce0
mov dword [rsp - 0x10], 0x16d6a1c4
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140084f7d
mov dword [rsp - 0x2c], edi
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, rbx
mov rcx, rbx
xchg rbx, rsi
call fcn.140084ce0
mov ecx, 0x4172fb3c
xor ecx, 0x181f7727
xor ecx, 0x7fe4cd94
add ecx, 0x49a18463
xor ecx, 0x8fd53a0d
xchg rsp, rax
mov rbx, rsp
xchg rsp, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x140084f56
mov r15, r15
nop dword [rax]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x60a579d7
sub r8d, 0x5b3aaa2
xor r8d, 0x535efd4d
xor r8d, 0x7d6a8405
sub r8d, 0x74c5b67c
inc rbx
call fcn.14008df40
mov dword [rsp - 0x10], 0x245ef999
cmp byte [rbx], 0
jne 0x140084f06
mov ecx, dword [rsp + 0x60]
mov rdx, rdx
not ecx
cmp ecx, r15d
je 0x140084fc8
mov dword [rsp - 0x24], 0x5e202920
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140084ebd
mov dword [rsp - 0x44], 0x4d5920a2
xor eax, eax
mov rbx, qword [rsp + 0x68]
nop
sub rsp, 0x5286b7d2
add rsp, 0x5286b7f2
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
mov dword [rsp - 0x30], 0x203b82ad
pop r13
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg r14, r14
xchg rbp, rsi
mov rcx, rbp
xchg rsi, rbp
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
mov edx, dword [rax + rdx*4]
mov rsp, rsp
call fcn.140084ce0
jmp 0x140084f7f
Function at 0x1400850e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
mov r10, rdx
xchg r12, r12
add r8, rcx
sub r10d, ecx
movzx eax, word [r8 + 0x14]
mov dword [rsp - 0xc], 0x74f07a9e
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
xor r9d, r9d
mov dword [rsp - 0xc], 0x25992f6e
cmp r9w, r11w
jae 0x14008516c
mov ecx, dword [rax + 8]
test ecx, ecx
mov dword [rsp - 0x28], 0x446f777a
jne 0x14008512c
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0x14]
mov dword [rsp - 0x30], 0x109a7fe0
cmp r10d, edx
jb 0x14008514b
add ecx, edx
mov dword [rsp - 0x2c], 0x4cd172b4
cmp r10d, ecx
jb 0x14008515b
inc r9w
neg rax
add rax, 0xffffffffffffffd8
neg rax
jmp 0x140085114
mov eax, dword [rax + 0xc]
sub eax, edx
mov dword [rsp - 0x40], 0x2407afc3
add eax, r10d
ret
xor eax, eax
ret
Function at 0x140089363
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg r14, rbx
push rdi
add rsp, 0xffffffffffffffa0
mov rbx, qword [rcx]
mov dword [rsp - 0x18], esi
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
xchg r9, r9
xchg rsi, r11
mov r11, qword [rcx + 0x38]
xchg rsi, r11
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x14], 0x6cd47eef
mov qword [rsp + 0x20], rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg rsp, r12
lea rdx, [rsi + 1]
xchg r12, rsp
movups xmmword [r12 + 0x38], xmm0
xchg rsp, r12
xchg r11, rsp
movups xmmword [r11 + 0x48], xmm0
xchg rsp, r11
call fcn.14001791c
mov dword [rsp - 0x38], esp
mov edx, 0x73da2c00
sub edx, 0x5df78674
add edx, 0x29d2c9
add edx, 0x802702d
add edx, 0x42b64b37
test rsi, rsi
mov dword [rsp - 0x30], 0x35493f55
je 0x1400893cc
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov r8, rsi
mov r12, r12
mov r9d, 0x40e74248
add r9d, 0x16b9e7b4
add r9d, 0x7c6e40a
sub r9d, 0x5f680d07
nop dword [rax]
mov dword [rsp - 0x2c], 0x6d4a09af
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x3c], 0x65ada87d
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r11, r11
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008939b
xchg rdx, rdx
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg rcx, r8
mov r8, qword [rsp + 0x20]
xchg r8, rcx
call fcn.140089490
mov dword [rsp - 0x20], ecx
xchg r12, rcx
mov r12, qword [rsp + 0x20]
xchg r12, rcx
mov ebx, eax
mov rbx, rbx
xchg rsi, r10
mov r10, qword [rsp + 0x70]
xchg r10, rsi
lea rax, [rsp + 0x28]
mov dword [rsp - 0x34], 0x378dd0f8
cmp rcx, rax
jne 0x14008945f
xor eax, eax
xchg rbx, rbx
lea rdi, [rsp + 0x28]
mov ecx, 0x5f08c083
add ecx, 0x11c73e1
xor ecx, 0x4c4b3057
sub ecx, 0x2a5ccfbb
sub ecx, 0x2113448
rep stosb byte [rdi], al
mov dword [rsp - 0x44], edi
mov eax, ebx
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x38], 0x75e6c6f8
ret
call fcn.140098930
mov eax, ebx
mov dword [rsp - 0x24], 0xe904e2e
xchg rbx, r15
mov r15, qword [rsp + 0x78]
xchg r15, rbx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008a843
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r13
mov r13, rsp
xchg r13, r11
xchg rdx, rbx
mov qword [r11 + 0x20], rdx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0xac5fe07
add rsp, 0xac5fda7
xchg rsp, rbx
mov rsp, qword [rcx]
xchg rsp, rbx
lea rax, [r11 - 0x40]
mov dword [rsp - 0x38], 0x74c6c23c
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg r12, r12
mov qword [r11 + 0x10], rsi
xchg r14, rsi
mov r14, qword [rcx + 0x38]
xchg rsi, r14
lea rcx, [r11 - 0x48]
mov dword [rsp - 0x18], 0x62873a5f
mov qword [r11 + 0x18], r14
xchg r11, r14
mov r11, rdx
xchg r14, r11
xchg rsp, rcx
movups xmmword [rcx + 0x28], xmm0
xchg rcx, rsp
lea rdx, [rsi + 1]
xchg rsi, rsp
movups xmmword [rsi + 0x38], xmm0
xchg rsi, rsp
movups xmmword [rsp + 0x48], xmm0
call fcn.14001791c
mov edx, 0x12505edf
add edx, 0x5576cf2a
add edx, 0x3d5890e
sub edx, 0xad7835e
test rsi, rsi
xchg rbx, rbx
je 0x14008a95e
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
sub rbx, rax
mov dword [rsp - 0x34], ebx
mov r8, rsi
mov r9d, 0x62ae2f8b
sub r9d, 0x4d18a54f
add r9d, 0x1404be66
xor r9d, 0x299a485d
nop word [rax + rax]
mov dword [rsp - 0x44], ebx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x24], ecx
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov r8, r8
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008a929
mov dword [rsp - 0x34], 0x32a222bc
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov dword [rsp - 0xc], 0x4d4d5e09
xchg r14, r12
mov rdx, r12
xchg r12, r14
xchg rcx, r8
mov r8, qword [rsp + 0x20]
xchg rcx, r8
call fcn.14008aa40
mov dword [rsp - 0x14], ebp
xchg rcx, rbp
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
mov ebx, eax
mov dword [rsp - 0x10], 0x1ff4dd9a
xchg rsi, r14
mov rsi, qword [rsp + 0x80]
xchg rsi, r14
lea rax, [rsp + 0x28]
mov dword [rsp - 0x34], 0x31291fa9
mov rsi, qword [rsp + 0x78]
xchg rbp, rbx
mov rbx, qword [rsp + 0x70]
xchg rbx, rbp
cmp rcx, rax
mov dword [rsp - 0x34], esp
jne 0x14008aa1e
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x4645c1d8
xor ecx, 0x1d68ff5a
add ecx, 0x3edee38
sub ecx, 0x16e7ce13
sub ecx, 0x48335e77
rep stosb byte [rdi], al
mov eax, ebx
xchg rdx, rdx
xchg rbp, rbx
mov rbp, qword [rsp + 0x88]
xchg rbx, rbp
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
call fcn.140098930
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov r10, r10
add rsp, 0x60
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008aa40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0x20], ebp
push rdi
add rsp, 0xfffffffffffffdc0
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x20], esi
mov r8d, 0x2661ffb3
xor r8d, 0x421cd626
sub r8d, 0x4b5d0472
xor r8d, 0x52de965d
sub r8d, 0x4bfeb176
call fcn.140098f00
mov r10, r10
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rsi, rax
mov rsi, qword [r8 + 0x10]
xchg rsi, rax
mov r8, qword [rax]
mov rsp, rsp
test r8, r8
je 0x14008ad28
mov r8, qword [r8 + 0x50]
mov dword [rsp - 0x18], 0x4c75def7
test r8, r8
je 0x14008ad28
mov edx, 0x2f58a44
add edx, 0x214b1947
xor edx, 0x7ad4c811
xor edx, 0x5e946a9e
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov rcx, rcx
call fcn.140099a60
mov edx, 0x5d7bb338
sub edx, 0x5920e117
add edx, 0x6396e426
xor edx, 0x43e4568b
sub edx, 0x2415e070
lea rcx, [rsp + 0x30]
call fcn.140099b90
test rax, rax
mov dword [rsp - 0x20], ebp
je 0x14008aced
xor ecx, ecx
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
mov word [rax], cx
movabs rcx, 0x20b9fe93040bcb64
add rcx, 0x3edddd1d
add rcx, 0x25d44bdc
xor rcx, 0x3f29ae4e
sub rcx, 0x1c2e764
mov rax, qword [0x140141690]
xchg rcx, rcx
xor rax, rcx
movabs rcx, 0x324b06ca76c6102e
sub rcx, 0x65a81dfd
xor rcx, 0x5bb55ebf
add rcx, 0x7fffffff
add rcx, 0x1d67a445
add rax, rcx
mov dword [rsp - 0x10], 0xddd8e1b
movabs rcx, 0x4f3482df4973fa7f
add rcx, 0x2be905eb
sub rcx, 0x62796ef1
add rcx, 0x17a3011e
ror rax, 1
ror rax, 1
ror rax, 2
ror rax, 1
sub rax, rcx
mov dword [rsp - 0x14], edx
lea rcx, [rsp + 0x20]
ror rax, 7
ror rax, 0x18
ror rax, 1
call rax
mov dword [rsp - 0x24], ebx
mov rax, qword [0x140141680]
lea r8, [rsp + 0x20]
not rax
mov dword [rsp - 0x28], edi
lea rdx, [rsp + 0x260]
movabs rcx, 0x62e31c9575d6773c
sub rcx, 0x4a42f26a
add rcx, 0x415bfe70
xor rcx, 0x5304116c
xchg r15, r9
mov r15, rbx
xchg r15, r9
sub rax, rcx
movabs rcx, 0x14fd8a2d77f5dabc
sub rcx, 0x5e4a27e2
xor rcx, 0x4f2b1daf
add rcx, 0x7fffffff
sub rcx, 0x2ce44d11
xor rax, rcx
movabs rcx, 0x7f47c6512e1a5d46
add rcx, 0x30437323
sub rcx, 0x1cf4d8b0
add rcx, 0x13bca644
add rcx, 0x7fffffff
add rcx, 0x26ef2452
rol rax, 0xe
rol rax, 0x27
rol rax, 1
rol rax, 1
add rax, rcx
movabs rcx, 0x14f8db3b49c27a58
sub rcx, 0xce32292
add rcx, 0x2012f96a
add rcx, 0x7fffffff
add rcx, 0xc5d8dd8
xor rax, rcx
lea rcx, [rsp + 0x30]
mov r11, r11
call rax
xchg rbx, r12
mov r12, qword [rsp + 0x250]
xchg r12, rbx
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x164a1336
add eax, 0x2300bd47
sub eax, 0x31cd936f
add eax, 0xb882c2f3
xchg rbp, rbx
mov rbp, qword [rsp + 0x250]
xchg rbp, rbx
add rsp, 0x71ca45a
sub rsp, 0x71ca21a
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbx, r8
mov r8, qword [rsp + 0x250]
xchg rbx, r8
mov eax, 0x515a27e1
sub eax, 0x44d90294
add eax, 0x6fd57f3d
xor eax, 0x64ac4278
add eax, 0xa7051a43
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008e2a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140141c24], 0
jne 0x14008e39d
xchg r8, r8
xor edx, edx
lea r8, [0x140141c20]
nop word [rax + rax]
mov ecx, edx
xchg r14, r14
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
mov rdx, rdx
neg ecx
and ecx, 0xedb88320
inc edx
xchg rdx, rdx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov r14, r14
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x40], ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov rbp, rbp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg rdx, rdx
shr ecx, 1
and eax, 1
neg eax
xchg rsp, rsp
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r15, r15
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r10, r10
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x2c], esi
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0xc], 0x49c9345c
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x3c], 0x2fbb7c25
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x28], esp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x38], ecx
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r14, r14
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008e2c3
ret
Function at 0x140093700
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg r12, rbp
mov qword [rsp + 0x18], rsi
xchg r15, r15
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
movzx eax, byte [rdx + 1]
mov rdi, rdi
mov r15, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
xchg r11, r11
mov r8d, dword [rcx + 4]
shl ebx, 3
shl ebx, 5
dec r8d
xchg rsi, rsi
or ebx, eax
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
mov rbp, rbp
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
mov r14, r14
movzx eax, byte [rdx + 3]
shl ebx, 7
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x30], edx
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 6
or edi, eax
mov dword [rsp - 0x18], 0x2851a881
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 2
shl edi, 2
or edi, eax
test r8d, r8d
mov r15, r15
jle 0x14009383b
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
movsxd rax, r8d
xchg r12, r12
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov dword [rsp - 0x10], 0x3e4dc3f2
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov dword [rsp - 0x1c], 0x207159d4
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
mov dword [rsp - 0x3c], ebx
call fcn.140093f70
xor ebx, eax
mov rdx, rbp
mov r11, r11
mov ecx, ebx
call fcn.140093f70
xor edi, eax
neg rsi
sub rsi, 0xffffffffffffffe8
neg rsi
neg rbp
sub rbp, 0xffffffffffffffe8
neg rbp
sub r14, 1
jne 0x1400937f5
mov r14, r14
lea rax, [r15 + 7]
mov ecx, 0x4bb597b6
sub ecx, 0x5ca223
xor ecx, 0x48fa13a8
add ecx, 0x367c1785
xor ecx, 0x3a1efdc4
mov byte [rax - 4], dil
mov r12, r12
mov byte [rax], bl
dec rax
shr ebx, 1
shr ebx, 5
shr ebx, 1
shr ebx, 1
shr edi, 8
mov r13, r13
sub rcx, 1
jne 0x14009385c
xchg rbx, rdi
mov rdi, qword [rsp + 0x40]
xchg rbx, rdi
xchg r13, rbp
mov r13, qword [rsp + 0x48]
xchg rbp, r13
xchg rsi, r14
mov r14, qword [rsp + 0x50]
xchg r14, rsi
add rsp, 0x20
mov rsp, rsp
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret