joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085860
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbx
mov qword [rsp], rbp
push rsi
mov r14, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
xchg r15, r15
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
nop
add rsp, 0x6d9b1b7
sub rsp, 0x6d9b1d7
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x40], edi
xor eax, 0x1d1855eb
mov rsi, rcx
cmp eax, 0x1d180fa6
xchg rcx, rcx
jne 0x1400859f6
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x1d1855eb
xchg rsp, rsp
cmp eax, 0x1d1810bb
jne 0x1400859f6
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400857a0
xchg rcx, rcx
xchg rdx, rsi
mov rcx, rdx
xchg rdx, rsi
xchg rbp, r14
mov rbp, rax
xchg rbp, r14
mov edx, dword [rax + 0x20]
mov r13, r13
call fcn.1400857a0
mov edx, dword [r14 + 0x24]
xchg r12, rcx
mov r12, rsi
xchg r12, rcx
mov r12, rax
call fcn.1400857a0
mov edx, dword [r14 + 0x1c]
xchg r9, r9
xchg rcx, rbp
mov rbp, rsi
xchg rbp, rcx
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.1400857a0
mov r11, r11
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
mov rbx, rbx
jbe 0x1400859f6
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.1400857a0
mov ecx, 0x77202007
add ecx, 0x262383c
sub ecx, 0x6973c26e
add ecx, 0x2d7b601a
xor ecx, 0xc2760a10
xchg rbx, rdx
mov rdx, rax
xchg rbx, rdx
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov rdi, rdi
je 0x1400859dc
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x1c], ecx
mov r8d, 0x14e2a27b
xor r8d, 0x797e2da6
xor r8d, 0xbca34c3
xor r8d, 0x6656bb1f
inc rbx
xchg r15, r15
call fcn.14008e8f0
cmp byte [rbx], 0
jne 0x14008599a
mov ecx, dword [rsp + 0x60]
mov rdx, rdx
not ecx
cmp ecx, r15d
je 0x140085a46
inc edi
mov rsi, rsi
cmp edi, dword [r14 + 0x18]
jb 0x14008594f
xor eax, eax
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg r13, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x20], esp
mov edx, dword [rax + rdx*4]
call fcn.1400857a0
jmp 0x1400859f8
Function at 0x140085a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov r8, r8
nop
sub rsp, 0x441e6362
add rsp, 0x441e6342
movzx eax, word [rcx]
mov edi, edx
xor eax, 0x1d1855eb
xchg r13, r13
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
cmp eax, 0x1d180fa6
jne 0x140085b2b
xchg r9, r9
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x1d1855eb
cmp eax, 0x1d1810bb
mov dword [rsp - 0x10], 0x77720282
jne 0x140085b2b
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400857a0
sub edi, dword [rax + 0x10]
mov dword [rsp - 0x24], ecx
cmp edi, dword [rax + 0x14]
jae 0x140085b2b
mov edx, dword [rax + 0x1c]
mov dword [rsp - 0x24], esp
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400857a0
xchg r8, r8
xchg r9, rcx
mov r9, rbx
xchg rcx, r9
mov edx, dword [rax + rdi*4]
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg rbx, r11
nop
add rsp, 0x2607d602
sub rsp, 0x2607d5e2
pop rdi
jmp fcn.1400857a0
mov rbx, qword [rsp + 0x30]
xor eax, eax
xchg rdi, rdi
nop
add rsp, 0xc5021db
sub rsp, 0xc5021bb
pop rdi
mov dword [rsp - 0x44], 0x1d6167f4
ret
Function at 0x140089e03
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r15, r15
push rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rbx, rsi
mov rsi, qword [rcx]
xchg rbx, rsi
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp - 0x20], edx
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r12, r12
xchg rsp, r15
movups xmmword [r15 + 0x28], xmm0
xchg rsp, r15
lea rdx, [rsi + 1]
mov dword [rsp - 0x14], 0x4f66d7c
xchg rsp, rsi
movups xmmword [rsi + 0x38], xmm0
xchg rsi, rsp
xchg rsp, r15
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.140017b4c
mov dword [rsp - 0x2c], 0x54fc29f4
mov edx, 0x2a906223
xor edx, 0x96c15ca
xor edx, 0x1dc5e497
sub edx, 0x235a5f93
test rsi, rsi
je 0x140089e67
mov dword [rsp - 0x10], ebx
xchg rdi, r10
mov r10, rax
xchg rdi, r10
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0xc], ebx
mov r9d, 0x430c2f01
xor r9d, 0x6ec381ce
xor r9d, 0xc5a94f1
sub r9d, 0x17bb482d
xor r9d, 0x9d9f2ee
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x2c], ebx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x28], ebx
mov word [rdi - 2], cx
sub r8, 1
jne 0x140089e37
xor ecx, ecx
mov dword [rsp - 0x38], ebp
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.140089f10
mov r14, r14
xchg rbx, rcx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
mov ebx, eax
mov dword [rsp - 0x1c], 0x22dc460b
xchg rsi, r13
mov r13, qword [rsp + 0x70]
xchg rsi, r13
lea rax, [rsp + 0x28]
mov dword [rsp - 0x20], 0x5f89173b
cmp rcx, rax
jne 0x140089ef7
xor eax, eax
lea rdi, [rsp + 0x28]
mov r12, r12
mov ecx, 0x446341d4
add ecx, 0x4bd29d7
xor ecx, 0x28d9c83
sub ecx, 0x3e9b794b
sub ecx, 0xd127dad
rep stosb byte [rdi], al
mov dword [rsp - 0x18], ecx
mov eax, ebx
xchg rsi, rbx
mov rsi, qword [rsp + 0x78]
xchg rbx, rsi
sub rsp, 0xffffffffffffffa0
pop rdi
xchg r9, r9
ret
call fcn.1400992c0
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0x18], edx
add rsp, 0x60
pop rdi
ret
Function at 0x14008b303
Capabilities:
Encode data using xor

Disassembly:
xchg r9, r11
mov r9, rsp
xchg r9, r11
xchg r12, rbx
mov qword [r11 + 0x20], r12
xchg r12, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
xchg r15, r15
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
xchg rbp, r13
mov qword [r11 + 8], r13
xchg rbp, r13
xorps xmm0, xmm0
mov dword [rsp - 0x34], 0x6ed7420
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg rsi, r12
mov qword [r11 + 0x10], r12
xchg rsi, r12
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x10], 0x52257b0a
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov r14, rdx
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp - 0x20], 0x58186851
lea rdx, [rsi + 1]
xchg rsp, r10
movups xmmword [r10 + 0x38], xmm0
xchg rsp, r10
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x34], 0xb7ed468
call fcn.140017b4c
mov edx, 0x6bb653b3
sub edx, 0x175d17cf
add edx, 0x2955ea89
sub edx, 0x3f2c827
sub edx, 0x5edd2a5b
test rsi, rsi
je 0x14008b416
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x18], esi
mov r8, rsi
mov r9d, 0x5ce5fd79
add r9d, 0x5688359
xor r9d, 0x5a32919f
xor r9d, 0x2c74bc2
sub r9d, 0x3abb5990
nop word [rax + rax]
mov rsp, rsp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 1
ror edx, 5
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
sub r8, 1
mov rbx, rbx
jne 0x14008b3ec
xor ecx, ecx
mov r8d, ebp
mov rdi, rdi
mov word [rax + rsi*2], cx
xchg rdx, rbx
mov rbx, r14
xchg rdx, rbx
xchg rbp, rcx
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
call fcn.14008b4f0
mov r15, r15
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r14, qword [rsp + 0x80]
mov dword [rsp - 0x44], 0x20b68f24
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
xchg r12, rbp
mov r12, qword [rsp + 0x70]
xchg rbp, r12
cmp rcx, rax
jne 0x14008b4b7
mov rbp, rbp
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x37055d54
sub ecx, 0x2e86c8e5
xor ecx, 0x7e68f342
add ecx, 0x576f883
xor ecx, 0x7b8d5f80
rep stosb byte [rdi], al
mov eax, ebx
mov rcx, rcx
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400992c0
mov eax, ebx
mov dword [rsp - 0x10], 0x24df5bbc
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x58af072f
sub rsp, 0x58af06cf
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008b4f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0x14], 0x1b0d9af8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
xchg rbx, r12
mov r12, rdx
xchg r12, rbx
xchg r15, rdi
mov r15, rcx
xchg r15, rdi
xor edx, edx
mov dword [rsp - 0x38], edx
lea rcx, [rsp + 0x30]
mov r8d, 0x67a00c2b
xor r8d, 0x133d3b04
sub r8d, 0x17ee87d5
xor r8d, 0x5caead52
call fcn.140099900
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg r12, r12
mov rax, qword [r8 + 0x10]
mov r8, qword [rax]
test r8, r8
je 0x14008b7bf
xchg rcx, rcx
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008b7bf
xchg r11, r11
mov edx, 0x3ef198b3
add edx, 0x271704d
sub edx, 0x21f8641a
sub edx, 0x1f6aa3e2
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.14009a490
mov r10, r10
mov edx, 0xf7e002d
xor edx, 0x5e1a33d6
xor edx, 0x40826d72
sub edx, 0x11e65e2d
lea rcx, [rsp + 0x30]
call fcn.14009a5a0
mov rbx, rbx
test rax, rax
je 0x14008b78c
xor ecx, ecx
mov rdx, rdi
mov dword [rsp - 0x24], 0x1e43c92e
mov word [rax], cx
movabs rcx, 0x7d53e0b76f6f6be4
xor rcx, 0x7fcaa6
sub rcx, 0x1de76570
add rcx, 0x7fffffff
add rcx, 0x22b78fb0
mov rax, qword [0x140141690]
xchg r8, r8
ror rax, 0x13
ror rax, 9
ror rax, 1
ror rax, 1
not rax
sub rax, rcx
xchg r8, r8
movabs rcx, 0x5e7ab73a5d513a5a
sub rcx, 0x123ac704
sub rcx, 0x2d57a632
add rcx, 0x3c6ade45
add rcx, 0x50f31c36
rol rax, 0xf
rol rax, 2
rol rax, 0xb
rol rax, 7
rol rax, 4
rol rax, 2
rol rax, 0xa
rol rax, 2
rol rax, 1
rol rax, 1
add rax, rcx
lea rcx, [rsp + 0x20]
xchg r11, r11
call rax
mov rax, qword [0x140141680]
lea r8, [rsp + 0x20]
not rax
xchg rsi, rsi
lea rdx, [rsp + 0x260]
movabs rcx, 0x37a5f728344ef76b
sub rcx, 0x23f898e5
xor rcx, 0x3d86efcb
sub rcx, 0x1844411c
sub rcx, 0xcf07b5c
xchg r9, rbx
mov rbx, r9
xchg r9, rbx
add rax, rcx
movabs rcx, 0x1cc8bee601b57b0
sub rcx, 0x11a10a12
sub rcx, 0x19612d3
add rcx, 0x9e22fc
xor rcx, 0x45e41ce4
ror rax, 0x28
ror rax, 2
ror rax, 1
ror rax, 3
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
movabs rcx, 0x31928bf103c666a1
add rcx, 0x6ca487f2
xor rcx, 0x73e11425
add rcx, 0x7c05676e
ror rax, 0x24
ror rax, 6
ror rax, 1
ror rax, 1
add rax, rcx
xchg r14, r14
lea rcx, [rsp + 0x30]
rol rax, 9
rol rax, 0xc
rol rax, 2
rol rax, 0x14
rol rax, 1
call rax
xchg rsi, rbx
mov rsi, qword [rsp + 0x250]
xchg rbx, rsi
add rsp, 0x4c7f6568
sub rsp, 0x4c7f6328
pop rdi
ret
mov eax, 0x47ec62b1
xor eax, 0x7cafa4fd
xor eax, 0x1be64342
xor eax, 0x57063ee
add eax, 0x9a2a1921
mov rbx, qword [rsp + 0x250]
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
mov r15, r15
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x2847ed68
xor eax, 0x5df10828
sub eax, 0x309ba076
sub eax, 0x1b57addd
xor eax, 0xe9c397d8
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008ec70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142084], 0
jne 0x14008ed74
mov rdx, rdx
xor edx, edx
lea r8, [0x140142080]
nop word [rax + rax]
mov dword [rsp - 0x30], 0x354bb975
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov r8, r8
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
mov rbp, rbp
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x38], ecx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x24], 0x5a0ecdd5
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x38], 0x177a2715
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x44], ebx
shr ecx, 1
and eax, 1
neg eax
mov rbp, rbp
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r14, r14
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r8, r8
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x3c], esp
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov rdi, rdi
shr eax, 1
and ecx, 1
neg ecx
xchg r12, r12
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x28], esi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x18], edx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008ec9b
mov dword [rsp - 0x44], edx
ret
Function at 0x1400940c0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rbp, r10
mov qword [rsp + 0x10], r10
xchg rbp, r10
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg r8, rsi
nop
push r15
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
push r15
nop
add rsp, 0x5f68a119
sub rsp, 0x5f68a139
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x3c], 0x6c037e88
xchg r15, r10
mov r10, r8
xchg r15, r10
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
xchg rsi, rsi
shl ebx, 1
shl ebx, 2
shl ebx, 2
shl ebx, 3
dec r8d
or ebx, eax
xchg r14, r14
shl edi, 2
shl edi, 2
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
xchg r8, r8
shl ebx, 1
shl ebx, 1
shl ebx, 5
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
mov dword [rsp - 0x10], esi
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x34], ecx
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
mov dword [rsp - 0x28], edi
shl edi, 5
shl edi, 3
or edi, eax
mov dword [rsp - 0x28], ebx
movzx eax, byte [rdx + 7]
shl edi, 6
shl edi, 1
shl edi, 1
or edi, eax
test r8d, r8d
mov dword [rsp - 0x40], esp
jle 0x140094231
xchg rdx, rbp
mov rbp, qword [rcx + 8]
xchg rbp, rdx
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
mov rsi, rsi
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
mov dword [rsp - 0xc], 0x27d2221d
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rsi, rbx
mov rdx, rbx
xchg rbx, rsi
mov ecx, edi
call fcn.1400949c0
mov rdi, rdi
xor ebx, eax
xchg r10, rbp
mov rdx, r10
xchg rbp, r10
mov ecx, ebx
call fcn.1400949c0
xor edi, eax
mov dword [rsp - 0x14], 0x1ff2e956
nop
add rsi, 0xf1f5ee5
sub rsi, 0xf1f5efd
nop
sub rbp, 0x5e89f3e1
add rbp, 0x5e89f3c9
sub r14, 1
jne 0x1400941da
lea rax, [r15 + 7]
xchg r12, r12
mov ecx, 0x667409ed
sub ecx, 0x1c60f200
sub ecx, 0x11265552
sub ecx, 0xd36c905
xor ecx, 0x2bb5f992
mov byte [rax - 4], dil
mov dword [rsp - 0x3c], 0x6d316383
mov byte [rax], bl
dec rax
shr ebx, 7
shr ebx, 1
shr edi, 6
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x140094255
mov dword [rsp - 0x3c], 0x50e747b4
mov rbx, qword [rsp + 0x40]
xchg rbp, rsi
mov rsi, qword [rsp + 0x48]
xchg rbp, rsi
mov rsi, qword [rsp + 0x50]
nop
add rsp, 0x59c989f2
sub rsp, 0x59c989d2
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400942c8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rcx, rsp
mov rax, rcx
xchg rsp, rcx
xchg rbx, rdi
mov qword [rax + 8], rdi
xchg rbx, rdi
xchg rbp, r10
mov qword [rax + 0x10], r10
xchg r10, rbp
xchg r12, rsi
mov qword [rax + 0x18], r12
xchg rsi, r12
xchg rdi, r14
mov qword [rax + 0x20], r14
xchg rdi, r14
nop
sub rsp, 8
mov qword [rsp], r14
nop
add rsp, 0x2a7c4ea0
sub rsp, 0x2a7c4ec0
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x10], 0x43ef0f7c
xchg r8, r14
mov r8, r14
xchg r8, r14
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
shl edi, 2
shl edi, 1
shl edi, 3
shl edi, 2
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x24], edi
shl ebx, 2
shl ebx, 4
shl ebx, 2
or ebx, eax
xchg rsi, rsi
movzx eax, byte [rdx + 3]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x18], 0x3c0341e2
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 5
shl edi, 2
shl edi, 1
or edi, eax
mov dword [rsp - 0x40], ebx
movzx eax, byte [rdx + 7]
shl edi, 6
shl edi, 2
or edi, eax
mov rcx, rcx
mov eax, dword [rcx + 4]
test eax, eax
jle 0x1400943ec
xchg rsi, r13
mov r13, qword [rcx + 8]
xchg rsi, r13
lea ebp, [rax - 1]
shr ebp, 1
mov dword [rsp - 0x38], 0x60af6029
inc ebp
mov rdx, rsi
mov ecx, edi
call fcn.1400949c0
mov r13, r13
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov dword [rsp - 0x14], 0x6e079d9d
call fcn.1400949c0
xor edi, eax
add rsi, 0x18
mov rcx, rcx
sub rbp, 1
jne 0x1400943b7
lea rax, [r14 + 7]
mov ecx, 0x5bf78936
add ecx, 0x19063702
xor ecx, 0x78d44b0d
xor ecx, 0xc298b31
mov byte [rax - 4], dil
mov byte [rax], bl
xchg r8, r8
dec rax
shr ebx, 6
shr ebx, 1
shr ebx, 1
shr edi, 3
shr edi, 3
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x140094407
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x2c], 0x172c4660
xchg rcx, rbp
mov rcx, qword [rsp + 0x38]
xchg rbp, rcx
xchg r11, rsi
mov r11, qword [rsp + 0x40]
xchg rsi, r11
xchg r15, rdi
mov r15, qword [rsp + 0x48]
xchg rdi, r15
add rsp, 0x20
pop r14
ret
Function at 0x140094638
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rsi, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
xchg r14, r14
lea rbp, [rsp - 0x47]
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001df0]
xchg rsp, rsp
xor edi, edi
movdqa xmm1, xmmword [0x140001db0]
xchg rbx, r13
mov r13, rdx
xchg rbx, r13
xchg rbp, r15
movdqu xmmword [r15 - 0x39], xmm0
xchg rbp, r15
xchg r15, rsi
mov r15, rcx
xchg r15, rsi
mov edx, edi
mov dword [rsp - 0x28], esp
movdqa xmm0, xmmword [0x140001dc0]
mov r8d, edi
xchg rbp, r14
movdqu xmmword [r14 - 0x29], xmm1
xchg rbp, r14
movdqa xmm1, xmmword [0x140001dd0]
mov dword [rsp - 0x14], edx
xchg rsi, rbp
movdqu xmmword [rsi - 0x19], xmm0
xchg rsi, rbp
movdqu xmmword [rbp - 9], xmm1
mov ecx, edx
lea r8, [r8 + 4]
xchg rbp, rbp
mov eax, 0x543eccd3
sub eax, 0x3b076d64
xor eax, 0x47b2d379
xor eax, 0x31b4e9f3
sub eax, 0x1b24435d
inc rdx
mov r10, r10
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov dword [rsp - 0x24], 0x286d91c0
jb 0x1400946db
cmp dword [rsi + 4], 8
jne 0x140094795
mov dword [rsp - 0x30], esp
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
xchg r11, r11
inc rdi
shl cx, 1
shl cx, 3
shl cx, 1
shl cx, 1
shl cx, 1
shl cx, 1
or cx, ax
mov dword [rsp - 0x38], 0x1ef43085
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140094733
mov r15, r15
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140094464
xchg rbp, rbp
jmp 0x140094888
cmp dword [rsi], edi
jle 0x140094888
mov dword [rsp - 0x40], 0x7fcc255
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x4aa12f77
add r8d, 0x11727bbf
add r8d, 0x2230e602
sub r8d, 0x3a9d04b9
sub r8d, 0x43a78c7b
movzx eax, byte [rbx]
mov dword [rsp - 0x38], 0x41d07959
movzx ecx, byte [rbx + 1]
neg rbx
add rbx, 0xfffffffffffffffe
neg rbx
shl ax, 2
shl ax, 5
shl ax, 1
or cx, ax
mov dword [rsp - 0x10], ebp
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x1400947ce
mov dword [rsp - 0x14], 0x45bffb90
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg r15, r15
mov rcx, rsi
call fcn.140094464
mov r8d, dword [rsi + 4]
mov dword [rsp - 0x2c], 0x622f93b
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
xchg r13, r13
nop
sub r8d, 0x3fcd18df
add r8d, 0x3fcd18d7
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140094464
inc edi
mov dword [rsp - 0x10], 0x671ac86f
nop
sub r14d, 0x7063568f
add r14d, 0x70635697
cmp edi, dword [rsi]
mov dword [rsp - 0x28], 0x4d260b7d
jl 0x1400947a8
xor eax, eax
lea r11, [rsp + 0xa0]
xchg r13, rbx
mov r13, qword [r11 + 0x28]
xchg rbx, r13
lea rdi, [rbp + 7]
mov r12, r12
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg r12, r11
mov rsp, r12
xchg r11, r12
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
ret
Function at 0x140094970
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov dword [rsp - 0x1c], 0x61a88b04
je 0x1400949b9
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
xchg rbx, rbx
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov dword [rsp - 0x44], ecx
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
mov dword [rsp - 0x2c], 0x40c7a686
cmovb r11d, ecx
shr edx, 1
jne 0x140094982
mov eax, r10d
mov r13, r13
ret
Function at 0x14009fc5c
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0xf8]
xchg r9, rax
xor r8d, r8d
xchg rsp, rsp
xchg r9, rdx
mov rdx, r9
xchg r9, rdx
test rax, rax
mov dword [rsp - 0x44], 0x28152191
je 0x14009fcd0
mov ecx, r8d
mov edx, 0x643b9b43
sub edx, 0x26d2ff57
add edx, 0x420a35f7
sub edx, 0x59a47e6d
add edx, 0x2e3ecf12
rol edx, cl
xor dl, byte [rax]
mov r11, r11
inc rax
mov byte [r8 + r9], dl
inc r8
xchg r12, r12
cmp r8, 0x20
jb 0x14009fc87
mov al, 0x52
sub al, 0x1d
sub al, 0x1a
sub al, 3
sub al, 0x17
ret
xchg rdi, rax
mov rdi, qword [rcx + 0x100]
xchg rdi, rax
test rax, rax
je 0x14009fd07
xchg r15, r15
movups xmm0, xmmword [rax]
xchg rdx, rsp
movups xmmword [rsp], xmm0
xchg rdx, rsp
movups xmm1, xmmword [rax + 0x10]
xchg rdx, rbp
movups xmmword [rbp + 0x10], xmm1
xchg rbp, rdx
jmp 0x14009fcc5
xorps xmm0, xmm0
xor al, al
mov dword [rsp - 0xc], esp
xchg rdx, r12
movups xmmword [r12], xmm0
xchg rdx, r12
xchg r13, rdx
movups xmmword [r13 + 0x10], xmm0
xchg r13, rdx
ret
Function at 0x1400b6758
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg rsp, r11
mov qword [r11 + 8], rbx
xchg rsi, r9
mov qword [r11 + 0x18], r9
xchg r9, rsi
mov qword [r11 + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x40
mov dword [rsp - 0x2c], 0x27ebc135
mov rdx, qword [0x1401414c8]
xchg rcx, r14
mov rbx, r14
xchg rcx, r14
movabs rcx, 0xce5b90325df81287
xor rcx, 0x6325945a
xor rcx, 0x3571277e
sub rcx, 0x5cf89f3
mov dword [rsp + 0x58], 0x1ff75481
xor dword [rsp + 0x58], 0x1a4bf7ba
add dword [rsp + 0x58], 0x50d27d46
xor dword [rsp + 0x58], 0x568f2091
add rdx, rcx
movabs rax, 0x1bb0b3b9607a23c7
xor rax, 0x1ae86f09
xor rax, 0x5ed7097c
sub rax, 0xa2d795c
ror rdx, 1
ror rdx, 5
ror rdx, 8
ror rdx, 1
ror rdx, 1
ror rdx, 1
movabs rcx, 0x8709453f2fcfbbf3
xor rcx, 0x73e3d123
sub rcx, 0x2b32a2b9
sub rcx, 0x2927bc5
sub rcx, 0x2963f076
add rax, rdx
lea rdx, [r11 + 0x10]
mov rdi, rdi
xor rax, rcx
movabs rcx, 0x7eff8c793e9d4df8
xor rcx, 0x2ff1824
add rcx, 0x64503c0
add rcx, 0x7fffffff
add rcx, 0x273230f5
sub rax, rcx
lea rcx, [r11 - 0x28]
xchg rcx, rcx
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg r14, r14
mov qword [rbx], rdi
xor esi, esi
xchg rdx, rdi
movups xmmword [rdx], xmm0
xchg rdi, rdx
movups xmmword [rdi + 0x10], xmm0
mov r15, r15
xchg rdx, rdi
movups xmmword [rdx + 0x20], xmm0
xchg rdx, rdi
test eax, eax
mov dword [rsp - 0x18], esp
jne 0x1400b68ae
mov qword [rbx + 0x38], rsi
jmp 0x1400b69e9
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
mov dword [rsp - 0x44], ebx
inc r14
cmp word [rax + r14*2], si
jne 0x1400b68bb
mov r14, r14
xchg r14, rdx
mov qword [rbx + 0x38], rdx
xchg rdx, r14
cmp qword [rbx], rdi
mov dword [rsp - 0x3c], 0x7f54009
je 0x1400b68ef
mov rcx, qword [rbx]
call fcn.1400992c0
cmp r14, 0x18
mov r10, r10
jbe 0x1400b692c
lea rcx, [r14 + r14]
call fcn.1400995f0
mov qword [rbx], rax
mov dword [rsp - 0x40], ecx
test rax, rax
jne 0x1400b6932
xchg rdi, rbp
mov qword [rbx], rbp
xchg rbp, rdi
xchg rbx, rcx
mov rbx, rsi
xchg rcx, rbx
jmp 0x1400b6953
mov qword [rbx], rdi
mov rax, rdi
xorps xmm0, xmm0
mov r11, r11
xchg rsp, rax
movups xmmword [rsp], xmm0
xchg rsp, rax
xchg r11, rax
movups xmmword [r11 + 0x10], xmm0
xchg r11, rax
movups xmmword [rax + 0x20], xmm0
xchg rdi, rdi
mov rcx, qword [rbx]
mov edx, 0x115d9a22
add edx, 0x38fbedb4
xor edx, 0x65a455ca
sub edx, 0x16f8b24a
add edx, 0x1da1419
cmp qword [rbx + 0x38], rsi
mov dword [rsp - 0x18], edx
jbe 0x1400b69e9
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x24], 0x6f53210f
mov r9d, 0x689995ed
add r9d, 0x17162229
xor r9d, 0xe9c3811
sub r9d, 0x4eb128b6
xor r9d, 0x228257ae
and ax, r9w
mov dword [rsp - 0x34], 0x5c144976
ror edx, 4
ror edx, 4
xor ax, word [r8 + rcx]
mov dword [rsp - 0x40], 0x75115381
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov rbx, rbx
jb 0x1400b6986
xchg rcx, rsi
mov rcx, qword [rsp + 0x60]
xchg rsi, rcx
mov rax, rbx
xchg rbp, rbp
xchg rbx, rcx
mov rcx, qword [rsp + 0x50]
xchg rcx, rbx
xchg rdi, rbp
mov rbp, qword [rsp + 0x68]
xchg rdi, rbp
sub rsp, 0xffffffffffffffc0
pop r14
mov dword [rsp - 0x14], ecx
ret