joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076850
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
push rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
push r12
mov dword [rsp - 0x10], 0x5c3870d6
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x531a1b60
sub rsp, 0x531a1b80
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x1cb47428
mov dword [rsp - 0xc], ebp
mov rsi, rcx
cmp eax, 0x1cb42e65
jne 0x140076a02
movsxd rdx, dword [rcx + 0x3c]
mov dword [rsp - 0xc], ecx
mov eax, dword [rdx + rcx]
xor eax, 0x1cb47428
cmp eax, 0x1cb43178
mov dword [rsp - 0xc], ebx
jne 0x140076a02
mov edx, dword [rdx + rcx + 0x88]
call fcn.140076770
xchg r14, r14
xchg r9, rsi
mov rcx, r9
xchg r9, rsi
xchg r8, rax
mov r14, r8
xchg r8, rax
mov edx, dword [rax + 0x20]
xchg rdx, rdx
call fcn.140076770
mov edx, dword [r14 + 0x24]
xchg r13, rcx
mov r13, rsi
xchg r13, rcx
mov r12, rax
mov r11, r11
call fcn.140076770
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
mov r13, rax
mov rdi, rdi
call fcn.140076770
xor edi, edi
mov qword [rsp + 0x70], rax
mov r15, r15
cmp dword [r14 + 0x18], edi
jbe 0x140076a02
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x34], edx
xchg rcx, r15
mov r15, rsi
xchg rcx, r15
call fcn.140076770
mov ecx, 0x6697b4a3
sub ecx, 0x50318037
add ecx, 0x388ce3d7
add ecx, 0xb10ce7bc
xchg rbx, rsp
mov rsp, rax
xchg rbx, rsp
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
xchg rcx, rcx
je 0x1400769e3
nop dword [rax]
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
lea rcx, [rsp + 0x60]
mov r12, r12
mov r8d, 0x20a34b13
add r8d, 0x537e1bc2
xor r8d, 0xd03471b
xor r8d, 0x6ef9c3a4
sub r8d, 0x17dbe269
inc rbx
mov dword [rsp - 0x40], 0x3703a78b
call fcn.140082330
cmp byte [rbx], 0
jne 0x140076990
mov ecx, dword [rsp + 0x60]
xchg rdx, rdx
not ecx
cmp ecx, r15d
je 0x140076a52
inc edi
mov dword [rsp - 0x30], 0x40ca2ab3
cmp edi, dword [r14 + 0x18]
jb 0x140076947
xor eax, eax
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg rbx, r14
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
xchg r15, r15
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, rdx
mov rdx, rsi
xchg rdx, rcx
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x28], ecx
call fcn.140076770
jmp 0x140076a04
Function at 0x14007a620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x20], 0x72b23049
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x1d2f717d
sub rsp, 0x1d2f71dd
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov r14, r14
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r13, rax
mov qword [rsp + 0x20], r13
xchg r13, rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg rsp, r12
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x3c], edx
xchg r14, rsp
movups xmmword [r14 + 0x48], xmm0
xchg r14, rsp
call fcn.14000ef40
xchg rdx, rdx
mov edx, 0x24a4c1d8
add edx, 0x2349bd4
xor edx, 0x772a990
xor edx, 0x7d17a47e
test rsi, rsi
je 0x14007a729
mov rdx, rdx
xchg rdi, r12
mov r12, rax
xchg r12, rdi
sub rbx, rax
mov dword [rsp - 0x14], 0x739c9953
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x35cd09b6
add r9d, 0x32018041
xor r9d, 0x1c342f29
sub r9d, 0x7bfaa5df
nop dword [rax]
mov dword [rsp - 0x18], 0x6296d7b8
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov r9, r9
ror edx, 7
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
mov r9, r9
sub r8, 1
jne 0x14007a700
xor ecx, ecx
mov dword [rsp - 0x30], ebx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.14007a7e0
xchg r8, r8
xchg r9, rcx
mov r9, qword [rsp + 0x20]
xchg r9, rcx
mov ebx, eax
mov dword [rsp - 0x34], 0x3348fa1e
xchg rsi, r12
mov r12, qword [rsp + 0x70]
xchg rsi, r12
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14007a7b4
mov dword [rsp - 0x40], 0x27389951
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x6ccedca9
xor ecx, 0x663399e9
xor ecx, 0x8f8c5a6
sub ecx, 0x20580b6
rep stosb byte [rdi], al
mov r14, r14
mov eax, ebx
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098180
xchg r10, r10
mov eax, ebx
mov rbx, qword [rsp + 0x78]
nop
sub rsp, 0x4a9e8cdd
add rsp, 0x4a9e8d3d
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007b3e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov r12, r12
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
mov rbx, rdx
mov rdi, rcx
mov dword [rsp - 0x24], ebp
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x47b15800
xor r8d, 0x53c9ef9b
add r8d, 0x35c642cc
sub r8d, 0x4a3ef85f
call fcn.140098790
mov rax, qword gs:[0x60]
xchg rbp, r8
mov rbp, qword [rax + 0x18]
xchg rbp, r8
xchg rsi, rax
mov rsi, qword [r8 + 0x10]
xchg rsi, rax
xchg r8, rsi
mov rsi, qword [rax]
xchg rsi, r8
test r8, r8
je 0x14007b644
xchg rbx, rbx
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14007b644
mov edx, 0x13c4112
xor edx, 0x79ee15b8
sub edx, 0x48a3821d
add edx, 0x23b9eb25
sub edx, 0x53e8bcae
lea rcx, [rsp + 0x30]
mov r9d, 0x3ddab865
sub r9d, 0x339b1fcb
sub r9d, 0x6ff19cd
add r9d, 0x32ae482d
sub r9d, 0x35eec5f7
call fcn.140099210
mov edx, 0x79b52e24
sub edx, 0x2b3f5ae4
xor edx, 0x2cfbbceb
sub edx, 0x628e6f4f
lea rcx, [rsp + 0x30]
call fcn.1400992e0
test rax, rax
mov dword [rsp - 0x14], 0x3901e040
je 0x14007b615
xor ecx, ecx
xchg rdi, rdx
mov rdi, rdx
xchg rdi, rdx
mov word [rax], cx
movabs rcx, 0x274e2fe66ab557c5
xor rcx, 0x3508a1d4
add rcx, 0x1ba9311d
sub rcx, 0x6392f38e
mov rax, qword [0x1404a5370]
xchg r10, r10
xor rax, rcx
movabs rcx, 0x6407e0383b90e008
sub rcx, 0x7bbf961
sub rcx, 0x2d413854
add rcx, 0x56e794
add rcx, 0x2943822c
not rax
rol rax, 0x19
rol rax, 0x19
xor rax, rcx
mov rcx, rcx
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [str.SkV_t5]
mov r8, r8
lea r8, [rsp + 0x20]
rol rax, 8
rol rax, 1
lea rdx, [rsp + 0x260]
xchg r12, r12
movabs rcx, 0x5a73ce1e4fff0cca
sub rcx, 0xc978d9e
sub rcx, 0x2aa6ec4b
add rcx, 0x41617812
add rcx, 0x7fffffff
add rcx, 0x244b39cd
xchg rbx, r9
mov rbx, r9
xchg r9, rbx
add rcx, rax
xchg rcx, rcx
movabs rax, 0x2137ce54520a0896
sub rax, 0x469e5684
xor rax, 0x7f7b79f5
add rax, 0x4803c3f9
ror rcx, 0x28
ror rcx, 0xa
ror rcx, 1
ror rcx, 3
ror rcx, 1
ror rcx, 1
add rax, rcx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x30], edx
call rax
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x1645d449
add eax, 0x20a3ef96
sub eax, 0x5503f79
add eax, 0x8e667b9b
mov rbx, qword [rsp + 0x250]
sub rsp, 0x1d1d7ff2
add rsp, 0x1d1d8232
pop rdi
mov rcx, rcx
ret
xchg r9, rbx
mov r9, qword [rsp + 0x250]
xchg r9, rbx
mov eax, 0x537d0c3
xor eax, 0x615f48d5
sub eax, 0x35ceef2
sub eax, 0x137523ca
add eax, 0x72697bdb
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400814b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov qword [rsp], rbx
add rsp, 0xfffffffffffffdd0
mov rax, qword [0x1404a58b0]
mov dword [rsp - 0x40], ebp
lea rdx, [rsp + 0x20]
not rax
xchg rsi, rcx
mov rbx, rsi
xchg rcx, rsi
movabs rcx, 0x42a1967e45d9fed1
xor rcx, 0x2b32fec8
sub rcx, 0x6a6e04e5
add rcx, 0x332823d7
xor r9d, r9d
xchg r10, r10
add rax, rcx
mov r8d, 0x3419bda3
add r8d, 0x173d0ecf
sub r8d, 0x1c768d27
add r8d, 0x2d2e4c4d
sub r8d, 0x5c0e8b90
rol rax, 0x1b
rol rax, 2
movabs rcx, 0xf3dd78be18f43514
add rcx, 0x2e8ac4bd
add rcx, 0x1da78fbb
add rcx, 0x111607a5
add rax, rcx
xor ecx, ecx
mov dword [rsp - 0x1c], esp
rol rax, 3
rol rax, 0xf
rol rax, 3
rol rax, 5
rol rax, 2
rol rax, 2
call rax
mov rbx, rbx
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg rcx, rsp
mov qword [rbx], rsp
xchg rsp, rcx
xchg rcx, rdx
movups xmmword [rdx], xmm0
xchg rcx, rdx
xchg rcx, rsi
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rcx
xchg rdx, rcx
movups xmmword [rdx + 0x20], xmm0
xchg rdx, rcx
test eax, eax
mov dword [rsp - 0x28], ebp
je 0x1400816b6
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff7e5b04ff
sub rdx, 0x4a878423
add rdx, 0xac432d2
sub rdx, 0x3cd6ce61
add rdx, 0x7fffffff
add rdx, 0x7e3f1ab3
nop
xchg r9, r9
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400815df
mov rcx, rbx
mov dword [rsp - 0x20], esp
mov qword [rbx + 0x38], rdx
call fcn.14000ef40
xor r8d, r8d
mov dword [rsp - 0x14], ecx
xchg r12, rax
mov rdx, r12
xchg r12, rax
mov ecx, 0x196cee71
sub ecx, 0xd260966
xor ecx, 0x3b467b27
xor ecx, 0x6bbcce6e
cmp qword [rbx + 0x38], r8
jbe 0x1400816cb
lea r9, [rsp + 0x20]
mov dword [rsp - 0x24], ebx
mov r10d, 0x2ce67ec9
add r10d, 0x260a6720
sub r10d, 0x44cdc362
add r10d, 0x15ca0ca4
sub r10d, 0x23ed2e2c
sub r9, rax
mov dword [rsp - 0x10], edi
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov rdx, rdx
ror ecx, 7
ror ecx, 1
xor ax, word [rdx + r9 - 2]
mov dword [rsp - 0x3c], 0x334e67ae
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x28], edi
jb 0x140081669
xchg rdx, rax
mov rdx, rbx
xchg rdx, rax
add rsp, 0x1e1b9b73
sub rsp, 0x1e1b9943
pop rbx
ret
xor r8d, r8d
mov dword [rsp - 0x14], 0x7e2c04d
xchg r8, rdx
mov qword [rbx + 0x38], rdx
xchg rdx, r8
mov rax, rbx
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
pop rbx
xchg rsi, rsi
ret
Function at 0x140082690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a6114], 0
jne 0x1400827a8
xor edx, edx
mov dword [rsp - 0x34], 0x75ffa96c
lea r8, [0x1404a6110]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x34], 0x1a8be2b9
and ecx, 1
mov eax, edx
shr eax, 1
mov r9, r9
neg ecx
and ecx, 0xedb88320
inc edx
xchg rdx, rdx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xchg rcx, rcx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x3c], 0x3d189251
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x24], edi
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x30], edx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], 0x2eb74119
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg r14, r14
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r9, r9
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x14], esp
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x18], 0x4680ddc0
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rsi, rsi
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov rdi, rdi
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], 0x48f75e26
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x34], 0x792a0887
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400826b8
xchg rdi, rdi
ret
Function at 0x1400871b2
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rcx
mov qword [rsp + 8], rbp
xchg rbp, rcx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push r12
mov r9, r9
nop
sub rsp, 8
mov qword [rsp], r13
push r14
xchg rcx, rcx
push r15
sub rsp, 0x28
xchg rsi, rdx
mov r14, rsi
xchg rdx, rsi
mov r13d, r8d
mov dword [rsp - 0x14], ebx
mov edx, 0x733dd5a6
xor edx, 0x20b82663
xor edx, 0x330306ad
add edx, 0x259109b
xor edx, 0x62e40603
cmp r8d, edx
xchg r11, r11
jae 0x140087143
mov edx, r13d
nop
movabs rcx, 0xffffffff5f1ea1b9
sub rcx, 0x382de474
add rcx, 0x178668a1
add rcx, 0x815cc85
add rcx, 0x7fffffff
add rcx, 0x39730d95
mov eax, 0x2f097671
add eax, 0x3f4108e0
sub eax, 0x4ee17d29
xor eax, 0x4bc4534d
sub eax, 0x54ad5161
mul rdx
mov dword [rsp - 0x18], ebx
cmovb rax, rcx
mov rcx, rax
call fcn.140098010
xchg r12, rax
mov r15, r12
xchg r12, rax
mov byte [rsp + 0x70], 0x76
sub byte [rsp + 0x70], 0x60
xor byte [rsp + 0x70], 0x53
sub byte [rsp + 0x70], 0x29
sub byte [rsp + 0x70], 0x1b
xchg rcx, rax
mov rcx, qword [rsp + 0x60]
xchg rcx, rax
lea r12d, [r13 + 0xfffff]
xor esi, esi
shr r12d, 8
shr r12d, 7
shr r12d, 4
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
mov dword [rsp - 0x24], 0x193e11e7
je 0x140087304
mov qword [rsp + 0x68], rbx
mov ecx, 0xce7b903
add ecx, 0x5b27930f
sub ecx, 0x79e2c9f
sub ecx, 0x60611f73
xchg rbp, rdi
mov qword [rsp + 0x20], rbp
xchg rbp, rdi
mov edi, esi
mov dword [rsp - 0x2c], 0x230a03dd
mov ebx, r13d
shl edi, 0x11
shl edi, 3
xchg r15, rdx
mov r15, rdx
xchg r15, rdx
sub ebx, edi
cmp ebx, ecx
cmova ebx, ecx
xchg rbx, rbx
xchg rcx, r8
mov r8, rax
xchg rcx, r8
mov r8d, ebx
mov dword [rsp - 0x2c], edx
call fcn.140083f00
test al, al
je 0x1400872db
shr ebx, 1
shr ebx, 1
xor eax, eax
xchg r8, r8
shr edi, 2
test ebx, ebx
je 0x1400872a2
xchg r9, r9
mov r9, r15
lea ecx, [rdi + rax]
mov r8d, ebp
mov r13, r13
xor r8d, dword [r9]
lea r9, [r9 + 4]
xor r8d, 0x1cb47428
mov rbp, rbp
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
jb 0x140087276
mov dword [rsp - 0x44], edx
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
inc esi
mov r8, r8
mov ecx, 0x601fb32e
sub ecx, 0xefeda6c
sub ecx, 0x41be3347
add ecx, 0x4f4016bf
sub ecx, 0x5e92bc3a
cmp esi, r12d
jb 0x140087219
jmp 0x1400872f4
mov byte [rsp + 0x70], 0x13
add byte [rsp + 0x70], 0x5e
sub byte [rsp + 0x70], 0x5e
xor byte [rsp + 0x70], 0x30
xor byte [rsp + 0x70], 0x23
mov rbx, qword [rsp + 0x68]
xchg rdi, r11
mov r11, qword [rsp + 0x20]
xchg r11, rdi
xchg r15, r8
mov rcx, r8
xchg r8, r15
call fcn.140098020
mov rbp, rbp
movzx eax, byte [rsp + 0x70]
nop
add rsp, 0x2c80ea38
sub rsp, 0x2c80ea10
pop r15
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
ret
Function at 0x140087370
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rbp
xchg rsi, rbp
mov qword [rsp + 0x20], rbp
xchg rsi, rbp
nop
push r12
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov dword [rsp - 0x44], ebp
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x20
mov dword [rsp - 0x30], 0x3555dbc1
mov r14d, r8d
xchg rdi, r14
mov r14, rdx
xchg rdi, r14
mov r9d, r14d
xchg rsi, r13
mov rsi, rcx
xchg rsi, r13
cmp r8d, 0x40000
xchg r12, r12
jb 0x140087403
mov r9d, 0x1d117e5d
sub r9d, 0x913376c
sub r9d, 0x14216fc
xor r9d, 0x229ffbb1
sub r9d, 0x301fd444
nop
movabs rcx, 0xffffffff2138476a
sub rcx, 0x3a6b81
add rcx, 0x1bb20d9f
add rcx, 0x7fffffff
add rcx, 0x43501678
mov eax, 0x5fb91a7f
add eax, 0x1fac3ab8
xor eax, 0x502c8f89
xor eax, 0x2f49daba
mul r9
mov dword [rsp - 0x20], 0x1fc37b84
cmovb rax, rcx
xchg rcx, r12
mov r12, rax
xchg rcx, r12
call fcn.140098010
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
xchg r13, r13
shr r15d, 0xf
shr r15d, 3
shr r15d, 1
shr r15d, 1
xor ebx, ebx
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov r12b, 0x27
add r12b, 0x29
sub r12b, 0x40
xor r12b, 0x2b
sub r12b, 0x3a
test r15d, r15d
mov dword [rsp - 0x40], ebp
je 0x1400875b5
nop
mov r8d, ebx
mov r9, r9
mov r10d, r14d
shl r8d, 0x10
shl r8d, 2
shl r8d, 1
shl r8d, 1
xor eax, eax
mov r15, r15
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
jbe 0x14008751d
mov r10d, 0x6807292b
add r10d, 0x8252b47
add r10d, 0x9587a3
add r10d, 0x1472d58
sub r10d, 0x71f9096d
mov r11d, 0x2022e431
sub r11d, 0x9f5d4ca
xor r11d, 0x20ba0fbd
add r11d, 0x27a7e1f7
sub r11d, 0x5e3ae2d1
jmp 0x140087533
mov r11d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x140087574
mov dword [rsp - 0x34], ecx
xchg r9, r13
mov r13, rbp
xchg r9, r13
nop dword [rax]
mov dword [rsp - 0x3c], esp
lea edx, [r8 + rax]
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
mov dword [rsp - 0xc], 0x658d2967
lea r9, [r9 + 4]
xor ecx, 0x1cb47428
inc eax
mov dword [r9 - 4], ecx
mov r15, r15
cmp eax, r11d
jb 0x140087547
mov r8d, r10d
mov dword [rsp - 0x38], 0x4fedc1a0
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
xchg rcx, r13
mov r13, rcx
xchg rcx, r13
call fcn.140084450
test al, al
je 0x1400875b2
mov dword [rsp - 0x10], esi
inc ebx
cmp ebx, r15d
jb 0x1400874a2
jmp 0x1400875b5
xor r12b, r12b
mov rcx, rbp
mov rdi, rdi
call fcn.140098020
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
mov dword [rsp - 0x3c], ebx
xchg r13, rbp
mov r13, qword [rsp + 0x58]
xchg rbp, r13
xchg rbx, rsi
mov rbx, qword [rsp + 0x68]
xchg rsi, rbx
add rsp, 0x20
mov dword [rsp - 0x24], 0x6fdeb4ef
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140087620
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg rbx, r9
mov qword [rsp + 0x18], rbp
xchg r9, r9
push rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
push r11
mov qword [rsp], r15
mov eax, 0x1e2461b2
add eax, 0x26f978d4
add eax, 0x1f91cc2d
sub eax, 0x2fcbe75f
xor eax, 0x34e3af74
call fcn.140099f00
mov dword [rsp - 0x44], ecx
sub rsp, rax
xchg r15, rcx
mov rcx, r15
xchg rcx, r15
call fcn.140099dd0
mov ebp, eax
mov dword [rsp - 0x18], edx
and ebp, 0x3fc
jbe 0x1400876e6
lea rdi, [rsp + 0x20]
mov esi, ebp
xchg rcx, rcx
call fcn.140099dd0
movzx ebx, ax
shl ebx, 8
shl ebx, 1
shl ebx, 5
shl ebx, 1
shl ebx, 1
call fcn.140099dd0
mov dword [rsp - 0x14], 0x35e8167c
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rsp - 0x1c], 0x450cbc73
mov dword [rdi - 4], ecx
sub rsi, 1
jne 0x1400876a4
xchg rbp, rbp
lea r14d, [rbp*4]
mov eax, 0x2b287b30
sub eax, 0xc72851e
add eax, 0xf58ce6
sub eax, 0x1fab82f4
mov ecx, r14d
mov dword [rsp - 0x10], edx
mul rcx
pushf
movabs rcx, 0xffffffff52c67e7a
add rcx, 0x2b595bb4
sub rcx, 0x6a0a9881
add rcx, 0x7fffffff
add rcx, 0x6beabe53
popf
cmovb rax, rcx
xchg rdx, rcx
mov rdx, rax
xchg rdx, rcx
call fcn.140098010
mov edi, dword [r15 + 0x18]
mov dword [rsp - 0x18], 0x49aead3e
lea ebp, [r14 + 0xfffff]
shr ebp, 9
shr ebp, 2
shr ebp, 8
shr ebp, 1
xor ebx, ebx
mov dword [rsp - 0x28], 0x3091b226
mov rsi, rax
mov r12b, 0x49
sub r12b, 0x2c
add r12b, 0xc
xor r12b, 0x4f
sub r12b, 0x65
test ebp, ebp
je 0x1400878a3
nop
mov dword [rsp - 0x10], 0x6c3a3b8d
mov r8d, ebx
mov r10d, r14d
shl r8d, 0xa
shl r8d, 8
shl r8d, 1
shl r8d, 1
xor eax, eax
mov dword [rsp - 0x40], edx
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
xchg rsi, rsi
jbe 0x140087814
mov r10d, 0x1387d3a7
add r10d, 0x20995177
sub r10d, 0x32c37034
xor r10d, 0x742dd5cb
sub r10d, 0x75606121
mov r11d, 0x44dc6e7f
add r11d, 0x10b40688
add r11d, 0x337dc72
xor r11d, 0x6b60357f
xor r11d, 0x33ac6406
jmp 0x140087829
mov r11d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x140087866
xchg r13, r13
xchg r9, rsi
mov rsi, r9
xchg rsi, r9
nop dword [rax]
mov dword [rsp - 0x14], edx
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
xchg rbp, rbp
xor ecx, 0x1cb47428
inc eax
mov dword [r9 - 4], ecx
mov rsp, rsp
cmp eax, r11d
jb 0x14008783d
mov r8d, r10d
mov rdx, rsi
xchg rdx, rdx
xchg r15, r11
mov rcx, r11
xchg r11, r15
call fcn.140084450
mov dword [rsp - 0x1c], ecx
test al, al
je 0x1400878a0
inc ebx
cmp ebx, ebp
mov dword [rsp - 0x10], 0x7199b80c
jb 0x140087798
jmp 0x1400878a3
xor r12b, r12b
xchg rcx, r13
mov r13, rsi
xchg rcx, r13
call fcn.140098020
lea r11, [rsp + 0x1020]
mov dword [rsp - 0x34], 0x7cb41d47
movzx eax, r12b
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
xchg rsi, rsi
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
xchg rbx, rbx
pop rsi
ret
Function at 0x14008b770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r11
mov qword [rsp + 0x10], r11
xchg rbp, r11
xchg rsi, r10
mov qword [rsp + 0x18], r10
xchg rsi, r10
mov qword [rsp + 0x20], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
mov rsi, rsi
push r15
movsxd rax, r8d
mov r13, rcx
mov r8, r8
xor ecx, ecx
xchg r12, r14
mov r14, r9
xchg r12, r14
xchg rdx, r11
mov rbx, r11
xchg r11, rdx
mov r10d, ecx
lea r11, [rax + rax*2]
shl r11, 1
shl r11, 1
nop word [rax + rax]
movsxd rax, dword [r12 + r10*4]
xchg rcx, rcx
mov edi, ecx
xchg rbx, r9
mov rbx, qword [r13 + 8]
xchg r9, rbx
add r9, r11
mov dword [r9 + 8], ecx
mov dword [rsp - 0x34], ecx
xchg rcx, r11
mov r11, rax
xchg r11, rcx
and eax, 3
mov qword [r9], 0x50aff32e
xor qword [r9], 0x36be3282
add qword [r9], 0x13b68efe
xor qword [r9], 0x79c850aa
lea rsi, [rbx + rax*2]
lea rax, [rcx + 1]
mov rcx, rcx
and eax, 3
lea r14, [rbx + rax*2]
lea rax, [rcx - 2]
mov dword [rsp - 0x24], 0x7be72e63
and eax, 3
lea r15, [rbx + rax*2]
lea rax, [rcx - 1]
and eax, 3
mov rsp, rsp
lea rbp, [rbx + rax*2]
mov eax, 0x2c5f77dc
xor eax, 0x26f5cf36
add eax, 0x11e04df6
xor eax, 0xb621ac4b
mov ecx, edi
xchg rbp, rbp
mul edi
inc edi
shr edx, 1
lea eax, [rdx + rdx*2]
xchg rcx, rcx
movzx edx, word [rsi]
sub ecx, eax
and dx, 1
movsxd rax, ecx
mov dword [rsp - 0x20], esp
mov ecx, dword [r9 + rax*4]
lea r8, [r9 + rax*4]
movzx eax, dx
add ecx, ecx
xchg rcx, rcx
or ecx, eax
not dx
mov dword [r8], ecx
movzx eax, word [rsi]
xchg r15, r15
shl dx, 0xb
shl dx, 1
shl dx, 1
shl dx, 1
shl dx, 1
shr ax, 1
xchg r13, r13
or dx, ax
mov word [rsi], dx
movzx edx, word [r14]
mov ecx, dword [r8]
mov dword [rsp - 0x34], ebx
and dx, 1
movzx eax, dx
add ecx, ecx
or ecx, eax
mov dword [rsp - 0x20], 0x62a892f6
not dx
mov dword [r8], ecx
movzx eax, word [r14]
shl dx, 0xf
mov dword [rsp - 0x38], esi
shr ax, 1
or dx, ax
mov word [r14], dx
mov rsi, rsi
movzx edx, word [r15]
mov ecx, dword [r8]
and dx, 1
mov dword [rsp - 0x28], edx
movzx eax, dx
add ecx, ecx
or ecx, eax
xchg r10, r10
not dx
mov dword [r8], ecx
movzx eax, word [r15]
shl dx, 2
shl dx, 0xb
shl dx, 2
shr ax, 1
or dx, ax
xchg r15, r15
mov word [r15], dx
movzx edx, word [rbp]
mov ecx, dword [r8]
and dx, 1
mov dword [rsp - 0x28], 0x1b4f13ec
movzx eax, dx
add ecx, ecx
or ecx, eax
mov dword [rsp - 0x44], 0x761e10a6
not dx
mov dword [r8], ecx
movzx eax, word [rbp]
mov dword [rsp - 0x18], edi
shr ax, 1
shl dx, 0xb
shl dx, 1
shl dx, 2
shl dx, 1
or dx, ax
mov dword [rsp - 0x24], 0x5af07a2b
mov word [rbp], dx
cmp edi, 0xf
jl 0x14008b850
inc r10
mov dword [rsp - 0xc], 0x5f3c2969
add r11, 0xc
mov ecx, 0xe8e7d6a
add ecx, 0x6c0aecb3
sub ecx, 0x6c8e2d5d
xor ecx, 0xe0b3cc0
cmp r10, 8
mov dword [rsp - 0xc], 0x261f5443
jl 0x14008b7d7
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov dword [rsp - 0x14], edx
xchg rsi, r15
mov r15, qword [rsp + 0x38]
xchg r15, rsi
xchg r12, rdi
mov r12, qword [rsp + 0x40]
xchg r12, rdi
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x2c], 0x204daddc
ret
Function at 0x14008be20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, r14
mov ebx, edx
mov r8d, ecx
test ecx, ecx
mov r14, r14
jne 0x14008be46
xor eax, eax
xchg rdx, rbx
mov rdx, qword [rsp + 8]
xchg rbx, rdx
ret
xor r10d, r10d
mov r11d, r8d
mov rsp, rsp
mov edx, r10d
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x2c], edi
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
mov rbx, rbx
mov r9d, eax
test r11b, 1
cmove ecx, edx
xchg r15, r15
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
mov dword [rsp - 0x34], esi
cmovb r9d, eax
shr r11d, 1
jne 0x14008be67
mov dword [rsp - 0xc], 0x19214016
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov rcx, rcx
je 0x14008bee9
lea eax, [r11 + r11]
mov ecx, r9d
mov r11, r11
xor ecx, r11d
mov r11d, eax
test dl, 1
cmove ecx, r9d
xchg r10, r10
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
mov dword [rsp - 0x10], edx
cmovb r11d, eax
shr edx, 1
jne 0x14008beb4
mov r11d, r9d
mov r10, r10
mov edx, r10d
test r9d, r9d
je 0x14008bf45
mov dword [rsp - 0xc], ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
mov r15, r15
xor ecx, r11d
mov r11d, eax
test r9b, 1
mov dword [rsp - 0x3c], 0x6360c4f2
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
mov rdi, rdi
cmovb r11d, eax
shr r9d, 1
jne 0x14008bf0d
test edx, edx
mov rsp, rsp
je 0x14008bf94
nop word [rax + rax]
mov ecx, r10d
xor ecx, r8d
mov dword [rsp - 0x10], 0x18ecb914
test dl, 1
cmove ecx, r10d
mov r10d, ecx
lea ecx, [r8 + r8]
mov rsp, rsp
mov r8d, ecx
xor r8d, ebx
cmp ecx, 0x100
mov dword [rsp - 0x14], esp
cmovb r8d, ecx
shr edx, 1
jne 0x14008bf56
xchg r11, r11
mov rbx, qword [rsp + 8]
mov eax, r10d
ret