joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1a60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b819e
mov r10, rcx
mov dword [rsp - 0x1c], ebp
mov eax, dword [0x14012ffc8]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov rdi, rdi
syscall
ret

Function at 0x1400a1a70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b80d2
xchg r10, r14
mov r14, rcx
xchg r14, r10
mov eax, dword [0x14012ffb4]
cmp qword [0x140130038], 0
mov dword [rsp - 0x38], 0x2f525be0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1a80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8100
xchg r8, rcx
mov r10, r8
xchg r8, rcx
mov eax, dword [0x14012ffb8]
xchg r8, r8
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1a90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7cc9
xchg r14, rcx
mov r10, r14
xchg r14, rcx
mov eax, dword [0x14012ff54]
cmp qword [0x140130038], 0
mov dword [rsp - 0x20], 0x4725ca53
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1aa0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7faa
mov r10, rcx
mov eax, dword [0x14012ff98]
cmp qword [0x140130038], 0
mov dword [rsp - 0x44], esp
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1ab0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7ffc
xchg rcx, r12
mov r10, r12
xchg r12, rcx
mov eax, dword [0x14012ffa0]
mov dword [rsp - 0x10], ebx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1ac0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7ac6
mov r10, rcx
mov rdi, rdi
mov eax, dword [0x14012ff24]
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov dword [rsp - 0x20], 0x4dc1ee06
ret

Function at 0x1400a1ad0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8081
mov r10, rcx
mov eax, dword [0x14012ffac]
cmp qword [0x140130038], 0
mov rdi, rdi
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1ae0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7e9e
xchg rsi, r10
mov rsi, rcx
xchg r10, rsi
mov eax, dword [0x14012ff80]
cmp qword [0x140130038], 0
mov dword [rsp - 0xc], esi
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1af0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7ec8
xchg rcx, rbx
mov r10, rbx
xchg rcx, rbx
mov eax, dword [0x14012ff84]
xchg rcx, rcx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov dword [rsp - 0x34], 0x557c28f0
ret

Function at 0x1400a1b00
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7d45
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x14012ff60]
mov dword [rsp - 0x44], 0x11ed1679
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov rsi, rsi
ret

Function at 0x1400a1b10
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov r8, r8
mov byte [rsp + 0x48], al
jmp 0x1400b82c0
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ffe4]
xchg r11, r11
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1b30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7bd6
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff3c]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov dword [rsp - 0x24], 0x320717a4
syscall
ret
Function at 0x1400a1b40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7c04
mov r10, rcx
mov dword [rsp - 0x10], ecx
mov eax, dword [0x14012ff40]
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
xchg r13, r13
ret

Function at 0x1400a1b50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7c2b
mov r10, rcx
mov eax, dword [0x14012ff44]
cmp qword [0x140130038], 0
xchg r8, r8
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1b60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7c4e
xchg r10, r12
mov r12, rcx
xchg r12, r10
mov eax, dword [0x14012ff48]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov dword [rsp - 0x20], ebp
syscall
ret

Function at 0x1400a1b70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7bad
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x14012ff38]
cmp qword [0x140130038], 0
jne 0x1400b7a10
xchg rbp, rbp
syscall
ret

Function at 0x1400a1b80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8129
xchg r10, r11
mov r11, rcx
xchg r10, r11
mov eax, dword [0x14012ffbc]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov dword [rsp - 0x24], 0x374c232d
syscall
ret

Function at 0x1400a1b90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7c78
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff4c]
cmp qword [0x140130038], 0
mov dword [rsp - 0x18], esi
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1ba0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7b25
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff2c]
mov dword [rsp - 0x2c], 0x84c53e
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1bb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7cf7
xchg r10, r13
mov r13, rcx
xchg r13, r10
mov eax, dword [0x14012ff58]
mov dword [rsp - 0x28], esp
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1bc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7f57
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff90]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov r9, r9
syscall
ret

Function at 0x1400a1bd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7fce
xchg r11, rcx
mov r10, r11
xchg rcx, r11
mov eax, dword [0x14012ff9c]
mov dword [rsp - 0x10], 0x7408e570
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1be0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8310
neg rsp
sub rsp, 0xfffffffffffffee0
neg rsp
lea rcx, [0x1400b7a8c]
mov dword [rsp - 0x34], ecx
nop
mov qword [rsp - 8], rcx
sub rsp, 8
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
mov dword [rsp - 0x38], 0x2f3a0a5
nop
sub rsp, 8
mov qword [rsp], rdi
push qword [0x140130040]
mov dword [rsp - 0x1c], 0x8d3e524
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov ecx, 0x1b728d5
add ecx, 0x4c2302ba
xor ecx, 0x76c30c3f
sub ecx, 0x3b1927a0
rep movsq qword [rdi], qword [rsi]
mov rbp, rbp
jmp qword [0x140130038]
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ffec]
mov rdx, rdx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret
Function at 0x1400a1bf0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7b7c
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff34]
mov dword [rsp - 0xc], 0x35749bd6
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov rbx, rbx
ret

Function at 0x1400a1c00
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b829a
mov r10, rcx
mov eax, dword [0x14012ffe0]
mov r10, r10
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
mov r14, r14
ret

Function at 0x1400a1c10
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8157
mov r10, rcx
mov eax, dword [0x14012ffc0]
mov dword [rsp - 0x3c], ecx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1c20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b824c
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ffd8]
cmp qword [0x140130038], 0
jne 0x1400b7a10
mov dword [rsp - 0x2c], edi
syscall
ret

Function at 0x1400a1c30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8026
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x14012ffa4]
cmp qword [0x140130038], 0
xchg rbx, rbx
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1c40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8276
mov r10, rcx
mov eax, dword [0x14012ffdc]
cmp qword [0x140130038], 0
mov dword [rsp - 0x18], esi
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1c50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7b53
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x14012ff30]
cmp qword [0x140130038], 0
xchg r9, r9
jne 0x1400b7a10
syscall
ret

Function at 0x1400a1c60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b7d21
mov r10, rcx
mov eax, dword [0x14012ff5c]
mov dword [rsp - 0x24], esi
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret
Function at 0x1400a5170
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x18], esi
add rsp, 0xfffffffffffffdd0
mov rax, qword [0x14012f2b0]
lea rdx, [rsp + 0x20]
rol rax, 0x20
rol rax, 1
rol rax, 0xd
mov rbx, rcx
movabs rcx, 0x579e7dcf578bee72
xor rcx, 0x581fd9ab
add rcx, 0x1f431d6d
sub rcx, 0x9863146
xor rcx, 0x1c6bbc41
xor r9d, r9d
mov dword [rsp - 0x44], 0x724b2e58
xor rax, rcx
movabs rcx, 0x7e7280c4428874c0
add rcx, 0x2316d68c
sub rcx, 0x2f5948d6
sub rcx, 0x27966cb3
add rcx, 0x617ebeef
add rax, rcx
movabs rcx, 0x7fc9c0da7c497023
sub rcx, 0x182d4d2e
sub rcx, 0x3caa84c
add rcx, 0x429db2e
rol rax, 2
rol rax, 3
rol rax, 1
xor rax, rcx
xchg rbp, rbp
lea r8d, [r9 + 0x1a]
rol rax, 4
rol rax, 0x12
rol rax, 5
rol rax, 3
rol rax, 1
rol rax, 1
rol rax, 1
xor ecx, ecx
not rax
mov dword [rsp - 0x3c], ecx
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg r11, r11
xchg rcx, r14
mov qword [rbx], r14
xchg rcx, r14
xchg r13, rcx
movups xmmword [r13], xmm0
xchg r13, rcx
xchg rcx, rdx
movups xmmword [rdx + 0x10], xmm0
xchg rcx, rdx
xchg rcx, rsp
movups xmmword [rsp + 0x20], xmm0
xchg rcx, rsp
test eax, eax
mov dword [rsp - 0x20], esi
je 0x1400a539f
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff5847e083
xor rdx, 0x4202746f
xor rdx, 0x188192ec
add rdx, 0x7fffffff
xor rdx, 0x7d3bfa00
nop
mov dword [rsp - 0x44], esp
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400a52bd
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
mov qword [rbx + 0x38], rdx
mov dword [rsp - 0x20], 0x36a69baf
call fcn.14001739c
xor r8d, r8d
xchg r15, rdx
mov r15, rax
xchg rdx, r15
mov ecx, 0x47f54dc4
sub ecx, 0x2aeae684
add ecx, 0x452daeec
xor ecx, 0x7d1311f0
xor ecx, 0x2e1801ee
cmp qword [rbx + 0x38], r8
jbe 0x1400a53ac
lea r9, [rsp + 0x20]
mov dword [rsp - 0x44], esp
mov r10d, 0x6be68d9e
add r10d, 0xa91f44e
xor r10d, 0x1988b70b
xor r10d, 0x6ff03618
sub r9, rax
mov dword [rsp - 0x10], 0x63558d2
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
xchg rbx, rbx
and ax, r10w
ror ecx, 3
ror ecx, 3
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
mov dword [rsp - 0x14], ebx
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x1400a5352
mov rsp, rsp
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
sub rsp, 0x300d6dc4
add rsp, 0x300d6ff4
pop rbx
ret
xor r8d, r8d
xchg r8, r14
mov qword [rbx + 0x38], r14
xchg r14, r8
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x230
mov r10, r10
pop rbx
ret
Function at 0x1400a5720
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x14012f2b0]
lea rdx, [rsp + 0x20]
xchg rdi, rdi
rol rax, 0x2d
rol rax, 1
xchg rdi, rcx
mov rbx, rdi
xchg rdi, rcx
movabs rcx, 0x579e7dcf0ad2d090
sub rcx, 0x4cf081
add rcx, 0x14454f75
xor rcx, 0x27f1b7c5
xor r9d, r9d
mov dword [rsp - 0xc], 0xb758d2
xor rax, rcx
movabs rcx, 0x7e7280c473aba144
sub rcx, 0x5aa6bce9
add rcx, 0x6290376a
sub rcx, 0xb66c713
add rax, rcx
movabs rcx, 0x7fc9c0da5836c9de
sub rcx, 0x29b7e9da
sub rcx, 0x2e3e892f
xor rcx, 0x311e30
add rcx, 0x640a0cf2
rol rax, 4
rol rax, 1
rol rax, 1
xor rax, rcx
lea r8d, [r9 + 8]
mov dword [rsp - 0x14], ebx
rol rax, 0xd
rol rax, 0x11
rol rax, 1
rol rax, 1
rol rax, 1
xor ecx, ecx
not rax
mov r13, r13
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg r11, rcx
mov qword [rbx], r11
xchg r11, rcx
xchg rcx, r8
movups xmmword [r8], xmm0
xchg rcx, r8
xchg rcx, rsp
movups xmmword [rsp + 0x10], xmm0
xchg rcx, rsp
xchg rcx, r13
movups xmmword [r13 + 0x20], xmm0
xchg rcx, r13
test eax, eax
je 0x1400a594a
lea rax, [rsp + 0x20]
xchg rdi, rdi
nop
movabs rdx, 0xffffffff7d7765f6
sub rdx, 0x710617b
xor rdx, 0xf321e40
add rdx, 0x7fffffff
add rdx, 0x6aae5c5
nop
inc rdx
cmp word [rax + rdx*2], 0
mov dword [rsp - 0x44], 0x2b203280
jne 0x1400a585c
xchg rcx, rdx
mov rdx, rbx
xchg rdx, rcx
xchg r10, rdx
mov qword [rbx + 0x38], r10
xchg r10, rdx
call fcn.14001739c
xor r8d, r8d
mov dword [rsp - 0x28], 0x668e0c27
xchg r8, rax
mov rdx, r8
xchg r8, rax
mov ecx, 0x27aa4f4d
xor ecx, 0x414c6279
sub ecx, 0x462d9d2a
xor ecx, 0x118b9638
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x40], 0x677ebedc
jbe 0x1400a5957
lea r9, [rsp + 0x20]
mov r10d, 0x82ec58f
xor r10d, 0x6ea0d23c
sub r10d, 0x45defa6f
sub r10d, 0x4cb6b51
xor r10d, 0x1be3b10c
sub r9, rax
nop word [rax + rax]
xchg r14, r14
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov rbp, rbp
ror ecx, 7
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
xchg r9, r9
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x1400a58fd
mov rax, rbx
mov dword [rsp - 0x3c], edx
sub rsp, 0x68d1b969
add rsp, 0x68d1bb99
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
xchg r8, r11
mov qword [rbx + 0x38], r11
xchg r11, r8
xchg r15, rax
mov r15, rbx
xchg r15, rax
add rsp, 0x230
mov dword [rsp - 0x2c], 0x6b74e3c5
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1400a5b60
Capabilities:
Encode data using xor

Disassembly:
push rbx
xchg rsi, rsi
sub rsp, 0x230
mov r8, qword [0x14012f3e0]
xchg r9, rcx
mov rbx, r9
xchg r9, rcx
ror r8, 0x1a
ror r8, 6
ror r8, 1
movabs rcx, 0x89d54db24a7c047f
sub rcx, 0x21284b2d
add rcx, 0x3940dc60
sub rcx, 0x348594be
xor rcx, 0x78f374dd
add r8, rcx
mov dword [rsp - 0x10], 0x675fc340
movabs rax, 0xe5a2f6d769c4be0
sub rax, 0x5c5623bd
add rax, 0x4e5f9e7d
xor rax, 0xa165ab0
add rax, 0x66bec142
not r8
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x44], 0x70bc50c3
sub r8, rax
mov edx, 0x5998e5a1
xor edx, 0x9cac5fb
xor edx, 0x3082c7ad
xor edx, 0x60d0e6f3
movabs rax, 0x47253dab27299b0b
xor rax, 0x254fed94
add rax, 0x29506f8
add rax, 0x7fffffff
add rax, 0x7aaff141
xor r8, rax
call r8
mov dword [rsp - 0x28], 0x397c43b1
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
mov dword [rsp - 0x20], esi
nop
movabs rdx, 0xffffffff42f49aea
sub rdx, 0x13f337c5
xor rdx, 0x21337ffc
add rdx, 0x7fffffff
add rdx, 0x71cde327
movups xmmword [rax], xmm0
mov dword [rsp - 0x34], esi
movups xmmword [rax + 0x10], xmm0
xchg rcx, rax
movups xmmword [rcx + 0x20], xmm0
xchg rcx, rax
lea rax, [rsp + 0x20]
mov rbp, rbp
nop
inc rdx
cmp word [rax + rdx*2], 0
mov rdx, rdx
jne 0x1400a5c85
mov rcx, rbx
xchg r14, rdx
mov qword [rbx + 0x38], r14
xchg rdx, r14
call fcn.14001739c
mov dword [rsp - 0x44], esp
xor r8d, r8d
mov edx, 0x68945420
add edx, 0x7ee1e38
sub edx, 0x10be1515
sub edx, 0x2e915711
cmp qword [rbx + 0x38], r8
jbe 0x1400a5d37
mov r10, r10
lea r9, [rsp + 0x20]
mov r10d, 0x23170523
add r10d, 0x340e0660
xor r10d, 0x74eed7c9
xor r10d, 0x4f81dd5c
xor r10d, 0x6c4a01e9
sub r9, rax
mov rbx, rbx
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
mov rcx, rcx
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [r9 + rax - 2]
mov rcx, rcx
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x1400a5d00
mov dword [rsp - 0x14], 0x275b9923
xchg rsp, rax
mov rsp, rbx
xchg rsp, rax
add rsp, 0x26155e16
sub rsp, 0x26155be6
pop rbx
mov r15, r15
ret
Function at 0x1400a8eb0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg rdi, rcx
mov qword [rsp + 0x20], rcx
xchg rcx, rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, r12
mov r12, rdx
xchg rdi, r12
xchg r9, rcx
mov rsi, r9
xchg r9, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x44], edx
call fcn.1400aac10
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0xc], ebx
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
je 0x1400a907f
mov dword [rsp - 0x28], edx
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov dword [rsp - 0x34], esp
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov rcx, rcx
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
jae 0x1400a8fb6
mov r11, r11
mov eax, dword [rdx + 8]
test eax, eax
jne 0x1400a8f72
mov eax, dword [rdx + 0x10]
xchg r11, r11
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x1400a8f8e
add eax, r9d
mov rdx, rdx
cmp r11d, eax
jb 0x1400a9038
inc r8w
mov dword [rsp - 0x10], 0x3a29efab
nop
add rdx, 0x4b19253e
sub rdx, 0x4b192516
cmp r8w, cx
jb 0x1400a8f61
xchg r12, r12
mov r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg rbx, rbx
nop
add rax, 0x7e3cc429
sub rax, 0x7e3cc431
nop
add r10, 0x6ba6fa16
sub r10, 0x6ba6fa0e
shr rax, 1
mov dword [rsp - 0x18], 0x2479d81a
test eax, eax
je 0x1400a906c
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x1c], esi
movzx eax, word [r10]
mov ecx, eax
shr ecx, 4
shr ecx, 7
shr ecx, 1
cmp ecx, 3
je 0x1400a9051
mov dword [rsp - 0x1c], 0x23c57791
cmp ecx, 0xa
jne 0x1400a905a
and eax, 0xfff
xchg rsi, rsi
add qword [rax + r8], rdi
jmp 0x1400a905a
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x1c], ebx
sub r8, r9
add r8, rsi
add r8, r11
xchg r15, r15
jmp 0x1400a8fb9
and eax, 0xfff
add dword [rax + r8], edi
add r10, 2
mov dword [rsp - 0x20], esi
sub rdx, 1
jne 0x1400a8fff
add ebx, dword [r9]
mov dword [rsp - 0x44], 0x3fc90a4d
cmp ebx, ebp
jb 0x1400a8f2e
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
xchg r14, rbp
mov r14, qword [rsp + 0x38]
xchg r14, rbp
mov rsi, qword [rsp + 0x40]
mov r15, r15
mov rdi, qword [rsp + 0x48]
nop
sub rsp, 0x75ef1578
add rsp, 0x75ef1598
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400aace0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rsi, rsi
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov r9, r9
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov rbx, rbx
nop
sub rsp, 8
mov qword [rsp], r14
nop
push 0x20de04f1
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov rdi, rdi
mov r15d, edx
xor eax, 0x71c6092d
xchg rsp, rcx
mov rsi, rsp
xchg rcx, rsp
cmp eax, 0x71c65360
jne 0x1400aaea0
mov dword [rsp - 0x24], 0x40b21b1b
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x71c6092d
mov dword [rsp - 0xc], edx
cmp eax, 0x71c64c7d
jne 0x1400aaea0
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x1c], ebx
call fcn.1400aac10
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.1400aac10
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0xc], 0x598bda64
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
xchg r8, r12
mov r8, rax
xchg r8, r12
call fcn.1400aac10
xchg r11, r11
mov edx, dword [r14 + 0x1c]
xchg rsi, r13
mov rcx, r13
xchg rsi, r13
xchg r13, rsp
mov rsp, rax
xchg r13, rsp
call fcn.1400aac10
xor edi, edi
xchg rcx, rax
mov qword [rsp + 0x70], rcx
xchg rcx, rax
cmp dword [r14 + 0x18], edi
jbe 0x1400aaea0
mov dword [rsp - 0x10], 0x5cdc22d9
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400aac10
mov dword [rsp - 0x24], 0x65229815
mov ecx, 0x74192ac1
xor ecx, 0x4e3f6b75
xor ecx, 0x6d1ef11e
xor ecx, 0xa8c74f55
mov rbx, rax
xchg r13, r13
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x1400aae82
nop dword [rax]
mov dword [rsp - 0x18], 0x5f98eb6a
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov r8d, 0x6dd013d9
xor r8d, 0x660d430a
xor r8d, 0x2a7f6f06
sub r8d, 0x21a23fd4
inc rbx
mov dword [rsp - 0x30], esi
call fcn.1400a1550
cmp byte [rbx], 0
jne 0x1400aae43
mov r14, r14
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
je 0x1400aaeeb
mov dword [rsp - 0x38], edi
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400aadf4
xchg rdi, rdi
xor eax, eax
mov rbx, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg r12, rcx
mov r12, rsi
xchg r12, rcx
xchg rdx, rax
mov rdx, qword [rsp + 0x70]
xchg rdx, rax
mov edx, dword [rax + rdx*4]
call fcn.1400aac10
jmp 0x1400aaea2
Function at 0x1400af025
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rbx, r8
mov r8, qword [rcx]
xchg r8, rbx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg rsi, rdx
mov qword [rsp + 0x70], rdx
xchg rdx, rsi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
xchg r9, r9
mov qword [rsp + 0x20], rax
xchg rsp, r12
movups xmmword [r12 + 0x28], xmm0
xchg rsp, r12
lea rdx, [rsi + 1]
xchg r13, rsp
movups xmmword [r13 + 0x38], xmm0
xchg rsp, r13
xchg rsp, rdx
movups xmmword [rdx + 0x48], xmm0
xchg rsp, rdx
call fcn.14001739c
mov rdx, rdx
mov edx, 0x70def077
xor edx, 0x1dea7622
sub edx, 0x391fd0f1
xor edx, 0x7e83ffa3
xor edx, 0x7ba44cf5
test rsi, rsi
mov dword [rsp - 0x28], 0x1bea8fd8
je 0x1400af11b
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov dword [rsp - 0x38], ebp
xchg rdi, r8
mov rdi, rsi
xchg rdi, r8
mov r9d, 0x717888c2
sub r9d, 0x4e26cce9
xor r9d, 0x59681c85
xor r9d, 0x7a39a7a3
nop dword [rax]
movzx ecx, dx
mov dword [rsp - 0x40], ebp
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x3c], 0x77156b7e
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400af0e9
mov rsi, rsi
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.1400af1d0
mov dword [rsp - 0x44], 0x7b481790
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov r8, r8
cmp rcx, rax
jne 0x1400af19c
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x1c], 0x11a96eef
mov ecx, 0x599af419
add ecx, 0x1409e63e
xor ecx, 0x754ced04
xor ecx, 0x18e83763
rep stosb byte [rdi], al
mov eax, ebx
mov r11, r11
mov rbx, qword [rsp + 0x78]
nop
sub rsp, 0x2d93fb42
add rsp, 0x2d93fba2
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400b9840
mov eax, ebx
xchg rbx, rdx
mov rdx, qword [rsp + 0x78]
xchg rdx, rbx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400b06f3
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r12
mov r12, rsp
xchg r12, r11
xchg rbx, rdx
mov qword [r11 + 0x20], rdx
xchg rdx, rbx
nop
push 0x71f762a5
mov qword [rsp], rdi
nop
add rsp, 0x7a05fc7d
sub rsp, 0x7a05fcdd
mov rbx, qword [rcx]
mov rdi, rdi
lea rax, [r11 - 0x40]
xchg r12, rbp
mov qword [r11 + 8], r12
xchg r12, rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg r11, r11
xchg rsi, r14
mov qword [r11 + 0x10], r14
xchg r14, rsi
xchg rsi, r15
mov r15, qword [rcx + 0x38]
xchg r15, rsi
lea rcx, [r11 - 0x48]
mov rdi, rdi
mov qword [r11 + 0x18], r14
mov r14, rdx
xchg rsp, r8
movups xmmword [r8 + 0x28], xmm0
xchg rsp, r8
lea rdx, [rsi + 1]
mov dword [rsp - 0x14], 0x5cd057e5
xchg rsp, rdx
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg rdx, rsp
movups xmmword [rdx + 0x48], xmm0
xchg rdx, rsp
call fcn.14001739c
mov rsp, rsp
mov edx, 0x62785fcd
sub edx, 0x1e452e04
sub edx, 0x3ab95126
sub edx, 0x4063af1
add edx, 0x2bbf6080
test rsi, rsi
je 0x1400b0823
xchg r15, r15
xchg r15, rdi
mov r15, rax
xchg rdi, r15
sub rbx, rax
xchg r15, r8
mov r15, rsi
xchg r8, r15
mov r9d, 0x32e12aac
add r9d, 0xd2285f2
xor r9d, 0x4d5714c2
add r9d, 0x31a7d52e
sub r9d, 0x3efc788b
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x1c], esp
and cx, r9w
ror edx, 2
ror edx, 3
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x3c], ebp
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400b07ed
mov dword [rsp - 0x2c], edx
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg r14, rdx
mov r14, rdx
xchg r14, rdx
xchg r9, rcx
mov r9, qword [rsp + 0x20]
xchg rcx, r9
call fcn.1400b08f0
mov dword [rsp - 0x14], esi
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r14, qword [rsp + 0x80]
xchg r12, r12
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
xchg rbp, r9
mov r9, qword [rsp + 0x70]
xchg rbp, r9
cmp rcx, rax
mov r13, r13
jne 0x1400b08c3
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x76a74932
xor ecx, 0x22234a87
add ecx, 0x2a07c462
xor ecx, 0x3fef7ae5
xor ecx, 0x4164b2c2
rep stosb byte [rdi], al
xchg r14, r14
mov eax, ebx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400b9840
mov dword [rsp - 0x28], ebx
mov eax, ebx
xchg rbx, r14
mov r14, qword [rsp + 0x88]
xchg r14, rbx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret