joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054cf0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089dca
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a4048]
mov dword [rsp - 0x10], 0x1d7153cb
cmp qword [0x1404a40a8], 0
jne 0x1400895d0
syscall
ret

Function at 0x140054d00
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089df8
mov r10, rcx
mov eax, dword [0x1404a404c]
xchg rdx, rdx
cmp qword [0x1404a40a8], 0
jne 0x1400895d0
syscall
mov dword [rsp - 0x14], 0x5c8af3dd
ret

Function at 0x140054d10
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089700
xchg r10, rdx
mov rdx, rcx
xchg r10, rdx
mov eax, dword [0x1404a3fa0]
cmp qword [0x1404a40a8], 0
jne 0x1400895d0
mov dword [rsp - 0x38], 0x5186915
syscall
ret

Function at 0x140054d20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400898b3
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404a3fcc]
cmp qword [0x1404a40a8], 0
jne 0x1400895d0
mov dword [rsp - 0x40], 0x565b1db7
syscall
ret
Function at 0x140058380
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rcx
mov rax, rcx
xchg rsp, rcx
xchg rbx, r8
mov qword [rax + 0x10], r8
xchg r8, rbx
push rdi
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x20], 0x62cbef46
movabs rbx, 0x650d49985cebdb7d
add rbx, 0x915b9d5
add rbx, 0x8111ea8
sub rbx, 0x4bc28781
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0x28], ebp
jne 0x1400585e3
mov dword [rax - 0x48], 0x70a700bb
sub dword [rax - 0x48], 0x5f7f1f57
add dword [rax - 0x48], 0x115fcc84
add dword [rax - 0x48], 0x5bf2508c
xor dword [rax - 0x48], 0x7e4dfe22
xor r8d, r8d
mov dword [rax - 0x44], 0x1a2a66d9
sub dword [rax - 0x44], 0x16d09c4a
xor dword [rax - 0x44], 0x77732a10
sub dword [rax - 0x44], 0x73afdfd9
mov dword [rax - 0x40], 0x5ebbf2b8
sub dword [rax - 0x40], 0x196b21d2
add dword [rax - 0x40], 0xc2b42d9
sub dword [rax - 0x40], 0x365f3fc8
sub dword [rax - 0x40], 0x1ae3d390
mov dword [rax - 0x3c], 0x7a8c092d
sub dword [rax - 0x3c], 0x46de0c40
xor dword [rax - 0x3c], 0x452360d6
sub dword [rax - 0x3c], 0xe67b05c
sub dword [rax - 0x3c], 0x67feeb5c
mov dword [rax - 0x38], 0x2ed8d108
sub dword [rax - 0x38], 0x652f912
add dword [rax - 0x38], 0xddf1987
xor dword [rax - 0x38], 0x5380a4e4
sub dword [rax - 0x38], 0x65b05560
mov dword [rax - 0x34], 0x42c174a4
add dword [rax - 0x34], 0x1fe6561f
add dword [rax - 0x34], 0x17400897
sub dword [rax - 0x34], 0x7971d27e
mov qword [rsp + 0x70], r8
mov rdi, rdi
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
nop word [rax + rax]
mov dword [rsp - 0x14], 0x7bdfe57f
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
and cl, 3
xchg r12, r12
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
xchg r10, r10
mov eax, 0x32037af9
xor eax, 0x6ecc520d
sub eax, 0x5c301a2e
xor eax, 0x1a2f5ed1
shr eax, cl
xchg rsp, rsp
movzx ecx, al
xchg r12, rax
mov r12, qword [rsp + 0x70]
xchg r12, rax
xor cx, dx
xchg r12, r12
mov word [rsp + rax*2 + 0x38], cx
xchg r9, rax
mov r9, qword [rsp + 0x70]
xchg r9, rax
inc rax
mov r13, r13
mov qword [rsp + 0x70], rax
xchg r14, rax
mov r14, qword [rsp + 0x70]
xchg r14, rax
cmp rax, 0xc
mov dword [rsp - 0x40], 0x14a423d0
jb 0x1400584bc
xor edx, edx
mov word [rsp + 0x50], r8w
lea rcx, [rsp + 0x38]
mov dword [rsp - 0x3c], 0x705269b5
call fcn.14007c4d0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rdi
mov rdi, rax
xchg r8, rdi
xor rdx, rbx
mov r14, r14
xor eax, eax
xchg r15, rdx
mov qword [rdi + 0x30], r15
xchg rdx, r15
lea rdi, [rsp + 0x38]
mov r8, r8
mov ecx, 0x329cae1b
xor ecx, 0x78e601b8
sub ecx, 0x7619b4f
xor ecx, 0x43191458
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400585eb
xchg rbx, rbx
lea rdx, [0x1404a3400]
xchg r15, rcx
mov r15, r8
xchg r15, rcx
call fcn.1400604e0
test al, al
mov r12, r12
setne al
xchg rbx, rdi
mov rdi, qword [rsp + 0x78]
xchg rdi, rbx
nop
sub rsp, 0x5add62f8
add rsp, 0x5add6358
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 6
xor al, 0x58
xor al, 0xc
sub al, 0x51
xchg rbx, r11
mov r11, qword [rsp + 0x78]
xchg rbx, r11
nop
sub rsp, 0x56d57d82
add rsp, 0x56d57de2
pop rdi
ret
Function at 0x140058610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x14], ecx
push rdi
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x650d4998640b1058
xor rbx, 0x6481907e
add rbx, 0x38b4228b
sub rbx, 0x10be49de
xor rbx, 0xad074aa
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x28], rbx
jne 0x140058834
xchg rsi, rsi
mov eax, 0x4609c4
add eax, 0x170f84b9
sub eax, 0x50ee522
sub eax, 0x1246a8e0
mov dword [rsp + 0x20], 0x1ed65635
xor dword [rsp + 0x20], 0x26054b97
xor dword [rsp + 0x20], 0x397a7998
sub dword [rsp + 0x20], 0x16d63e2
mov word [rsp + 0x30], ax
mov dword [rsp - 0x38], 0x6fc73151
xor r8d, r8d
mov dword [rsp + 0x24], 0x33d13c22
add dword [rsp + 0x24], 0x11730d11
sub dword [rsp + 0x24], 0x1b1e8ef1
add dword [rsp + 0x24], 0x40edee64
sub dword [rsp + 0x24], 0x6aeaa7d1
mov dword [rsp + 0x28], 0x5be09108
sub dword [rsp + 0x28], 0x464bcd15
sub dword [rsp + 0x28], 0x306656
add dword [rsp + 0x28], 0x5d967373
sub dword [rsp + 0x28], 0x727cd0eb
mov dword [rsp + 0x2c], 0x5804355c
xor dword [rsp + 0x2c], 0x21f453d0
sub dword [rsp + 0x2c], 0x4aacd2cc
sub dword [rsp + 0x2c], 0x2ecd92ec
mov qword [rsp + 0x60], r8
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
nop dword [rax + rax]
xchg r12, r12
mov rcx, qword [rsp + 0x60]
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x44cd4504
sub eax, 0xe672cb2
sub eax, 0x359d7772
add eax, 0x86005c
add eax, 0x1961aedb
shr eax, cl
movzx ecx, al
mov dword [rsp - 0xc], ebp
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
inc rax
xchg r12, rax
mov qword [rsp + 0x60], r12
xchg r12, rax
xchg r11, rax
mov r11, qword [rsp + 0x60]
xchg r11, rax
cmp rax, 9
mov dword [rsp - 0x14], ecx
jb 0x14005872d
xor edx, edx
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
mov rdx, rdx
call fcn.14007c4d0
xchg r14, rax
mov rdx, r14
xchg r14, rax
mov r8, rax
xor rdx, rbx
xor eax, eax
mov rbx, rbx
xchg rbx, rdx
mov qword [rdi + 0x28], rbx
xchg rbx, rdx
lea rdi, [rsp + 0x32]
mov ecx, 0x61755e88
sub ecx, 0x4f6b9353
add ecx, 0x17c54f92
sub ecx, 0x18a6fb2f
xor ecx, 0x11281f91
rep stosb byte [rdi], al
xchg rcx, rcx
cmp rdx, rbx
je 0x14005883c
lea rdx, [0x1404a30e0]
xchg rcx, r11
mov r11, r8
xchg rcx, r11
call fcn.14006bc00
test al, al
mov dword [rsp - 0x18], 0x6752e3e4
setne al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
mov r9, r9
ret
mov al, 0x35
add al, 0xe
sub al, 1
sub al, 0x41
xchg rbx, r11
mov r11, qword [rsp + 0x68]
xchg r11, rbx
nop
add rsp, 0x444de10e
sub rsp, 0x444de0be
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140058eb0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
push rdi
mov rdx, rdx
sub rsp, 0x50
movabs rbx, 0x650d4998022e3ecb
add rbx, 0x6c41d57f
sub rbx, 0xfaee2c0
sub rbx, 0x3cae52cd
add rbx, 0x3d4dbc
mov rdi, rcx
cmp qword [rcx + 0x20], rbx
jne 0x1400590fd
xchg r15, r15
mov eax, 0x42bb1083
xor eax, 0x3ae91758
sub eax, 0x9cf4eb9
sub eax, 0x6cb05a32
sub eax, 0x1d25e14
mov dword [rsp + 0x20], 0x65bd7fac
sub dword [rsp + 0x20], 0x51772e9
add dword [rsp + 0x20], 0x1e1af0d8
xor dword [rsp + 0x20], 0x17078c3c
sub dword [rsp + 0x20], 0x698f7163
mov word [rsp + 0x34], ax
xchg r9, r9
xor r8d, r8d
mov dword [rsp + 0x24], 0x4381f1dd
add dword [rsp + 0x24], 0x32d1e13
sub dword [rsp + 0x24], 0x2e4f5b95
xor dword [rsp + 0x24], 0x1829b48e
mov dword [rsp + 0x28], 0x4f433887
sub dword [rsp + 0x28], 0x21c9502e
sub dword [rsp + 0x28], 0x2053bdde
xor dword [rsp + 0x28], 0x36c73bf2
sub dword [rsp + 0x28], 0x3b7e110e
mov dword [rsp + 0x2c], 0x3569e47d
add dword [rsp + 0x2c], 0x2484b06e
add dword [rsp + 0x2c], 0x4c81479
sub dword [rsp + 0x2c], 0x5e82a8e2
mov dword [rsp + 0x30], 0x7f30aba6
sub dword [rsp + 0x30], 0x20d7bac7
sub dword [rsp + 0x30], 0xa2710ab
sub dword [rsp + 0x30], 0x84946f9
sub dword [rsp + 0x30], 0x4bac98c8
mov qword [rsp + 0x60], r8
mov r10, r10
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
xchg rcx, r9
mov r9, qword [rsp + 0x60]
xchg rcx, r9
mov rax, qword [rsp + 0x60]
and cl, 3
xchg r14, r14
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x45128548
sub eax, 0x42cbecb9
xor eax, 0x187cc0c3
add eax, 0x75f7cb
shr eax, cl
mov dword [rsp - 0x1c], 0x78abf4d5
movzx ecx, al
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x36], cx
xchg rcx, rcx
mov rax, qword [rsp + 0x60]
inc rax
xchg rbx, rax
mov qword [rsp + 0x60], rbx
xchg rbx, rax
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0x20], ecx
cmp rax, 0xb
jb 0x140058fe6
xor edx, edx
mov dword [rsp - 0x24], esp
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
call fcn.14007c4d0
xchg r10, rax
mov rdx, r10
xchg r10, rax
xchg r15, rax
mov r8, r15
xchg r15, rax
xor rdx, rbx
xchg r12, r12
xor eax, eax
xchg rdx, r15
mov qword [rdi + 0x20], r15
xchg r15, rdx
lea rdi, [rsp + 0x36]
mov ecx, 0x7a158062
sub ecx, 0x6665e729
xor ecx, 0x52c5de8b
sub ecx, 0xf8096cf
sub ecx, 0x31e9b0d8
rep stosb byte [rdi], al
mov dword [rsp - 0x1c], esi
cmp rdx, rbx
je 0x140059105
lea rdx, [0x1404a33d0]
mov rcx, r8
mov dword [rsp - 0x1c], ebx
call fcn.14006c160
test al, al
setne al
xchg rbx, rbp
mov rbp, qword [rsp + 0x68]
xchg rbp, rbx
nop
sub rsp, 0x63900bc3
add rsp, 0x63900c13
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x69
add al, 0x12
xor al, 0x7b
xor al, 1
mov rbx, qword [rsp + 0x68]
mov r10, r10
nop
add rsp, 0x151f33fc
sub rsp, 0x151f33ac
pop rdi
ret
Function at 0x140073880
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
nop
sub rsp, 0x2961eaa1
add rsp, 0x2961ea91
mov dword [rsp + 0x20], 0x403ff627
sub dword [rsp + 0x20], 0x22bf055a
sub dword [rsp + 0x20], 0x9c39696
mov r8, rcx
mov byte [rsp + 0x24], 0x7a
sub byte [rsp + 0x24], 0x53
sub byte [rsp + 0x24], 0xc
mov qword [rsp + 0x28], 0x49fdc496
sub qword [rsp + 0x28], 0x17f934d7
sub qword [rsp + 0x28], 0x32048fbf
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x4232ed1
add edx, 0x4acd71ad
sub edx, 0x89d916a
sub edx, 0x2ba2befd
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x1400738e7
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0
add byte [rsp + 7], 0x62
sub byte [rsp + 7], 0x62
popf
je 0x14007399d
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x1400739a0
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140073990
movzx eax, byte [rcx]
test al, al
jne 0x140073974
jmp 0x1400739a0
inc r8
cmp byte [r8], 0
jne 0x14007395f
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x608bf64c
sub ecx, 0x4339fafe
xor ecx, 0x1d51fb4b
rep stosb byte [rdi], al
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x1400739d0
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x41e4b008
sub rsp, 0x41e4b018
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x140073b93
mov dword [rsp + 0x28], 0x1c536d81
add dword [rsp + 0x28], 0x3bcb4a26
add dword [rsp + 0x28], 0x2350d3e8
sub dword [rsp + 0x28], 0x67b23158
mov byte [rsp + 0x2c], 0xd
add byte [rsp + 0x2c], 0x56
sub byte [rsp + 0x2c], 0x48
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x6d4c9156
sub edx, 0x3223ecc9
sub edx, 0x20785476
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x140073a2e
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x140073aa9
lea rcx, [rcx + 1]
cmp dil, al
je 0x140073b78
movzx eax, byte [rcx]
test al, al
jne 0x140073a91
mov word [rsp + 0x20], 0x66c3
sub word [rsp + 0x20], 0x484b
add word [rsp + 0x20], 0x283a
sub word [rsp + 0x20], 0x3948
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0x3a269e18
xor edx, 0x8d45fe0
sub edx, 0x184271e1
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x140073ada
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x140073b56
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x140073bfd
movzx eax, byte [rcx]
test al, al
jne 0x140073b3e
xor dl, dl
mov r8d, 0x166b93b4
add r8d, 0x2d951388
sub r8d, 0x2f218864
xor r8d, 0x14df1edb
jmp 0x140073b9e
mov r8d, 0x34af822b
sub r8d, 0xc0d6f26
add r8d, 0x5486c42e
sub r8d, 0x7d28d732
mov dl, 0x36
add dl, 0x15
add dl, 0xc
sub dl, 0x56
test r8b, 2
je 0x140073bc5
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x2f2f8876
xor ecx, 0x7c62838c
xor ecx, 0x534d0bf8
rep stosb byte [rdi], al
test r8b, 1
je 0x140073be9
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x45ec7744
xor ecx, 0x37fc29f6
sub ecx, 0x72105ead
rep stosb byte [rdi], al
movzx eax, dl
nop
add rsp, 0x600eb15c
sub rsp, 0x600eb14c
pop rdi
ret
mov r8d, 0x725e3bff
xor r8d, 0x17295bbe
xor r8d, 0x65776042
jmp 0x140073b93
Function at 0x140074860
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x75f7ae37
add rsp, 0x75f7ae27
mov word [rsp + 0x20], 0x46d5
xor word [rsp + 0x20], 0x62ed
sub word [rsp + 0x20], 0x16ce
mov r8, rcx
mov qword [rsp + 0x28], 0x6a1f3ad6
sub qword [rsp + 0x28], 0x68ab90ab
add qword [rsp + 0x28], 0xf171039
sub qword [rsp + 0x28], 0x108aba64
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x2e1b6b25
add edx, 0x419eefe2
xor edx, 0x750a0b10
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x1400748b4
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x35
sub byte [rsp + 2], 0x22
sub byte [rsp + 2], 0x13
test al, al
je 0x140074939
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007496f
movzx eax, byte [rcx]
test al, al
jne 0x140074922
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x15e0dd6d
add ecx, 0x29607957
sub ecx, 0x3f4156c2
rep stosb byte [rdi], al
test dl, dl
jne 0x14007497c
mov byte [r8], al
lea rax, [r8 + 1]
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov dl, 0x6b
xor dl, 0x1b
sub dl, 0x6f
jmp 0x14007493b
mov rax, r8
nop
add rsp, 0x1f3638cf
sub rsp, 0x1f3638bf
pop rdi
ret
Function at 0x140074a90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x44], 0x2b7cc12a
mov qword [rsp + 0x18], rsi
xchg rdi, r14
mov qword [rsp + 0x20], r14
xchg rdi, r14
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x27415a41
add rsp, 0x27415a21
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, rsi
mov rsi, rdx
xchg rsi, rdi
xchg rcx, r13
mov rsi, r13
xchg rcx, r13
mov edx, dword [rbx + rcx + 0xb0]
xchg r12, r12
call fcn.140076c30
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg r9, r9
xchg r10, rsp
mov rsp, rax
xchg r10, rsp
mov ebx, r14d
test ebp, ebp
je 0x140074c6f
mov r10, r10
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov rsp, rsp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x2c], esp
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov r15, r15
cmp r14w, cx
jae 0x140074b9f
mov eax, dword [rdx + 8]
test eax, eax
xchg r12, r12
jne 0x140074b5f
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x10], esp
jb 0x140074b84
add eax, r9d
cmp r11d, eax
jb 0x140074c1d
mov dword [rsp - 0x28], 0x7a5e0e9e
inc r8w
neg rdx
add rdx, 0xffffffffffffffd8
neg rdx
cmp r8w, cx
xchg rbp, rbp
jb 0x140074b4e
xchg r8, r12
mov r12, r14
xchg r12, r8
mov eax, dword [r10 + 4]
mov dword [rsp - 0x18], 0x43f61dcc
lea r9, [r10 + 4]
nop
sub rax, 0x3b771b0
add rax, 0x3b771a8
add r10, 8
mov r13, r13
shr rax, 1
test eax, eax
je 0x140074c5c
mov edx, eax
mov dword [rsp - 0x14], 0x4b8f4d13
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 7
shr ecx, 1
shr ecx, 3
shr ecx, 1
cmp ecx, 3
xchg r12, r12
je 0x140074c32
cmp ecx, 0xa
jne 0x140074c3b
xchg rsp, rsp
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140074c3b
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov r12, r12
add r8, r11
jmp 0x140074ba8
and eax, 0xfff
add dword [rax + r8], edi
nop
sub r10, 0x2df7b3a7
add r10, 0x2df7b3a9
sub rdx, 1
mov dword [rsp - 0xc], 0x7db2217e
jne 0x140074be7
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140074b1b
mov dword [rsp - 0x24], 0x31d650f6
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
xchg r13, rbp
mov r13, qword [rsp + 0x38]
xchg r13, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x28], 0x7debddd0
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140076d00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
push r14
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push rdx
mov qword [rsp], r14
push r15
mov rsp, rsp
add rsp, 0xffffffffffffffe0
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x14], edx
xor eax, 0x4c8b78f0
xchg rcx, rdx
mov rsi, rdx
xchg rdx, rcx
cmp eax, 0x4c8b22bd
mov dword [rsp - 0xc], 0x58e49cb7
jne 0x140076eaf
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x40], esp
xor eax, 0x4c8b78f0
cmp eax, 0x4c8b3da0
jne 0x140076eaf
mov dword [rsp - 0x20], ebx
mov edx, dword [rdx + rcx + 0x88]
call fcn.140076c30
xchg r13, rsi
mov rcx, r13
xchg r13, rsi
mov r14, rax
mov edx, dword [rax + 0x20]
call fcn.140076c30
mov dword [rsp - 0x24], esp
mov edx, dword [r14 + 0x24]
mov rcx, rsi
mov r12, rax
call fcn.140076c30
xchg rdi, rdi
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg rbx, rax
mov r13, rbx
xchg rbx, rax
call fcn.140076c30
xor edi, edi
mov qword [rsp + 0x70], rax
mov dword [rsp - 0x28], 0x1c613d80
cmp dword [r14 + 0x18], edi
jbe 0x140076eaf
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov dword [rsp - 0x20], edx
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140076c30
mov ecx, 0x609bdf74
xor ecx, 0x2c0d858c
sub ecx, 0x21d84afe
add ecx, 0xd541f005
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x2c], edx
cmp byte [rax], 0
je 0x140076e94
nop dword [rax]
xchg rdx, r14
mov r14, rbx
xchg r14, rdx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x10], 0x92a4a09
mov r8d, 0x1489fec8
add r8d, 0x637c065c
xor r8d, 0x2c54a280
xor r8d, 0x508e43bb
xor r8d, 0x4dce41e
inc rbx
call fcn.140083320
mov dword [rsp - 0x14], esi
cmp byte [rbx], 0
jne 0x140076e3f
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x2c], ebp
not ecx
cmp ecx, r15d
je 0x140076efc
mov dword [rsp - 0x40], esi
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140076df7
xor eax, eax
mov dword [rsp - 0x24], esi
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg rbx, r13
add rsp, 0x20
mov dword [rsp - 0x44], esp
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
pop r12
pop rdi
mov dword [rsp - 0x40], 0x4053a663
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
mov dword [rsp - 0x34], 0x53de3297
xchg rbx, rax
mov rbx, qword [rsp + 0x70]
xchg rbx, rax
mov edx, dword [rax + rdx*4]
call fcn.140076c30
jmp 0x140076eb5
Function at 0x14007af80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg r9, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
mov r13, r13
xorps xmm0, xmm0
xchg rsi, r8
mov qword [rsp + 0x70], r8
xchg r8, rsi
xchg rdi, rsi
mov rdi, qword [rcx + 0x38]
xchg rsi, rdi
lea rcx, [rsp + 0x20]
mov r15, r15
xchg r8, rax
mov qword [rsp + 0x20], r8
xchg r8, rax
xchg rsp, r13
movups xmmword [r13 + 0x28], xmm0
xchg r13, rsp
lea rdx, [rsi + 1]
mov r13, r13
xchg rbx, rsp
movups xmmword [rbx + 0x38], xmm0
xchg rsp, rbx
xchg r13, rsp
movups xmmword [r13 + 0x48], xmm0
xchg rsp, r13
call fcn.14000ee10
mov dword [rsp - 0x24], esp
mov edx, 0x162043ac
add edx, 0x208685a6
xor edx, 0x509db972
sub edx, 0x5a9df7f1
add edx, 0xf12d7e8
test rsi, rsi
je 0x14007b088
mov rdi, rax
xchg rbx, rbx
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x1330e88f
xor r9d, 0xcddbd28
add r9d, 0x32903dab
xor r9d, 0x31fb1943
sub r9d, 0x63868912
nop dword [rax]
mov r13, r13
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x10], ecx
ror edx, 8
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
sub r8, 1
xchg rsi, rsi
jne 0x14007b060
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x1c], ebx
call fcn.14007b130
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x40], edx
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14007b0fa
xor eax, eax
mov dword [rsp - 0x24], edi
lea rdi, [rsp + 0x28]
mov ecx, 0x2a1a182a
sub ecx, 0xc5fba68
add ecx, 0x25b3a4f1
sub ecx, 0x436e0283
rep stosb byte [rdi], al
mov eax, ebx
xchg rbx, r15
mov r15, qword [rsp + 0x78]
xchg rbx, r15
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140099240
mov eax, ebx
xchg r13, rbx
mov r13, qword [rsp + 0x78]
xchg r13, rbx
nop
add rsp, 0x31e1d32d
sub rsp, 0x31e1d2cd
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140082730
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x2c], ebp
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x1404a3590]
xchg r11, r11
xchg r10, rcx
mov rbx, r10
xchg rcx, r10
not rax
movabs rcx, 0x1a8bfb7e0f721811
add rcx, 0x5e246fff
sub rcx, 0x47e39fbe
add rcx, 0x3b2104bb
add rcx, 0x182f0bf4
add rax, rcx
mov edx, 0x18f80f76
add edx, 0x5025535f
xor edx, 0x740529d2
add edx, 0x542f4284
sub edx, 0x71478c87
rol rax, 2
mov dword [rsp - 0x14], 0x4801095b
movabs rcx, 0xa91dc73f648397fd
sub rcx, 0x4ae33f9d
xor rcx, 0xf5c98c5
add rcx, 0x58d20973
add rcx, 0x479277bb
add rax, rcx
lea rcx, [rsp + 0x20]
xchg r9, r9
call rax
lea rax, [rbx + 8]
xorps xmm0, xmm0
xchg r8, r8
xchg rdi, rax
mov qword [rbx], rdi
xchg rdi, rax
nop
movabs rdx, 0xffffffff64ea1729
sub rdx, 0x4157fee9
add rdx, 0x235bf44b
add rdx, 0x7fffffff
add rdx, 0x3911f375
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rax
movups xmmword [rax + 0x20], xmm0
xchg r10, r10
lea rax, [rsp + 0x20]
inc rdx
cmp word [rax + rdx*2], 0
mov r12, r12
jne 0x140082833
xchg rcx, r14
mov r14, rbx
xchg rcx, r14
mov qword [rbx + 0x38], rdx
xchg r10, r10
call fcn.14000ee10
xor r8d, r8d
mov edx, 0x43d14ab2
add edx, 0xeb26cb
xor edx, 0xabb35cc
sub edx, 0xaf923bd
sub edx, 0x285dd0dd
cmp qword [rbx + 0x38], r8
mov r12, r12
jbe 0x1400828f1
lea r9, [rsp + 0x20]
mov r10d, 0x5c724ed3
xor r10d, 0x3168e01d
sub r10d, 0x69a388bd
sub r10d, 0x3772512
sub r9, rax
mov dword [rsp - 0x28], edi
nop dword [rax]
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x38], edx
lea rax, [rax + 2]
and cx, r10w
ror edx, 3
ror edx, 1
ror edx, 3
ror edx, 1
xor cx, word [rax + r9 - 2]
inc r8
mov dword [rsp - 0x18], esi
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x1400828ba
xchg r10, r10
xchg r14, rax
mov r14, rbx
xchg r14, rax
add rsp, 0x230
mov r8, r8
nop
mov rbx, qword [rsp]
add rsp, 8
ret