joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400776f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ebc7
mov r10, rcx
xchg rdx, rdx
mov eax, dword [0x1400da030]
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov dword [rsp - 0x10], 0x28d48286
ret

Function at 0x140077710
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
xchg rdi, rdi
mov byte [rsp + 0x28], al
jmp 0x14007f1fb
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400da0c8]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x2c], edx
jne 0x14007e960
syscall
ret

Function at 0x140077730
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007e9da
xchg r10, r13
mov r13, rcx
xchg r13, r10
mov eax, dword [0x1400da000]
xchg rcx, rcx
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov r11, r11
ret

Function at 0x140077740
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ee17
xchg r10, rbx
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1400da068]
mov rcx, rcx
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov dword [rsp - 0x3c], esi
ret

Function at 0x140077750
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ea31
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x1400da008]
mov rdi, rdi
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov rsi, rsi
ret

Function at 0x140077760
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f009
xchg r10, r8
mov r8, rcx
xchg r8, r10
mov eax, dword [0x1400da098]
xchg r9, r9
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov dword [rsp - 0x3c], 0xbb71b3d
ret

Function at 0x140077770
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ebf2
xchg r15, r10
mov r15, rcx
xchg r10, r15
mov eax, dword [0x1400da034]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x20], 0x2a8250c5
jne 0x14007e960
syscall
ret

Function at 0x140077780
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eeb8
xchg r15, r10
mov r15, rcx
xchg r15, r10
mov eax, dword [0x1400da078]
xchg r12, r12
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
ret

Function at 0x140077790
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ea0a
mov r10, rcx
mov eax, dword [0x1400da004]
cmp qword [0x1400da118], 0
mov r13, r13
jne 0x14007e960
syscall
ret

Function at 0x1400777a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ef92
mov r10, rcx
mov eax, dword [0x1400da08c]
cmp qword [0x1400da118], 0
mov r8, r8
jne 0x14007e960
syscall
ret

Function at 0x1400777b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007edbc
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1400da060]
xchg rbx, rbx
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov dword [rsp - 0x40], esp
ret

Function at 0x1400777c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ede9
xchg rcx, rsp
mov r10, rsp
xchg rcx, rsp
mov eax, dword [0x1400da064]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x3c], 0x2991ad19
jne 0x14007e960
syscall
ret

Function at 0x1400777d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ec72
xchg rcx, r13
mov r10, r13
xchg r13, rcx
mov eax, dword [0x1400da040]
cmp qword [0x1400da118], 0
xchg r9, r9
jne 0x14007e960
syscall
ret
Function at 0x1400777e0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov dword [rsp - 0x18], 0x4191358b
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x14007f1d2
xchg rcx, r8
mov r10, r8
xchg rcx, r8
mov eax, dword [0x1400da0c4]
cmp qword [0x1400da118], 0
mov r9, r9
jne 0x14007e960
syscall
ret

Function at 0x140077800
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eaf7
xchg r10, rbx
mov rbx, rcx
xchg r10, rbx
mov eax, dword [0x1400da01c]
xchg rbx, rbx
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
xchg r14, r14
ret

Function at 0x140077810
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eb23
xchg r10, rbx
mov rbx, rcx
xchg r10, rbx
mov eax, dword [0x1400da020]
cmp qword [0x1400da118], 0
jne 0x14007e960
mov dword [rsp - 0x44], esp
syscall
ret

Function at 0x140077820
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eb4d
xchg rdi, rcx
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1400da024]
mov r11, r11
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
ret

Function at 0x140077830
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eb76
xchg r10, r12
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1400da028]
cmp qword [0x1400da118], 0
xchg r11, r11
jne 0x14007e960
syscall
ret

Function at 0x140077840
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eacc
mov r10, rcx
mov eax, dword [0x1400da018]
mov rbx, rbx
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
mov dword [rsp - 0x18], 0x291a05dd
ret

Function at 0x140077850
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f03a
xchg r10, rdi
mov rdi, rcx
xchg rdi, r10
mov eax, dword [0x1400da09c]
xchg r15, r15
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
ret

Function at 0x140077860
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eb9f
mov r10, rcx
mov eax, dword [0x1400da02c]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x10], 0x1468953e
jne 0x14007e960
syscall
ret

Function at 0x140077870
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ea5d
mov r10, rcx
mov eax, dword [0x1400da00c]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x18], edi
jne 0x14007e960
syscall
ret

Function at 0x140077880
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ec20
xchg rcx, r9
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1400da038]
cmp qword [0x1400da118], 0
mov r8, r8
jne 0x14007e960
syscall
ret

Function at 0x140077890
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ee6a
mov r10, rcx
mov eax, dword [0x1400da070]
xchg r14, r14
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
xchg rsp, rsp
ret

Function at 0x1400778a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eee1
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x1400da07c]
mov rsp, rsp
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
ret
Function at 0x1400778b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f225
add rsp, 0x43265e76
sub rsp, 0x43265f96
lea rcx, [0x14007e9cd]
mov dword [rsp - 0x1c], 0x6e41e735
nop
mov qword [rsp - 8], rcx
sub rsp, 8
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
xchg r15, r15
push rdi
push qword [0x1400da120]
lea rsi, [rsp + 0x170]
mov dword [rsp - 0x18], esi
lea rdi, [rsp + 0x28]
mov ecx, 0x6d4a03bf
sub ecx, 0x57244672
xor ecx, 0x6a52c4bc
xor ecx, 0x7c7779e1
rep movsq qword [rdi], qword [rsi]
jmp qword [0x1400da118]
xchg r10, r12
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1400da0cc]
cmp qword [0x1400da118], 0
mov r14, r14
jne 0x14007e960
syscall
ret

Function at 0x1400778c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007eaa9
mov r10, rcx
mov eax, dword [0x1400da014]
cmp qword [0x1400da118], 0
xchg r8, r8
jne 0x14007e960
syscall
ret

Function at 0x1400778d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f1af
mov r10, rcx
mov eax, dword [0x1400da0c0]
xchg r15, r15
cmp qword [0x1400da118], 0
jne 0x14007e960
syscall
ret

Function at 0x1400778e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f158
xchg rcx, rsi
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x1400da0b8]
cmp qword [0x1400da118], 0
jne 0x14007e960
mov rbx, rbx
syscall
ret

Function at 0x1400778f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007f181
xchg rcx, rsp
mov r10, rsp
xchg rsp, rcx
mov eax, dword [0x1400da0bc]
cmp qword [0x1400da118], 0
jne 0x14007e960
mov dword [rsp - 0x10], 0x4e7cc6ca
syscall
ret

Function at 0x140077900
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ea81
mov r10, rcx
mov eax, dword [0x1400da010]
cmp qword [0x1400da118], 0
mov dword [rsp - 0x34], 0x4f8fe147
jne 0x14007e960
syscall
ret

Function at 0x140077910
Capabilities:
Execute syscall

Disassembly:
jmp 0x14007ec49
xchg r10, rsp
mov rsp, rcx
xchg r10, rsp
mov eax, dword [0x1400da03c]
cmp qword [0x1400da118], 0
mov r12, r12
jne 0x14007e960
syscall
ret
Function at 0x140079040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400da184], 0
jne 0x140079144
mov dword [rsp - 0x20], 0x2feb0020
xor edx, edx
lea r8, [0x1400da180]
nop word [rax + rax]
mov dword [rsp - 0x34], 0x6557fc83
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
xchg rcx, rcx
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x14], esi
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x38], 0x60ce97e9
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg rdx, rdx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x38], edx
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg r12, r12
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x30], edi
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rsp, rsp
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x14], 0x4e6fa919
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
xchg rbx, rbx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov r13, r13
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r12, r12
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x30], ebx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov r9, r9
cmp edx, 0x100
jb 0x140079070
ret
Function at 0x14007da3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x14], 0x6cc5a069
mov qword [rsp + 0x10], rbp
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg rsi, r14
push rdi
mov dword [rsp - 0x30], 0x6a0f5b1e
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
mov rdx, rdx
movzx eax, byte [rdx + 1]
xchg r14, r15
mov r14, r8
xchg r14, r15
movzx ebx, byte [rdx]
xchg r15, r15
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 8
xchg r14, r14
dec r8d
or ebx, eax
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
mov r12, r12
shl ebx, 2
shl ebx, 2
shl ebx, 4
or ebx, eax
mov dword [rsp - 0x38], ebp
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x2c], ebx
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 2
shl edi, 2
or edi, eax
mov dword [rsp - 0x24], 0xd98c4c1
test r8d, r8d
jle 0x14007db84
xchg rdx, r10
mov r10, qword [rcx + 8]
xchg rdx, r10
lea r14d, [r8 - 1]
mov dword [rsp - 0x44], edx
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov dword [rsp - 0x38], 0x264c0b7f
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
xchg r14, r14
lea rbp, [rdx + rax*4]
mov rdx, rsi
mov ecx, edi
mov r9, r9
call fcn.14007e2a4
xor ebx, eax
mov rdx, rbp
mov ecx, ebx
xchg r10, r10
call fcn.14007e2a4
xor edi, eax
nop
sub rsi, 0x6a85ea53
add rsi, 0x6a85ea3b
add rbp, 0xffffffffffffffe8
mov dword [rsp - 0x18], esi
sub r14, 1
jne 0x14007db45
lea rax, [r15 + 7]
xchg r12, r12
mov ecx, 0x4aebee18
add ecx, 0x27c4c23a
sub ecx, 0x4b426cc2
sub ecx, 0x276e438c
mov byte [rax - 4], dil
mov rsp, rsp
mov byte [rax], bl
dec rax
shr ebx, 4
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 4
shr edi, 1
shr edi, 2
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x44], esp
jne 0x14007dba2
xchg rbx, r10
mov r10, qword [rsp + 0x40]
xchg rbx, r10
mov rbp, qword [rsp + 0x48]
mov dword [rsp - 0x24], 0x7fca1c1f
xchg rsi, r15
mov r15, qword [rsp + 0x50]
xchg r15, rsi
nop
sub rsp, 0x7c89bd5
add rsp, 0x7c89bf5
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007dc24
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, rsp
xchg rbp, rax
mov qword [rax + 8], rbx
xchg r10, r10
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
xchg r9, rdi
mov qword [rax + 0x20], r9
xchg r9, rdi
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffe0
xchg rsp, rsp
movzx eax, byte [rdx + 1]
xchg r15, r14
mov r15, r8
xchg r15, r14
movzx ebx, byte [rdx]
xchg rdi, rdi
movzx edi, byte [rdx + 4]
shl ebx, 4
shl ebx, 4
or ebx, eax
mov rsi, rsi
shl edi, 2
shl edi, 5
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x38], 0x6a85bc90
shl ebx, 5
shl ebx, 3
or ebx, eax
mov dword [rsp - 0x30], 0x59fdb69a
movzx eax, byte [rdx + 3]
shl ebx, 8
or ebx, eax
xchg rsi, rsi
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 3
shl edi, 2
shl edi, 2
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x28], 0x392b530e
shl edi, 1
shl edi, 4
shl edi, 1
shl edi, 2
or edi, eax
xchg r15, r15
mov eax, dword [rcx + 4]
test eax, eax
jle 0x14007dd31
mov rsi, qword [rcx + 8]
mov dword [rsp - 0x34], edi
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
mov dword [rsp - 0x28], 0x1d69ac15
mov rdx, rsi
mov ecx, edi
call fcn.14007e2a4
xor ebx, eax
mov r15, r15
lea rdx, [rsi + 0xc]
mov ecx, ebx
call fcn.14007e2a4
xor edi, eax
xchg r15, r15
neg rsi
add rsi, 0xffffffffffffffe8
neg rsi
sub rbp, 1
mov dword [rsp - 0x10], esp
jne 0x14007dcfa
lea rax, [r14 + 7]
mov ecx, 0x132f80c9
xor ecx, 0x61caa117
xor ecx, 0x22cd798e
xor ecx, 0x50285854
mov byte [rax - 4], dil
mov byte [rax], bl
mov dword [rsp - 0x18], 0x8f36309
dec rax
shr ebx, 2
shr ebx, 4
shr ebx, 1
shr ebx, 1
shr edi, 1
shr edi, 3
shr edi, 1
shr edi, 2
shr edi, 1
sub rcx, 1
jne 0x14007dd4c
xchg r15, r15
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, r8
mov r8, qword [rsp + 0x40]
xchg rsi, r8
mov rdi, qword [rsp + 0x48]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x14007df88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
nop
push r9
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
add rsp, 0x3fb6f40
sub rsp, 0x3fb6fe0
movdqa xmm0, xmmword [0x14000bb00]
mov r13, r13
xor edi, edi
movdqa xmm1, xmmword [0x14000bac0]
xchg rbx, r14
mov r14, rdx
xchg rbx, r14
xchg r15, rbp
movdqu xmmword [r15 - 0x39], xmm0
xchg rbp, r15
xchg rsi, r8
mov r8, rcx
xchg rsi, r8
mov edx, edi
xchg r14, r14
movdqa xmm0, xmmword [0x14000bad0]
mov r8d, edi
xchg rsp, rbp
movdqu xmmword [rsp - 0x29], xmm1
xchg rbp, rsp
movdqa xmm1, xmmword [0x14000bab0]
mov dword [rsp - 0x38], ebx
xchg rbp, r10
movdqu xmmword [r10 - 0x19], xmm0
xchg r10, rbp
xchg rbp, rdi
movdqu xmmword [rdi - 9], xmm1
xchg rdi, rbp
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0x4741b4a1
xor eax, 0x4bf918d3
add eax, 0x157c71b1
xor eax, 0x3dae1db9
inc rdx
xchg r10, r10
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov rcx, rcx
jb 0x14007e031
cmp dword [rsi + 4], 8
jne 0x14007e0d3
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x28], edi
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 4
shl cx, 3
shl cx, 1
or cx, ax
mov word [rdx], cx
mov r9, r9
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x14007e07c
lea r9, [rbp + 7]
mov rdi, rdi
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.14007ddb0
mov dword [rsp - 0x38], 0x3cbc9e4a
jmp 0x14007e195
cmp dword [rsi], edi
jle 0x14007e195
mov r14d, edi
mov rbp, rbp
lea rdx, [rbp + 0x6d]
mov r8d, 0x586b309c
add r8d, 0x218eb30c
sub r8d, 0x64d8186f
xor r8d, 0x17ec3851
sub r8d, 0x2cdf364
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
mov dword [rsp - 0x38], esi
sub rbx, 0xfffffffffffffffe
shl ax, 4
shl ax, 2
shl ax, 1
shl ax, 1
or cx, ax
mov word [rdx], cx
mov r14, r14
lea rdx, [rdx - 2]
sub r8, 1
jne 0x14007e107
mov dword [rsp - 0x30], edx
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
mov dword [rsp - 0x18], esi
call fcn.14007ddb0
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
mov dword [rsp - 0x30], 0x60a412d5
lea rdx, [rbp + 0x67]
sub r8d, 8
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.14007ddb0
inc edi
sub r14d, 0xfffffff8
mov dword [rsp - 0x20], 0x7820424d
cmp edi, dword [rsi]
jl 0x14007e0e1
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbp, rbp
mov rbx, qword [r11 + 0x28]
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
mov rbp, rbp
rep stosb byte [rdi], al
xchg rsp, rdi
mov rdi, r11
xchg rdi, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
pop rbp
ret

Function at 0x14007e25c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov r8, r8
je 0x14007e29e
lea ecx, [r11 + r11]
mov r9d, r10d
xchg r11, r11
xor r9d, r11d
mov r11d, ecx
test dl, 1
mov rbp, rbp
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov dword [rsp - 0x28], ebx
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
jne 0x14007e269
mov r14, r14
mov eax, r10d
ret
Function at 0x140086358
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
mov r15, r15
xor r8d, r8d
mov r9, rdx
test rax, rax
mov rcx, rcx
je 0x1400863be
mov ecx, r8d
mov edx, 0x77bd2d84
sub edx, 0x429990a6
add edx, 0x1589fd93
sub edx, 0x2fa928b
sub edx, 0x2818044c
rol edx, cl
xor dl, byte [rax]
mov dword [rsp - 0x34], ecx
inc rax
mov byte [r8 + r9], dl
inc r8
xchg rsp, rsp
cmp r8, 0x20
jb 0x140086374
mov al, 0x4d
add al, 0xe
add al, 0xa
sub al, 0x3a
sub al, 0x2a
ret
xchg rsi, rax
mov rsi, qword [rcx + 0x100]
xchg rsi, rax
test rax, rax
xchg r9, r9
je 0x1400863f8
movups xmm0, xmmword [rax]
xchg rbp, rdx
movups xmmword [rbp], xmm0
xchg rdx, rbp
xchg r15, rax
movups xmm1, xmmword [r15 + 0x10]
xchg r15, rax
movups xmmword [rdx + 0x10], xmm1
mov dword [rsp - 0x34], edi
jmp 0x1400863b3
xorps xmm0, xmm0
mov r8, r8
xor al, al
movups xmmword [rdx], xmm0
xchg rdx, rsi
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rdx
ret
Function at 0x140097228
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rsp
mov r11, rdi
xchg rsp, rdi
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rdx, rdx
mov qword [r11 + 0x20], rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov rax, qword [0x1400d95d8]
mov rbp, rbp
lea rdx, [r11 + 0x10]
rol rax, 0x13
rol rax, 0xb
xchg rcx, r8
mov rbx, r8
xchg rcx, r8
movabs rcx, 0x227a3c21c178931
add rcx, 0x5fc2a5ac
xor rcx, 0x5b4cb693
add rcx, 0x37863ad2
mov dword [rsp + 0x58], 0x3086f0db
add dword [rsp + 0x58], 0x34436848
sub dword [rsp + 0x58], 0x5350dfff
xor dword [rsp + 0x58], 0x11797934
add rax, rcx
movabs rcx, 0xbde0d7ec31e31a70
sub rcx, 0x15539a59
add rcx, 0x32f93ffa
xor rcx, 0x20718827
rol rax, 0x1a
rol rax, 0x1a
rol rax, 1
rol rax, 1
rol rax, 2
rol rax, 1
add rax, rcx
mov dword [rsp - 0x38], esp
lea rcx, [r11 - 0x28]
not rax
call rax
mov dword [rsp - 0x34], 0x5cbb260e
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rdi
xchg r9, r9
xor esi, esi
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rbp
movups xmmword [rbp + 0x20], xmm0
xchg rbp, rdi
test eax, eax
mov r10, r10
jne 0x140097333
xchg rsi, r8
mov qword [rbx + 0x38], r8
xchg r8, rsi
jmp 0x140097473
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
inc r14
xchg r8, r8
cmp word [rax + r14*2], si
jne 0x14009733c
mov qword [rbx + 0x38], r14
cmp qword [rbx], rdi
mov dword [rsp - 0x34], 0x65769f7a
je 0x14009736a
mov rcx, qword [rbx]
call fcn.14007fbb0
cmp r14, 0x18
mov dword [rsp - 0x38], edx
jbe 0x1400973b2
lea rcx, [r14 + r14]
call fcn.14007fed0
mov dword [rsp - 0x1c], 0x5d8b51dd
xchg r8, rax
mov qword [rbx], r8
xchg r8, rax
test rax, rax
mov dword [rsp - 0x18], 0x615639c5
jne 0x1400973c1
mov qword [rbx], rdi
xchg rcx, rbp
mov rbp, rsi
xchg rbp, rcx
jmp 0x1400973ea
mov qword [rbx], rdi
xchg rdi, rdi
xchg rdi, r15
mov rax, r15
xchg rdi, r15
xorps xmm0, xmm0
mov dword [rsp - 0x10], 0x7fb6f6ac
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
xchg r10, rax
movups xmmword [r10 + 0x10], xmm0
xchg r10, rax
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
mov rcx, qword [rbx]
mov edx, 0x4a15964b
add edx, 0xe99181
xor edx, 0x34fd18d9
xor edx, 0x430c98f7
sub edx, 0xe353092
cmp qword [rbx + 0x38], rsi
jbe 0x140097473
xchg r9, r9
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov r9d, 0x6d0d6059
sub r9d, 0x323cc934
add r9d, 0x2ec2e78c
sub r9d, 0x69937db2
and ax, r9w
mov dword [rsp - 0x1c], edx
ror edx, 4
ror edx, 3
ror edx, 1
xor ax, word [r8 + rcx]
inc rsi
mov dword [rsp - 0x28], 0x75ea9255
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x28], 0x6e022fec
jb 0x14009741c
mov rsi, qword [rsp + 0x60]
xchg r12, rax
mov r12, rbx
xchg r12, rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rsp, rsp
nop
add rsp, 0x574ecde7
sub rsp, 0x574ecda7
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400a563c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r11, rsi
mov qword [rsp + 0x18], r11
xchg rsi, r11
push rdi
xchg r12, r12
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
xchg rsi, rsi
sub rsp, 0x20
movzx esi, word [rdx + 0x14]
lea rbx, [rdx + 0x18]
mov dword [rsp - 0x40], esi
movzx eax, word [rdx + 6]
xchg r8, r13
mov r8, rcx
xchg r8, r13
add rbx, rsi
mov ecx, 0x40870f0c
add ecx, 0x17006873
sub ecx, 0x3edf6870
sub ecx, 0xb5688aa
sub ecx, 0xd518664
xchg r15, r9
mov r9, r15
xchg r9, r15
mov r12, r8
mov r12, r12
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
cmp cx, ax
xchg rdx, rdx
jae 0x1400a5726
lea rbp, [rdx + 0x40]
add rbp, rsi
mov dword [rsp - 0x18], 0x5ef0e483
sub ax, cx
movzx r14d, ax
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
mov rcx, r13
mov dword [rsp - 0x14], 0x4927871
call fcn.1400a57b0
test al, al
xchg rbp, r8
mov rcx, r8
xchg r8, rbp
cmove rcx, rbx
add rbp, 0x28
mov dword [rsp - 0x38], ecx
mov rbx, rcx
sub r14, 1
jne 0x1400a56e6
xchg r9, r9
mov eax, dword [rsi + rdi + 0x24]
xchg rbx, r11
mov rdx, r11
xchg rbx, r11
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
mov dword [r12], eax
xchg r14, r14
call fcn.1400708b0
add eax, dword [rbx + 0xc]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov dword [rsp - 0x28], 0x292ff263
xchg rsi, r11
mov r11, qword [rsp + 0x60]
xchg rsi, r11
mov dword [r15], eax
xchg r8, r8
add rsp, 0x20
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret