joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008838
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], 0
sar rdx, 9
call fcn.140008672
mov qword [rsp + 0x50], rax
xor eax, eax
lea rcx, [0x1400e6580]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0x24
jne 0x140008878
mov r14d, edi
shr r14d, 6
and r14d, 7
mov r13d, 1
mov ecx, edi
shl r13, cl
mov r11d, 0x2f7d4ef2
xor ebp, ebp
lea rcx, [0x1400e3670]
lea rdi, [0x1400e6560]
mov r12d, 0x112dbc20
xor r10d, r10d
xor r15d, r15d
cmp r11d, 0x634c96fe
jle 0x14000891c
cmp r11d, 0x771e161a
jle 0x140008951
cmp r11d, 0x775b11f8
je 0x1400089b8
cmp r11d, 0x7cbfe930
jne 0x140008a6b
test r15b, r15b
jne 0x1400088ff
xor dword [rsp + 0x3c], 0x28a16966
cmp r8d, 2
mov r11d, 0x2c06b878
mov eax, 0x74118a0
cmove r11d, eax
xor r11d, dword [rsp + 0x34]
mov r15b, 1
jmp 0x1400088c6
cmp r11d, 0x2f7d4ef1
jg 0x14000898a
cmp r11d, 0x13cd7de5
je 0x1400089ce
cmp r11d, 0x1b98f6ac
jne 0x1400088c6
mov eax, esi
and al, 1
mov r11d, dword [rsp + 0x40]
mov edx, 0x2c06b878
xor r11d, edx
jmp 0x1400088c6
cmp r11d, 0x634c96ff
je 0x140008a0b
cmp r11d, 0x69603052
jne 0x1400088c6
test r8d, r8d
mov r11d, 0x2c06b878
mov eax, 0x408058cf
cmove r11d, eax
xor r11d, dword [rsp + 0x38]
mov esi, r9d
jmp 0x1400088c6
cmp r11d, 0x2f7d4ef2
je 0x140008a29
cmp r11d, 0x5c59b6c3
jne 0x1400088c6
mov r11d, dword [rsp + 0x3c]
mov edx, 0x682131a9
xor r11d, edx
xor esi, esi
jmp 0x1400088c6
mov r11d, dword [rsp + 0x28]
xor r11d, r12d
mov r8d, 2
xor r9d, r9d
jmp 0x1400088c6
test r10b, r10b
jne 0x1400089eb
xor edx, edx
movsxd rbx, dword [rdx + rcx]
xor dword [rsp + rbx*4 + 0x20], 0x59f86fa6
add rdx, 4
cmp rdx, 0x14
jne 0x1400089d5
cmp r8d, 2
mov r11d, 0x7e5f28f5
mov edx, 0x6b80f197
cmovl r11d, edx
xor r11d, dword [rsp + 0x30]
mov r10b, 1
jmp 0x1400088c6
mov rdx, qword [rsp + 0x50]
test qword [rdx + r14*8 + 0x10], r13
setne r9b
mov r11d, dword [rsp + 0x2c]
xor r11d, r12d
xor r8d, r8d
jmp 0x1400088c6
mov rdx, qword [rsp + 0x50]
test bpl, bpl
jne 0x140008a4c
xor ebp, ebp
movsxd rbx, dword [rbp + rdi]
xor dword [rsp + rbx*4 + 0x20], 0x7a21c57f
add rbp, 4
cmp rbp, 0x20
jne 0x140008a35
test rdx, rdx
mov r11d, 0x1b8d9245
mov edx, 0xf9a1542
cmove r11d, edx
xor r11d, dword [rsp + 0x20]
mov bpl, 1
jmp 0x1400088c6
cmp r11d, 0x771e161b
jne 0x1400088c6
and al, 1
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140009c4c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x60], rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], rdx
mov rcx, rdx
mov qword [rsp + 0x20], r8
mov rdx, r8
call fcn.140008672
mov qword [rsp + 0x28], rax
xor eax, eax
lea rcx, [0x1400e79b0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x20
jne 0x140009c99
movzx r15d, byte [rsp + 0x20]
mov edx, 0x3d971519
xor r14d, r14d
mov r8d, 0x32789e31
lea rsi, [0x1400e7990]
mov ebx, 0x61ac573a
lea r13, [0x1400e3b0c]
xor r12d, r12d
cmp edx, 0x634c96fe
jle 0x140009d0a
cmp edx, 0x775b11f7
jg 0x140009d65
cmp edx, 0x634c96ff
je 0x140009db2
cmp edx, 0x69603052
jne 0x140009cd9
mov edx, dword [rsp + 0x4c]
mov ebp, 0x74118a0
xor edx, ebp
jmp 0x140009cd9
cmp edx, 0x47c49477
jg 0x140009d91
cmp edx, 0x13cd7de5
je 0x140009deb
cmp edx, 0x3d971519
jne 0x140009cd9
mov rdx, qword [rsp + 0x28]
test r14b, r14b
jne 0x140009d49
xor ebp, ebp
movsxd rdi, dword [rbp + rsi]
xor dword [rsp + rdi*4 + 0x30], 0x7a21c57f
add rbp, 4
cmp rbp, 0x1c
jne 0x140009d32
test rdx, rdx
mov edx, 0x3f0590c2
mov ebp, 0xf9a1542
cmove edx, ebp
xor edx, dword [rsp + 0x30]
mov r14b, 1
jmp 0x140009cd9
cmp edx, 0x775b11f8
je 0x140009e00
cmp edx, 0x7cbfe930
jne 0x140009cd9
test ecx, ecx
mov edx, 0x74118a0
cmove edx, r8d
xor edx, dword [rsp + 0x48]
jmp 0x140009cd9
cmp edx, 0x47c49478
jne 0x140009e40
mov edx, dword [rsp + 0x38]
xor edx, ebx
mov ecx, 2
mov rax, qword [rsp + 0x28]
jmp 0x140009cd9
test r12b, r12b
jne 0x140009dcf
xor edx, edx
movsxd rbp, dword [rdx + r13]
xor dword [rsp + rbp*4 + 0x30], 0x59f86fa6
add rdx, 4
cmp rdx, 0x10
jne 0x140009db9
cmp ecx, 2
mov edx, 0x112dbc20
mov ebp, 0x7e5f28f5
cmovl edx, ebp
xor edx, dword [rsp + 0x40]
mov r12b, 1
jmp 0x140009cd9
cmp ecx, 2
mov edx, 0x74118a0
cmove edx, r8d
xor edx, dword [rsp + 0x44]
jmp 0x140009cd9
mov edx, 0x50
mov rcx, qword [rsp + 0x60]
call fcn.140007e08
mov ebx, 0x61ac573a
mov r8d, 0x32789e31
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + r15*8]
mov qword [rax], rcx
mov qword [rdx + r15*8], rax
mov rcx, qword [rsp + 0x20]
mov qword [rax + 8], rcx
mov edx, dword [rsp + 0x3c]
xor edx, ebx
xor ecx, ecx
jmp 0x140009cd9
cmp edx, 0x5c59b6c3
jne 0x140009cd9
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140009e8f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r8
mov rdi, rdx
mov r14, rcx
lea r12, [rdx + r8]
mov r13, qword [rdx + 8]
sub r13, r8
mov qword [rdx + r8 + 8], r13
xorps xmm0, xmm0
movaps xmmword [rdx + r8 + 0x10], xmm0
mov qword [rdx + r8], r8
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
mov rax, qword [rdx + 8]
add rax, rdx
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
sar rdx, 0xc
lea r15, [rcx + 0x20a8]
mov rcx, r15
call fcn.140008838
mov byte [rsp + 0x27], al
xor eax, eax
lea rcx, [0x1400e74fc]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x140009f02
mov ecx, 0x28a16966
mov r9b, 1
lea rax, [0x1400e74f0]
mov r8d, 0x3225c030
mov r10d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
cmp ecx, 0x3d971518
jg 0x140009f50
cmp ecx, 0xe97711d
je 0x140009f75
cmp ecx, 0x28a16966
jne 0x140009f36
jmp 0x140009f80
cmp ecx, 0x3d971519
je 0x140009fbc
cmp ecx, 0x4ae4c48a
jne 0x140009f36
mov rcx, qword [rsp + 0x28]
mov rsi, qword [rcx]
and esi, 1
or rsi, r13
mov qword [rcx], rsi
mov ecx, edx
jmp 0x140009f78
mov ecx, r10d
xor ecx, 0x3f77d4dc
jmp 0x140009f36
mov cl, byte [rsp + 0x27]
test r9b, 1
je 0x140009fa2
xor ecx, ecx
movsxd rdx, dword [rcx + rax]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 0xc
jne 0x140009f8c
cmp byte [rsp + 0x27], 0
mov ecx, 0x765675a7
cmovne ecx, r8d
xor ecx, dword [rsp + 0x30]
xor r9d, r9d
jmp 0x140009f2d
mov qword [rdi + 8], rbx
mov rdi, r12
sar rdi, 0xc
mov r8, r12
sar r8, 0x15
mov rcx, r14
mov rdx, r15
call fcn.140009c4c
mov rdx, rdi
shr rdx, 3
mov ebx, 1
mov ecx, edi
shl rbx, cl
and edx, 0x38
or qword [rax + rdx + 0x10], rbx
mov rax, r12
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a172
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r10, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov qword [rsp + 0x20], 0
lea rax, [rdx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 8], rax
mov rax, r8
shl rax, 8
add rax, rcx
mov rcx, qword [rsp + 8]
mov qword [rax + r9*8 + 0x878], rcx
xor eax, eax
lea rcx, [0x1400e66d0]
movsxd rbp, dword [rax + rcx]
xor dword [rsp + rbp*4 + 0x10], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x14000a1cc
mov r11d, 0xfffffffe
mov ecx, r8d
rol r11d, cl
mov eax, 0xfffffffe
mov ecx, r9d
rol eax, cl
mov esi, 0x23b3651a
mov r13b, 1
xor r12d, r12d
mov r9d, 0x452455bd
lea rcx, [0x1400e66b4]
mov r15d, 0x2d9d8f37
mov edi, dword [rsp + 0x18]
xor edi, r9d
mov ebp, dword [rsp + 0x1c]
mov r14d, dword [rsp + 0x20]
mov ebx, r14d
xor ebx, 0x7449e904
cmp esi, 0x3d971518
jle 0x14000a264
cmp esi, 0x3d971519
je 0x14000a27f
cmp esi, 0x47c49478
je 0x14000a2ee
cmp esi, 0x4ae4c48a
jne 0x14000a22f
mov rsi, qword [rsp + 8]
mov qword [rsi + 0x18], 0
mov esi, edi
jmp 0x14000a22f
cmp esi, 0x23b3651a
je 0x14000a2aa
cmp esi, 0x2f7d4ef2
jne 0x14000a22f
and dword [r10 + 0x810], r11d
mov esi, ebx
jmp 0x14000a22f
mov esi, r14d
xor esi, 0x316dbcb9
test r12b, r12b
cmove r14d, esi
and dword [r10 + r8*4 + 0x814], eax
mov esi, 0x452455bd
cmove esi, r15d
xor esi, ebp
mov r12b, 1
jmp 0x14000a226
mov dword [rsp + 0x20], r14d
mov rsi, qword [rsp + 8]
test r13b, 1
je 0x14000a2d2
xor edi, edi
movsxd rbx, dword [rdi + rcx]
xor dword [rsp + rbx*4 + 0x10], 0x7a21c57f
add rdi, 4
cmp rdi, 0x10
jne 0x14000a2bc
test rsi, rsi
mov esi, 0x3225c030
mov edi, 0x455611a3
cmove esi, edi
xor esi, dword [rsp + 0x10]
xor r13d, r13d
jmp 0x14000a216
mov dword [rsp + 0x20], r14d
xor eax, eax
mov qword [rdx + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a994
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
xor ebx, ebx
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea rax, [0x1400e7408]
movsxd rcx, dword [rbx + rax]
xor dword [rsp + rcx*4 + 0x30], 0x78c104ba
add rbx, 4
cmp rbx, 0xc
jne 0x14000a9cb
mov edx, 0x59f86fa6
mov bl, 1
lea rax, [0x1400e7400]
mov r8d, 0x5b7261a0
cmp edx, 0xe97711d
je 0x14000aa48
cmp edx, 0x59f86fa6
je 0x14000aa12
cmp edx, 0x23b3651a
jne 0x14000a9f5
jmp 0x14000aaa7
mov rdx, qword [rsp + 0x28]
test bl, 1
je 0x14000aa34
xor ebx, ebx
movsxd rcx, dword [rbx + rax]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rbx, 4
cmp rbx, 8
jne 0x14000aa1e
test rdx, rdx
mov edx, 0x765675a7
cmove edx, r8d
xor edx, dword [rsp + 0x30]
xor ebx, ebx
jmp 0x14000a9f5
mov rbx, qword [rsp + 0x28]
add qword [rsi + 0x2080], rdi
xorps xmm0, xmm0
movaps xmmword [rbx + 0x10], xmm0
mov qword [rbx + 8], rdi
mov qword [rbx], 1
mov rdi, rbx
sar rdi, 0xc
lea rdx, [rsi + 0x20a8]
mov r8, rbx
sar r8, 0x15
mov rcx, rsi
call fcn.140009c4c
mov rdx, rdi
shr rdx, 3
mov esi, 1
mov ecx, edi
shl rsi, cl
and edx, 0x38
or qword [rax + rdx + 0x10], rsi
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.140007c4f
int3

Function at 0x14000aaad
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
add rcx, 0x28d8
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
xor eax, eax
lea rcx, [0x1400e7408]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x14000aaef
mov eax, 0x59f86fa6
mov r10b, 1
mov r9d, 0xc77b0d8
lea rcx, [0x1400e7400]
mov r8d, 0x5b7261a0
mov edx, dword [rsp + 0x28]
xor edx, r9d
cmp eax, 0xe97711d
je 0x14000ab95
cmp eax, 0x23b3651a
je 0x14000ab3e
cmp eax, 0x59f86fa6
jne 0x14000ab27
jmp 0x14000ab5d
mov r11, qword [rsp + 8]
mov rax, qword [rsp + 0x18]
mov qword [rax], r11
mov r11, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [r11 + 8], rax
mov eax, edx
jmp 0x14000ab27
mov r11, qword [rsp + 0x30]
test r10b, 1
je 0x14000ab80
xor edx, edx
movsxd rax, dword [rdx + rcx]
xor dword [rsp + rax*4 + 0x20], 0x7a21c57f
add rdx, 4
cmp rdx, 8
jne 0x14000ab6a
test r11, r11
mov eax, 0x765675a7
cmove eax, r8d
xor eax, dword [rsp + 0x20]
xor r10d, r10d
jmp 0x14000ab20
mov rax, qword [rsp + 8]
add rsp, 0x38
ret
Function at 0x14000ab9f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14, r8
mov r15, rdx
mov r13, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
lea rax, [rcx + 0x28c0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor eax, eax
lea rcx, [0x1400e74fc]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x14000abea
mov eax, 0x28a16966
mov bpl, 1
lea rbx, [0x1400e74f0]
mov esi, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x3c]
cmp eax, 0x3d971518
jg 0x14000ac2f
cmp eax, 0xe97711d
je 0x14000ac52
cmp eax, 0x28a16966
jne 0x14000ac18
jmp 0x14000ac70
cmp eax, 0x3d971519
je 0x14000acae
cmp eax, 0x4ae4c48a
jne 0x14000ac18
mov edx, 0x28
mov rcx, r13
call fcn.140007e08
mov rdi, rax
mov eax, r12d
jmp 0x14000ac69
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x20]
mov eax, esi
xor eax, 0x3f77d4dc
jmp 0x14000ac18
mov rax, qword [rsp + 0x20]
test bpl, 1
je 0x14000ac93
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 0xc
jne 0x14000ac7d
test rax, rax
mov eax, 0x765675a7
mov ecx, 0x3225c030
cmove eax, ecx
xor eax, dword [rsp + 0x30]
xor ebp, ebp
jmp 0x14000ac0f
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r14
mov rcx, r13
call fcn.14000aaad
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x20], 1
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ace1
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov rax, qword [rcx]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
xor eax, eax
lea r8, [0x1400e74fc]
movsxd rdx, dword [rax + r8]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x14000ad3a
mov edx, 0x28a16966
mov r9b, 1
lea rsi, [0x1400e74f0]
mov r8d, 0x3225c030
mov r10d, dword [rsp + 0x28]
mov r11d, dword [rsp + 0x2c]
cmp edx, 0x3d971518
jg 0x14000ad89
cmp edx, 0xe97711d
je 0x14000adc3
cmp edx, 0x28a16966
jne 0x14000ad6f
jmp 0x14000adce
cmp edx, 0x3d971519
je 0x14000ae0e
cmp edx, 0x4ae4c48a
jne 0x14000ad6f
mov rax, qword [rsp + 0x10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, qword [rcx]
mov rdx, qword [rsp + 8]
mov qword [rax + 8], rdx
mov edx, r11d
jmp 0x14000adc6
mov edx, r10d
xor edx, 0x3f77d4dc
jmp 0x14000ad6f
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
test r9b, 1
je 0x14000adf6
xor edx, edx
movsxd rax, dword [rdx + rsi]
xor dword [rsp + rax*4 + 0x20], 0x7a21c57f
add rdx, 4
cmp rdx, 0xc
jne 0x14000ade0
cmp r10, r11
mov edx, 0x765675a7
cmove edx, r8d
xor edx, dword [rsp + 0x20]
xor r9d, r9d
jmp 0x14000ad65
add rsp, 0x50
pop rsi
ret
Function at 0x14000ae14
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov rax, qword [rcx]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 8
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
xor eax, eax
lea r8, [0x1400e74fc]
movsxd rdx, dword [rax + r8]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x14000ae7c
mov edx, 0x28a16966
mov r9b, 1
lea rsi, [0x1400e74f0]
mov r8d, 0x3225c030
mov r10d, dword [rsp + 0x28]
mov r11d, dword [rsp + 0x2c]
cmp edx, 0x3d971518
jg 0x14000aecb
cmp edx, 0xe97711d
je 0x14000af0d
cmp edx, 0x28a16966
jne 0x14000aeb1
jmp 0x14000af18
cmp edx, 0x3d971519
je 0x14000af58
cmp edx, 0x4ae4c48a
jne 0x14000aeb1
mov rax, qword [rsp + 0x10]
mov qword [rcx], rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov rdx, qword [rsp + 8]
mov qword [rdx], rax
mov rax, qword [rcx]
mov rdx, qword [rsp]
mov qword [rax], rdx
mov rax, qword [rcx]
inc qword [rax + 0x20]
mov edx, r11d
jmp 0x14000af10
mov edx, r10d
xor edx, 0x3f77d4dc
jmp 0x14000aeb1
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
test r9b, 1
je 0x14000af40
xor edx, edx
movsxd rax, dword [rdx + rsi]
xor dword [rsp + rax*4 + 0x20], 0x7a21c57f
add rdx, 4
cmp rdx, 0xc
jne 0x14000af2a
cmp r10, r11
mov edx, 0x765675a7
cmove edx, r8d
xor edx, dword [rsp + 0x20]
xor r9d, r9d
jmp 0x14000aea7
add rsp, 0x50
pop rsi
ret
Function at 0x14000bdbf
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c], xmm0
movaps xmmword [rsp + 0x10], xmm0
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
xor eax, eax
lea rbp, [0x1400e74d0]
movsxd rbx, dword [rax + rbp]
xor dword [rsp + rbx*4 + 0x10], 0x78c104ba
add rax, 4
cmp rax, 0x18
jne 0x14000bded
lea r9, [rdx + 0x10]
lea rax, [rdx + 0x18]
mov qword [rsp + 0x48], rax
mov edi, 0xe97711d
mov r15b, 1
xor r14d, r14d
lea rax, [0x1400e74b0]
mov r8d, 0x455611a3
xor r12d, r12d
mov ebx, dword [rsp + 0x20]
mov r13d, dword [rsp + 0x18]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x24]
mov esi, r10d
xor esi, 0x3245711c
mov ebp, r11d
xor ebp, 0x3854389c
cmp edi, 0x47c49477
jg 0x14000be79
cmp edi, 0xe97711d
je 0x14000bf4e
cmp edi, 0x2f7d4ef2
je 0x14000beb0
cmp edi, 0x3d971519
jne 0x14000be50
jmp 0x14000bf10
cmp edi, 0x47c49478
je 0x14000bec1
cmp edi, 0x634c96ff
je 0x14000bf93
cmp edi, 0x775b11f8
jne 0x14000be50
mov rdi, qword [rsp + 0x38]
mov rdi, qword [rdi]
mov r8, qword [rsp + 0x40]
mov qword [r8 + 0x18], rdi
mov r8d, 0x455611a3
mov edi, ebp
jmp 0x14000be50
mov rdi, qword [rsp + 8]
mov qword [rdi + 0x18], 0
mov edi, esi
jmp 0x14000be50
mov rdi, qword [r9]
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x38]
mov rbp, qword [rbp]
mov qword [rbp + 0x10], rdi
mov rdi, qword [r9]
mov ebp, r11d
xor ebp, 0x59f86fa6
test r12b, r12b
cmove r11d, ebp
mov qword [rsp + 0x40], rdi
cmp qword [rsp + 0x40], 0
mov edi, 0x75bbd03d
mov ebp, 0x61ac573a
cmove edi, ebp
xor edi, ebx
mov r12b, 1
jmp 0x14000be47
mov rsi, qword [r9]
mov qword [rsp + 8], rsi
mov esi, r10d
xor esi, 0x53e92626
test r14b, r14b
mov rdi, qword [rsp + 8]
cmove r10d, esi
mov qword [rcx], rdi
cmp qword [rsp + 8], 0
mov edi, 0x2d9d8f37
mov esi, 0x61ac573a
cmove edi, esi
xor edi, r13d
mov r14b, 1
jmp 0x14000be3e
mov dword [rsp + 0x1c], r10d
mov dword [rsp + 0x24], r11d
mov rbp, qword [rsp + 0x50]
test r15b, 1
je 0x14000bf7b
xor ebx, ebx
movsxd rdi, dword [rbx + rax]
xor dword [rsp + rdi*4 + 0x10], 0x7a21c57f
add rbx, 4
cmp rbx, 0x14
jne 0x14000bf65
cmp rbp, rdx
mov edi, 0x3f0590c2
cmove edi, r8d
xor edi, dword [rsp + 0x10]
xor r15d, r15d
jmp 0x14000be2b
mov dword [rsp + 0x1c], r10d
mov dword [rsp + 0x24], r11d
xorps xmm0, xmm0
movaps xmmword [r9], xmm0
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c461
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
sar rdx, 9
call fcn.140008672
mov qword [rsp + 0x28], rax
xor eax, eax
lea rcx, [0x1400e74fc]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x14000c490
mov eax, esi
shr eax, 6
and eax, 7
mov r9, 0xfffffffffffffffe
mov ecx, esi
rol r9, cl
mov edx, 0x28a16966
mov r10b, 1
lea rcx, [0x1400e74f0]
mov r8d, 0x765675a7
mov r11d, dword [rsp + 0x38]
mov esi, dword [rsp + 0x3c]
cmp edx, 0x3d971518
jg 0x14000c4f2
cmp edx, 0xe97711d
je 0x14000c510
cmp edx, 0x28a16966
jne 0x14000c4d8
jmp 0x14000c51b
cmp edx, 0x3d971519
je 0x14000c556
cmp edx, 0x4ae4c48a
jne 0x14000c4d8
mov rdx, qword [rsp + 0x28]
and qword [rdx + rax*8 + 0x10], r9
mov edx, esi
jmp 0x14000c513
mov edx, r11d
xor edx, 0x3f77d4dc
jmp 0x14000c4d8
mov r11, qword [rsp + 0x28]
test r10b, 1
je 0x14000c53e
xor esi, esi
movsxd rdx, dword [rsi + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rsi, 4
cmp rsi, 0xc
jne 0x14000c528
test r11, r11
mov edx, 0x3225c030
cmove edx, r8d
xor edx, dword [rsp + 0x30]
xor r10d, r10d
jmp 0x14000c4cf
add rsp, 0x50
pop rsi
ret
Function at 0x14000de62
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov r15, rdx
mov rdi, rcx
mov r14, qword [rdx + 8]
sar rdx, 0xc
add rcx, 0x20a8
call fcn.14000c461
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
lea rax, [rdi + 0x2088]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
add rdi, 0x2080
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
xor eax, eax
lea rcx, [0x1400e74fc]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x14000ded2
mov edi, 0x28a16966
mov dl, 1
lea r8, [rsp + 0x58]
lea rcx, [0x1400e74f0]
mov r9d, 0x3225c030
lea r10, [rsp + 0x28]
mov ebx, dword [rsp + 0x38]
mov esi, dword [rsp + 0x3c]
cmp edi, 0x3d971518
jg 0x14000df28
cmp edi, 0xe97711d
je 0x14000df3f
cmp edi, 0x28a16966
jne 0x14000df0e
jmp 0x14000df4f
cmp edi, 0x3d971519
je 0x14000df8d
cmp edi, 0x4ae4c48a
jne 0x14000df0e
mov rax, r10
mov edi, esi
jmp 0x14000df44
mov rax, r8
mov edi, ebx
xor edi, 0x3f77d4dc
mov rax, qword [rax]
jmp 0x14000df0e
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x28]
test dl, 1
je 0x14000df76
xor edx, edx
movsxd rsi, dword [rdx + rcx]
xor dword [rsp + rsi*4 + 0x30], 0x7a21c57f
add rdx, 4
cmp rdx, 0xc
jne 0x14000df60
cmp rbx, rdi
mov edi, 0x765675a7
cmovl edi, r9d
xor edi, dword [rsp + 0x30]
xor edx, edx
jmp 0x14000df06
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
sub rax, r14
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
xor esi, esi
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rsp + 0x28], eax
lea rax, [0x1400e7408]
movsxd rcx, dword [rsi + rax]
xor dword [rsp + rcx*4 + 0x30], 0x78c104ba
add rsi, 4
cmp rsi, 0xc
jne 0x14000dfce
mov edx, 0x59f86fa6
mov bl, 1
lea rax, [0x1400e7400]
mov ecx, 0x765675a7
cmp edx, 0x23b3651a
je 0x14000e044
cmp edx, 0x59f86fa6
je 0x14000e011
cmp edx, 0xe97711d
jne 0x14000dff7
jmp 0x14000e050
mov edx, dword [rsp + 0x28]
test bl, 1
je 0x14000e032
xor ebx, ebx
movsxd rdi, dword [rbx + rax]
xor dword [rsp + rdi*4 + 0x30], 0x7a21c57f
add rbx, 4
cmp rbx, 8
jne 0x14000e01c
test edx, edx
mov edx, 0x5b7261a0
cmove edx, ecx
xor edx, dword [rsp + 0x30]
xor ebx, ebx
jmp 0x14000dff7
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14002529f
mov ecx, 1
call sub.msvcrt.dll_exit
int3