joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006fb98
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
xchg rdi, rsi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x44], 0xc79c9b5
nop
mov qword [rsp - 8], rbp
sub rsp, 8
mov rbp, rsp
nop
sub rsp, 0x1d27e366
add rsp, 0x1d27e316
movabs rbx, 0x68cc10c434f39b9a
xor rbx, 0x41b6b55b
sub rbx, 0x60c8bb49
add rbx, 0x52340c25
sub rbx, 0x246102df
xchg r13, rcx
mov rdi, r13
xchg rcx, r13
cmp qword [rcx + 0x28], rbx
mov rbp, rbp
jne 0x14006fdac
mov r8d, 0x72284adc
sub r8d, 0x3c6df6a3
sub r8d, 0xe692711
xor r8d, 0x10a26b84
sub r8d, 0x37f346a9
mov dword [rbp - 0x30], 0xe678a8f
add dword [rbp - 0x30], 0x1a507911
xor dword [rbp - 0x30], 0x41d5a658
sub dword [rbp - 0x30], 0x68f4a5bb
xor esi, esi
mov dword [rsp - 0x44], edi
mov dword [rbp - 0x2c], 0x441f66fd
add dword [rbp - 0x2c], 0x134151a
sub dword [rbp - 0x2c], 0x156f4319
sub dword [rbp - 0x2c], 0x2fe138d7
mov dword [rbp - 0x28], 0x33fd2b7e
sub dword [rbp - 0x28], 0x16d07243
add dword [rbp - 0x28], 0x3da52ece
sub dword [rbp - 0x28], 0x5a96e7c9
mov dword [rbp - 0x24], 0x5cc5b37c
sub dword [rbp - 0x24], 0x2c19df9d
add dword [rbp - 0x24], 0x3943641c
add dword [rbp - 0x24], 0x11a9891b
sub dword [rbp - 0x24], 0x7b3cc0f0
lea eax, [r8 + 0x1b]
mov word [rbp - 0x20], ax
mov qword [rbp + 0x10], rsi
mov r10, r10
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x30], 0x2532c0f1
and cl, r8b
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x6b28a696
sub eax, 0x45fa3e9d
add eax, 0x44b7ee40
sub eax, 0x39a440c7
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x14], ebp
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov dword [rsp - 0x1c], esp
mov word [rbp + rax*2 - 0x1e], cx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
inc rax
mov dword [rsp - 0x38], 0x2633fc00
xchg r9, rax
mov qword [rbp + 0x10], r9
xchg r9, rax
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
cmp rax, 9
jb 0x14006fcc5
xchg rbp, rbp
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
xchg r8, r8
call fcn.140085750
xchg rcx, rax
mov rdx, rcx
xchg rcx, rax
xchg rcx, rax
mov r8, rcx
xchg rcx, rax
xor eax, eax
mov rbx, rbx
xor rdx, rbx
mov qword [rdi + 0x28], rdx
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
xchg r15, r15
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006fdb4
lea rdx, str.I_hL
mov dword [rsp - 0x24], 0x2a93786c
xchg r8, rdi
mov rcx, rdi
xchg r8, rdi
call fcn.140078468
test al, al
setne al
xchg rdx, rdx
jmp 0x14006fdb4
mov al, 0x34
sub al, 0x1e
xor al, 0x6c
xor al, 0x7b
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
xchg rcx, rcx
xchg rcx, rdi
mov rcx, qword [rsp + 0x78]
xchg rcx, rdi
add rsp, 0x50
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14006fddc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rdi
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg r10, rbp
mov r10, rsp
xchg rbp, r10
nop
sub rsp, 0x71133f36
add rsp, 0x71133ee6
movabs rbx, 0x68cc10c424d3e96d
xor rbx, 0x79f92c37
xor rbx, 0x79fe63c
xor rbx, 0x7e2de39
sub rbx, 0x1b0880a1
xchg rcx, r15
mov rdi, r15
xchg r15, rcx
cmp qword [rcx + 0x38], rbx
jne 0x14006ffdf
xor esi, esi
xchg rsp, rsp
mov dword [rbp - 0x30], 0x1b0ad5ea
add dword [rbp - 0x30], 0x25e9658b
sub dword [rbp - 0x30], 0x2ebdd60d
sub dword [rbp - 0x30], 0x11d16548
mov dword [rbp - 0x2c], 0x1d535a7c
add dword [rbp - 0x2c], 0x9f14dda
sub dword [rbp - 0x2c], 0x23f7aa00
xor dword [rbp - 0x2c], 0x6f1b06ee
sub dword [rbp - 0x2c], 0x6c15f897
mov dword [rbp - 0x28], 0x5d6c6610
sub dword [rbp - 0x28], 0x280bfcca
add dword [rbp - 0x28], 0x42c83cdc
sub dword [rbp - 0x28], 0x7f11787
xor dword [rbp - 0x28], 0x70168e9d
mov dword [rbp - 0x24], 0x8199544
xor dword [rbp - 0x24], 0x1361f040
xor dword [rbp - 0x24], 0x1458ca3f
add dword [rbp - 0x24], 0x37a103d7
sub dword [rbp - 0x24], 0x466db2a6
mov dword [rbp - 0x20], 0x2ba6d454
xor dword [rbp - 0x20], 0x289f52e6
add dword [rbp - 0x20], 0x6efc929
sub dword [rbp - 0x20], 0x9b04fbd
xchg rsi, r8
mov qword [rbp + 0x10], r8
xchg r8, rsi
mov rax, qword [rbp + 0x10]
xchg rsi, rcx
mov rsi, qword [rbp + 0x10]
xchg rsi, rcx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x20], ebx
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x15825733
add eax, 0x235c4420
add eax, 0x1f49ada6
xor eax, 0x72162206
add eax, 0x603aa73
shr eax, cl
mov dword [rsp - 0x2c], 0x3d6b7b7f
movzx ecx, al
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
xor cx, dx
mov dword [rsp - 0x2c], 0x155d13f6
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r15, rax
mov qword [rbp + 0x10], r15
xchg r15, rax
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
cmp rax, 0xa
xchg rbp, rbp
jb 0x14006fefd
xor edx, edx
mov word [rbp - 8], si
mov dword [rsp - 0x2c], ecx
lea rcx, [rbp - 0x1c]
call fcn.140085750
xchg r14, rax
mov rdx, r14
xchg r14, rax
mov r8, rax
xchg r9, r9
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x38], rdx
xchg rbp, rbp
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x24], esi
cmp rdx, rbx
je 0x14006ffe7
lea rdx, [0x1400ef830]
mov rbp, rbp
mov rcx, r8
call fcn.140078850
test al, al
setne al
xchg rbx, rbx
jmp 0x14006ffe7
mov al, 0x18
xor al, 0x75
sub al, 0x19
sub al, 0x53
xchg rbx, rdi
mov rdi, qword [rsp + 0x68]
xchg rdi, rbx
xchg rcx, rsi
mov rcx, qword [rsp + 0x70]
xchg rcx, rsi
xchg rdi, r13
mov r13, qword [rsp + 0x78]
xchg rdi, r13
add rsp, 0x50
pop rbp
ret
Function at 0x140070010
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x38], edi
push rbp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x68cc10c469091839
xor rbx, 0x1ef17206
xor rbx, 0x5965aa61
add rbx, 0x13b1bc60
mov rdi, rcx
cmp qword [rcx + 0x20], rbx
mov dword [rsp - 0x20], esp
jne 0x140070221
mov eax, 0x36655ea1
xor eax, 0x6eb2f34e
sub eax, 0x5efcc72
xor eax, 0x6b97dcfc
sub eax, 0x39703d53
mov dword [rbp - 0x30], 0xd7d7105
add dword [rbp - 0x30], 0x336ce382
xor dword [rbp - 0x30], 0x2608ca90
sub dword [rbp - 0x30], 0x66659df6
mov word [rbp - 0x1c], ax
mov dword [rsp - 0x30], ebx
xor esi, esi
mov dword [rbp - 0x2c], 0x10d88168
add dword [rbp - 0x2c], 0x4d1fb08e
xor dword [rbp - 0x2c], 0x2857dd6e
sub dword [rbp - 0x2c], 0x7553ec71
mov dword [rbp - 0x28], 0x7145bedd
sub dword [rbp - 0x28], 0x57d3dddb
add dword [rbp - 0x28], 0x26a35ad9
xor dword [rbp - 0x28], 0x745b55c4
sub dword [rbp - 0x28], 0x34286e01
mov dword [rbp - 0x24], 0x6574fab
xor dword [rbp - 0x24], 0x3b1208ec
add dword [rbp - 0x24], 0x2aec5e2d
sub dword [rbp - 0x24], 0x506f0366
sub dword [rbp - 0x24], 0x17a4a19e
mov dword [rbp - 0x20], 0x454b3d31
xor dword [rbp - 0x20], 0x2250233c
add dword [rbp - 0x20], 0x66f1981
sub dword [rbp - 0x20], 0x608ca9d0
xor dword [rbp - 0x20], 0xc848da8
xchg rdx, rsi
mov qword [rbp + 0x10], rdx
xchg rdx, rsi
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
xchg r9, rcx
mov r9, qword [rbp + 0x10]
xchg rcx, r9
mov rax, qword [rbp + 0x10]
and cl, 3
mov rbx, rbx
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x3154c75b
xor eax, 0x48411802
sub eax, 0x10055bc3
sub eax, 0x562e4f98
xor eax, 0x22a0268c
shr eax, cl
mov dword [rsp - 0xc], 0x145f9efd
movzx ecx, al
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov rax, qword [rbp + 0x10]
mov r14, r14
inc rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
xchg r13, r13
jb 0x140070143
xor edx, edx
mov word [rbp - 4], si
xchg r10, r10
lea rcx, [rbp - 0x1a]
call fcn.140085750
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, r15
mov r15, rax
xchg r8, r15
xor eax, eax
mov dword [rsp - 0x20], 0x414bc4c0
xor rdx, rbx
xchg r8, rdx
mov qword [rdi + 0x20], r8
xchg rdx, r8
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
mov dword [rsp - 0x28], edi
cmp rdx, rbx
je 0x14007022b
lea rdx, [0x1400ef298]
mov rcx, r8
mov r11, r11
call fcn.140078b90
test al, al
setne al
jmp 0x14007022b
mov al, 0x16
add al, 0x62
sub al, 0x1a
sub al, 0x1a
sub al, 0x43
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rcx, rbx
xchg r8, rsi
mov r8, qword [rsp + 0x70]
xchg rsi, r8
xchg rbx, rdi
mov rbx, qword [rsp + 0x78]
xchg rbx, rdi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
pop rbp
ret
Function at 0x14007b0b4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x14000b938]
sub r10, rcx
mov dword [rsp - 0x2c], edx
xchg rcx, r8
mov rcx, r8
xchg rcx, r8
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x7bf2a3b0
sub edx, 0x66b2661d
xor edx, 0x4327443
xor edx, 0x417200f1
sub edx, 0x265533cc
inc r9
rol edx, cl
mov r10, r10
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov r9, r9
jb 0x14007b0ce
xchg r8, r13
mov rax, r13
xchg r13, r8
ret
Function at 0x14007bf7c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
mov qword [rsp + 8], rcx
mov dword [rsp - 0x10], ebp
nop
push 0x7a61f04d
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
mov qword [rsp], r12
nop
push 0x146435e4
mov qword [rsp], r13
push r14
mov dword [rsp - 0x2c], ecx
push r11
mov qword [rsp], r15
nop
add rsp, 0x636197ca
sub rsp, 0x636197ea
xchg r14, rcx
mov rbx, r14
xchg r14, rcx
mov r13d, r8d
mov r9d, 0x7c585c6b
xor r9d, 0x1dcd963
sub r9d, 0x35996347
sub r9d, 0x47e721c1
xchg r12, rsi
mov rsi, rdx
xchg r12, rsi
cmp r8d, r9d
mov dword [rsp - 0xc], esi
pushf
movabs rcx, 0xffffffff1618b728
add rcx, 0x593ee7f1
add rcx, 0x2e83802
xor rcx, 0xda62073
add rcx, 0x7fffffff
xor rcx, 0x660898
popf
pushf
mov eax, 0x144a74df
xor eax, 0x1fdb2df9
add eax, 0x13cdc5bf
sub eax, 0x1f5f1ee1
popf
cmovb r9d, r13d
mov dword [rsp - 0x20], esi
mul r9
cmovo rax, rcx
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call fcn.140091f90
mov dword [rsp - 0x14], esi
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 2
shr r15d, 0xb
shr r15d, 4
shr r15d, 1
shr r15d, 2
xchg r13, rax
mov rbp, r13
xchg r13, rax
mov eax, dword [rbx + 0x18]
xchg r11, r11
mov ebx, 0x4d2223cb
xor ebx, 0x392bdb22
xor ebx, 0x36b5bdb2
xor ebx, 0x3e574881
sub ebx, 0x7ceb0dd9
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov dword [rsp - 0x34], edx
test r15d, r15d
je 0x14007c1c4
mov eax, 0x5fc13c47
xor eax, 0x3195b16d
sub eax, 0x313551ab
xor eax, 0x5ee62d2
sub eax, 0x38e159ad
xchg r8, rcx
mov r8, qword [rsp + 0x60]
xchg rcx, r8
mov r14d, esi
shl r14d, 4
shl r14d, 0xc
shl r14d, 3
shl r14d, 1
mov edi, r13d
mov r12, r12
sub edi, r14d
xchg rdx, r12
mov r12, rbp
xchg r12, rdx
cmp edi, eax
xchg r14, r14
cmova edi, eax
mov r8d, edi
call fcn.14008b0a0
test al, al
mov dword [rsp - 0x24], ebx
je 0x14007c1c2
shr edi, 2
xor r8d, r8d
shr r14d, 2
mov r13, r13
test edi, edi
je 0x14007c191
mov r15d, dword [rsp + 0x70]
mov dword [rsp - 0x28], edx
mov r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
mov r8, r8
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x3db36469
lea r9, [r9 + 4]
mov dword [rsp - 0x14], 0x7dfa2e4
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14007c159
mov dword [rsp - 0x28], ebx
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x71affdb9
xor eax, 0x2f381db6
sub eax, 0x450bc475
add eax, 0x265848d4
sub eax, 0x3fd4646e
cmp esi, r15d
mov dword [rsp - 0x10], 0x2f5b2fb1
jb 0x14007c0ed
jmp 0x14007c1c4
xor bl, bl
xchg rcx, r9
mov r9, rbp
xchg r9, rcx
call fcn.140091fa0
mov dword [rsp - 0x1c], ebp
mov al, bl
xchg rbx, rbp
mov rbp, qword [rsp + 0x68]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
mov r11, r11
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14007cbd8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbp
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg r9, rsi
push rdi
xchg r9, r9
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push rax
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
mov dword [rsp - 0x1c], 0x6a7db688
mov r15, rcx
mov r14d, r8d
mov r9d, 0x62568cf9
sub r9d, 0x72d3d1b
add r9d, 0x1ad1459a
xor r9d, 0x64d21662
sub r9d, 0x1124831a
xchg rdx, r13
mov r12, r13
xchg r13, rdx
cmp r8d, r9d
mov dword [rsp - 0x40], 0x6f69f76c
pushf
movabs rcx, 0xffffffff7b56f8c6
sub rcx, 0x133dc6f
sub rcx, 0x690f9b89
add rcx, 0x7fffffff
add rcx, 0x6eec7f32
popf
pushf
mov eax, 0x5b792ec9
sub eax, 0x4fe37d18
xor eax, 0x36cf276f
xor eax, 0x3d5a96da
popf
cmovb r9d, r14d
mul r9
mov dword [rsp - 0x1c], 0x119163e4
cmovo rax, rcx
xchg rcx, r8
mov r8, rax
xchg r8, rcx
call fcn.140091f90
mov r13d, dword [r15 + 0x18]
xchg rbp, rbp
lea ebp, [r14 + 0xfffff]
shr ebp, 0x10
shr ebp, 2
shr ebp, 1
shr ebp, 1
xor edi, edi
mov r10, r10
xchg r8, rax
mov rsi, r8
xchg r8, rax
mov ebx, 0x61e659a4
sub ebx, 0x3fcaf4e7
add ebx, 0x25b1bb4c
sub ebx, 0x47cd2008
test ebp, ebp
xchg rcx, rcx
je 0x14007cde4
mov eax, 0x3651b610
add eax, 0x2e7e5cf
add eax, 0x46768535
sub eax, 0xe3f9c39
sub eax, 0x716084db
mov r9d, edi
mov r8d, r14d
shl r9d, 0xd
shl r9d, 5
shl r9d, 1
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x28], edi
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
xchg r15, r15
xor r10d, r10d
shr r11d, 2
test r11d, r11d
mov dword [rsp - 0x40], 0x59bbd5b0
je 0x14007cda1
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
lea ecx, [r9 + r10]
mov eax, r13d
xor eax, dword [r12 + rcx*4]
mov dword [rsp - 0x3c], edi
add r10d, ebx
xor eax, 0x3db36469
mov dword [rdx], eax
mov dword [rsp - 0x2c], 0x27154c6c
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14007cd70
mov r9, r9
mov rdx, rsi
mov rcx, r15
call fcn.14008b4d0
xchg r15, r15
test al, al
je 0x14007cde2
add edi, ebx
mov eax, 0x4b96a975
xor eax, 0x1c9e4f24
add eax, 0x5432289
sub eax, 0x5c3c08da
cmp edi, ebp
mov dword [rsp - 0xc], 0x10608786
jb 0x14007cd23
jmp 0x14007cde4
xor bl, bl
xchg rcx, rbp
mov rbp, rsi
xchg rcx, rbp
call fcn.140091fa0
mov dword [rsp - 0x38], 0x62c5b5d6
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xchg r12, r12
nop
sub rsp, 0x667befcb
add rsp, 0x667befeb
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
pop r12
mov dword [rsp - 0x20], 0x776389c9
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007dd70
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x44f46ddd
add rsp, 0x44f46dcd
mov dword [rsp + 0x20], 0x7b6f9fa3
sub dword [rsp + 0x20], 0x5de20765
xor dword [rsp + 0x20], 0x36146c8d
add dword [rsp + 0x20], 0xdb52a9f
mov r8, rcx
mov byte [rsp + 0x24], 0x21
xor byte [rsp + 0x24], 0x56
add byte [rsp + 0x24], 7
mov qword [rsp + 0x28], 0x1a9692a1
add qword [rsp + 0x28], 0x5559d6dd
sub qword [rsp + 0x28], 0x2a48b867
sub qword [rsp + 0x28], 0x45a7b117
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x772b5a8
xor edx, 0x755ed5b
add edx, 0x171dcfef
add edx, 0x18fcec90
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x14007dde8
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x27
xor byte [rsp + 7], 0x7c
sub byte [rsp + 7], 0x59
sub byte [rsp + 7], 2
popf
je 0x14007dea3
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x14007dea6
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007de96
movzx eax, byte [rcx]
test al, al
jne 0x14007de7a
jmp 0x14007dea6
inc r8
cmp byte [r8], 0
jne 0x14007de65
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x355c1bbb
add ecx, 0x322953bc
sub ecx, 0x5801b8c3
xor ecx, 0xf83b6b1
rep stosb byte [rdi], al
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x14007dee0
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x283602fe
sub rsp, 0x2836030e
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x14007e09a
mov dword [rsp + 0x28], 0x18bed19e
xor dword [rsp + 0x28], 0x2483d7b3
sub dword [rsp + 0x28], 0x2ede6db
mov byte [rsp + 0x2c], 0x5d
add byte [rsp + 0x2c], 9
add byte [rsp + 0x2c], 0x18
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x8c3ee08
xor edx, 0xcc1330d
add edx, 0x404b4684
xor edx, 0x740c36fb
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x14007df36
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x14007dfb7
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007e07f
movzx eax, byte [rcx]
test al, al
jne 0x14007df9f
mov word [rsp + 0x20], 0x5331
sub word [rsp + 0x20], 0x3ea5
xor word [rsp + 0x20], 0x1a57
add word [rsp + 0x20], 0x3934
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 0xa374832
xor edx, 0x63b7b5c8
sub edx, 0x393ee888
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 2
jb 0x14007dfe8
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x14007e064
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007e107
movzx eax, byte [rcx]
test al, al
jne 0x14007e04c
xor dl, dl
mov r8d, 0x7f8647e0
sub r8d, 0x604d3a61
xor r8d, 0x1f390d7c
jmp 0x14007e0a2
mov r8d, 0x4f00133d
xor r8d, 0x1ac592cd
add r8d, 0x11a4244
sub r8d, 0x56dfc433
mov dl, 0x42
xor dl, 0x5c
sub dl, 0x1d
test r8b, 2
je 0x14007e0c9
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x3e6e2a00
xor ecx, 0x74d69c2d
xor ecx, 0x4ab8b62f
rep stosb byte [rdi], al
test r8b, 1
je 0x14007e0f3
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x1c776dbd
add ecx, 0x1e1c616a
sub ecx, 0x321b0473
sub ecx, 0x878caaf
rep stosb byte [rdi], al
movzx eax, dl
nop
sub rsp, 0x16532042
add rsp, 0x16532052
pop rdi
ret
mov r8d, 0x6bfa646
xor r8d, 0x9ead750
xor r8d, 0x1c47a686
sub r8d, 0x1312d78d
jmp 0x14007e09a
Function at 0x14007ed40
Capabilities:
Encode data using xor

Disassembly:
push rdi
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
mov word [rsp + 0x20], 0x8dc
xor word [rsp + 0x20], 0x18e8
add word [rsp + 0x20], 0x5609
sub word [rsp + 0x20], 0x1e2e
mov r8, rcx
mov qword [rsp + 0x28], 0x37ee602b
xor qword [rsp + 0x28], 0x7d3e576
sub qword [rsp + 0x28], 0x303d855d
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x3751bc5
add edx, 0x548074cd
sub edx, 0x27b37b20
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007ed8d
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x6f
sub byte [rsp + 2], 0x16
sub byte [rsp + 2], 0x59
test al, al
je 0x14007ee12
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007ee48
movzx eax, byte [rcx]
test al, al
jne 0x14007edfb
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x668794c4
xor ecx, 0x382c8989
sub ecx, 0x5eab1d4b
rep stosb byte [rdi], al
test dl, dl
jne 0x14007ee58
mov byte [r8], al
lea rax, [r8 + 1]
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov dl, 0x67
sub dl, 0x17
add dl, 7
sub dl, 0x56
jmp 0x14007ee14
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x14007ef50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, r15
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
add rsp, 0x5a6ea839
sub rsp, 0x5a6ea859
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, r10
mov rdi, r10
xchg rdx, r10
xchg r11, rcx
mov rsi, r11
xchg r11, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140080950
sub rdi, qword [rbx + rsi + 0x30]
xchg rdx, rdx
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg r14, rax
mov r10, r14
xchg r14, rax
mov ebx, r14d
test ebp, ebp
xchg r12, r12
je 0x14007f10b
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
xchg r8, r8
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x28], edx
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
xchg rbx, rbx
jae 0x14007f045
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14007f00f
mov rdx, rdx
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14007f030
mov dword [rsp - 0x38], 0x22e58e05
add eax, r9d
cmp r11d, eax
jb 0x14007f0c2
inc r8w
mov rcx, rcx
sub rdx, 0xffffffffffffffd8
cmp r8w, cx
jb 0x14007effe
xchg r14, r8
mov r14, r8
xchg r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
xchg rdi, rdi
neg rax
sub rax, 0xfffffffffffffff8
neg rax
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
mov dword [rsp - 0x30], esi
test eax, eax
je 0x14007f0fd
mov edx, eax
xchg r11, r11
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
mov rsi, rsi
shr ecx, 8
shr ecx, 4
cmp ecx, 3
je 0x14007f0d8
mov dword [rsp - 0x28], esi
cmp ecx, 0xa
jne 0x14007f0e1
and eax, 0xfff
mov dword [rsp - 0x30], 0x4ea615c1
add qword [rax + r8], rdi
jmp 0x14007f0e1
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0xc], esp
sub r8, r9
add r8, rsi
add r8, r11
jmp 0x14007f04e
and eax, 0xfff
add dword [rax + r8], edi
nop
sub r10, 0x4bee0add
add r10, 0x4bee0adf
sub rdx, 1
xchg rbp, rbp
jne 0x14007f087
add ebx, dword [r9]
cmp ebx, ebp
jb 0x14007efcb
mov rcx, rcx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, r9
mov r9, qword [rsp + 0x40]
xchg r9, rsi
xchg rdx, rdi
mov rdx, qword [rsp + 0x48]
xchg rdi, rdx
nop
add rsp, 0xd991822
sub rsp, 0xd991802
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140080950
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rsp, rsp
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov dword [rsp - 0x34], edi
mov r10d, edx
xchg r9, rbx
mov r9, rcx
xchg rbx, r9
movzx eax, word [r8 + 0x14]
mov dword [rsp - 0x34], esi
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
cmp r9w, r11w
mov dword [rsp - 0xc], 0x5c3268cf
jae 0x1400809ee
nop dword [rax]
mov ecx, dword [rax + 8]
mov dword [rsp - 0x24], ebx
test ecx, ecx
jne 0x1400809b2
mov ecx, dword [rax + 0x10]
mov rcx, rcx
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x1400809d0
mov dword [rsp - 0x40], edi
add ecx, edx
cmp r10d, ecx
jb 0x1400809fc
mov r9, r9
inc r9w
nop
sub rax, 0x4b23ac45
add rax, 0x4b23ac6d
cmp r9w, r11w
jb 0x14008099d
xchg rdi, rdi
xor eax, eax
xchg rbx, r12
mov r12, qword [rsp + 8]
xchg r12, rbx
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
mov rdx, rdx
xchg rbx, r12
mov r12, qword [rsp + 8]
xchg rbx, r12
add rax, r10
mov dword [rsp - 0x1c], 0x95a84d9
ret