joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006db01
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x10], esi
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x20], 0x2a49721f
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov qword [rdx], rsi
xor edi, edi
xchg r9, r9
xchg rsi, r10
movups xmmword [r10], xmm0
xchg rsi, r10
xchg r14, r9
mov r9, r14
xchg r9, r14
mov rbp, r8
mov dword [rsp - 0x10], ebx
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rdx
mov rbx, rsi
xchg rdx, rsi
xchg rsi, r9
movups xmmword [r9 + 0x20], xmm0
xchg r9, rsi
mov qword [rdx + 0x38], rdi
mov dword [rsp - 0xc], ebx
mov rax, qword [rcx + 0x38]
cmp r8, rax
jae 0x14006dc19
sub rax, r8
mov dword [rsp - 0x34], edx
mov qword [rsp + 0x40], r15
cmp rax, r9
cmovb r14, rax
mov dword [rsp - 0x3c], esp
mov qword [rdx + 0x38], r14
mov rax, qword [rcx]
xchg rbx, rcx
mov rbx, qword [rdx]
xchg rbx, rcx
lea r15, [rax + r8*2]
mov dword [rsp - 0x40], ebx
cmp rcx, rsi
je 0x14006dabd
call fcn.1400bc0d0
xchg rcx, rcx
cmp r14, 0x18
jbe 0x14006dafb
lea rcx, [r14 + r14]
call fcn.1400bc380
mov dword [rsp - 0x28], 0x55b212d8
mov qword [rbx], rax
test rax, rax
jne 0x14006db0b
xchg rsi, r14
mov qword [rbx], r14
xchg rsi, r14
xchg r9, rbp
mov rbp, rdi
xchg rbp, r9
jmp 0x14006db2c
xchg r12, rsi
mov qword [rbx], r12
xchg r12, rsi
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xorps xmm0, xmm0
mov dword [rsp - 0x2c], 0x132f19e9
movups xmmword [rax], xmm0
xchg r8, rax
movups xmmword [r8 + 0x10], xmm0
xchg r8, rax
movups xmmword [rax + 0x20], xmm0
mov r9, qword [rbx]
xchg r12, r12
and ebp, 3
mov r8d, 0x99db0a8
xor r8d, 0x7884dc07
sub r8d, 0x3d5c3269
add r8d, 0x36387494
sub r8d, 0x1ce258e8
shl ebp, 1
shl ebp, 2
mov edx, r8d
mov r10, r10
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x14006dbdb
xchg rbp, rbp
sub r15, r9
mov ecx, 0xde1fe36
sub ecx, 0x7a6e239
add ecx, 0x36330366
sub ecx, 0xeb120bc
sub ecx, 0x2dbcfda8
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
xchg rsi, rsi
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 1
ror edx, 2
ror edx, 2
ror edx, 3
and ax, cx
xchg r13, r13
ror r8d, 8
xor ax, word [r15 + r9 - 2]
inc rdi
mov word [r9 - 2], ax
mov dword [rsp - 0x2c], ecx
cmp rdi, qword [rbx + 0x38]
jb 0x14006db9c
mov r15, qword [rsp + 0x40]
mov dword [rsp - 0x30], ecx
xchg r8, rbx
mov rax, r8
xchg r8, rbx
xchg rbx, rcx
mov rcx, qword [rsp + 0x48]
xchg rbx, rcx
mov rbp, qword [rsp + 0x50]
mov r8, r8
sub rsp, 0xffffffffffffffe0
nop
mov r14, qword [rsp]
add rsp, 8
pop rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x14006dbed
Function at 0x140071250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
xchg r11, r11
push rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0xb0
mov r14d, edx
xchg r10, r10
xchg rsi, r9
mov r9, rcx
xchg rsi, r9
mov rdx, r9
mov dword [rsp - 0x28], 0x38a33d5e
lea rcx, [rsp + 0x20]
mov ebp, r8d
call fcn.140034230
mov dword [rsp - 0x2c], 0x3fb26578
mov rax, qword [rsp + 0xa8]
mov edi, 0x4f263708
add edi, 0x1777cd4
sub edi, 0x1a3809ca
xor edi, 0x3665d5ed
cmp rax, rdi
jbe 0x1400712e0
mov ecx, edi
xchg r10, r10
call fcn.1400bbf80
xchg r15, rbx
mov r15, rax
xchg r15, rbx
xor edx, edx
jmp 0x140071306
xchg rcx, r9
mov r9, rax
xchg r9, rcx
mov rdi, rax
call fcn.1400bbf80
xchg r8, r8
xor edx, edx
mov rbx, rax
test rdi, rdi
mov dword [rsp - 0x1c], ebx
je 0x140071327
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + rdx]
xor cl, 0x37
xchg r9, r9
mov byte [rdx + rbx], cl
inc rdx
cmp rdx, rdi
mov r11, r11
jb 0x140071306
mov r8d, ebp
mov edx, r14d
xchg r10, r10
xchg rcx, r11
mov r11, rsi
xchg rcx, r11
call fcn.14006ecc0
mov rsp, rsp
xchg rbx, r8
mov qword [rax + 8], r8
xchg r8, rbx
mov byte [rax + 4], 0x31
add byte [rax + 4], 0x40
sub byte [rax + 4], 0x66
sub byte [rax + 4], 7
mov word [rax + 5], di
mov dword [rsp - 0x20], 0x5c964c36
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov byte [rsi + 8], 0x68
xor byte [rsi + 8], 0x67
xor byte [rsi + 8], 0x47
sub byte [rsi + 8], 0x47
cmp rcx, rax
jne 0x1400713b9
mov dword [rsp - 0x10], esi
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x4831a1cb
sub ecx, 0x413a7fab
sub ecx, 0x3902875
add ecx, 0x129ae28e
xor ecx, 0x1601dcb9
rep stosb byte [rdi], al
jmp 0x1400713be
call fcn.1400bc0d0
lea r11, [rsp + 0xb0]
xchg rbx, r10
mov r10, qword [r11 + 0x28]
xchg r10, rbx
mov rbp, qword [r11 + 0x30]
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x140094dc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae096
xchg rcx, r12
mov r10, r12
xchg r12, rcx
mov eax, dword [0x1404e0f90]
mov dword [rsp - 0x18], edx
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140094de0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
xchg rsi, rsi
jmp 0x1400ae6ec
xchg rcx, r8
mov r10, r8
xchg rcx, r8
mov eax, dword [0x1404e1028]
mov dword [rsp - 0x40], ebx
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov dword [rsp - 0xc], 0x1a29a9e8
ret

Function at 0x140094e00
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ade7d
xchg r10, rdi
mov rdi, rcx
xchg rdi, r10
mov eax, dword [0x1404e0f60]
cmp qword [0x1404e1078], 0
xchg r12, r12
jne 0x1400ade00
syscall
ret

Function at 0x140094e10
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae43b
mov r10, rcx
mov eax, dword [0x1404e0fe8]
xchg r12, r12
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140094e20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae2ed
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e0fc8]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
xchg rsi, rsi
syscall
ret

Function at 0x140094e30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adeda
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e0f68]
mov dword [rsp - 0x14], 0x6e36beeb
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
xchg rsp, rsp
ret

Function at 0x140094e40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae56c
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e1004]
cmp qword [0x1404e1078], 0
mov r13, r13
jne 0x1400ade00
syscall
ret

Function at 0x140094e50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae595
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e1008]
mov dword [rsp - 0x40], ebp
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
xchg rsi, rsi
ret

Function at 0x140094e60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae4be
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0ff4]
mov dword [rsp - 0x34], 0x2fd2b8e
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140094e70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae4ec
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404e0ff8]
xchg r12, r12
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov dword [rsp - 0x24], edi
ret

Function at 0x140094e80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae0c0
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0f94]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x20], edi
jne 0x1400ade00
syscall
ret

Function at 0x140094ea0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae3e9
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0fe0]
cmp qword [0x1404e1078], 0
xchg r8, r8
jne 0x1400ade00
syscall
ret

Function at 0x140094eb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adeaa
xchg rdi, rcx
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1404e0f64]
mov rdi, rdi
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
xchg rsp, rsp
ret
Function at 0x140094ec0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae45e
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0fec]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x2c], 0x7c1d59a1
jne 0x1400ade00
syscall
ret

Function at 0x140094ed0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae29b
xchg r9, rcx
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1404e0fc0]
xchg r14, r14
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140094ee0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae2c4
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0fc4]
xchg rbp, rbp
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140094ef0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae141
xchg rsp, rcx
mov r10, rsp
xchg rcx, rsp
mov eax, dword [0x1404e0fa0]
mov dword [rsp - 0x30], ecx
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov dword [rsp - 0xc], 0x3da94394
ret

Function at 0x140094f00
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
mov dword [rsp - 0x24], 0x5f1ebf9b
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x1400ae6bb
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e1024]
mov dword [rsp - 0x44], 0x3f0f3f46
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov r8, r8
ret

Function at 0x140094f20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adfbc
xchg r10, r14
mov r14, rcx
xchg r14, r10
mov eax, dword [0x1404e0f7c]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
mov dword [rsp - 0xc], 0x577b1788
syscall
ret

Function at 0x140094f30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adfea
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0f80]
cmp qword [0x1404e1078], 0
xchg rcx, rcx
jne 0x1400ade00
syscall
ret

Function at 0x140094f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae013
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e0f84]
cmp qword [0x1404e1078], 0
xchg rsp, rsp
jne 0x1400ade00
syscall
ret

Function at 0x140094f50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae03c
mov r10, rcx
mov dword [rsp - 0x34], edx
mov eax, dword [0x1404e0f88]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
mov dword [rsp - 0x14], 0xc65cdae
syscall
ret

Function at 0x140094f60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf8e
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e0f78]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x20], 0x200700b7
jne 0x1400ade00
syscall
ret

Function at 0x140094f70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae519
xchg r10, rsi
mov rsi, rcx
xchg r10, rsi
mov eax, dword [0x1404e0ffc]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
mov r8, r8
syscall
ret

Function at 0x140094f80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae068
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e0f8c]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x10], 0xcc50845
jne 0x1400ade00
syscall
ret
Function at 0x140094f90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf0b
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0f6c]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x2c], 0x5148c6cc
jne 0x1400ade00
syscall
ret

Function at 0x140094fa0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae0ea
xchg r10, rbx
mov rbx, rcx
xchg r10, rbx
mov eax, dword [0x1404e0f98]
cmp qword [0x1404e1078], 0
xchg r8, r8
jne 0x1400ade00
syscall
ret

Function at 0x140094fd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae71e
neg rsp
sub rsp, 0xfffffffffffffee0
neg rsp
lea rcx, [0x1400ade70]
push rcx
nop
push 0x1b48220e
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
push 0x53fefffd
mov qword [rsp], rdi
push qword [0x1404e1080]
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov rcx, rcx
mov ecx, 0xc2c0cbf
xor ecx, 0x355c19e3
add ecx, 0x1ef451d7
sub ecx, 0x58646723
rep movsq qword [rdi], qword [rsi]
mov dword [rsp - 0xc], 0x61b16c03
jmp qword [0x1404e1078]
xchg r10, r12
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404e102c]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x40], 0x4a1e68e5
jne 0x1400ade00
syscall
ret

Function at 0x140094fe0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf62
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e0f74]
xchg rcx, rcx
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov r13, r13
ret

Function at 0x140094ff0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae692
xchg r10, r12
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404e1020]
cmp qword [0x1404e1078], 0
xchg r15, r15
jne 0x1400ade00
syscall
ret

Function at 0x140095000
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae542
xchg rcx, r13
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404e1000]
mov dword [rsp - 0x38], esp
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140095010
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae63f
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e1018]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
mov dword [rsp - 0x2c], ebp
syscall
ret

Function at 0x140095020
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae412
xchg rcx, r15
mov r10, r15
xchg rcx, r15
mov eax, dword [0x1404e0fe4]
mov rcx, rcx
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140095030
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae669
xchg r8, r10
mov r8, rcx
xchg r10, r8
mov eax, dword [0x1404e101c]
cmp qword [0x1404e1078], 0
jne 0x1400ade00
xchg r10, r10
syscall
ret

Function at 0x140095040
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf39
xchg r10, r12
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1404e0f70]
xchg rbp, rbp
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
ret

Function at 0x140095050
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae113
xchg r9, rcx
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1404e0f9c]
cmp qword [0x1404e1078], 0
mov dword [rsp - 0x2c], 0x64b0ca48
jne 0x1400ade00
syscall
ret
Function at 0x140095060
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rbp, r13
mov qword [rsp + 0x10], r13
xchg r13, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x38], 0x18b6d889
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
push r14
nop
sub rsp, 0x1e2e6ae1
add rsp, 0x1e2e6ac1
movsxd rbx, dword [rcx + 0x3c]
mov r9, r9
xchg rdi, r13
mov r13, rdx
xchg rdi, r13
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
xchg rsi, rsi
call fcn.140096e00
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov rdi, rdi
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
mov rbp, rbp
je 0x140095236
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg r15, r15
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov r13, r13
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov rdx, rdx
jae 0x140095166
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14009512e
xchg rsi, rsi
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14009514e
xchg rbp, rbp
add eax, r9d
cmp r11d, eax
jb 0x1400951e3
mov dword [rsp - 0xc], esi
inc r8w
neg rdx
add rdx, 0xffffffffffffffd8
neg rdx
cmp r8w, cx
jb 0x14009511d
xchg rsp, r14
mov r8, rsp
xchg rsp, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
add rax, 0xfffffffffffffff8
xchg r13, r13
nop
add r10, 0x36cfe312
sub r10, 0x36cfe30a
shr rax, 1
mov dword [rsp - 0x20], esp
test eax, eax
je 0x140095227
mov edx, eax
nop word [rax + rax]
mov rcx, rcx
movzx eax, word [r10]
mov ecx, eax
shr ecx, 4
shr ecx, 1
shr ecx, 1
shr ecx, 2
shr ecx, 3
shr ecx, 1
cmp ecx, 3
mov r12, r12
je 0x1400951f9
cmp ecx, 0xa
jne 0x140095206
and eax, 0xfff
mov dword [rsp - 0x1c], ebx
add qword [rax + r8], rdi
jmp 0x140095206
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x2c], ebp
add r8, r11
jmp 0x14009516f
and eax, 0xfff
mov dword [rsp - 0x10], edi
add dword [rax + r8], edi
nop
add r10, 0x5360de13
sub r10, 0x5360de11
sub rdx, 1
mov dword [rsp - 0x38], 0x440ac91f
jne 0x1400951a7
add ebx, dword [r9]
cmp ebx, ebp
mov dword [rsp - 0x14], ecx
jb 0x1400950eb
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rcx, rsi
mov rcx, qword [rsp + 0x40]
xchg rsi, rcx
mov rdi, qword [rsp + 0x48]
xchg r11, r11
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140096e00
Capabilities:
Enumerate pe sections

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
movsxd r8, dword [rcx + 0x3c]
mov dword [rsp - 0x20], 0x2fa25642
xor r9d, r9d
add r8, rcx
mov r10d, edx
mov rbx, rcx
mov dword [rsp - 0x2c], ebp
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
mov dword [rsp - 0xc], 0x7eff3f07
add rax, r8
cmp r9w, r11w
jae 0x140096ea8
nop dword [rax]
mov dword [rsp - 0x18], 0x48517cb3
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x140096e6c
mov ecx, dword [rax + 0x10]
mov dword [rsp - 0x34], 0x98e8daf
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x140096e93
mov dword [rsp - 0x14], 0x34527b1
add ecx, edx
cmp r10d, ecx
jb 0x140096eb6
mov dword [rsp - 0x30], 0x18d7493
inc r9w
add rax, 0x28
cmp r9w, r11w
xchg rdx, rdx
jb 0x140096e56
xor eax, eax
xchg rbx, r10
mov r10, qword [rsp + 8]
xchg r10, rbx
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
xchg rsi, rsi
mov rbx, qword [rsp + 8]
add rax, r10
ret
Function at 0x140096ed0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg r15, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov dword [rsp - 0x1c], 0x5d1bece0
push r11
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
movzx eax, word [rcx]
mov r15d, edx
mov r12, r12
xor eax, 0x734237da
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
cmp eax, 0x73426d97
mov dword [rsp - 0x10], 0x15d5924d
jne 0x140097087
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov rbp, rbp
xor eax, 0x734237da
cmp eax, 0x7342728a
jne 0x140097087
mov edx, dword [rdx + rcx + 0x88]
mov rsp, rsp
call fcn.140096e00
xchg r13, rsi
mov rcx, r13
xchg r13, rsi
xchg rdi, rax
mov r14, rdi
xchg rdi, rax
mov edx, dword [rax + 0x20]
call fcn.140096e00
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0xc], 0x1cf81a96
xchg rsp, rsi
mov rcx, rsp
xchg rsi, rsp
mov r12, rax
xchg r11, r11
call fcn.140096e00
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r8, r13
mov r8, rax
xchg r8, r13
call fcn.140096e00
mov dword [rsp - 0x24], 0x3ac05c90
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140097087
mov dword [rsp - 0x20], 0x6fbb8fa
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140096e00
mov r15, r15
mov ecx, 0x1480bed4
add ecx, 0x3bad7fee
xor ecx, 0x5943d7c1
add ecx, 0xf69216fc
xchg rsp, rax
mov rbx, rsp
xchg rsp, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
je 0x14009706a
xchg r8, r8
nop dword [rax]
xchg r10, rdx
mov r10, rbx
xchg r10, rdx
lea rcx, [rsp + 0x60]
mov r8d, 0x79c88fe7
xor r8d, 0x4b14b816
add r8d, 0x101b0b7b
sub r8d, 0xdadeea
sub r8d, 0x421c6481
inc rbx
mov r8, r8
call fcn.1400a07b0
cmp byte [rbx], 0
jne 0x14009701f
mov ecx, dword [rsp + 0x60]
xchg r11, r11
not ecx
cmp ecx, r15d
je 0x1400970c9
xchg rdi, rdi
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140096fdf
xchg r11, r11
xor eax, eax
xchg rbx, r11
mov r11, qword [rsp + 0x68]
xchg r11, rbx
add rsp, 0x20
mov dword [rsp - 0x24], 0xbe8e28d
pop r15
pop r14
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x30], edx
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0xc], 0x528b9086
xchg r15, rsi
mov rcx, r15
xchg rsi, r15
mov rax, qword [rsp + 0x70]
xchg rdx, rdx
mov edx, dword [rax + rdx*4]
call fcn.140096e00
jmp 0x140097089
Function at 0x140097100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x4227bf55
sub rsp, 0x4227bf75
movzx eax, word [rcx]
xchg rbp, rbp
mov edi, edx
xor eax, 0x734237da
mov rbx, rcx
cmp eax, 0x73426d97
mov rdi, rdi
jne 0x1400971c9
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x734237da
xchg r12, r12
cmp eax, 0x7342728a
jne 0x1400971c9
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x44], ebx
call fcn.140096e00
sub edi, dword [rax + 0x10]
cmp edi, dword [rax + 0x14]
jae 0x1400971c9
mov dword [rsp - 0x40], 0x2b16e2d0
mov edx, dword [rax + 0x1c]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.140096e00
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
mov edx, dword [rax + rdi*4]
xchg r8, r8
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
nop
sub rsp, 0x31538f43
add rsp, 0x31538f63
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.140096e00
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xor eax, eax
mov dword [rsp - 0x30], 0x7784d10b
nop
add rsp, 0x5c2a4df8
sub rsp, 0x5c2a4dd8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14009b325
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg rbx, r15
mov r15, qword [rcx]
xchg r15, rbx
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov r8, r8
mov qword [rsp + 0x70], rsi
xchg rsi, rbp
mov rbp, qword [rcx + 0x38]
xchg rbp, rsi
lea rcx, [rsp + 0x20]
xchg rdi, rax
mov qword [rsp + 0x20], rdi
xchg rdi, rax
xchg rbp, rsp
movups xmmword [rbp + 0x28], xmm0
xchg rsp, rbp
lea rdx, [rsi + 1]
mov r10, r10
xchg rbx, rsp
movups xmmword [rbx + 0x38], xmm0
xchg rsp, rbx
xchg rsp, r11
movups xmmword [r11 + 0x48], xmm0
xchg r11, rsp
call fcn.140018ab0
mov edx, 0x5e7b15d
add edx, 0x4554a4bb
add edx, 0x26a2a9e8
sub edx, 0x15274448
sub edx, 0xfa465c6
test rsi, rsi
je 0x14009b40c
mov rdi, rax
mov dword [rsp - 0x1c], ebp
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg rsi, r8
mov r9d, 0x2812fad1
sub r9d, 0x14aa2ca4
xor r9d, 0x865defa
xor r9d, 0x200fe5f0
sub r9d, 0x3b02f428
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x40], ebx
and cx, r9w
ror edx, 8
xor cx, word [rbx + rdi - 2]
xchg r8, r8
mov word [rdi - 2], cx
sub r8, 1
jne 0x14009b3e4
xor ecx, ecx
xchg r8, r8
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.14009b4c0
mov dword [rsp - 0x34], 0x7266edf5
xchg rcx, r10
mov r10, qword [rsp + 0x20]
xchg r10, rcx
mov ebx, eax
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov rdx, rdx
cmp rcx, rax
jne 0x14009b48c
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x40], 0xa1683d9
mov ecx, 0x2566e7d8
xor ecx, 0x4289f4aa
sub ecx, 0x636c1f0e
sub ecx, 0x482f434
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x78]
xchg r15, r15
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x14], edx
ret
call fcn.1400bc0d0
mov eax, ebx
xchg rbp, rbx
mov rbp, qword [rsp + 0x78]
xchg rbx, rbp
nop
add rsp, 0x74fecdac
sub rsp, 0x74fecd4c
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret