joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a370
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg rbx, r14
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg r9, rsp
mov rbp, r9
xchg rsp, r9
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
movabs rbx, 0x1f3d0b5f70a82347
sub rbx, 0x2c8592bb
xor rbx, 0x4562eac9
add rbx, 0x536c924e
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x30], rbx
jne 0x14006a59b
xor esi, esi
xchg rdx, rdx
mov dword [rbp - 0x40], 0x35747714
add dword [rbp - 0x40], 0x137520e1
xor dword [rbp - 0x40], 0x7ffd425d
sub dword [rbp - 0x40], 0x233ae356
sub dword [rbp - 0x40], 0x1382f1a8
mov dword [rbp - 0x3c], 0x490922e1
sub dword [rbp - 0x3c], 0xc040d1a
add dword [rbp - 0x3c], 0x1078bf31
xor dword [rbp - 0x3c], 0x4d06d451
mov dword [rbp - 0x38], 0x75f7cf0
add dword [rbp - 0x38], 0x5c153e88
xor dword [rbp - 0x38], 0x1f2530b4
sub dword [rbp - 0x38], 0x7b2768a1
sub dword [rbp - 0x38], 0xd02290
mov dword [rbp - 0x34], 0x60464452
sub dword [rbp - 0x34], 0xe0f3c6b
xor dword [rbp - 0x34], 0x69b9dae4
sub dword [rbp - 0x34], 0x195757bb
xor dword [rbp - 0x34], 0x221f85a4
mov dword [rbp - 0x30], 0x1e2e26b6
add dword [rbp - 0x30], 0x2366ac6c
add dword [rbp - 0x30], 0x32d63b00
xor dword [rbp - 0x30], 0x29343d2c
sub dword [rbp - 0x30], 0x5d083249
mov dword [rbp - 0x2c], 0x648deb29
sub dword [rbp - 0x2c], 0x30eadda9
xor dword [rbp - 0x2c], 0x76f60878
sub dword [rbp - 0x2c], 0x43e0b582
xor dword [rbp - 0x2c], 0x10250c5
xchg rbx, rsi
mov qword [rbp + 0x10], rbx
xchg rsi, rbx
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
mov rcx, qword [rbp + 0x10]
xchg r10, r10
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x40]
xchg rbp, rbp
mov eax, 0x1aa9b327
add eax, 0x433d11db
sub eax, 0x2d382175
sub eax, 0x15cf6fa2
shr eax, cl
movzx ecx, al
xchg rsp, rsp
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
xor cx, dx
xchg rbp, rbp
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg r13, rax
mov qword [rbp + 0x10], r13
xchg r13, rax
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 0xc
jb 0x14006a4b5
mov dword [rsp - 0x14], 0x530a4a7e
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
call fcn.14008b800
mov r8, r8
mov rdx, rax
xchg rdx, r8
mov rdx, rax
xchg r8, rdx
xor eax, eax
xor rdx, rbx
mov r12, r12
xchg r8, rdx
mov qword [rdi + 0x30], r8
xchg rdx, r8
lea rdi, [rbp - 0x28]
xchg rdi, rdi
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
cmp rdx, rbx
xchg rcx, rcx
je 0x14006a5a3
lea rdx, [0x1401412c0]
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.14006e8c0
test al, al
mov dword [rsp - 0x10], 0x2f136390
setne al
jmp 0x14006a5a3
mov al, 0x48
add al, 0x28
sub al, 0x4a
xor al, 0x27
lea r11, [rsp + 0x60]
mov dword [rsp - 0x38], esp
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
xchg rcx, r11
mov rsp, rcx
xchg r11, rcx
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14006a5cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x2c], 0xc654902
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg r11, rdi
push rbp
xchg rsp, rbp
mov rsp, rbp
xchg rsp, rbp
sub rsp, 0x50
mov r12, r12
movabs rbx, 0x1f3d0b5f0354b73a
add rbx, 0x41440f43
sub rbx, 0x3f667559
add rbx, 0x4f7abb6f
mov rdi, rcx
mov dword [rsp - 0x18], 0x1702564f
cmp qword [rcx + 0x28], rbx
jne 0x14006a7db
mov eax, 0x5d0b84c6
add eax, 0x1afd5385
sub eax, 0x30d3a55
xor eax, 0x75220988
xor eax, 0x1d994f9
mov dword [rbp - 0x30], 0x428369b
add dword [rbp - 0x30], 0x6674f2e5
add dword [rbp - 0x30], 0xcd33772
sub dword [rbp - 0x30], 0x597fe991
xor dword [rbp - 0x30], 0x1daf77c5
mov word [rbp - 0x20], ax
mov dword [rsp - 0x3c], ebx
xor esi, esi
mov dword [rbp - 0x2c], 0x2db0ff16
add dword [rbp - 0x2c], 0x4cfbd1cc
sub dword [rbp - 0x2c], 0x1ee9d17b
sub dword [rbp - 0x2c], 0x223005de
sub dword [rbp - 0x2c], 0x3969f8cf
mov dword [rbp - 0x28], 0x3da3d87a
xor dword [rbp - 0x28], 0x26ababe6
add dword [rbp - 0x28], 0x60402964
xor dword [rbp - 0x28], 0x1bf5512c
xor dword [rbp - 0x28], 0x60a0ccf5
mov dword [rbp - 0x24], 0x388d54fe
xor dword [rbp - 0x24], 0xe0472ac
xor dword [rbp - 0x24], 0x135c9d9b
xor dword [rbp - 0x24], 0x25a3bb72
xchg rsi, r13
mov qword [rbp + 0x10], r13
xchg r13, rsi
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
mov rcx, qword [rbp + 0x10]
mov r13, r13
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
and cl, 3
mov dword [rsp - 0xc], 0x17160045
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x6f548c7f
add eax, 0x4cfa752
sub eax, 0x1a9dd3a5
xor eax, 0x435953c7
shr eax, cl
mov dword [rsp - 0xc], 0x6958a647
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
xchg rdi, rdi
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
inc rax
mov dword [rsp - 0x1c], 0x6e06e3b6
xchg r9, rax
mov qword [rbp + 0x10], r9
xchg r9, rax
mov rax, qword [rbp + 0x10]
xchg rdx, rdx
cmp rax, 9
jb 0x14006a6e8
xor edx, edx
mov word [rbp - 0xc], si
mov dword [rsp - 0xc], ebx
lea rcx, [rbp - 0x1e]
call fcn.14008b800
xchg r8, rax
mov rdx, r8
xchg r8, rax
xchg rsi, rax
mov r8, rsi
xchg rsi, rax
xor eax, eax
mov rdx, rdx
xor rdx, rbx
xchg r14, rdx
mov qword [rdi + 0x28], r14
xchg rdx, r14
lea rdi, [rbp - 0x1e]
mov dword [rsp - 0x44], 0x224795d2
lea ecx, [rax + 9]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006a7e5
mov r14, r14
lea rdx, [0x140141810]
xchg r8, rsi
mov rcx, rsi
xchg rsi, r8
call fcn.1400729b8
test al, al
xchg rbp, rbp
setne al
jmp 0x14006a7e5
mov al, 0x50
sub al, 0x20
add al, 0x31
xor al, 0x3b
sub al, 0x59
xchg rbx, r15
mov r15, qword [rsp + 0x68]
xchg rbx, r15
xchg r12, rsi
mov r12, qword [rsp + 0x70]
xchg r12, rsi
mov rdi, qword [rsp + 0x78]
mov rbp, rbp
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14006a818
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rdi
mov qword [rsp + 0x18], rsi
xchg r9, rdi
mov qword [rsp + 0x20], r9
xchg r9, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rbp, rbx
mov rbx, rsp
xchg rbp, rbx
nop
add rsp, 0x55f5e6a
sub rsp, 0x55f5eba
movabs rbx, 0x1f3d0b5f00bfa8fe
add rbx, 0x595d77b8
sub rbx, 0x66ad918
xor rbx, 0x659b332a
add rbx, 0x1e8397df
mov rdi, rcx
cmp qword [rcx + 0x38], rbx
xchg r13, r13
jne 0x14006aa24
xor esi, esi
mov dword [rbp - 0x30], 0xef39a02
add dword [rbp - 0x30], 0x689e0c7c
sub dword [rbp - 0x30], 0x5fea4fec
sub dword [rbp - 0x30], 0x6a7c3d9
xor dword [rbp - 0x30], 0x10bc9200
mov dword [rbp - 0x2c], 0x5595309f
sub dword [rbp - 0x2c], 0x3496601b
add dword [rbp - 0x2c], 0x509c2fb4
sub dword [rbp - 0x2c], 0x43b8cc0c
xor dword [rbp - 0x2c], 0x2d8a3490
mov dword [rbp - 0x28], 0x5a96e1c4
xor dword [rbp - 0x28], 0x2c79247
sub dword [rbp - 0x28], 0x20f696c5
xor dword [rbp - 0x28], 0x375ddc21
mov dword [rbp - 0x24], 0x2b75eb1a
add dword [rbp - 0x24], 0xa27578
xor dword [rbp - 0x24], 0x24abb197
sub dword [rbp - 0x24], 0x835d014
mov dword [rbp - 0x20], 0x51c5b4d7
sub dword [rbp - 0x20], 0x270d4d2
sub dword [rbp - 0x20], 0x26b157af
xor dword [rbp - 0x20], 0x446905b7
sub dword [rbp - 0x20], 0x6c6b8d5a
mov qword [rbp + 0x10], rsi
mov dword [rsp - 0x10], esi
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
xchg rdx, rcx
mov rdx, qword [rbp + 0x10]
xchg rdx, rcx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov rdx, rdx
mov eax, 0x57ddee65
add eax, 0x10b69742
sub eax, 0x22db890f
sub eax, 0x2ad9c8ad
shr eax, cl
movzx ecx, al
mov rdi, rdi
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov dword [rsp - 0x24], ebp
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
inc rax
mov dword [rsp - 0x14], edx
xchg r9, rax
mov qword [rbp + 0x10], r9
xchg r9, rax
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x10], 0x72e59380
cmp rax, 0xa
jb 0x14006a93a
xor edx, edx
mov word [rbp - 8], si
xchg r12, r12
lea rcx, [rbp - 0x1c]
call fcn.14008b800
mov rdx, rax
xchg rbp, r8
mov rbp, rax
xchg r8, rbp
xor eax, eax
mov rdi, rdi
xor rdx, rbx
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov dword [rsp - 0x1c], 0x688b13f8
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006aa2c
lea rdx, [0x140141830]
mov dword [rsp - 0xc], 0x502ee908
xchg rdi, rcx
mov rdi, r8
xchg rcx, rdi
call fcn.140072d38
test al, al
setne al
xchg rcx, rcx
jmp 0x14006aa2c
mov al, 0x42
xor al, 0x5c
add al, 0xd
sub al, 0x2a
xchg rbx, rdx
mov rdx, qword [rsp + 0x68]
xchg rdx, rbx
xchg rcx, rsi
mov rcx, qword [rsp + 0x70]
xchg rcx, rsi
xchg rdi, rbp
mov rbp, qword [rsp + 0x78]
xchg rbp, rdi
sub rsp, 0xffffffffffffffb0
pop rbp
mov r12, r12
ret
Function at 0x14006aa58
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
xchg rcx, rsi
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x10], 0xd61e33b
nop
push 0x6343de72
mov qword [rsp], rbp
xchg rsp, rdx
mov rbp, rdx
xchg rdx, rsp
add rsp, 0xffffffffffffffb0
movabs rbx, 0x1f3d0b5f435db039
add rbx, 0x22bde6de
xor rbx, 0x1a024654
sub rbx, 0x2afd370e
add rbx, 0x390725e
xchg r8, rcx
mov rdi, r8
xchg r8, rcx
cmp qword [rcx + 0x20], rbx
xchg r8, r8
jne 0x14006ac82
mov eax, 0x234ec927
sub eax, 0xd0dc72e
sub eax, 0x1340c0c4
add eax, 0x7095c52f
sub eax, 0x739605b1
mov dword [rbp - 0x30], 0x10cdab6
xor dword [rbp - 0x30], 0x1a1fef62
xor dword [rbp - 0x30], 0x415beb8f
xor dword [rbp - 0x30], 0x5a13dee3
mov word [rbp - 0x1c], ax
xor esi, esi
mov dword [rbp - 0x2c], 0x144a20d7
add dword [rbp - 0x2c], 0x449e86c3
sub dword [rbp - 0x2c], 0x26ceab2f
add dword [rbp - 0x2c], 0x346c3a30
sub dword [rbp - 0x2c], 0x661035e1
mov dword [rbp - 0x28], 0x2ab86901
sub dword [rbp - 0x28], 0x1ffb6961
xor dword [rbp - 0x28], 0x5a245e29
sub dword [rbp - 0x28], 0x5098a102
mov dword [rbp - 0x24], 0x70d61299
xor dword [rbp - 0x24], 0x7a556616
xor dword [rbp - 0x24], 0x5af7df45
sub dword [rbp - 0x24], 0x5040aadd
mov dword [rbp - 0x20], 0x3bb54fd1
add dword [rbp - 0x20], 0x3852a244
xor dword [rbp - 0x20], 0x302abc6c
sub dword [rbp - 0x20], 0x43ce4dea
mov qword [rbp + 0x10], rsi
mov r11, r11
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
mov rcx, qword [rbp + 0x10]
mov rbp, rbp
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x10], 0x5b242fdf
mov eax, 0x2326f0f0
add eax, 0x3e921204
xor eax, 0x8cbc935
add eax, 0xa5f507c
sub eax, 0x58f2e852
shr eax, cl
movzx ecx, al
xchg rsi, rsi
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov r11, r11
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
inc rax
mov dword [rsp - 0x2c], 0x1b976e9a
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
jb 0x14006ab8f
mov rdi, rdi
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.14008b800
mov dword [rsp - 0xc], esi
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg rdi, r8
mov rdi, rax
xchg rdi, r8
xor eax, eax
xchg r12, r12
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
xchg rdi, rdi
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x14006ac8c
mov dword [rsp - 0x44], 0x4914cb9e
lea rdx, [0x140141298]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.140073168
mov dword [rsp - 0x24], esp
test al, al
setne al
jmp 0x14006ac8c
mov al, 0x4f
sub al, 0x1f
add al, 0x1c
xor al, 0x7f
xor al, 0x32
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov dword [rsp - 0x3c], ebx
xchg rdi, r8
mov r8, qword [rsp + 0x78]
xchg r8, rdi
nop
add rsp, 0x1d24bd88
sub rsp, 0x1d24bd38
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140074ace
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
nop
sub rsp, 0x7b219dbd
add rsp, 0x7b219d5d
lea rax, [rcx + 8]
mov dword [rsp - 0x10], ebp
xchg rbx, r14
mov qword [rsp + 0x70], r14
xchg rbx, r14
mov qword [rcx], rax
mov rsp, rsp
xorps xmm0, xmm0
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
mov rsi, rcx
xchg r13, rbp
mov qword [rsp + 0x78], r13
xchg rbp, r13
xchg r11, rax
movups xmmword [r11 + 0x10], xmm0
xchg r11, rax
lea rcx, [rsp + 0x20]
xchg r8, r8
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
mov dword [rsp - 0x14], edx
xchg r11, rax
movups xmmword [r11 + 0x50], xmm0
xchg r11, rax
movups xmmword [rax + 0x60], xmm0
xchg r10, r10
xchg rdi, rax
movups xmmword [rdi + 0x70], xmm0
xchg rdi, rax
xchg rbp, r12
mov r12, qword [rdx + 0x38]
xchg rbp, r12
lea rax, [rsp + 0x28]
mov rdx, rdx
xchg r12, rbx
mov r12, qword [rdx]
xchg rbx, r12
xchg r9, rax
mov qword [rsp + 0x20], r9
xchg r9, rax
xchg r13, rsp
movups xmmword [r13 + 0x28], xmm0
xchg rsp, r13
lea rdx, [rbp + 1]
mov dword [rsp - 0x30], 0x1b298a5f
xchg rsp, r9
movups xmmword [r9 + 0x38], xmm0
xchg r9, rsp
xchg rsp, r9
movups xmmword [r9 + 0x48], xmm0
xchg rsp, r9
call fcn.140017b4c
mov r14, r14
mov edx, 0x3c7447cc
sub edx, 0x3c310020
add edx, 0x649f5cb6
xor edx, 0x7e3d9789
test rbp, rbp
je 0x140074c1f
mov rdi, rax
mov rdx, rdx
sub rbx, rax
xchg rbp, rsp
mov r9, rsp
xchg rsp, rbp
mov r8d, 0x3859ea0a
add r8d, 0x350c7742
sub r8d, 0x613e6f42
sub r8d, 0xc27f10b
nop word [rax + rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x3c], edx
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x38], edx
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074bf3
mov rsp, rsp
xor ecx, ecx
xchg r8, r9
mov r9, rbp
xchg r9, r8
mov word [rax + rbp*2], cx
xchg rdi, rsi
mov rcx, rdi
xchg rsi, rdi
xchg rdx, r13
mov r13, qword [rsp + 0x20]
xchg r13, rdx
call fcn.1400915e0
mov dword [rsp - 0x10], edx
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
xchg rbp, r14
mov r14, qword [rsp + 0x78]
xchg rbp, r14
mov rbx, qword [rsp + 0x70]
cmp rcx, rax
jne 0x140074cba
xchg rcx, rcx
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x1ab10b93
xor ecx, 0x6deac4a7
xor ecx, 0x17759f73
add ecx, 0x112b99e6
xor ecx, 0x7159ea1d
rep stosb byte [rdi], al
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rsi, r10
mov r10, qword [rsp + 0x80]
xchg r10, rsi
add rsp, 0x60
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400992c0
mov dword [rsp - 0x2c], 0x4d16e647
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rsi, r9
mov r9, qword [rsp + 0x80]
xchg r9, rsi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007f41c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
mov rcx, rcx
sub r10, rcx
xchg r8, rcx
mov rcx, r8
xchg rcx, r8
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x1c8a8dbf
xor edx, 0x7ff51ff5
xor edx, 0x328f44ca
add edx, 0x2c021408
sub edx, 0x29e5c800
inc r9
mov rsi, rsi
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov rsp, rsp
jb 0x14007f435
xchg r8, rbp
mov rax, rbp
xchg rbp, r8
ret
Function at 0x14008036c
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
xchg r13, rcx
mov qword [rsp + 8], r13
xchg rcx, r13
nop
sub rsp, 8
mov qword [rsp], rbp
nop
push 0x5f853620
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x30], ebx
push r12
push r15
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x5c85382f
add rsp, 0x5c85380f
xchg rbx, rsp
mov rsp, rcx
xchg rbx, rsp
mov r13d, r8d
mov r9d, 0x18d7bc50
add r9d, 0x1146f8e1
add r9d, 0x4093609f
xor r9d, 0x4247cbdb
xor r9d, 0x28f1de0b
xchg r12, rdx
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
xchg r8, r8
pushf
movabs rcx, 0xffffffff19096aec
add rcx, 0x4e2b2c48
xor rcx, 0x3e5f03e9
add rcx, 0x7fffffff
xor rcx, 0x26946b23
popf
pushf
mov eax, 0x16533aaa
sub eax, 0x15a9b96d
add eax, 0x23215568
add eax, 0x9480ae1
xor eax, 0x2d12e182
popf
cmovb r9d, r13d
xchg r13, r13
mul r9
cmovo rax, rcx
xchg rcx, r11
mov r11, rax
xchg r11, rcx
call fcn.140099140
lea r15d, [r13 + 0xfffff]
xor esi, esi
mov dword [rsp - 0x40], edi
shr r15d, 0xa
shr r15d, 3
shr r15d, 5
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x437bcd3b
add ebx, 0x1d56f647
sub ebx, 0xadfd32d
sub ebx, 0x55f2f054
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
test r15d, r15d
mov dword [rsp - 0x40], 0xff5bec
je 0x1400805a0
mov eax, 0x297533f4
sub eax, 0x170e2a36
xor eax, 0x721a384d
sub eax, 0x606d31f3
xchg r9, rcx
mov r9, qword [rsp + 0x60]
xchg rcx, r9
mov r14d, esi
shl r14d, 0x11
shl r14d, 1
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov dword [rsp - 0x28], 0x500f85f
sub edi, r14d
xchg rsp, rdx
mov rsp, rbp
xchg rdx, rsp
cmp edi, eax
cmova edi, eax
mov r8d, edi
mov dword [rsp - 0x44], esi
call fcn.140093510
test al, al
je 0x14008059e
shr edi, 2
mov dword [rsp - 0x28], ebp
xor r8d, r8d
shr r14d, 2
test edi, edi
je 0x14008057a
mov dword [rsp - 0x3c], 0x6478b4e1
mov r15d, dword [rsp + 0x70]
mov r9, rbp
lea eax, [r14 + r8]
mov rsi, rsi
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x1d1855eb
mov dword [rsp - 0x34], 0x7a79074f
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
mov dword [rsp - 0x44], ebx
jb 0x140080542
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0xa8535be
xor eax, 0x35eed062
add eax, 0x274af6f9
sub eax, 0x66a6dcd5
cmp esi, r15d
jb 0x1400804d1
jmp 0x1400805a0
xor bl, bl
mov rcx, rbp
xchg r9, r9
call fcn.140099150
mov al, bl
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg rbx, r13
nop
sub rsp, 0x5d1ec204
add rsp, 0x5d1ec224
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140080d1c
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rbp
xchg rbx, rbx
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg rsi, r14
nop
push 0x1dc24704
mov qword [rsp], rdi
push r12
mov r8, r8
nop
sub rsp, 8
mov qword [rsp], r13
push r14
mov r10, r10
push r15
sub rsp, 0x20
xchg r15, rcx
mov rcx, r15
xchg rcx, r15
mov r14d, r8d
xchg r10, r10
mov r9d, 0x2d68e5be
add r9d, 0x10b0ff48
xor r9d, 0x2b199001
sub r9d, 0x14fc7507
mov r12, rdx
mov dword [rsp - 0x10], esp
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff68177636
sub rcx, 0x5aaeb8d5
add rcx, 0x122aea09
xor rcx, 0x731ce663
add rcx, 0x7fffffff
add rcx, 0x1370bef7
popf
pushf
mov eax, 0x4f15fcae
xor eax, 0x4cea6a45
xor eax, 0xa2e2a3f
sub eax, 0x9d1bcd0
popf
cmovb r9d, r14d
mul r9
mov r13, r13
cmovo rax, rcx
xchg rsi, rcx
mov rsi, rax
xchg rsi, rcx
call fcn.140099140
mov dword [rsp - 0x44], 0x361a43e2
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 2
shr ebp, 0xc
shr ebp, 4
shr ebp, 1
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x30], 0x124d0d4c
mov rsi, rax
mov ebx, 0x86010ae
add ebx, 0x3f8c3bb
xor ebx, 0x2edb380d
add ebx, 0x1bbf7cc9
xor ebx, 0x3e43692c
test ebp, ebp
je 0x140080f18
mov eax, 0x50f949f7
xor eax, 0x6fcd7fe3
add eax, 0x2bc57207
sub eax, 0x6ae9a81b
mov r9d, edi
mov r8d, r14d
mov r10, r10
shl r9d, 0xd
shl r9d, 4
shl r9d, 1
shl r9d, 1
shl r9d, 1
sub r8d, r9d
mov r14, r14
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x20], esi
xor r10d, r10d
shr r11d, 2
test r11d, r11d
xchg rsi, rsi
je 0x140080ed2
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
mov dword [rsp - 0x14], edi
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x1d1855eb
mov dword [rdx], eax
mov dword [rsp - 0x14], ebp
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x140080ea4
mov dword [rsp - 0x24], ebp
xchg r13, rsi
mov rdx, r13
xchg r13, rsi
mov rcx, r15
call fcn.140093930
mov dword [rsp - 0x14], ebx
test al, al
je 0x140080f12
add edi, ebx
mov eax, 0x20e5ed93
add eax, 0x2c9e9054
add eax, 0x2382557
sub eax, 0x4faca33e
cmp edi, ebp
jb 0x140080e5c
jmp 0x140080f18
xor bl, bl
mov dword [rsp - 0xc], ebx
xchg rsi, r8
mov rcx, r8
xchg rsi, r8
call fcn.140099150
mov dword [rsp - 0x10], edx
xchg rcx, rbp
mov rcx, qword [rsp + 0x58]
xchg rcx, rbp
mov al, bl
mov dword [rsp - 0x28], ecx
mov rbx, qword [rsp + 0x50]
xchg rcx, rsi
mov rcx, qword [rsp + 0x60]
xchg rsi, rcx
nop
sub rsp, 0x78a1b129
add rsp, 0x78a1b149
pop r15
mov rdi, rdi
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
mov r8, r8
pop rdi
ret
Function at 0x140083a20
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x38], 0x85fb006
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg rdi, r10
mov qword [rsp + 0x20], r10
xchg r10, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdx
xchg rcx, rcx
xchg rcx, r12
mov rsi, r12
xchg r12, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.1400857a0
mov rsp, rsp
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov rcx, rcx
xchg r13, rax
mov r10, r13
xchg r13, rax
mov ebx, r14d
test ebp, ebp
xchg rbx, rbx
je 0x140083c0c
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov dword [rsp - 0x2c], 0x249cd572
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x10], 0x44437bb5
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov r9, r9
cmp r14w, cx
jae 0x140083b3e
mov eax, dword [rdx + 8]
xchg r8, r8
test eax, eax
jne 0x140083af5
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x2c], 0x2155de33
cmp r11d, r9d
jb 0x140083b1e
add eax, r9d
mov dword [rsp - 0xc], 0x17fa402e
cmp r11d, eax
jb 0x140083bc4
inc r8w
nop
add rdx, 0x3a31bb45
sub rdx, 0x3a31bb1d
cmp r8w, cx
xchg rdi, rdi
jb 0x140083ae4
xchg r8, r14
mov r14, r8
xchg r14, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x10], esi
neg rax
sub rax, 0xfffffffffffffff8
neg rax
nop
add r10, 0x9e8eacf
sub r10, 0x9e8eac7
shr rax, 1
mov dword [rsp - 0x24], ecx
test eax, eax
je 0x140083c01
mov edx, eax
xchg r14, r14
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 5
shr ecx, 4
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x18], ebx
je 0x140083bd9
cmp ecx, 0xa
jne 0x140083be5
and eax, 0xfff
mov dword [rsp - 0x24], 0x389cad39
add qword [rax + r8], rdi
jmp 0x140083be5
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov r13, r13
add r8, rsi
add r8, r11
jmp 0x140083b47
and eax, 0xfff
add dword [rax + r8], edi
mov r9, r9
neg r10
add r10, 0xfffffffffffffffe
neg r10
sub rdx, 1
jne 0x140083b86
mov dword [rsp - 0x40], 0x1e13a647
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140083aa8
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x38], esp
xchg rbp, rdx
mov rdx, qword [rsp + 0x38]
xchg rdx, rbp
xchg rdx, rsi
mov rdx, qword [rsp + 0x40]
xchg rsi, rdx
xchg r12, rdi
mov r12, qword [rsp + 0x48]
xchg rdi, r12
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400857a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
xchg rsi, rsi
add r8, rcx
mov r10d, edx
xchg rcx, rdx
mov rbx, rdx
xchg rdx, rcx
movzx eax, word [r8 + 0x14]
mov dword [rsp - 0x34], 0x9bda5c4
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
cmp r9w, r11w
mov dword [rsp - 0x20], 0x4d3db90e
jae 0x14008583b
nop dword [rax]
mov ecx, dword [rax + 8]
xchg r11, r11
test ecx, ecx
jne 0x140085802
mov ecx, dword [rax + 0x10]
mov dword [rsp - 0x38], ecx
mov edx, dword [rax + 0xc]
cmp r10d, edx
jb 0x14008581c
add ecx, edx
mov rsi, rsi
cmp r10d, ecx
jb 0x140085846
inc r9w
mov dword [rsp - 0xc], esi
nop
sub rax, 0x3b210738
add rax, 0x3b210760
cmp r9w, r11w
jb 0x1400857ed
xor eax, eax
xchg rdi, rdi
mov rbx, qword [rsp + 8]
ret
mov eax, dword [rax + 0x14]
xchg r15, r15
sub rax, rdx
add rax, rbx
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x38], ebx
add rax, r10
ret