joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069528
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 0x18], rsi
mov rbx, rbx
xchg rdi, rbx
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
mov rbp, rsp
add rsp, 0xffffffffffffffa0
mov r10, r10
movabs rbx, 0x7bd70e0010cf0605
add rbx, 0x4ed6ec9e
xor rbx, 0x69901170
xor rbx, 0x7f32e16d
xchg rsp, rdi
mov rsp, rcx
xchg rdi, rsp
cmp qword [rcx + 0x30], rbx
jne 0x140069739
xor esi, esi
mov dword [rsp - 0x44], ebx
mov dword [rbp - 0x40], 0x275922cc
sub dword [rbp - 0x40], 0x154fe182
xor dword [rbp - 0x40], 0x5b73fc2c
sub dword [rbp - 0x40], 0x2e1d9c79
sub dword [rbp - 0x40], 0x1b352036
mov dword [rbp - 0x3c], 0x198fa19d
add dword [rbp - 0x3c], 0x2249d773
xor dword [rbp - 0x3c], 0x102f1c13
sub dword [rbp - 0x3c], 0x2ba364d5
mov dword [rbp - 0x38], 0x1f069c34
add dword [rbp - 0x38], 0x15ae5daf
add dword [rbp - 0x38], 0x1e4f1a77
sub dword [rbp - 0x38], 0x52df13d4
mov dword [rbp - 0x34], 0x53d994ce
xor dword [rbp - 0x34], 0x287ea355
xor dword [rbp - 0x34], 0x96e6e37
sub dword [rbp - 0x34], 0x72c95941
mov dword [rbp - 0x30], 0x965a849
add dword [rbp - 0x30], 0xdb88dbf
add dword [rbp - 0x30], 0x3ccf4bf4
sub dword [rbp - 0x30], 0x1d4034a4
xor dword [rbp - 0x30], 0x36854d80
mov dword [rbp - 0x2c], 0x63892d15
sub dword [rbp - 0x2c], 0x20a59fc0
xor dword [rbp - 0x2c], 0x61aaba49
xor dword [rbp - 0x2c], 0x854e8f
sub dword [rbp - 0x2c], 0x236e795f
mov qword [rbp + 0x10], rsi
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x34], 0x74b0cf03
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x40b98b9a
sub eax, 0x308f9246
xor eax, 0x26218b91
sub eax, 0x3b025cf
shr eax, cl
movzx ecx, al
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
xchg r14, r14
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
inc rax
xchg rcx, rcx
mov qword [rbp + 0x10], rax
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
cmp rax, 0xc
jb 0x14006965b
xor edx, edx
mov rbp, rbp
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
call fcn.14008b8e0
mov r10, r10
xchg rdx, rbx
mov rbx, rax
xchg rbx, rdx
mov r8, rax
xor eax, eax
mov rsi, rsi
xor rdx, rbx
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov dword [rsp - 0x34], 0x92fbbcb
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069743
mov dword [rsp - 0x34], 0x6f032458
lea rdx, [0x1401422c0]
mov rcx, r8
call fcn.14006e038
mov dword [rsp - 0x10], 0x3c09c0f9
test al, al
setne al
jmp 0x140069743
mov al, 0x4c
sub al, 0x43
add al, 0x42
xor al, 0x7c
xor al, 0x36
lea r11, [rsp + 0x60]
xchg rbp, rbx
mov rbp, qword [r11 + 0x18]
xchg rbp, rbx
xchg rsi, rsp
mov rsp, qword [r11 + 0x20]
xchg rsi, rsp
mov rdi, qword [r11 + 0x28]
mov rbp, rbp
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140069778
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov rdi, rdi
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg r8, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
mov r11, r11
push r14
xchg rsi, rbp
mov rsi, rsp
xchg rsi, rbp
nop
add rsp, 0x2f585ed9
sub rsp, 0x2f585f29
movabs rsi, 0x7bd70e0003300929
add rsi, 0x45b07b38
sub rsi, 0xd2a15e0
add rsi, 0x1e4d9957
sub rsi, 0x10fd051a
xchg rcx, rsp
mov rbx, rsp
xchg rcx, rsp
cmp qword [rcx + 0x28], rsi
mov rsp, rsp
jne 0x140069982
mov eax, 0x2100467b
sub eax, 0x1f7208b5
add eax, 0x5ecdab8
sub eax, 0x77b17e4
mov dword [rbp - 0x30], 0x4ee6f934
sub dword [rbp - 0x30], 0x80fc9a2
sub dword [rbp - 0x30], 0x1a114795
sub dword [rbp - 0x30], 0x2ca5e744
mov word [rbp - 0x20], ax
xchg r14, r14
xor r14d, r14d
mov dword [rbp - 0x2c], 0x52c952ba
sub dword [rbp - 0x2c], 0x13814ed
xor dword [rbp - 0x2c], 0x7ac27162
xor dword [rbp - 0x2c], 0x2e44af6b
xor dword [rbp - 0x2c], 0x516e3f9
mov edi, 0x318a62d7
add edi, 0xed30b0d
sub edi, 0x40575be2
sub edi, 0x61201
mov dword [rbp - 0x28], 0x5788bc9a
add dword [rbp - 0x28], 0x16cf375d
sub dword [rbp - 0x28], 0x62bb0242
sub dword [rbp - 0x28], 0xb3af0f1
mov dword [rbp - 0x24], 0x51794201
sub dword [rbp - 0x24], 0x33e827b6
add dword [rbp - 0x24], 0x16b7f5a9
xor dword [rbp - 0x24], 0x34170fc8
mov qword [rbp + 0x20], r14
xchg r8, rax
mov r8, qword [rbp + 0x20]
xchg r8, rax
mov rcx, qword [rbp + 0x20]
xchg rsp, rax
mov rsp, qword [rbp + 0x20]
xchg rsp, rax
and cl, 3
mov dword [rsp - 0x28], 0xd1975ca
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x40], edi
mov eax, 0x16e1e47f
add eax, 0x664fe20a
sub eax, 0x27f49b27
xor eax, 0x67656794
shr eax, cl
mov r14, r14
movzx ecx, al
xchg r8, rax
mov r8, qword [rbp + 0x20]
xchg r8, rax
xor cx, dx
xchg rsi, rsi
mov word [rbp + rax*2 - 0x1e], cx
mov rax, qword [rbp + 0x20]
add rax, rdi
mov qword [rbp + 0x20], rax
mov r8, r8
mov rax, qword [rbp + 0x20]
cmp rax, 9
jb 0x1400698a6
xor edx, edx
mov dword [rsp - 0x44], esp
mov word [rbp - 0xc], r14w
lea rcx, [rbp - 0x1e]
call fcn.14008b8e0
xchg r15, r15
mov rdx, rax
lea rdi, [rbp - 0x1e]
xor rdx, rsi
mov dword [rsp - 0x34], 0x1f16d200
xchg r9, r8
mov r9, rax
xchg r9, r8
xor eax, eax
mov rcx, rcx
mov qword [rbx + 0x28], rdx
lea ecx, [rax + 9]
rep stosb byte [rdi], al
mov dword [rsp - 0xc], ebp
cmp rdx, rsi
je 0x14006999b
lea rdx, [0x140142810]
mov r15, r15
mov rcx, r8
call fcn.140072230
test al, al
xchg r14, r14
setne al
jmp 0x14006999b
mov eax, 0x6f114cdc
sub eax, 0x119fecbe
sub eax, 0x412457a3
add eax, 0x1e5c195b
sub eax, 0x3aa921d5
lea r11, [rsp + 0x50]
xchg r15, rbx
mov r15, qword [r11 + 0x28]
xchg rbx, r15
mov rsi, qword [r11 + 0x30]
mov rsp, r11
mov dword [rsp - 0x10], 0xc1b4076
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400699d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x20], 0x2cf39333
nop
push 0x7de5179b
mov qword [rsp], rbp
xchg rcx, rsp
mov rbp, rcx
xchg rcx, rsp
nop
add rsp, 0x7da7da5
sub rsp, 0x7da7df5
movabs rbx, 0x7bd70e001cd724b0
xor rbx, 0x3896212a
add rbx, 0x1fade33e
add rbx, 0x51819e6
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
cmp qword [rcx + 0x38], rbx
jne 0x140069bd6
xor esi, esi
mov dword [rsp - 0x14], 0x28a64aaf
mov dword [rbp - 0x30], 0x502fd42f
add dword [rbp - 0x30], 0x14b54d5e
sub dword [rbp - 0x30], 0x2467548c
add dword [rbp - 0x30], 0x2a5a4b86
sub dword [rbp - 0x30], 0x6a9c17e3
mov dword [rbp - 0x2c], 0x64ac359c
xor dword [rbp - 0x2c], 0xb08305f
sub dword [rbp - 0x2c], 0x407cf244
add dword [rbp - 0x2c], 0x2cd620f4
sub dword [rbp - 0x2c], 0x5bbd3438
mov dword [rbp - 0x28], 0x765e8d5
xor dword [rbp - 0x28], 0x5e982273
xor dword [rbp - 0x28], 0x76de0b3d
sub dword [rbp - 0x28], 0x2eabc119
mov dword [rbp - 0x24], 0x30e64477
add dword [rbp - 0x24], 0x321600e7
sub dword [rbp - 0x24], 0x1314ab5f
add dword [rbp - 0x24], 0x28bd3b67
sub dword [rbp - 0x24], 0x784ed4f0
mov dword [rbp - 0x20], 0x6f131fe6
sub dword [rbp - 0x20], 0x276c83f8
sub dword [rbp - 0x20], 0x3acd938d
xor dword [rbp - 0x20], 0xcf908fb
xchg rsi, r10
mov qword [rbp + 0x10], r10
xchg rsi, r10
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
mov dword [rsp - 0x30], 0x5d254ae3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x49ff58d2
add eax, 0x15e61c5b
sub eax, 0x5809a204
add eax, 0x2a7c79cd
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x30], 0x7a958814
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov dword [rsp - 0x28], ecx
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rsi, rsi
cmp rax, 0xa
jb 0x140069afe
xor edx, edx
xchg r9, r9
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008b8e0
xchg rsp, rsp
mov rdx, rax
xchg r11, rax
mov r8, r11
xchg r11, rax
xor eax, eax
xor rdx, rbx
mov dword [rsp - 0x28], 0x27974345
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov r14, r14
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069be0
lea rdx, [0x140142830]
mov dword [rsp - 0x3c], 0x29db5231
xchg r8, rdx
mov rcx, rdx
xchg r8, rdx
call fcn.140072690
mov dword [rsp - 0x30], edx
test al, al
setne al
jmp 0x140069be0
mov al, 0x28
xor al, 0x2d
xor al, 0xa
add al, 0x53
sub al, 0x61
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
xchg r14, rsi
mov r14, qword [rsp + 0x70]
xchg r14, rsi
xchg rcx, rdi
mov rcx, qword [rsp + 0x78]
xchg rdi, rcx
add rsp, 0x50
mov dword [rsp - 0x2c], 0x13e20469
pop rbp
ret
Function at 0x140069c10
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
xchg rbp, rdi
mov qword [rsp + 0x20], rbp
xchg rdi, rbp
push rbp
mov rbp, rsp
mov dword [rsp - 0x34], edx
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x7bd70e0054235c74
add rbx, 0x1c2090fd
add rbx, 0xb1a0661
add rbx, 0x2c1916b
sub rbx, 0x3518827f
mov rdi, rcx
xchg r15, r15
cmp qword [rcx + 0x20], rbx
jne 0x140069e25
mov eax, 0x779ec2ef
sub eax, 0x36a9dad1
xor eax, 0x727e9647
xor eax, 0x328a7e6d
mov dword [rbp - 0x30], 0x7a0c04e9
xor dword [rbp - 0x30], 0x49b45ffc
sub dword [rbp - 0x30], 0x265b125e
add dword [rbp - 0x30], 0x3892db85
xor dword [rbp - 0x30], 0x45d42499
mov word [rbp - 0x1c], ax
xor esi, esi
mov rdx, rdx
mov dword [rbp - 0x2c], 0x13903e5b
add dword [rbp - 0x2c], 0xf71cc83
add dword [rbp - 0x2c], 0x57a20458
sub dword [rbp - 0x2c], 0x64610e2
sub dword [rbp - 0x2c], 0x73fffe17
mov dword [rbp - 0x28], 0x5169fbae
add dword [rbp - 0x28], 0x835f305
add dword [rbp - 0x28], 0x171dcab4
xor dword [rbp - 0x28], 0x70c2b9fd
mov dword [rbp - 0x24], 0x7d331eb1
sub dword [rbp - 0x24], 0x45a4fdac
xor dword [rbp - 0x24], 0x27e4d319
xor dword [rbp - 0x24], 0x1076f276
mov dword [rbp - 0x20], 0x20aaa809
xor dword [rbp - 0x20], 0x2e30cd88
add dword [rbp - 0x20], 0x70ae4b64
sub dword [rbp - 0x20], 0x7f28b053
mov qword [rbp + 0x10], rsi
xchg rcx, rcx
mov rax, qword [rbp + 0x10]
xchg r15, rcx
mov r15, qword [rbp + 0x10]
xchg rcx, r15
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x44], 0x38198e9b
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x681f5f4f
sub eax, 0x2524bda2
xor eax, 0x733e9cc3
add eax, 0x940f88
shr eax, cl
movzx ecx, al
mov r11, r11
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
inc rax
xchg r15, rax
mov qword [rbp + 0x10], r15
xchg r15, rax
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
cmp rax, 0xb
mov dword [rsp - 0x34], esi
jb 0x140069d3b
xor edx, edx
mov word [rbp - 4], si
mov dword [rsp - 0x14], 0x6e3ef98
lea rcx, [rbp - 0x1a]
call fcn.14008b8e0
xchg r10, rdx
mov r10, rax
xchg r10, rdx
mov r8, rax
xor eax, eax
xchg r8, r8
xor rdx, rbx
xchg rdx, rbp
mov qword [rdi + 0x20], rbp
xchg rdx, rbp
lea rdi, [rbp - 0x1a]
mov dword [rsp - 0x44], esi
lea ecx, [rax + 0xb]
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x1c], ebx
je 0x140069e2f
lea rdx, [0x140142298]
xchg rbx, r8
mov rcx, rbx
xchg r8, rbx
call fcn.140072a88
mov dword [rsp - 0x40], 0x3b17f3df
test al, al
setne al
jmp 0x140069e2f
mov al, 0x34
add al, 0x2f
add al, 2
sub al, 0x2f
sub al, 0x35
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg r14, rbx
xchg rdi, rsi
mov rdi, qword [rsp + 0x70]
xchg rdi, rsi
mov rdi, qword [rsp + 0x78]
mov rdx, rdx
add rsp, 0x50
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14007485c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
xchg r12, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
lea rax, [rcx + 8]
xchg rbx, rbp
mov qword [rsp + 0x70], rbp
xchg rbp, rbx
mov qword [rcx], rax
mov dword [rsp - 0x20], 0x63cab018
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xchg rcx, r12
mov rsi, r12
xchg rcx, r12
xchg rbp, r15
mov qword [rsp + 0x78], r15
xchg rbp, r15
movups xmmword [rax + 0x10], xmm0
lea rcx, [rsp + 0x20]
xchg r9, r9
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
movups xmmword [rax + 0x30], xmm0
mov dword [rsp - 0x20], ecx
xchg rbx, rax
movups xmmword [rbx + 0x40], xmm0
xchg rbx, rax
xchg rbp, rax
movups xmmword [rbp + 0x50], xmm0
xchg rbp, rax
xchg r9, rax
movups xmmword [r9 + 0x60], xmm0
xchg r9, rax
xchg rsi, rax
movups xmmword [rsi + 0x70], xmm0
xchg rsi, rax
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x28], 0x46b292f1
xchg r14, rbx
mov r14, qword [rdx]
xchg r14, rbx
mov qword [rsp + 0x20], rax
xchg r9, rsp
movups xmmword [r9 + 0x28], xmm0
xchg r9, rsp
lea rdx, [rbp + 1]
xchg rdx, rsp
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg rsp, r12
movups xmmword [r12 + 0x48], xmm0
xchg r12, rsp
call fcn.140017890
mov edx, 0x60a1785d
xor edx, 0x1836441b
sub edx, 0x75c69fb6
xor edx, 0x18b48e76
xor edx, 0x283c5e10
test rbp, rbp
je 0x1400748ea
mov rsp, rsp
xchg r9, rdi
mov r9, rax
xchg r9, rdi
sub rbx, rax
xchg rsi, rsi
xchg r11, r9
mov r11, rbp
xchg r9, r11
mov r8d, 0xab2acfc
xor r8d, 0x4cd60c15
sub r8d, 0x1968c733
add r8d, 0x22eec625
sub r8d, 0x4fea9edc
nop word [rax + rax]
mov dword [rsp - 0x30], esi
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x30], ebp
sub r9, 1
jne 0x1400748c1
xor ecx, ecx
mov r8, rbp
xchg r15, r15
mov word [rax + rbp*2], cx
xchg r8, rcx
mov r8, rsi
xchg r8, rcx
xchg rdx, r13
mov r13, qword [rsp + 0x20]
xchg r13, rdx
call fcn.140091800
mov dword [rsp - 0x20], ebp
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
xchg r9, rbx
mov r9, qword [rsp + 0x70]
xchg r9, rbx
cmp rcx, rax
jne 0x14007499c
xor eax, eax
mov dword [rsp - 0x14], 0x9ada0e3
lea rdi, [rsp + 0x28]
mov ecx, 0x196fec90
xor ecx, 0x3ad084c2
xor ecx, 0x7d26c491
add ecx, 0x1d9f301c
xor ecx, 0x7c38dcef
rep stosb byte [rdi], al
mov dword [rsp - 0x44], 0x16fa1fca
mov rax, rsi
xchg r9, rsi
mov r9, qword [rsp + 0x80]
xchg rsi, r9
nop
add rsp, 0x76102c17
sub rsp, 0x76102bb7
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140099360
xchg rbx, rsi
mov rax, rbx
xchg rsi, rbx
mov rsi, qword [rsp + 0x80]
mov dword [rsp - 0x38], ecx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007f1cc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov dword [rsp - 0x1c], 0xbdfc8e6
lea r10, [0x140001900]
sub r10, rcx
mov r8, rcx
mov dword [rsp - 0x10], 0x631a261b
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x17f71d11
add edx, 0x4e94d5ac
xor edx, 0x7bb9c070
add edx, 0x522cc2c4
xor edx, 0x1613c0f2
inc r9
rol edx, cl
xor dl, byte [r10 + rax]
xchg r12, r12
mov byte [rax], dl
cmp r9, 0x10
jb 0x14007f1ec
xchg rsp, rsp
xchg rsp, rax
mov rsp, r8
xchg rsp, rax
ret
Function at 0x140080070
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg r8, rbx
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x45e1104a
mov qword [rsp], rsi
nop
push 0x6b4763de
mov qword [rsp], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x7e515613
add rsp, 0x7e5155f3
mov rbx, rcx
mov r13d, r8d
mov r10, r10
mov r9d, 0x607f3193
add r9d, 0x144d4a78
sub r9d, 0x35515d2b
xor r9d, 0xb4fffc5
xor r9d, 0x3430e125
xchg rdx, r12
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff2a6cae47
add rcx, 0x42e4c5a3
sub rcx, 0x2c9c6592
add rcx, 0x7fffffff
xor rcx, 0x3f4af1a8
popf
pushf
mov eax, 0x5cc5c3fc
sub eax, 0x37af05a3
add eax, 0x5fdaeca
xor eax, 0xe038c
sub eax, 0x2b1a6eab
popf
cmovb r9d, r13d
mov r14, r14
mul r9
cmovo rax, rcx
xchg rcx, rbx
mov rbx, rax
xchg rcx, rbx
call fcn.140099210
mov rbp, rbp
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 7
shr r15d, 4
shr r15d, 7
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x4acdb6f0
sub ebx, 0x25ad023a
add ebx, 0x187b9305
xor ebx, 0x43dcf18c
xor ebx, 0x7e40b636
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
test r15d, r15d
mov r11, r11
je 0x1400802aa
mov eax, 0x1466b1bd
sub eax, 0x18b3445
add eax, 0x67572fe8
sub eax, 0x10cea691
xor eax, 0x697406cf
xchg r11, rcx
mov r11, qword [rsp + 0x60]
xchg r11, rcx
mov r14d, esi
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
mov rsi, rsi
sub edi, r14d
xchg r12, rbp
mov rdx, r12
xchg rbp, r12
cmp edi, eax
mov rdi, rdi
cmova edi, eax
mov r8d, edi
call fcn.140093720
test al, al
mov r8, r8
je 0x1400802a8
shr edi, 2
xor r8d, r8d
mov dword [rsp - 0x1c], edi
shr r14d, 1
shr r14d, 1
test edi, edi
mov r15, r15
je 0x140080277
mov r15d, dword [rsp + 0x70]
xchg rbp, r9
mov rbp, r9
xchg r9, rbp
lea eax, [r14 + r8]
mov edx, r15d
xchg r11, r11
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x4dcc1598
lea r9, [r9 + 4]
mov dword [rsp - 0x44], 0x2b9b74dd
mov dword [r12 + rax*4], edx
cmp r8d, edi
jb 0x14008023f
mov r15d, dword [rsp + 0x78]
mov dword [rsp - 0x20], esp
add esi, ebx
mov eax, 0x738449f4
add eax, 0xf670e2
sub eax, 0x3f3b55c9
sub eax, 0x235a9f55
sub eax, 0x11d4c5b8
cmp esi, r15d
mov dword [rsp - 0x14], 0x4c9d998d
jb 0x1400801d1
jmp 0x1400802aa
xor bl, bl
xchg rsp, rcx
mov rsp, rbp
xchg rsp, rcx
call fcn.140099220
xchg r9, r9
mov al, bl
xchg rbx, r13
mov r13, qword [rsp + 0x68]
xchg r13, rbx
nop
add rsp, 0x6d0148cd
sub rsp, 0x6d0148ad
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x44], ebx
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140080cd4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rsi
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x1c575eef
sub rsp, 0x1c575f0f
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
mov r14d, r8d
xchg rsi, rsi
mov r9d, 0x53e1156a
xor r9d, 0x34fcb110
sub r9d, 0xc23a6ec
sub r9d, 0x5af5fd8e
xchg rsi, rdx
mov r12, rsi
xchg rsi, rdx
cmp r8d, r9d
mov dword [rsp - 0x28], 0x29cd58ff
pushf
movabs rcx, 0xffffffff16698ce6
add rcx, 0x46def166
sub rcx, 0x161fc078
add rcx, 0x7fffffff
add rcx, 0x38d7422c
popf
pushf
mov eax, 0x3c07a94
add eax, 0x670262d6
add eax, 0x8cf854
sub eax, 0x3c748d9c
xor eax, 0x2edb4826
popf
cmovb r9d, r14d
mul r9
cmovo rax, rcx
mov r10, r10
xchg rsi, rax
mov rcx, rsi
xchg rsi, rax
call fcn.140099210
mov r12, r12
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 6
shr ebp, 2
shr ebp, 0xa
shr ebp, 1
shr ebp, 1
xor edi, edi
xchg rcx, rcx
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x74dc65d4
add ebx, 0x594e71d
sub ebx, 0x75b73f9c
xor ebx, 0x15d4cf22
sub ebx, 0x116ec276
test ebp, ebp
mov dword [rsp - 0x20], 0x2c9fb32
je 0x140080efd
mov eax, 0x691e37ff
sub eax, 0x5b20440
xor eax, 0x2179d291
xor eax, 0x4205e12e
mov r9d, edi
mov dword [rsp - 0x20], 0x177df5bc
mov r8d, r14d
shl r9d, 4
shl r9d, 5
shl r9d, 3
shl r9d, 7
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0x14], ebp
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov dword [rsp - 0x1c], 0x7f4b4d1c
mov r11d, r8d
xor r10d, r10d
shr r11d, 2
mov dword [rsp - 0x24], ebp
test r11d, r11d
je 0x140080eb2
xchg rdx, r11
mov r11, rsi
xchg rdx, r11
lea ecx, [r9 + r10]
mov eax, r13d
xchg rdx, rdx
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x4dcc1598
xchg r14, r14
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
xchg r15, r15
jb 0x140080e87
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.140093af0
test al, al
je 0x140080efb
mov r8, r8
add edi, ebx
mov eax, 0x272316db
xor eax, 0x558ecb7
sub eax, 0xd0213c2
xor eax, 0x1569e6aa
cmp edi, ebp
mov dword [rsp - 0x40], edi
jb 0x140080e2c
jmp 0x140080efd
xor bl, bl
xchg rcx, r12
mov r12, rsi
xchg rcx, r12
call fcn.140099220
xchg rbp, rdx
mov rdx, qword [rsp + 0x58]
xchg rdx, rbp
mov al, bl
mov rbx, qword [rsp + 0x50]
mov r8, r8
xchg r8, rsi
mov r8, qword [rsp + 0x60]
xchg r8, rsi
sub rsp, 0xffffffffffffffe0
mov rsp, rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x20], esp
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
ret
Function at 0x1400839d0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r9
mov qword [rsp + 0x10], r9
xchg r9, rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x40], 0x6b01a5d1
push r14
nop
sub rsp, 0x2775fa38
add rsp, 0x2775fa18
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, r8
mov r8, rdx
xchg rdi, r8
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
xchg r13, r13
call fcn.140085770
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov dword [rsp - 0xc], 0x461929b0
mov r10, rax
mov ebx, r14d
test ebp, ebp
mov rsp, rsp
je 0x140083bad
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov r8, r8
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
mov dword [rsp - 0x3c], 0x7b022609
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0x34], 0x380559d0
cmp r14w, cx
jae 0x140083ae1
mov eax, dword [rdx + 8]
test eax, eax
xchg rsi, rsi
jne 0x140083aa0
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
mov dword [rsp - 0x10], esi
cmp r11d, r9d
jb 0x140083ac1
add eax, r9d
cmp r11d, eax
mov dword [rsp - 0x44], ecx
jb 0x140083b5e
inc r8w
nop
sub rdx, 0x27c06278
add rdx, 0x27c062a0
cmp r8w, cx
xchg rbx, rbx
jb 0x140083a8f
xchg r14, rcx
mov r8, rcx
xchg r14, rcx
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x24], 0x47cf3baf
neg rax
sub rax, 0xfffffffffffffff8
neg rax
neg r10
add r10, 0xfffffffffffffff8
neg r10
shr rax, 1
test eax, eax
je 0x140083b9a
mov dword [rsp - 0x38], edi
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
mov dword [rsp - 0x44], 0x2b305575
shr ecx, 5
shr ecx, 6
shr ecx, 1
cmp ecx, 3
je 0x140083b78
cmp ecx, 0xa
xchg r11, r11
jne 0x140083b81
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140083b81
mov r8d, dword [rdx + 0x14]
sub r8, r9
add r8, rsi
mov dword [rsp - 0x44], 0x43bc2b21
add r8, r11
jmp 0x140083aea
and eax, 0xfff
add dword [rax + r8], edi
nop
sub r10, 0x1489f7d7
add r10, 0x1489f7d9
sub rdx, 1
jne 0x140083b25
add ebx, dword [r9]
mov dword [rsp - 0x30], 0x625a2623
cmp ebx, ebp
jb 0x140083a53
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
mov rbp, qword [rsp + 0x38]
xchg r14, rsi
mov r14, qword [rsp + 0x40]
xchg r14, rsi
xchg rdi, rdx
mov rdx, qword [rsp + 0x48]
xchg rdx, rdi
sub rsp, 0xffffffffffffffe0
nop
mov r14, qword [rsp]
add rsp, 8
ret