joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054ef0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089ba5
add rsp, 0x2fcd91e1
sub rsp, 0x2fcd9301
lea rcx, [0x140089311]
push rcx
push rbp
mov r14, r14
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
xchg rsp, rsp
push qword [0x1404a80e8]
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x14], 0x318176fd
mov ecx, 0x453f58eb
add ecx, 0x2260490e
sub ecx, 0x3db72ac
sub ecx, 0x33ef23ae
xor ecx, 0x2fd50b8f
rep movsq qword [rdi], qword [rsi]
mov dword [rsp - 0x14], 0x44282796
jmp qword [0x1404a80e0]
xchg rdx, rcx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x1404a808c]
mov r13, r13
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
syscall
ret

Function at 0x140054f00
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400893f5
mov r10, rcx
xchg r9, r9
mov eax, dword [0x1404a7fd4]
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
mov dword [rsp - 0x14], 0x565958b2
syscall
ret

Function at 0x140054f10
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089b1f
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a8080]
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
mov dword [rsp - 0x30], 0x33a15119
syscall
ret

Function at 0x140054f20
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089ad2
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404a8078]
cmp qword [0x1404a80e0], 0
mov dword [rsp - 0x34], esp
jne 0x1400892a0
syscall
ret

Function at 0x140054f30
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089afc
mov r10, rcx
mov eax, dword [0x1404a807c]
cmp qword [0x1404a80e0], 0
mov rcx, rcx
jne 0x1400892a0
syscall
ret

Function at 0x140054f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400893cb
xchg rcx, rdx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x1404a7fd0]
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
mov dword [rsp - 0x14], ebp
syscall
ret

Function at 0x140054f50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400895af
xchg r14, r10
mov r14, rcx
xchg r14, r10
mov eax, dword [0x1404a7ffc]
cmp qword [0x1404a80e0], 0
jne 0x1400892a0
mov dword [rsp - 0x28], esp
syscall
ret
Function at 0x140058640
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, rsp
xchg rdx, rax
xchg rbx, r11
mov qword [rax + 0x10], r11
xchg rbx, r11
nop
push 0x5e6e46a1
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
movabs rbx, 0xd6313e33b3a3df1
add rbx, 0x389d159f
sub rbx, 0x50753778
add rbx, 0xe81de2e
add rbx, 0x5ef7728
xchg r12, rcx
mov rdi, r12
xchg r12, rcx
cmp qword [rcx + 0x30], rbx
xchg r13, r13
jne 0x140058890
mov dword [rax - 0x48], 0x73ec4a31
sub dword [rax - 0x48], 0x19be4667
sub dword [rax - 0x48], 0x51c19429
sub dword [rax - 0x48], 0x8346f39
xor r8d, r8d
mov dword [rsp - 0x24], edx
mov dword [rax - 0x44], 0x13ea4320
add dword [rax - 0x44], 0x8cfaa74
add dword [rax - 0x44], 0x3dcf01bb
sub dword [rax - 0x44], 0x3631a7d9
xor dword [rax - 0x44], 0x24674787
mov dword [rax - 0x40], 0x3d2c8714
sub dword [rax - 0x40], 0x2705cce1
add dword [rax - 0x40], 0x27bbec61
sub dword [rax - 0x40], 0x3dada63b
mov dword [rax - 0x3c], 0x347de763
xor dword [rax - 0x3c], 0x48ed92c
sub dword [rax - 0x3c], 0x21199da5
add dword [rax - 0x3c], 0x261d5080
xor dword [rax - 0x3c], 0x3595f19e
mov dword [rax - 0x38], 0x485bf7e0
add dword [rax - 0x38], 0x13dbf788
xor dword [rax - 0x38], 0x763adbf5
add dword [rax - 0x38], 0x2bf4a263
xor dword [rax - 0x38], 0x5639d707
mov dword [rax - 0x34], 0x274ffad1
add dword [rax - 0x34], 0x2fcd6b2b
xor dword [rax - 0x34], 0x1fc44934
sub dword [rax - 0x34], 0x489c2bdd
xchg r9, r8
mov qword [rsp + 0x70], r9
xchg r9, r8
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
nop word [rax + rax]
mov rcx, qword [rsp + 0x70]
xchg rsi, rax
mov rsi, qword [rsp + 0x70]
xchg rsi, rax
and cl, 3
shl cl, 3
mov dword [rsp - 0x1c], 0x4c3222bb
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x481f580d
sub eax, 0x5f4eb57
xor eax, 0x76150e3f
xor eax, 0x508bc982
sub eax, 0x132d4ee2
shr eax, cl
movzx ecx, al
mov r9, r9
mov rax, qword [rsp + 0x70]
xor cx, dx
mov word [rsp + rax*2 + 0x38], cx
mov dword [rsp - 0x10], 0x5bec32df
mov rax, qword [rsp + 0x70]
inc rax
mov qword [rsp + 0x70], rax
mov dword [rsp - 0x3c], 0x22843409
xchg rbp, rax
mov rbp, qword [rsp + 0x70]
xchg rbp, rax
cmp rax, 0xc
jb 0x140058779
xchg rdi, rdi
xor edx, edx
mov word [rsp + 0x50], r8w
lea rcx, [rsp + 0x38]
call fcn.14007c6a0
mov dword [rsp - 0x30], edx
xchg r9, rax
mov rdx, r9
xchg r9, rax
mov r8, rax
xchg r8, r8
xor rdx, rbx
xor eax, eax
mov qword [rdi + 0x30], rdx
lea rdi, [rsp + 0x38]
mov dword [rsp - 0x14], edx
mov ecx, 0x2ed320b9
add ecx, 0x4815bd23
xor ecx, 0x239906b0
sub ecx, 0x5571db60
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140058898
mov dword [rsp - 0x10], 0x6a049ac2
lea rdx, [0x1404a7420]
mov rcx, r8
call fcn.140061500
test al, al
mov dword [rsp - 0x34], 0x46223cbc
setne al
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0xe
add al, 0x37
xor al, 0x7f
sub al, 0x39
mov rbx, qword [rsp + 0x78]
nop
sub rsp, 0x223c90b3
add rsp, 0x223c9113
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400588c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r15, r15
push rdi
nop
sub rsp, 0x5252f1fa
add rsp, 0x5252f1aa
movabs rbx, 0xd6313e319d083d5
add rbx, 0x4c9c46f7
add rbx, 0xf6dcfc4
sub rbx, 0x3e072922
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
cmp qword [rcx + 0x28], rbx
xchg rdi, rdi
jne 0x140058aee
mov eax, 0x4f81cd36
xor eax, 0x3943324
add eax, 0x2b3c8154
sub eax, 0x77527f21
mov dword [rsp + 0x20], 0x4f241c16
add dword [rsp + 0x20], 0x13048d56
xor dword [rsp + 0x20], 0x3d8a09c6
sub dword [rsp + 0x20], 0x2c372fa9
sub dword [rsp + 0x20], 0x333b709b
mov word [rsp + 0x30], ax
xor r8d, r8d
xchg r13, r13
mov dword [rsp + 0x24], 0x650047d6
sub dword [rsp + 0x24], 0x224e9bb3
add dword [rsp + 0x24], 0x2855b28a
xor dword [rsp + 0x24], 0x6b655e4f
mov dword [rsp + 0x28], 0x650cb8c8
xor dword [rsp + 0x28], 0x11fa748b
xor dword [rsp + 0x28], 0x197e3141
sub dword [rsp + 0x28], 0x6d16fce7
mov dword [rsp + 0x2c], 0xfcb96bb
add dword [rsp + 0x2c], 0x1bf06dd0
add dword [rsp + 0x2c], 0x3f306ef9
xor dword [rsp + 0x2c], 0x6ad17367
xchg rbp, r8
mov qword [rsp + 0x60], rbp
xchg r8, rbp
xchg rbx, rax
mov rbx, qword [rsp + 0x60]
xchg rbx, rax
nop dword [rax + rax]
mov dword [rsp - 0x28], edi
mov rcx, qword [rsp + 0x60]
xchg rbx, rax
mov rbx, qword [rsp + 0x60]
xchg rbx, rax
and cl, 3
xchg r8, r8
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x1245c69e
xor eax, 0x42fe874e
xor eax, 0x2d49ae98
xor eax, 0x2b983e95
sub eax, 0x4e375b4
shr eax, cl
xchg r10, r10
movzx ecx, al
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg r10, r10
xchg r13, rax
mov r13, qword [rsp + 0x60]
xchg r13, rax
inc rax
mov dword [rsp - 0xc], edx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 9
jb 0x1400589d4
mov dword [rsp - 0xc], 0x347d9151
xor edx, edx
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
xchg rcx, rcx
call fcn.14007c6a0
mov rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor rdx, rbx
xchg r14, r14
xor eax, eax
mov qword [rdi + 0x28], rdx
lea rdi, [rsp + 0x32]
mov ecx, 0x1df1ef06
add ecx, 0x3a990ef0
add ecx, 0x5621605
xor ecx, 0x5ded13f2
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140058af6
xchg r10, r10
lea rdx, [0x1404a75a0]
xchg r8, r11
mov rcx, r11
xchg r11, r8
call fcn.14006c4d0
mov dword [rsp - 0x3c], 0x6d9db9c1
test al, al
setne al
xchg rbp, rbx
mov rbp, qword [rsp + 0x68]
xchg rbp, rbx
nop
sub rsp, 0xeecb946
add rsp, 0xeecb996
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x39
add al, 0x34
sub al, 0x18
xor al, 0x54
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg r10, rbx
nop
add rsp, 0x45b93883
sub rsp, 0x45b93833
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140059090
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg r15, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x7ea0fec1
sub rsp, 0x7ea0ff11
movabs rbx, 0xd6313e33da36e3f
sub rbx, 0xff29a70
sub rbx, 0x24c7ed1f
xor rbx, 0x67dda7a9
sub rbx, 0x3761cfab
mov rdi, rcx
xchg r12, r12
cmp qword [rcx + 0x20], rbx
jne 0x140059300
mov eax, 0x5b731fa5
xor eax, 0x7a9feaa
add eax, 0x5a71076
sub eax, 0x2b7cab43
sub eax, 0x37054557
mov dword [rsp + 0x20], 0x1fff2125
add dword [rsp + 0x20], 0x2f20f6e9
xor dword [rsp + 0x20], 0xe2c1cbe
add dword [rsp + 0x20], 0x9fa7c88
xor dword [rsp + 0x20], 0x4b328142
mov word [rsp + 0x34], ax
xchg rcx, rcx
xor r8d, r8d
mov dword [rsp + 0x24], 0x76f2f0d5
sub dword [rsp + 0x24], 0x3d3a765
sub dword [rsp + 0x24], 0x3f32a364
sub dword [rsp + 0x24], 0x33afa52a
mov dword [rsp + 0x28], 0x71c52e2d
xor dword [rsp + 0x28], 0x38093a6d
sub dword [rsp + 0x28], 0x324a40c9
add dword [rsp + 0x28], 0x55a1824f
sub dword [rsp + 0x28], 0x6cb45581
mov dword [rsp + 0x2c], 0x199741da
add dword [rsp + 0x2c], 0x537450c0
xor dword [rsp + 0x2c], 0x1b6c574
sub dword [rsp + 0x2c], 0x4af51a29
sub dword [rsp + 0x2c], 0x21493d10
mov dword [rsp + 0x30], 0x6e835630
xor dword [rsp + 0x30], 0x362d031a
xor dword [rsp + 0x30], 0x71b8ba79
xor dword [rsp + 0x30], 0x7b3fa40c
sub dword [rsp + 0x30], 0x51f94b12
xchg r11, r8
mov qword [rsp + 0x60], r11
xchg r8, r11
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
and cl, 3
mov dword [rsp - 0x3c], 0x1577d3b4
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x316f3f5e
sub eax, 0x16edc3f
sub eax, 0xfb4758d
add eax, 0x34dec57e
xor eax, 0x4adef39
shr eax, cl
movzx ecx, al
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0x38], ebp
xor cx, dx
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
inc rax
mov dword [rsp - 0x38], edi
xchg r8, rax
mov qword [rsp + 0x60], r8
xchg r8, rax
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
cmp rax, 0xb
jb 0x1400591e1
mov rdi, rdi
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
mov dword [rsp - 0x3c], edx
call fcn.14007c6a0
xchg rdx, rsi
mov rsi, rax
xchg rsi, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor rdx, rbx
xor eax, eax
xchg r9, rdx
mov qword [rdi + 0x20], r9
xchg rdx, r9
lea rdi, [rsp + 0x36]
mov dword [rsp - 0x28], ecx
mov ecx, 0x2c18ea8a
add ecx, 0x3f0773ce
sub ecx, 0x5fca71d
xor ecx, 0x6523b730
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x28], 0x9c3fb41
je 0x140059308
lea rdx, [0x1404a7890]
mov rcx, r8
mov dword [rsp - 0x20], 0x308374e9
call fcn.14006cb30
test al, al
setne al
xchg rsi, rbx
mov rsi, qword [rsp + 0x68]
xchg rbx, rsi
nop
sub rsp, 0x40c6380e
add rsp, 0x40c6385e
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x53
sub al, 0x1f
add al, 0x1a
sub al, 0x4d
xchg r8, rbx
mov r8, qword [rsp + 0x68]
xchg rbx, r8
add rsp, 0x50
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140074510
Capabilities:
Encode data using xor

Disassembly:
push rdi
add rsp, 0xfffffffffffffff0
mov dword [rsp + 0x20], 0x5d96920a
add dword [rsp + 0x20], 0xd0af5a4
sub dword [rsp + 0x20], 0x121731a5
mov r8, rcx
mov byte [rsp + 0x24], 0x79
sub byte [rsp + 0x24], 0x3f
add byte [rsp + 0x24], 0x38
sub byte [rsp + 0x24], 0x4d
mov qword [rsp + 0x28], 0x7731d627
sub qword [rsp + 0x28], 0x6b0e449c
sub qword [rsp + 0x28], 0xc23918b
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x44911ade
sub edx, 0x28894393
add edx, 0x5b758fb
add edx, 0x2fc82be3
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x140074571
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x21
xor byte [rsp + 7], 0x44
sub byte [rsp + 7], 0x50
xor byte [rsp + 7], 0x15
popf
je 0x14007462c
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x14007462f
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x14007461f
movzx eax, byte [rcx]
test al, al
jne 0x140074603
jmp 0x14007462f
inc r8
cmp byte [r8], 0
jne 0x1400745ee
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x6b8fda5a
sub ecx, 0xd18b1fd
sub ecx, 0x5e772858
rep stosb byte [rdi], al
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x140074660
Capabilities:
Encode data using xor

Disassembly:
push rdi
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x140074810
mov dword [rsp + 0x28], 0x452b9ac9
sub dword [rsp + 0x28], 0x449161dd
xor dword [rsp + 0x28], 0x526d1383
xor dword [rsp + 0x28], 0xa7d7d66
mov byte [rsp + 0x2c], 0x3f
add byte [rsp + 0x2c], 0x27
sub byte [rsp + 0x2c], 0x41
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x301b94ad
sub edx, 0xc5cb47c
add edx, 0x2dc87bf8
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x1400746b9
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x140074734
lea rcx, [rcx + 1]
cmp dil, al
je 0x1400747f5
movzx eax, byte [rcx]
test al, al
jne 0x14007471c
mov word [rsp + 0x20], 0x75c7
sub word [rsp + 0x20], 0x3d81
xor word [rsp + 0x20], 0x3912
mov qword [rsp + 0x28], r8
mov rax, qword [rsp + 0x28]
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x186d63df
xor edx, 0x49f019c0
sub edx, 0x161df6
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007475e
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x1400747da
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x140074872
movzx eax, byte [rcx]
test al, al
jne 0x1400747c2
xor dl, dl
mov r8d, 0x49fefc58
add r8d, 0x1f08907a
sub r8d, 0x69078ccf
jmp 0x140074818
mov r8d, 0x15c386f2
xor r8d, 0x4db69756
add r8d, 0xd769d63
xor r8d, 0x65ebaf06
mov dl, 0x70
xor dl, 0x18
sub dl, 0x67
test r8b, 2
je 0x140074845
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0xe481ce2
add ecx, 0xfe79b47
xor ecx, 0x157ec47b
xor ecx, 0xb517c50
rep stosb byte [rdi], al
test r8b, 1
je 0x140074869
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x33181ff5
xor ecx, 0x3c2e2826
sub ecx, 0xf3637ce
rep stosb byte [rdi], al
movzx eax, dl
add rsp, 0x10
pop rdi
ret
mov r8d, 0x6176367b
xor r8d, 0x29637eb5
sub r8d, 0x481548cb
jmp 0x140074810
Function at 0x140075450
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x5279871a
sub rsp, 0x5279872a
mov word [rsp + 0x20], 0x64c6
xor word [rsp + 0x20], 0x65d6
add word [rsp + 0x20], 0x44
mov r8, rcx
mov qword [rsp + 0x28], 0x7499a85b
xor qword [rsp + 0x28], 0x75329cc3
sub qword [rsp + 0x28], 0x1ab3498
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x1e6e8b6d
add edx, 0x43ab6397
xor edx, 0x1c1dfaf6
sub edx, 0x2c7cb9c9
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007549a
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x10
xor byte [rsp + 2], 0x2b
sub byte [rsp + 2], 0x3b
test al, al
je 0x140075525
lea rcx, [rcx + 1]
cmp dl, al
je 0x140075555
movzx eax, byte [rcx]
test al, al
jne 0x14007550e
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x63d94917
sub ecx, 0x54dad053
sub ecx, 0xefe78c2
rep stosb byte [rdi], al
test dl, dl
jne 0x140075565
mov byte [r8], al
lea rax, [r8 + 1]
add rsp, 0x10
pop rdi
ret
mov dl, 0x6e
sub dl, 0x12
xor dl, 0x42
sub dl, 0x1d
jmp 0x140075527
mov rax, r8
sub rsp, 0xfffffffffffffff0
pop rdi
ret
Function at 0x140075670
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, r14
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg rbp, r12
mov qword [rsp + 0x18], rsi
mov rbp, rbp
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
push r14
mov dword [rsp - 0x20], 0x3ea1d39c
nop
sub rsp, 0x70c95815
add rsp, 0x70c957f5
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x18], edi
xchg r8, rdi
mov r8, rdx
xchg rdi, r8
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
xchg r9, r9
call fcn.140077720
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov rbx, rbx
xchg rsp, rax
mov r11, rsp
xchg rsp, rax
mov ebx, r14d
mov dword [rsp - 0x34], 0x38cb179b
test ebp, ebp
je 0x140075871
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
mov dword [rsp - 0x44], 0x1ba66624
lea rdx, [rsi + 0x18]
mov r9d, dword [r11]
add rdx, rcx
mov dword [rsp - 0x38], 0x23f2ccc
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx r10d, word [rcx + rsi + 6]
mov dword [rsp - 0x14], 0x61e34a66
add rdx, rax
cmp r14w, r10w
jae 0x14007578a
xchg rbp, rbp
mov eax, dword [rdx + 8]
test eax, eax
jne 0x140075757
mov eax, dword [rdx + 0x10]
xchg rbp, rbp
mov ecx, dword [rdx + 0xc]
cmp r9d, ecx
jb 0x140075772
mov dword [rsp - 0x38], esi
add eax, ecx
cmp r9d, eax
jb 0x140075809
inc r8w
xchg rdi, rdi
add rdx, 0x28
cmp r8w, r10w
jb 0x140075746
xchg r12, r12
xchg r14, r15
mov r8, r15
xchg r14, r15
mov eax, dword [r11 + 4]
mov r12, r12
lea rdx, [r11 + 8]
nop
sub rax, 0x2a3d4817
add rax, 0x2a3d480f
shr rax, 1
xchg r14, r14
test eax, eax
je 0x140075850
mov r9d, eax
mov dword [rsp - 0x24], 0x4489b980
nop word [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
xchg r11, r11
shr ecx, 9
shr ecx, 2
shr ecx, 1
cmp ecx, 3
je 0x140075830
cmp ecx, 0xa
xchg rsp, rsp
jne 0x14007583c
and eax, 0xfff
add qword [rax + r8], rdi
mov dword [rsp - 0x24], 0x2c7eccab
jmp 0x14007583c
test rdx, rdx
mov rbp, rbp
je 0x14007578a
mov r8d, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
mov r8, r8
sub r8, rax
add r8, rsi
add r8, r9
mov rdx, rdx
jmp 0x140075793
and eax, 0xfff
add dword [rax + r8], edi
mov r13, r13
neg rdx
add rdx, 0xfffffffffffffffe
neg rdx
sub r9, 1
jne 0x1400757ce
add ebx, dword [r11 + 4]
mov dword [rsp - 0x1c], 0x7dcbd360
xchg r11, rdx
mov rdx, r11
xchg rdx, r11
cmp ebx, ebp
jb 0x140075701
mov dword [rsp - 0x20], ebx
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
xchg rbp, rdi
mov rdi, qword [rsp + 0x38]
xchg rbp, rdi
mov rsi, qword [rsp + 0x40]
xchg rdi, r15
mov r15, qword [rsp + 0x48]
xchg rdi, r15
add rsp, 0x20
mov r14, r14
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140077800
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbx, rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
mov r9, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
push r15
sub rsp, 0x20
mov rcx, rcx
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x2dbe645e
xchg rbx, rbx
xchg rsi, r13
mov r13, rcx
xchg r13, rsi
cmp eax, 0x2dbe3e13
xchg r10, r10
jne 0x1400779ae
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0x28], ebp
xor eax, 0x2dbe645e
cmp eax, 0x2dbe210e
jne 0x1400779ae
mov rcx, rcx
mov edx, dword [rdx + rcx + 0x88]
call fcn.140077720
xchg rsi, r12
mov rcx, r12
xchg rsi, r12
xchg r14, rax
mov rax, r14
xchg r14, rax
mov edx, dword [rax + 0x20]
call fcn.140077720
mov dword [rsp - 0x38], ebp
mov edx, dword [r14 + 0x24]
mov rcx, rsi
xchg rcx, rax
mov r12, rcx
xchg rcx, rax
call fcn.140077720
mov dword [rsp - 0x44], 0x450dad68
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg rcx, r13
mov rcx, rax
xchg r13, rcx
call fcn.140077720
xor edi, edi
mov rbx, rbx
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x1400779ae
nop dword [rax]
mov dword [rsp - 0x34], 0x27e340e4
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140077720
mov r15, r15
mov ecx, 0x7819c74c
xor ecx, 0x3e2b3831
add ecx, 0x3307b657
add ecx, 0x86c54a2b
xchg r10, rax
mov rbx, r10
xchg r10, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov r15, r15
je 0x140077987
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x60]
xchg r14, r14
mov r8d, 0x3f77b77
add r8d, 0x309011ed
sub r8d, 0xc4fee1f
xor r8d, 0x6eed1693
xor r8d, 0x46da89d7
inc rbx
call fcn.1400834b0
cmp byte [rbx], 0
mov dword [rsp - 0x1c], 0x70298c05
jne 0x14007793d
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov dword [rsp - 0x30], 0x5cc8772e
je 0x140077a0f
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0xc], 0x71439779
jb 0x1400778fd
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x3c], 0x51d5324f
nop
add rsp, 0x379cc0c5
sub rsp, 0x379cc0a5
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
mov dword [rsp - 0x3c], ebx
xchg rsi, r8
mov rcx, r8
xchg r8, rsi
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
mov edx, dword [rax + rdx*4]
call fcn.140077720
mov r11, r11
jmp 0x1400779b0
Function at 0x14007b693
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x5e096cf
add rsp, 0x5e0966f
mov rbx, qword [rcx]
mov r13, r13
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
mov dword [rsp - 0x34], edi
xchg rsi, rbx
mov rbx, qword [rcx + 0x38]
xchg rsi, rbx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x40], esi
xchg r14, rax
mov qword [rsp + 0x20], r14
xchg r14, rax
xchg rsp, rdx
movups xmmword [rdx + 0x28], xmm0
xchg rsp, rdx
lea rdx, [rsi + 1]
mov dword [rsp - 0x14], 0x1b4ce8f0
xchg rsp, rbx
movups xmmword [rbx + 0x38], xmm0
xchg rsp, rbx
xchg rsp, rcx
movups xmmword [rcx + 0x48], xmm0
xchg rcx, rsp
call fcn.14000ee60
mov dword [rsp - 0x44], ebx
mov edx, 0x4c1e6a13
add edx, 0x18405be5
xor edx, 0x16675f75
add edx, 0x4f0445a
sub edx, 0x25a282be
test rsi, rsi
je 0x14007b712
xchg rsp, rax
mov rdi, rsp
xchg rsp, rax
sub rbx, rax
mov dword [rsp - 0x44], ebp
xchg rsi, rcx
mov r8, rcx
xchg rcx, rsi
mov r9d, 0x3cbac539
add r9d, 0x1809f88
add r9d, 0x39967b35
add r9d, 0x36cec06
xor r9d, 0x7b3ecb03
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x10], 0x270d6ffa
and cx, r9w
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0x20], edx
sub r8, 1
jne 0x14007b6e0
xor ecx, ecx
mov word [rax + rsi*2], cx
mov dword [rsp - 0x1c], edi
mov rcx, qword [rsp + 0x20]
call fcn.14007b7c0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
xchg r13, r13
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
xchg rdi, rdi
jne 0x14007b793
xor eax, eax
lea rdi, [rsp + 0x28]
mov r10, r10
mov ecx, 0x22a71122
add ecx, 0x2566e3b2
add ecx, 0x20b073b7
sub ecx, 0x55529fcc
xor ecx, 0x136bc88f
rep stosb byte [rdi], al
mov dword [rsp - 0x40], 0x569ce6e0
mov eax, ebx
xchg rbx, rdx
mov rdx, qword [rsp + 0x78]
xchg rbx, rdx
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098730
mov eax, ebx
xchg rbx, rbp
mov rbp, qword [rsp + 0x78]
xchg rbp, rbx
nop
sub rsp, 0x30acac1c
add rsp, 0x30acac7c
pop rdi
ret