joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069238
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg r11, rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x2c], ebx
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
nop
sub rsp, 8
mov qword [rsp], rbp
mov rbp, rsp
nop
add rsp, 0x1213e890
sub rsp, 0x1213e8f0
movabs rbx, 0x14b57aa13117c560
sub rbx, 0x193d0dc3
add rbx, 0x557def15
xor rbx, 0x4f2508bd
add rbx, 0x250e68ab
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
cmp qword [rcx + 0x30], rbx
jne 0x140069454
xchg r8, r8
xor esi, esi
mov dword [rbp - 0x40], 0x493144a7
sub dword [rbp - 0x40], 0x764cd63
xor dword [rbp - 0x40], 0x347dcc0d
sub dword [rbp - 0x40], 0x32c31b33
sub dword [rbp - 0x40], 0x42dc9f75
mov dword [rbp - 0x3c], 0x5e59ceb9
sub dword [rbp - 0x3c], 0x2694e064
add dword [rbp - 0x3c], 0x3d576cc7
xor dword [rbp - 0x3c], 0x75295b8d
mov dword [rbp - 0x38], 0x76e9d833
sub dword [rbp - 0x38], 0x4cc6ea10
sub dword [rbp - 0x38], 0x1e690dca
xor dword [rbp - 0x38], 0x3392f442
sub dword [rbp - 0x38], 0x380c138b
mov dword [rbp - 0x34], 0x4ca96bce
xor dword [rbp - 0x34], 0x41401d3f
sub dword [rbp - 0x34], 0xd1e09eb
add dword [rbp - 0x34], 0x40f9ec31
xor dword [rbp - 0x34], 0x41a359e3
mov dword [rbp - 0x30], 0x40f407c6
sub dword [rbp - 0x30], 0x9513ad4
xor dword [rbp - 0x30], 0x3b1a5e9e
sub dword [rbp - 0x30], 0xca6919e
mov dword [rbp - 0x2c], 0x78e5515e
sub dword [rbp - 0x2c], 0x61ed7c3d
add dword [rbp - 0x2c], 0x1e9be33c
sub dword [rbp - 0x2c], 0x832656b
sub dword [rbp - 0x2c], 0x2d295267
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov r13, r13
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 3
mov dword [rsp - 0x2c], edi
movzx edx, word [rbp + rax*2 - 0x40]
mov eax, 0x35052925
sub eax, 0x12f337c7
add eax, 0x197022e3
xor eax, 0x6f6562a1
shr eax, cl
mov dword [rsp - 0x20], ebp
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
xchg r14, r14
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
xchg r8, r8
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 0xc
mov rbp, rbp
jb 0x14006937f
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
xchg rdx, rdx
call fcn.14008b3a0
xchg rdx, rbp
mov rbp, rax
xchg rbp, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
xchg rsp, rsp
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
mov dword [rsp - 0x40], 0x4bc5387e
cmp rdx, rbx
je 0x14006945c
lea rdx, [0x1401412c0]
mov dword [rsp - 0x14], edi
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.14006dad0
mov dword [rsp - 0x20], esp
test al, al
setne al
jmp 0x14006945c
mov al, 0x4a
xor al, 0x24
add al, 0xf
sub al, 0x7c
lea r11, [rsp + 0x60]
mov r15, r15
xchg rbx, rdx
mov rdx, qword [r11 + 0x18]
xchg rbx, rdx
xchg r8, rsi
mov r8, qword [r11 + 0x20]
xchg rsi, r8
mov rdi, qword [r11 + 0x28]
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r11, rsi
mov qword [rsp + 0x18], r11
xchg rsi, r11
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
add rsp, 0xffffffffffffffb0
movabs rbx, 0x14b57aa10997e3e8
add rbx, 0x38791869
xor rbx, 0x767411cf
add rbx, 0x1327291c
mov rdi, rcx
cmp qword [rcx + 0x28], rbx
jne 0x140069674
mov dword [rsp - 0x3c], esi
mov eax, 0xc9a97f5
sub eax, 0x95a0993
add eax, 0x3b863c8c
add eax, 0x348cbe13
sub eax, 0x73538875
mov dword [rbp - 0x30], 0x9598171
add dword [rbp - 0x30], 0x4638b6a6
sub dword [rbp - 0x30], 0x2c0ba4f1
add dword [rbp - 0x30], 0x11ea9946
sub dword [rbp - 0x30], 0x35572bbd
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rbp - 0x2c], 0x7a3c8e5c
sub dword [rbp - 0x2c], 0x7185228b
add dword [rbp - 0x2c], 0x554f7b2c
xor dword [rbp - 0x2c], 0x5e61e67f
mov dword [rbp - 0x28], 0x225c4e5f
sub dword [rbp - 0x28], 0x13bf61bd
add dword [rbp - 0x28], 0x76d4bc1
sub dword [rbp - 0x28], 0xdda4d80
sub dword [rbp - 0x28], 0x7d7ea11
mov dword [rbp - 0x24], 0x4eae78dc
sub dword [rbp - 0x24], 0x217da6d3
xor dword [rbp - 0x24], 0x5e65a3b6
sub dword [rbp - 0x24], 0xbde8392
sub dword [rbp - 0x24], 0x673eedaa
xchg rbx, rsi
mov qword [rbp + 0x10], rbx
xchg rbx, rsi
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
mov rcx, qword [rbp + 0x10]
xchg rsi, rax
mov rsi, qword [rbp + 0x10]
xchg rsi, rax
and cl, 3
mov rsp, rsp
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x405fd028
add eax, 0x2db6eadb
sub eax, 0x671f6d38
xor eax, 0x52103b2b
shr eax, cl
movzx ecx, al
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov dword [rsp - 0x34], 0x550b9b57
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
inc rax
mov dword [rsp - 0x20], esi
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 9
mov dword [rsp - 0x40], edx
jb 0x1400695a1
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
mov dword [rsp - 0x44], edx
call fcn.14008b3a0
xchg r8, rax
mov rdx, r8
xchg r8, rax
xchg r8, rbp
mov rbp, rax
xchg rbp, r8
xor eax, eax
xor rdx, rbx
mov qword [rdi + 0x28], rdx
mov r13, r13
lea rdi, [rbp - 0x1e]
lea ecx, [rax + 9]
rep stosb byte [rdi], al
mov r9, r9
cmp rdx, rbx
je 0x14006967c
lea rdx, [0x140141810]
mov rcx, r8
mov r12, r12
call fcn.140071ef8
test al, al
setne al
mov r15, r15
jmp 0x14006967c
mov al, 0x54
sub al, 0x31
sub al, 0x23
xor al, 1
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg r10, rbx
mov rsi, qword [rsp + 0x70]
xchg rdi, r9
mov r9, qword [rsp + 0x78]
xchg r9, rdi
nop
add rsp, 0x16bfee6a
sub rsp, 0x16bfee1a
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400696b4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg rbx, r14
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg rsi, r9
mov qword [rsp + 0x20], rdi
mov rsi, rsi
push rbp
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x14b57aa15fa13f88
add rbx, 0x16d52930
xor rbx, 0x4dadbfab
sub rbx, 0x1cce0c7a
add rbx, 0x287e4c21
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x38], rbx
jne 0x1400698a9
mov dword [rsp - 0x20], 0xcbcff86
xor esi, esi
mov dword [rbp - 0x30], 0x79b1b173
add dword [rbp - 0x30], 0x11e8269
xor dword [rbp - 0x30], 0x1f93eec6
sub dword [rbp - 0x30], 0x653ddc68
mov dword [rbp - 0x2c], 0x627a19d3
xor dword [rbp - 0x2c], 0x78b5fec2
add dword [rbp - 0x2c], 0x595a5766
sub dword [rbp - 0x2c], 0x4a560970
sub dword [rbp - 0x2c], 0x29ae3483
mov dword [rbp - 0x28], 0x4a33cb9a
sub dword [rbp - 0x28], 0x3842741b
add dword [rbp - 0x28], 0x19667ea5
xor dword [rbp - 0x28], 0x2b15d6b0
mov dword [rbp - 0x24], 0x48b414d5
add dword [rbp - 0x24], 0x2d6a2f5e
sub dword [rbp - 0x24], 0x689c2260
sub dword [rbp - 0x24], 0xd52210a
mov dword [rbp - 0x20], 0x2378901
xor dword [rbp - 0x20], 0x60712972
xor dword [rbp - 0x20], 0x4ba6dd11
sub dword [rbp - 0x20], 0x29c67cd6
xchg r9, rsi
mov qword [rbp + 0x10], r9
xchg rsi, r9
mov rax, qword [rbp + 0x10]
xchg rbx, rcx
mov rbx, qword [rbp + 0x10]
xchg rbx, rcx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
and cl, 3
mov dword [rsp - 0x34], esi
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x5599988f
xor eax, 0x6b56b0a5
add eax, 0x71e145b
add eax, 0xefa3a5b
shr eax, cl
movzx ecx, al
xchg r13, r13
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
xchg rbp, rbp
mov rax, qword [rbp + 0x10]
inc rax
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 0xa
jb 0x1400697ca
mov dword [rsp - 0x24], edx
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
mov r9, r9
call fcn.14008b3a0
xchg rbp, rdx
mov rbp, rax
xchg rbp, rdx
xchg r8, rax
mov rax, r8
xchg r8, rax
xor eax, eax
xor rdx, rbx
xchg rdx, rdx
mov qword [rdi + 0x38], rdx
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
mov dword [rsp - 0x10], 0x7ab9c3b8
cmp rdx, rbx
je 0x1400698b3
lea rdx, [0x140141830]
mov r10, r10
xchg r10, r8
mov rcx, r10
xchg r10, r8
call fcn.1400722f0
test al, al
setne al
mov dword [rsp - 0x2c], ebx
jmp 0x1400698b3
mov al, 0x62
sub al, 0x22
add al, 0x30
xor al, 0x13
sub al, 0x62
mov rbx, qword [rsp + 0x68]
xchg r9, rsi
mov r9, qword [rsp + 0x70]
xchg rsi, r9
xchg rdi, rdx
mov rdx, qword [rsp + 0x78]
xchg rdx, rdi
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400698e4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg rbx, r10
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x1c], 0x581dcc5d
push rbp
xchg rbp, rdi
mov rdi, rsp
xchg rdi, rbp
nop
sub rsp, 0x76eed6fe
add rsp, 0x76eed6ae
movabs rbx, 0x14b57aa1671bf422
sub rbx, 0x3bf987a5
xor rbx, 0xdad0364
add rbx, 0x20fca7a1
mov rdi, rcx
cmp qword [rcx + 0x20], rbx
xchg r14, r14
jne 0x140069af4
mov eax, 0x2b751b6
add eax, 0x6e147621
xor eax, 0x280ae3d6
sub eax, 0x4e43105b
xor eax, 0xa7e132d
mov dword [rbp - 0x30], 0xb95872
add dword [rbp - 0x30], 0x66fa6ad2
xor dword [rbp - 0x30], 0x80cf121
xor dword [rbp - 0x30], 0x5d63259e
xor dword [rbp - 0x30], 0x32c21748
mov word [rbp - 0x1c], ax
xor esi, esi
xchg r8, r8
mov dword [rbp - 0x2c], 0x1ff247d8
xor dword [rbp - 0x2c], 0x6cf4eb69
sub dword [rbp - 0x2c], 0x2512a274
xor dword [rbp - 0x2c], 0x4dcc0abf
mov dword [rbp - 0x28], 0x5e2fd23f
add dword [rbp - 0x28], 0xf4a44c3
sub dword [rbp - 0x28], 0x49e0b5a5
xor dword [rbp - 0x28], 0x23dc61d1
mov dword [rbp - 0x24], 0x643bc272
sub dword [rbp - 0x24], 0x1b335525
add dword [rbp - 0x24], 0x78ad3cb
add dword [rbp - 0x24], 0x1a683292
xor dword [rbp - 0x24], 0x6a81737f
mov dword [rbp - 0x20], 0x3ff9548d
add dword [rbp - 0x20], 0x7be286c
xor dword [rbp - 0x20], 0x4f662c10
add dword [rbp - 0x20], 0x2b98ab29
sub dword [rbp - 0x20], 0x344ffb8e
xchg r15, rsi
mov qword [rbp + 0x10], r15
xchg rsi, r15
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp - 0x1c], 0x31f6735d
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x30]
xchg r14, r14
mov eax, 0xb836ff3
add eax, 0x222c932a
sub eax, 0x1b70b576
add eax, 0x42a82939
shr eax, cl
movzx ecx, al
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
xor cx, dx
mov word [rbp + rax*2 - 0x1a], cx
mov dword [rsp - 0x20], ebp
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
inc rax
xchg rdi, rdi
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xb
jb 0x140069a1e
mov dword [rsp - 0x38], ecx
xor edx, edx
mov word [rbp - 4], si
lea rcx, [rbp - 0x1a]
call fcn.14008b3a0
mov r14, r14
xchg r10, rdx
mov r10, rax
xchg r10, rdx
xchg r13, rax
mov r8, r13
xchg r13, rax
xor eax, eax
mov rdi, rdi
xor rdx, rbx
mov qword [rdi + 0x20], rdx
lea rdi, [rbp - 0x1a]
lea ecx, [rax + 0xb]
mov rsi, rsi
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069afe
mov dword [rsp - 0x28], 0x17889a6f
lea rdx, [0x140141298]
mov rcx, r8
call fcn.140072604
mov r13, r13
test al, al
setne al
jmp 0x140069afe
mov al, 0x5c
sub al, 0x4a
xor al, 0x5f
sub al, 0x2a
sub al, 0x22
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x28], 0xaecf02
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
nop
sub rsp, 0x315e6178
add rsp, 0x315e61c8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14007434e
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x60
mov dword [rsp - 0x40], esp
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rbx
xchg r14, rax
mov qword [rcx], r14
xchg r14, rax
xorps xmm0, xmm0
xchg r10, r10
movups xmmword [rax], xmm0
xchg rsi, rbp
mov rbp, rcx
xchg rsi, rbp
xchg rbp, rcx
mov qword [rsp + 0x78], rcx
xchg rcx, rbp
movups xmmword [rax + 0x10], xmm0
xchg rbx, rbx
lea rcx, [rsp + 0x20]
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
xchg rcx, rax
movups xmmword [rcx + 0x30], xmm0
xchg rcx, rax
xchg rcx, rax
movups xmmword [rcx + 0x40], xmm0
xchg rcx, rax
xchg r10, rax
movups xmmword [r10 + 0x50], xmm0
xchg r10, rax
xchg r12, rax
movups xmmword [r12 + 0x60], xmm0
xchg r12, rax
movups xmmword [rax + 0x70], xmm0
mov dword [rsp - 0x24], ebp
mov rbp, qword [rdx + 0x38]
lea rax, [rsp + 0x28]
xchg rbx, r12
mov r12, qword [rdx]
xchg r12, rbx
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
xchg r15, rsp
movups xmmword [r15 + 0x28], xmm0
xchg r15, rsp
lea rdx, [rbp + 1]
xchg rsp, rdx
movups xmmword [rdx + 0x38], xmm0
xchg rdx, rsp
xchg rbp, rsp
movups xmmword [rbp + 0x48], xmm0
xchg rsp, rbp
call fcn.140017814
mov edx, 0x4161b8f5
xor edx, 0x287cabf3
sub edx, 0x11f49561
add edx, 0x1aa23d78
sub edx, 0x1ce3443d
test rbp, rbp
mov dword [rsp - 0x30], 0x669c6be1
je 0x1400744a4
mov rdi, rax
sub rbx, rax
xchg rbp, rbx
mov r9, rbx
xchg rbx, rbp
mov r8d, 0x548fb8e9
sub r8d, 0x20249772
sub r8d, 0x7a11b2b
add r8d, 0x3fc9f66b
xor r8d, 0x6c93fc48
nop word [rax + rax]
movzx ecx, dx
xchg rbp, rbp
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0xc], esi
mov word [rdi - 2], cx
sub r9, 1
jne 0x140074474
mov dword [rsp - 0x2c], 0x3938dfbf
xor ecx, ecx
xchg rbp, r8
mov rbp, r8
xchg rbp, r8
mov word [rax + rbp*2], cx
xchg r15, rsi
mov rcx, r15
xchg r15, rsi
mov rdx, qword [rsp + 0x20]
mov r14, r14
call fcn.140091260
xchg rcx, r15
mov r15, qword [rsp + 0x20]
xchg r15, rcx
lea rax, [rsp + 0x28]
xchg rbp, r11
mov r11, qword [rsp + 0x78]
xchg r11, rbp
xchg rbx, rdi
mov rdi, qword [rsp + 0x70]
xchg rbx, rdi
cmp rcx, rax
jne 0x14007453c
xor eax, eax
mov dword [rsp - 0x10], ebx
lea rdi, [rsp + 0x28]
mov ecx, 0x261d18c0
xor ecx, 0x491f7fb6
xor ecx, 0x73eff8f
xor ecx, 0x5538b8b6
xor ecx, 0x3d04207f
rep stosb byte [rdi], al
xchg rsi, rdx
mov rax, rdx
xchg rdx, rsi
mov rsi, qword [rsp + 0x80]
mov r10, r10
sub rsp, 0xffffffffffffffa0
pop rdi
ret
call fcn.140098de0
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x80]
mov r11, r11
nop
sub rsp, 0x2311186e
add rsp, 0x231118ce
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007ec78
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov dword [rsp - 0x40], edi
lea r10, [0x140001910]
sub r10, rcx
xchg rcx, r8
mov rcx, r8
xchg r8, rcx
lea rax, [r9 + r8]
mov rsp, rsp
mov ecx, r9d
mov edx, 0x3db3cc5a
add edx, 0x29becdef
sub edx, 0x15043704
sub edx, 0x2baceee1
sub edx, 0xd0b3384
inc r9
xchg r15, r15
rol edx, cl
xor dl, byte [r10 + rax]
mov byte [rax], dl
xchg r11, r11
cmp r9, 0x10
jb 0x14007ec92
xchg rdx, r8
mov rax, rdx
xchg rdx, r8
ret

Function at 0x14007fc18
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
push r9
mov qword [rsp], rdi
push r12
mov dword [rsp - 0xc], 0xc88cad9
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
nop
sub rsp, 0x3dc243cd
add rsp, 0x3dc243ad
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov r13d, r8d
mov r9d, 0x63dbd14a
sub r9d, 0x2fdf01c
xor r9d, 0x6fa855c1
xor r9d, 0x1b473099
sub r9d, 0x142e8476
mov r12, rdx
mov dword [rsp - 0x24], 0x140cddf8
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff6d572673
sub rcx, 0x5a77bfe9
xor rcx, 0x38b535d7
add rcx, 0x7fffffff
add rcx, 0x5595aca3
popf
pushf
mov eax, 0x143d7102
xor eax, 0x1d6aa163
xor eax, 0x34637609
sub eax, 0x3d34a664
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x34], esi
cmovo rax, rcx
mov rcx, rax
call fcn.140098c90
lea r15d, [r13 + 0xfffff]
mov r8, r8
xor esi, esi
shr r15d, 7
shr r15d, 4
shr r15d, 7
shr r15d, 1
shr r15d, 1
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov eax, dword [rbx + 0x18]
mov ebx, 0x120d11c1
add ebx, 0x55cd9985
sub ebx, 0x947b548
xor ebx, 0x5e92f5ff
mov dword [rsp + 0x70], eax
xchg r11, r11
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007fe49
xchg rdi, rdi
mov eax, 0x2ca10126
sub eax, 0x5766972
sub eax, 0x116be43a
xor eax, 0x15aeb37a
xchg r9, rcx
mov r9, qword [rsp + 0x60]
xchg rcx, r9
mov r14d, esi
xchg rsp, rsp
shl r14d, 0xa
shl r14d, 5
shl r14d, 2
shl r14d, 1
shl r14d, 2
mov edi, r13d
mov rdi, rdi
sub edi, r14d
xchg rbp, rsi
mov rdx, rsi
xchg rsi, rbp
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x38], edi
mov r8d, edi
call fcn.140093170
test al, al
xchg rbx, rbx
je 0x14007fe47
shr edi, 1
shr edi, 1
xor r8d, r8d
shr r14d, 2
mov dword [rsp - 0x24], 0x17ec3bab
test edi, edi
je 0x14007fe18
mov r15d, dword [rsp + 0x70]
mov r9, rbp
xchg r14, r14
lea eax, [r14 + r8]
mov edx, r15d
xor edx, dword [r9]
mov r14, r14
add r8d, ebx
xor edx, 0x24fd0ef4
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
mov rbp, rbp
cmp r8d, edi
jb 0x14007fde9
mov r15d, dword [rsp + 0x78]
add esi, ebx
xchg rsp, rsp
mov eax, 0x7e327c65
sub eax, 0x200db62b
xor eax, 0x61d6259
sub eax, 0x5829a463
cmp esi, r15d
jb 0x14007fd71
mov dword [rsp - 0x30], 0x70fd39fb
jmp 0x14007fe49
xor bl, bl
xchg rcx, r14
mov r14, rbp
xchg rcx, r14
call fcn.140098ca0
xchg rsi, rsi
mov al, bl
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x1f2b469d
sub rsp, 0x1f2b467d
pop r15
mov r11, r11
pop r14
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov r15, r15
ret
Function at 0x14008070c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rbp
mov qword [rsp + 0x10], r9
xchg rbp, r9
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
push 0x64b70234
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x5a76ad6f
sub rsp, 0x5a76ad8f
xchg rcx, rbx
mov r15, rbx
xchg rbx, rcx
mov r14d, r8d
mov dword [rsp - 0x30], 0x5b3ce930
mov r9d, 0x1f9abb36
xor r9d, 0x3502b22
sub r9d, 0x16c60bd4
xor r9d, 0x29837fd
xor r9d, 0x498b3bd
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
xchg rsi, rsi
pushf
movabs rcx, 0xffffffff717e1260
xor rcx, 0x37ae3ffe
sub rcx, 0x1ad7092b
add rcx, 0x7fffffff
xor rcx, 0x5406db8d
popf
pushf
mov eax, 0x5e3272e1
xor eax, 0x30947cae
xor eax, 0x6f0d1677
add eax, 0x1fd2f05c
sub eax, 0x217e0890
popf
cmovb r9d, r14d
mul r9
mov rdx, rdx
cmovo rax, rcx
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.140098c90
mov r13d, dword [r15 + 0x18]
xchg r14, r14
lea ebp, [r14 + 0xfffff]
shr ebp, 5
shr ebp, 0xd
shr ebp, 1
shr ebp, 1
xor edi, edi
xchg rsi, rax
mov rax, rsi
xchg rsi, rax
mov ebx, 0x46c86eb7
xor ebx, 0x2e30f5f2
xor ebx, 0x39c8fca0
sub ebx, 0x50adffa4
sub ebx, 0x826840
test ebp, ebp
je 0x140080927
mov eax, 0x41684854
sub eax, 0x1343c690
sub eax, 0x29cb15bc
xor eax, 0x4496c08
mov r9d, edi
xchg r15, r15
mov r8d, r14d
shl r9d, 0x12
shl r9d, 1
shl r9d, 1
sub r8d, r9d
mov dword [rsp - 0x38], ecx
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov dword [rsp - 0x34], 0x712dc778
mov r11d, r8d
xor r10d, r10d
shr r11d, 2
mov dword [rsp - 0x38], 0x33d29421
test r11d, r11d
je 0x1400808d5
mov rdx, rsi
lea ecx, [r9 + r10]
mov dword [rsp - 0x34], edx
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
xor eax, 0x24fd0ef4
xchg r10, r10
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0xc], ecx
jb 0x1400808a8
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg rcx, rsp
mov rsp, r15
xchg rsp, rcx
call fcn.140093550
test al, al
je 0x14008091d
mov rcx, rcx
add edi, ebx
mov eax, 0x4153ab6a
sub eax, 0x2e89f9f8
add eax, 0x386a6cd5
xor eax, 0x4b241e47
cmp edi, ebp
xchg r11, r11
jb 0x14008085d
jmp 0x140080927
xor bl, bl
mov dword [rsp - 0xc], 0x6a60fa00
mov rcx, rsi
call fcn.140098ca0
xchg r8, rbp
mov r8, qword [rsp + 0x58]
xchg r8, rbp
mov al, bl
xchg rsi, rsi
xchg rdx, rbx
mov rdx, qword [rsp + 0x50]
xchg rdx, rbx
mov rsi, qword [rsp + 0x60]
nop
sub rsp, 0x37966f1e
add rsp, 0x37966f3e
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140083340
Capabilities:
Enumerate pe sections

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rbp, rsi
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
xchg rsi, rbx
mov qword [rsp + 0x18], rbx
xchg rsi, rbx
xchg r12, rdi
mov qword [rsp + 0x20], r12
xchg rdi, r12
push r14
mov dword [rsp - 0x14], 0x2dec82ae
add rsp, 0xffffffffffffffe0
movsxd rbx, dword [rcx + 0x3c]
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140085110
sub rdi, qword [rbx + rsi + 0x30]
mov dword [rsp - 0xc], ebx
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rdi, rax
mov r10, rdi
xchg rdi, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x18], esp
je 0x1400834fe
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg rsp, rsp
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
add rdx, rcx
xchg r11, r11
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
xchg r13, r13
cmp r14w, cx
jae 0x140083446
mov eax, dword [rdx + 8]
mov dword [rsp - 0x28], ecx
test eax, eax
jne 0x140083410
mov eax, dword [rdx + 0x10]
mov dword [rsp - 0x20], ebp
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x140083431
add eax, r9d
mov dword [rsp - 0x24], 0x54d3aa2d
cmp r11d, eax
jb 0x1400834b9
inc r8w
add rdx, 0x28
mov rbp, rbp
cmp r8w, cx
jb 0x1400833fa
xchg r8, r14
mov r14, r8
xchg r14, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov r11, r11
add rax, 0xfffffffffffffff8
add r10, 8
shr rax, 1
test eax, eax
xchg r12, r12
je 0x1400834f0
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov dword [rsp - 0x18], ebx
mov ecx, eax
shr ecx, 5
shr ecx, 4
shr ecx, 1
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x1400834ce
mov rbx, rbx
cmp ecx, 0xa
jne 0x1400834df
and eax, 0xfff
mov dword [rsp - 0x28], 0x44e5c1f9
add qword [rax + r8], rdi
jmp 0x1400834df
mov r8d, dword [rdx + 0x14]
sub r8, r9
xchg r15, r15
add r8, rsi
add r8, r11
jmp 0x14008344f
and eax, 0xfff
mov dword [rsp - 0xc], 0x4a903ec9
add dword [rax + r8], edi
sub r10, 0xfffffffffffffffe
sub rdx, 1
xchg r10, r10
jne 0x140083478
add ebx, dword [r9]
cmp ebx, ebp
jb 0x1400833c8
xchg r13, r13
mov rbx, qword [rsp + 0x30]
xchg r14, rbp
mov r14, qword [rsp + 0x38]
xchg r14, rbp
xchg rsi, r14
mov r14, qword [rsp + 0x40]
xchg rsi, r14
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x2c], 0x76b72845
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret