joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073f9c
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
push rdi
sub rsp, 0x60
mov dword [rsp - 0x40], 0x5f705f7c
lea rax, [rcx + 8]
xchg rbx, r10
mov qword [rsp + 0x70], r10
xchg r10, rbx
mov qword [rcx], rax
xchg r14, r14
xorps xmm0, xmm0
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg rsp, rcx
mov rsi, rsp
xchg rcx, rsp
xchg rbp, r13
mov qword [rsp + 0x78], r13
xchg rbp, r13
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
lea rcx, [rsp + 0x20]
mov rsp, rsp
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
movups xmmword [rax + 0x30], xmm0
xchg r14, rax
movups xmmword [r14 + 0x40], xmm0
xchg r14, rax
movups xmmword [rax + 0x50], xmm0
mov dword [rsp - 0x40], 0x3e4d2594
xchg rbp, rax
movups xmmword [rbp + 0x60], xmm0
xchg rbp, rax
xchg r13, rax
movups xmmword [r13 + 0x70], xmm0
xchg r13, rax
xchg r10, rbp
mov r10, qword [rdx + 0x38]
xchg rbp, r10
lea rax, [rsp + 0x28]
mov rbx, qword [rdx]
mov dword [rsp - 0x40], ebx
mov qword [rsp + 0x20], rax
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rsp, rcx
lea rdx, [rbp + 1]
xchg rsp, r10
movups xmmword [r10 + 0x38], xmm0
xchg r10, rsp
xchg rsp, rbx
movups xmmword [rbx + 0x48], xmm0
xchg rbx, rsp
call fcn.140017984
mov edx, 0x3282c791
add edx, 0x1d53406a
add edx, 0x104bc2cc
sub edx, 0x3398c52d
add edx, 0x22d85956
test rbp, rbp
je 0x140074029
mov rdi, rax
mov dword [rsp - 0x10], esp
sub rbx, rax
xchg r12, rbp
mov r9, r12
xchg rbp, r12
mov r8d, 0x206b1033
add r8d, 0x5c73824c
xor r8d, 0x44d8ecf1
xor r8d, 0x36d837d9
xor r8d, 0xede49a8
nop word [rax + rax]
mov r12, r12
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 2
ror edx, 3
ror edx, 2
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x2c], 0x157b7743
mov word [rdi - 2], cx
sub r9, 1
jne 0x140073ff8
xor ecx, ecx
xchg r13, r13
mov r8, rbp
mov word [rax + rbp*2], cx
mov rcx, rsi
mov rsp, rsp
mov rdx, qword [rsp + 0x20]
call fcn.140090c90
xchg rcx, rsi
mov rsi, qword [rsp + 0x20]
xchg rsi, rcx
lea rax, [rsp + 0x28]
mov r10, r10
xchg rbp, r8
mov r8, qword [rsp + 0x78]
xchg r8, rbp
mov rbx, qword [rsp + 0x70]
mov r13, r13
cmp rcx, rax
jne 0x1400740bc
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x40], ebx
mov ecx, 0xfb7bd71
add ecx, 0x2463d1b
xor ecx, 0x510a4428
xor ecx, 0x40f7be94
rep stosb byte [rdi], al
xchg rcx, rax
mov rcx, rsi
xchg rcx, rax
xchg rsi, r10
mov r10, qword [rsp + 0x80]
xchg r10, rsi
sub rsp, 0xffffffffffffffa0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.140098770
xchg r13, rsi
mov rax, r13
xchg r13, rsi
xchg rsi, r9
mov r9, qword [rsp + 0x80]
xchg r9, rsi
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x14007e918
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [0x140001910]
sub r10, rcx
mov rbp, rbp
mov r8, rcx
lea rax, [r9 + r8]
mov ecx, r9d
mov edx, 0x4c588615
sub edx, 0x18c595bc
xor edx, 0x7175f9b5
xor edx, 0x19b3fa37
sub edx, 0x1572e500
inc r9
rol edx, cl
xchg rdi, rdi
xor dl, byte [r10 + rax]
mov byte [rax], dl
cmp r9, 0x10
mov r12, r12
jb 0x14007e92b
xchg rbp, r8
mov rax, rbp
xchg rbp, r8
ret

Function at 0x14007f830
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg r10, rcx
mov qword [rsp + 8], r10
xchg rcx, r10
nop
sub rsp, 8
mov qword [rsp], rbp
nop
push 0x2f37b9b
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x6de22325
add rsp, 0x6de22305
xchg rcx, r13
mov rbx, r13
xchg rcx, r13
mov r13d, r8d
mov r9d, 0x56cdd8d1
add r9d, 0x1be01bd7
sub r9d, 0x4796e332
add r9d, 0x31db9d64
sub r9d, 0x5ceeaeda
xchg r9, rdx
mov r12, r9
xchg rdx, r9
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff3d757988
add rcx, 0x2047c583
sub rcx, 0x13673da8
sub rcx, 0x12d48ea
add rcx, 0x7fffffff
add rcx, 0x36d74787
popf
pushf
mov eax, 0x6ea5c099
add eax, 0x992f147
sub eax, 0x569344a7
sub eax, 0x21a56d35
popf
cmovb r9d, r13d
mul r9
mov r12, r12
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140098610
mov dword [rsp - 0x3c], esi
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 4
shr r15d, 0xe
shr r15d, 1
shr r15d, 1
xchg rbp, rbx
mov rbx, rax
xchg rbx, rbp
mov eax, dword [rbx + 0x18]
mov ebx, 0x128bae3c
xor ebx, 0x14ac6cc
xor ebx, 0x2191e1e0
xor ebx, 0x32508911
mov dword [rsp + 0x70], eax
mov r13, r13
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14007fa6c
mov eax, 0x7182566b
sub eax, 0x2e5944c9
sub eax, 0x3ab257f0
add eax, 0x1c9518cf
sub eax, 0x24fbd281
xchg rdi, rcx
mov rdi, qword [rsp + 0x60]
xchg rdi, rcx
mov r14d, esi
shl r14d, 0x12
shl r14d, 1
shl r14d, 1
mov edi, r13d
sub edi, r14d
mov rcx, rcx
xchg r12, rdx
mov r12, rbp
xchg rdx, r12
cmp edi, eax
mov dword [rsp - 0x1c], esp
cmova edi, eax
mov r8d, edi
call fcn.140092ae0
test al, al
xchg r12, r12
je 0x14007fa6a
shr edi, 1
shr edi, 1
xor r8d, r8d
xchg rdi, rdi
shr r14d, 1
shr r14d, 1
test edi, edi
mov rsi, rsi
je 0x14007fa3a
mov r15d, dword [rsp + 0x70]
xchg rsp, r9
mov rsp, rbp
xchg r9, rsp
lea eax, [r14 + r8]
mov edx, r15d
xchg r14, r14
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x17dc431b
mov rbx, rbx
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg r14, r14
jb 0x14007fa08
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov rsp, rsp
mov eax, 0x4adabd3f
sub eax, 0x1b3ceefe
xor eax, 0x3bf4a74c
add eax, 0x543095db
sub eax, 0x6889fee8
cmp esi, r15d
mov dword [rsp - 0x3c], esp
jb 0x14007f999
jmp 0x14007fa6c
xor bl, bl
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.140098620
mov al, bl
mov r10, r10
xchg rdi, rbx
mov rdi, qword [rsp + 0x68]
xchg rdi, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
mov dword [rsp - 0x10], ecx
pop r14
pop r13
pop r12
pop rdi
mov dword [rsp - 0x18], 0x48bcf794
pop rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140080218
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x34], 0x12416205
xchg rbp, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
mov qword [rsp + 0x18], rsi
nop
push 0x52d05e78
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
xchg rcx, rsp
mov r15, rsp
xchg rcx, rsp
mov r14d, r8d
mov dword [rsp - 0x3c], esi
mov r9d, 0x7b0d280
xor r9d, 0x237ec213
sub r9d, 0x24ca6df7
add r9d, 0x5d64
xchg rdx, r8
mov r12, r8
xchg rdx, r8
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff3dcad4b2
xor rcx, 0x4ae42c1a
xor rcx, 0x6186a5bd
xor rcx, 0x79ea286b
add rcx, 0x7fffffff
add rcx, 0x10bd8a82
popf
pushf
mov eax, 0x1b3cb72b
add eax, 0x28735741
sub eax, 0x2cbc2d22
sub eax, 0x16f3e146
popf
cmovb r9d, r14d
xchg rcx, rcx
mul r9
cmovo rax, rcx
xchg rcx, r13
mov r13, rax
xchg rcx, r13
call fcn.140098610
mov r14, r14
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0xd
shr ebp, 6
shr ebp, 1
xor edi, edi
mov r14, r14
mov rsi, rax
mov ebx, 0x17b55892
xor ebx, 0x4adfd583
add ebx, 0x1411e802
sub ebx, 0x717c7512
test ebp, ebp
xchg rbp, rbp
je 0x140080424
mov eax, 0xb0aaa73
add eax, 0x3fa3f4e3
add eax, 0x18ec9278
xor eax, 0xd934b4f
sub eax, 0x6df87a81
mov r9d, edi
mov r8d, r14d
mov rbx, rbx
shl r9d, 0xe
shl r9d, 3
shl r9d, 2
shl r9d, 1
sub r8d, r9d
xchg rsi, rsi
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov rsi, rsi
mov r11d, r8d
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
xchg r12, r12
je 0x1400803d6
xchg r11, rsi
mov rdx, r11
xchg rsi, r11
lea ecx, [r9 + r10]
mov dword [rsp - 0x14], 0x307d0d81
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
mov dword [rsp - 0x38], edx
xor eax, 0x17dc431b
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp r10d, r11d
mov dword [rsp - 0x20], esi
jb 0x1400803a4
xchg r11, rsi
mov rdx, r11
xchg rsi, r11
xchg r15, r13
mov rcx, r13
xchg r15, r13
call fcn.140092f50
test al, al
je 0x14008041f
mov rcx, rcx
add edi, ebx
mov eax, 0x712d83d2
sub eax, 0x5bf350c0
xor eax, 0xbe7b32
sub eax, 0x15744820
cmp edi, ebp
mov dword [rsp - 0x18], esi
jb 0x140080357
jmp 0x140080424
xor bl, bl
mov rcx, rcx
mov rcx, rsi
call fcn.140098620
xchg rdx, rbp
mov rdx, qword [rsp + 0x58]
xchg rbp, rdx
mov al, bl
xchg rcx, rbx
mov rcx, qword [rsp + 0x50]
xchg rcx, rbx
xchg rbp, rsi
mov rbp, qword [rsp + 0x60]
xchg rbp, rsi
nop
sub rsp, 0xba2bf7f
add rsp, 0xba2bf9f
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140082e50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg r8, rbp
mov qword [rsp + 0x18], rsi
mov r8, r8
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
mov r11, r11
xchg rdx, r8
mov rdi, r8
xchg r8, rdx
mov rsi, rcx
mov dword [rsp - 0x10], edi
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140084b80
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x3c], 0x2c63d85f
mov ebp, dword [rbx + rsi + 0xb4]
xchg rsi, rax
mov r10, rsi
xchg rsi, rax
mov ebx, r14d
test ebp, ebp
xchg r9, r9
je 0x140083027
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x38], esp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov rbp, rbp
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov dword [rsp - 0x3c], 0x2068ef50
jae 0x140082f55
mov eax, dword [rdx + 8]
test eax, eax
mov r14, r14
jne 0x140082f1b
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
mov dword [rsp - 0x30], ecx
jb 0x140082f40
add eax, r9d
cmp r11d, eax
mov dword [rsp - 0x40], 0x8a9b59b
jb 0x140082fd6
inc r8w
add rdx, 0x28
cmp r8w, cx
xchg r15, r15
jb 0x140082f0a
xchg r8, rbp
mov rbp, r14
xchg rbp, r8
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x40], 0x12d944c9
nop
sub rax, 0x20eceb85
add rax, 0x20eceb7d
nop
sub r10, 0x2a5d1351
add r10, 0x2a5d1359
shr rax, 1
xchg rdx, rdx
test eax, eax
je 0x140083018
mov edx, eax
nop word [rax + rax]
mov rbp, rbp
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xa
shr ecx, 1
shr ecx, 1
cmp ecx, 3
xchg r12, r12
je 0x140082ff3
cmp ecx, 0xa
jne 0x140082fff
mov rbp, rbp
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140082fff
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x18], 0x1f85ff5a
sub r8, r9
add r8, rsi
add r8, r11
mov r15, r15
jmp 0x140082f5e
and eax, 0xfff
add dword [rax + r8], edi
mov rbx, rbx
nop
add r10, 0x4acfaad7
sub r10, 0x4acfaad5
sub rdx, 1
jne 0x140082fa3
add ebx, dword [r9]
mov dword [rsp - 0x20], ecx
cmp ebx, ebp
jb 0x140082ed2
mov rbx, qword [rsp + 0x30]
mov rsp, rsp
xchg r11, rbp
mov r11, qword [rsp + 0x38]
xchg r11, rbp
xchg rbp, rsi
mov rbp, qword [rsp + 0x40]
xchg rsi, rbp
mov rdi, qword [rsp + 0x48]
xchg r14, r14
add rsp, 0x20
pop r14
ret
Function at 0x140084c50
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
push 0x2cb78ffe
mov qword [rsp], r13
push r14
mov rsp, rsp
nop
sub rsp, 8
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x17dc431b
xchg rcx, rcx
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
cmp eax, 0x17dc1956
mov dword [rsp - 0x18], edi
jne 0x140084e1c
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x17dc431b
mov dword [rsp - 0x2c], edx
cmp eax, 0x17dc064b
jne 0x140084e1c
mov edx, dword [rdx + rcx + 0x88]
call fcn.140084b80
mov rbx, rbx
xchg rdx, rsi
mov rcx, rdx
xchg rsi, rdx
mov r14, rax
mov dword [rsp - 0x24], ecx
mov edx, dword [rax + 0x20]
call fcn.140084b80
mov edx, dword [r14 + 0x24]
xchg rsp, rsp
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.140084b80
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x20], edi
xchg rcx, rbx
mov rbx, rsi
xchg rbx, rcx
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.140084b80
xor edi, edi
mov dword [rsp - 0x28], 0x6820585b
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140084e1c
mov dword [rsp - 0x10], 0x52d09cd7
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140084b80
mov dword [rsp - 0x34], ebx
mov ecx, 0x2d663306
xor ecx, 0x4653f048
add ecx, 0xf47b8f4
sub ecx, 0x1843456f
add ecx, 0x9dc5c92c
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x1c], 0x71584363
cmp byte [rax], 0
je 0x140084dff
nop dword [rax]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x18], 0x59aaffb2
mov r8d, 0x1418d275
add r8d, 0x647d64ce
add r8d, 0x379ab48
xor r8d, 0x9f2ab4d
sub r8d, 0x75fd49c5
inc rbx
call fcn.14008dff0
cmp byte [rbx], 0
mov dword [rsp - 0x24], 0x52f1716b
jne 0x140084daa
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov rdx, rdx
je 0x140084e5c
inc edi
cmp edi, dword [r14 + 0x18]
mov r11, r11
jb 0x140084d5e
xor eax, eax
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x1ac28839
sub rsp, 0x1ac28819
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
pop rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rdi, rcx
mov rdi, rsi
xchg rcx, rdi
xchg rcx, rax
mov rcx, qword [rsp + 0x70]
xchg rcx, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x10], edx
call fcn.140084b80
jmp 0x140084e1e
Function at 0x1400892d3
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
push rdi
mov dword [rsp - 0x24], 0x7c3d4432
nop
sub rsp, 0x190c0f58
add rsp, 0x190c0ef8
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
xchg r13, r13
xchg r14, rsi
mov qword [rsp + 0x70], r14
xchg r14, rsi
xchg rdx, rsi
mov rdx, qword [rcx + 0x38]
xchg rdx, rsi
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x30], 0x6f4adef6
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
xchg r8, rsp
movups xmmword [r8 + 0x28], xmm0
xchg r8, rsp
lea rdx, [rsi + 1]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp - 0x44], edi
xchg rdi, rsp
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017984
mov edx, 0x26bc0bdd
add edx, 0x2b75f78f
xor edx, 0x19d8b11e
xor edx, 0x3d9c5505
sub edx, 0x27158887
test rsi, rsi
mov dword [rsp - 0x1c], 0x6fc4ce95
je 0x140089351
xchg rcx, rax
mov rdi, rcx
xchg rcx, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x10], 0x12c7f998
mov r9d, 0x17884e69
add r9d, 0x4478dd80
sub r9d, 0x4ec72a60
add r9d, 0x58eabb36
sub r9d, 0x6624bbc0
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg r9, r9
and cx, r9w
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0xc], edi
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008931f
xchg rsi, rsi
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg rcx, r9
mov r9, qword [rsp + 0x20]
xchg rcx, r9
call fcn.140089400
xchg rcx, rdi
mov rdi, qword [rsp + 0x20]
xchg rcx, rdi
mov ebx, eax
mov rdi, rdi
xchg r11, rsi
mov r11, qword [rsp + 0x70]
xchg rsi, r11
lea rax, [rsp + 0x28]
mov r11, r11
cmp rcx, rax
jne 0x1400893d7
xor eax, eax
mov dword [rsp - 0x28], 0x604a0aa7
lea rdi, [rsp + 0x28]
mov ecx, 0x93d36a7
add ecx, 0x6bdd32cf
sub ecx, 0x39de1981
xor ecx, 0x3b3c4fc5
rep stosb byte [rdi], al
mov dword [rsp - 0x44], esi
mov eax, ebx
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
xchg r9, r9
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098770
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0x38], 0x5bc5df3a
nop
sub rsp, 0x16b9e61a
add rsp, 0x16b9e67a
pop rdi
ret
Function at 0x14008a8d0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x8a03ba3
sub rsp, 0x8a03c03
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
xchg rbp, rsp
mov qword [r11 + 8], rsp
xchg rbp, rsp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov dword [rsp - 0xc], ecx
mov ebp, r8d
mov qword [r11 + 0x10], rsi
xchg r12, rsi
mov r12, qword [rcx + 0x38]
xchg r12, rsi
lea rcx, [r11 - 0x48]
xchg r8, r14
mov qword [r11 + 0x18], r8
xchg r14, r8
xchg rsi, rdx
mov r14, rsi
xchg rdx, rsi
xchg rsp, rdi
movups xmmword [rdi + 0x28], xmm0
xchg rsp, rdi
lea rdx, [rsi + 1]
xchg rsp, rbx
movups xmmword [rbx + 0x38], xmm0
xchg rbx, rsp
xchg r15, rsp
movups xmmword [r15 + 0x48], xmm0
xchg rsp, r15
call fcn.140017984
xchg rbx, rbx
mov edx, 0x36a9d6bd
sub edx, 0x26b22ceb
xor edx, 0x2459b519
add edx, 0x23b34225
test rsi, rsi
je 0x14008a9e5
mov r15, r15
mov rdi, rax
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x6b7d2693
xor r9d, 0x10d181f0
sub r9d, 0x75ce2a23
sub r9d, 0x5de7c41
nop word [rax + rax]
movzx ecx, dx
xchg rbp, rbp
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 7
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov word [rdi - 2], cx
mov dword [rsp - 0xc], 0x7f3a237
sub r8, 1
jne 0x14008a9b7
xor ecx, ecx
mov r8d, ebp
mov dword [rsp - 0x20], esi
mov word [rax + rsi*2], cx
xchg rdx, r14
mov r14, rdx
xchg r14, rdx
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rbx, rcx
call fcn.14008aac0
xchg rcx, r12
mov r12, qword [rsp + 0x20]
xchg rcx, r12
mov ebx, eax
mov dword [rsp - 0x34], ebp
xchg rdx, r14
mov rdx, qword [rsp + 0x80]
xchg r14, rdx
lea rax, [rsp + 0x28]
mov dword [rsp - 0x10], edx
xchg rbx, rsi
mov rbx, qword [rsp + 0x78]
xchg rbx, rsi
mov rbp, qword [rsp + 0x70]
mov dword [rsp - 0x28], ecx
cmp rcx, rax
jne 0x14008aa95
xor eax, eax
mov dword [rsp - 0x34], ebp
lea rdi, [rsp + 0x28]
mov ecx, 0x19c42cc2
add ecx, 0x23696dcc
xor ecx, 0x4b6834e8
sub ecx, 0x26341fa1
sub ecx, 0x50118e95
rep stosb byte [rdi], al
mov eax, ebx
mov rsp, rsp
mov rbx, qword [rsp + 0x88]
sub rsp, 0xffffffffffffffa0
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.140098770
mov eax, ebx
mov dword [rsp - 0x30], esi
xchg rcx, rbx
mov rcx, qword [rsp + 0x88]
xchg rbx, rcx
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x14008aac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov rbp, rbp
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x67a18888
add rsp, 0x67a18648
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg rdi, rbx
mov rbx, rcx
xchg rdi, rbx
xor edx, edx
mov dword [rsp - 0x20], esp
lea rcx, [rsp + 0x30]
mov r8d, 0x2f3b15c4
xor r8d, 0x155f5ef0
sub r8d, 0x36d7a092
sub r8d, 0x38ca89a
call fcn.140098d20
mov dword [rsp - 0x34], 0x1d209ecf
mov rax, qword gs:[0x60]
xchg rbx, r8
mov rbx, qword [rax + 0x18]
xchg r8, rbx
xchg r13, rax
mov r13, qword [r8 + 0x10]
xchg r13, rax
xchg rbx, r8
mov rbx, qword [rax]
xchg r8, rbx
test r8, r8
mov dword [rsp - 0x40], 0x30ff6392
je 0x14008ad90
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008ad90
xchg rsi, rsi
mov edx, 0x4a8b2c97
sub edx, 0x345277da
add edx, 0x4dd3b5d3
xor edx, 0x640c6b94
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.140099830
mov r10, r10
mov edx, 0x66e0f9a5
sub edx, 0x2b23deb6
add edx, 0x312556d0
xor edx, 0x6b88d5be
sub edx, 0x76aa3a5
lea rcx, [rsp + 0x30]
xchg r15, r15
call fcn.140099930
test rax, rax
je 0x14008ad64
xor ecx, ecx
mov dword [rsp - 0x10], edi
xchg rdi, rsi
mov rdx, rsi
xchg rdi, rsi
mov word [rax], cx
mov r9, r9
movabs rcx, 0x37338a496bfd475e
xor rcx, 0x44f977bf
xor rcx, 0x20ccdd8f
add rcx, 0x7fffffff
add rcx, 0x108a20a7
mov r8, qword [str.b__eOi]
mov dword [rsp - 0x28], esp
movabs rax, 0xf0f73f2f50f5a2ce
sub rax, 0x3d25d8db
add rax, 0x2cefefe2
add rax, 0x45c5de97
add r8, rcx
lea rcx, [rsp + 0x20]
rol r8, 0x14
rol r8, 3
rol r8, 0x1a
rol r8, 1
xor r8, rax
mov dword [rsp - 0xc], 0x504a8b34
movabs rax, 0x152d254d1de3c7db
xor rax, 0x337ef7ea
xor rax, 0x212e62c8
add rax, 0x2d992b2f
sub r8, rax
mov r13, r13
call r8
mov rax, qword [0x140141680]
lea r8, [rsp + 0x20]
mov r14, r14
movabs rcx, 0x35249747126a334b
sub rcx, 0x1042cd7c
add rcx, 0x408d22b8
add rcx, 0xcd13263
lea rdx, [rsp + 0x260]
xor rax, rcx
mov dword [rsp - 0x38], esp
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
movabs rcx, 0x68d8f72a2f93ed98
xor rcx, 0x6f8c1c2e
sub rcx, 0xc85e22d
sub rcx, 0xe836b93
add rcx, 0x7fffffff
add rcx, 0x3c8ba065
sub rax, rcx
movabs rcx, 0x817d0abf269570e2
sub rcx, 0x25a21552
add rcx, 0x66e24661
sub rcx, 0x3308813e
add rcx, 0x7fffffff
add rcx, 0x2c35b65d
xor rax, rcx
lea rcx, [rsp + 0x30]
not rax
mov dword [rsp - 0x10], esp
ror rax, 0xe
ror rax, 1
ror rax, 1
ror rax, 8
ror rax, 0x19
ror rax, 1
ror rax, 1
ror rax, 1
call rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x250]
xchg rbx, rbp
add rsp, 0x7b0320bd
sub rsp, 0x7b031e7d
pop rdi
mov dword [rsp - 0x38], edx
ret
mov eax, 0x2b27e863
sub eax, 0x991c341
add eax, 0x50acccd9
add eax, 0x4dbd0e06
mov rbx, qword [rsp + 0x250]
add rsp, 0x73686c76
sub rsp, 0x73686a36
pop rdi
ret
xchg rsi, rbx
mov rsi, qword [rsp + 0x250]
xchg rbx, rsi
mov eax, 0x7ee7d453
sub eax, 0x1c16a951
xor eax, 0x61911985
add eax, 0x5235e8fc
add eax, 0x6a89e5b2
add rsp, 0x3326a751
sub rsp, 0x3326a511
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008e340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142084], 0
jne 0x14008e44f
xor edx, edx
mov dword [rsp - 0x20], 0x1044acaf
lea r8, [0x140142080]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x20], 0x47e25487
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
mov dword [rsp - 0x3c], 0x6eae553b
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov dword [rsp - 0x18], ecx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov r13, r13
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov r11, r11
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x44], edi
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x3c], 0x596ca1cf
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r9, r9
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x2c], ebx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x14], 0x314b391a
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r9, r9
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r15, r15
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x28], 0x214be52a
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], edi
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
mov dword [rsp - 0x44], edx
jb 0x14008e368
ret