joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057f10
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffb0
mov rbp, rbp
movabs rbx, 0x21895caf0fa30fcb
add rbx, 0x21e58e5f
xor rbx, 0x5845636c
sub rbx, 0x3c21b366
mov rdi, rcx
cmp qword [rcx + 0x38], rbx
mov rbp, rbp
jne 0x140058155
xor r8d, r8d
mov dword [rsp + 0x20], 0x7e34e272
sub dword [rsp + 0x20], 0x362e26a7
add dword [rsp + 0x20], 0x2ffbb2eb
sub dword [rsp + 0x20], 0x77d36e50
mov dword [rsp + 0x24], 0x76262350
sub dword [rsp + 0x24], 0x5c8562ee
sub dword [rsp + 0x24], 0x132d84f0
xor dword [rsp + 0x24], 0x66a3b9c
mov dword [rsp + 0x28], 0x4fd7459c
sub dword [rsp + 0x28], 0x1a9fe087
xor dword [rsp + 0x28], 0x46ecddb9
xor dword [rsp + 0x28], 0x69475e9c
sub dword [rsp + 0x28], 0x1a31e5f0
mov dword [rsp + 0x2c], 0x4aeb41ba
add dword [rsp + 0x2c], 0x18103de7
sub dword [rsp + 0x2c], 0x3225f275
sub dword [rsp + 0x2c], 0x30c68c89
mov dword [rsp + 0x30], 0x71c2f449
xor dword [rsp + 0x30], 0x4cdf7975
add dword [rsp + 0x30], 0x2f64ced3
add dword [rsp + 0x30], 0x65d16cd
xor dword [rsp + 0x30], 0x72ec7284
mov qword [rsp + 0x60], r8
xchg r13, rax
mov r13, qword [rsp + 0x60]
xchg r13, rax
nop word [rax + rax]
xchg rbp, rbp
xchg r11, rcx
mov r11, qword [rsp + 0x60]
xchg rcx, r11
mov rax, qword [rsp + 0x60]
xchg rdx, rdx
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x44fb47ef
add eax, 0x15a04dfd
sub eax, 0x1f5bf1eb
add eax, 0x2dd3c346
add eax, 0x279f7ed
shr eax, cl
mov dword [rsp - 0x20], 0x165f8467
movzx ecx, al
xchg r14, rax
mov r14, qword [rsp + 0x60]
xchg r14, rax
xor cx, dx
mov dword [rsp - 0x20], 0x61a54ec
mov word [rsp + rax*2 + 0x34], cx
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
xchg rdi, rdi
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
cmp rax, 0xa
mov dword [rsp - 0x30], 0x10eb394a
jb 0x140058029
xor edx, edx
mov word [rsp + 0x48], r8w
lea rcx, [rsp + 0x34]
mov dword [rsp - 0x28], 0x3d64247d
call fcn.14007c2b0
xchg rdx, rbx
mov rbx, rax
xchg rdx, rbx
xchg rcx, rax
mov r8, rcx
xchg rcx, rax
xor rdx, rbx
xor eax, eax
mov qword [rdi + 0x38], rdx
mov dword [rsp - 0x18], 0x7d92c671
lea rdi, [rsp + 0x34]
mov ecx, 0x3ffdb71d
xor ecx, 0x5771fd09
sub ecx, 0x4d912fa9
add ecx, 0x17451890
sub ecx, 0x324032f1
rep stosb byte [rdi], al
cmp rdx, rbx
mov rsi, rsi
je 0x14005815d
lea rdx, [0x1404a85d0]
xchg rbx, r8
mov rcx, rbx
xchg rbx, r8
call fcn.14006d1f0
test al, al
mov r10, r10
setne al
mov rbx, qword [rsp + 0x68]
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x21
add al, 0x50
sub al, 0x3e
sub al, 0x32
mov rbx, qword [rsp + 0x68]
nop
add rsp, 0x62c1c52a
sub rsp, 0x62c1c4da
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140058180
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg rbx, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x480a4d83
add rsp, 0x480a4d33
movabs rbx, 0x21895caf2d3bcb93
add rbx, 0x3072ac8a
sub rbx, 0xb5a0bd5
xor rbx, 0x7ff825a8
xchg r10, rcx
mov rdi, r10
xchg r10, rcx
cmp qword [rcx + 0x20], rbx
jne 0x1400583d4
mov rdx, rdx
mov eax, 0x2608ade4
add eax, 0x3ba4688a
add eax, 0x19121120
sub eax, 0x7abf26ad
mov dword [rsp + 0x20], 0x2df8269f
add dword [rsp + 0x20], 0x2d336eee
xor dword [rsp + 0x20], 0xbe57cb5
sub dword [rsp + 0x20], 0x5097e8d1
mov word [rsp + 0x34], ax
mov dword [rsp - 0x30], 0x128cff72
xor r8d, r8d
mov dword [rsp + 0x24], 0x2095ffd5
xor dword [rsp + 0x24], 0x64d041f0
xor dword [rsp + 0x24], 0x3c5d3bfa
sub dword [rsp + 0x24], 0x781184f7
mov dword [rsp + 0x28], 0x2ba67a19
add dword [rsp + 0x28], 0x3e8453e2
xor dword [rsp + 0x28], 0x49acbfd7
xor dword [rsp + 0x28], 0x1dc7d056
sub dword [rsp + 0x28], 0x3dd5a222
mov dword [rsp + 0x2c], 0x65ebbb76
sub dword [rsp + 0x2c], 0x536d4da4
sub dword [rsp + 0x2c], 0xe164633
xor dword [rsp + 0x2c], 0x42d2720
mov dword [rsp + 0x30], 0x182a2940
add dword [rsp + 0x30], 0x2e842499
xor dword [rsp + 0x30], 0x5cbc6b1b
sub dword [rsp + 0x30], 0xc5ee403
sub dword [rsp + 0x30], 0xd80426f
xchg r8, r9
mov qword [rsp + 0x60], r9
xchg r9, r8
mov rax, qword [rsp + 0x60]
xchg rcx, r11
mov r11, qword [rsp + 0x60]
xchg r11, rcx
xchg rbp, rax
mov rbp, qword [rsp + 0x60]
xchg rbp, rax
and cl, 3
shl cl, 3
mov dword [rsp - 0x10], ebx
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x4cc58c6a
sub eax, 0x37c66b9b
add eax, 0x1a15adac
xor eax, 0x63566238
add eax, 0x1f4ab2f1
shr eax, cl
movzx ecx, al
mov rax, qword [rsp + 0x60]
xchg rbx, rbx
xor cx, dx
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0x20], 0x4250dcba
inc rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 0xb
mov rsi, rsi
jb 0x1400582bd
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
xchg rcx, rcx
call fcn.14007c2b0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg rsi, r8
mov rsi, rax
xchg r8, rsi
xor rdx, rbx
xchg r15, r15
xor eax, eax
mov qword [rdi + 0x20], rdx
lea rdi, [rsp + 0x36]
mov ecx, 0x2c6f928d
add ecx, 0x43acdf94
add ecx, 0x865905f
sub ecx, 0x15fe0f19
xor ecx, 0x6283f36c
rep stosb byte [rdi], al
mov dword [rsp - 0x2c], 0x49ff156c
cmp rdx, rbx
je 0x1400583dc
lea rdx, [0x1404a8890]
mov dword [rsp - 0x28], ebx
mov rcx, r8
call fcn.14006d730
test al, al
mov rdi, rdi
setne al
mov rbx, qword [rsp + 0x68]
nop
sub rsp, 0x1813649b
add rsp, 0x181364eb
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x38
sub al, 0x22
xor al, 0
sub al, 0x15
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffb0
mov dword [rsp - 0x30], 0x4a68b57a
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140074120
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp + 0x20], 0x77f5d49d
sub dword [rsp + 0x20], 0x665ce7c6
xor dword [rsp + 0x20], 0x3ff90cbf
add dword [rsp + 0x20], 0x341e74ac
mov r8, rcx
mov byte [rsp + 0x24], 0x46
add byte [rsp + 0x24], 0x26
sub byte [rsp + 0x24], 0x34
mov qword [rsp + 0x28], 0x68a984b1
sub qword [rsp + 0x28], 0x9ea2c05
sub qword [rsp + 0x28], 0x37cba460
sub qword [rsp + 0x28], 0x26f3b44c
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x1fe90720
add edx, 0x5b484896
xor edx, 0x10bc1082
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x14007418d
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x2e
sub byte [rsp + 7], 0xd
sub byte [rsp + 7], 0x21
popf
je 0x14007423d
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x140074240
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140074230
movzx eax, byte [rcx]
test al, al
jne 0x140074214
jmp 0x140074240
inc r8
cmp byte [r8], 0
jne 0x1400741ff
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x28cba0cf
add ecx, 0x1e209791
sub ecx, 0x3950ab67
sub ecx, 0xd9b8cf4
rep stosb byte [rdi], al
mov rax, r8
add rsp, 0x10
pop rdi
ret
Function at 0x140074270
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x140074426
mov dword [rsp + 0x28], 0x2f201903
xor dword [rsp + 0x28], 0x409890dc
sub dword [rsp + 0x28], 0xd3834cb
mov byte [rsp + 0x2c], 2
xor byte [rsp + 0x2c], 0x66
sub byte [rsp + 0x2c], 0x2c
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x613e86ab
sub edx, 0x58e25c85
xor edx, 0x24d7ee0
add edx, 0x617c0a6e
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x1400742bb
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x14007433c
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007440b
movzx eax, byte [rcx]
test al, al
jne 0x140074324
mov word [rsp + 0x20], 0x35c0
xor word [rsp + 0x20], 0x1bff
add word [rsp + 0x20], 0x18c9
sub word [rsp + 0x20], 0x44bf
mov qword [rsp + 0x28], r8
mov rax, qword [rsp + 0x28]
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x6c11a71e
sub edx, 0x29b56665
add edx, 0x29311e7b
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x14007436d
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x1400743e9
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x14007448b
movzx eax, byte [rcx]
test al, al
jne 0x1400743d1
xor dl, dl
mov r8d, 0x3dd67936
xor r8d, 0x76b19262
sub r8d, 0x1059189f
sub r8d, 0x3b0ed2b2
jmp 0x140074431
mov r8d, 0x43ccd323
add r8d, 0xf48bab8
xor r8d, 0xc17a5c6
sub r8d, 0x5f02281c
mov dl, 0x51
add dl, 4
sub dl, 0x4c
sub dl, 8
test r8b, 2
je 0x140074458
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x6f2091b9
sub ecx, 0x6150d495
sub ecx, 0xdcfbd22
rep stosb byte [rdi], al
test r8b, 1
je 0x14007447c
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x3af14c9
add ecx, 0x3838d349
sub ecx, 0x3be7e80d
rep stosb byte [rdi], al
movzx eax, dl
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov r8d, 0x93279b6
add r8d, 0x53153c12
xor r8d, 0x5c47b5cb
jmp 0x140074426
Function at 0x140075080
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x482a849c
sub rsp, 0x482a84ac
mov word [rsp + 0x20], 0x34be
add word [rsp + 0x20], 0x2113
sub word [rsp + 0x20], 0x5388
mov r8, rcx
mov qword [rsp + 0x28], 0xf699b79
xor qword [rsp + 0x28], 0x32a89639
xor qword [rsp + 0x28], 0x1ff5f287
sub qword [rsp + 0x28], 0x2234ffc7
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x584b54e2
xor edx, 0xaa4496b
xor edx, 0x396242bd
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x1400750d4
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x4f
xor byte [rsp + 2], 2
xor byte [rsp + 2], 0x4d
test al, al
je 0x140075159
lea rcx, [rcx + 1]
cmp dl, al
je 0x140075189
movzx eax, byte [rcx]
test al, al
jne 0x140075142
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x4bc5f336
sub ecx, 0x117bc674
sub ecx, 0x3a4a2cc0
rep stosb byte [rdi], al
test dl, dl
jne 0x140075196
mov byte [r8], al
lea rax, [r8 + 1]
add rsp, 0x10
pop rdi
ret
mov dl, 0x31
add dl, 0
sub dl, 0x30
jmp 0x14007515b
mov rax, r8
sub rsp, 0xfffffffffffffff0
pop rdi
ret
Function at 0x140075280
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0xc], 0x56281767
mov qword [rsp + 0x10], rbp
xchg r10, rsi
mov qword [rsp + 0x18], r10
xchg r10, rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x1c], ecx
push r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdx
mov rsi, rcx
mov dword [rsp - 0x44], ecx
mov edx, dword [rbx + rcx + 0xb0]
call fcn.1400772e0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov r13, r13
mov ebp, dword [rbx + rsi + 0xb4]
xchg rbp, r11
mov rbp, rax
xchg rbp, r11
mov ebx, r14d
test ebp, ebp
xchg rbx, rbx
je 0x140075453
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
xchg rsi, rsi
mov r9d, dword [r11]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x18], ecx
movzx eax, word [rcx + rsi + 0x14]
movzx r10d, word [rcx + rsi + 6]
add rdx, rax
xchg rsp, rsp
cmp r14w, r10w
jae 0x14007537e
mov eax, dword [rdx + 8]
mov r8, r8
test eax, eax
jne 0x140075341
mov eax, dword [rdx + 0x10]
mov dword [rsp - 0x1c], ecx
mov ecx, dword [rdx + 0xc]
cmp r9d, ecx
jb 0x14007535e
xchg r11, r11
add eax, ecx
cmp r9d, eax
jb 0x1400753ef
xchg r8, r8
inc r8w
nop
add rdx, 0x2b606a8d
sub rdx, 0x2b606a65
cmp r8w, r10w
jb 0x14007532c
mov rbp, rbp
xchg rbp, r14
mov r8, rbp
xchg rbp, r14
mov eax, dword [r11 + 4]
xchg r11, r11
lea rdx, [r11 + 8]
add rax, 0xfffffffffffffff8
shr rax, 1
test eax, eax
mov r11, r11
je 0x14007543b
mov r9d, eax
nop word [rax + rax]
mov dword [rsp - 0x3c], edx
movzx eax, word [rdx]
mov ecx, eax
shr ecx, 0xb
shr ecx, 1
cmp ecx, 3
mov dword [rsp - 0x20], 0x2c5dd41a
je 0x140075413
cmp ecx, 0xa
jne 0x140075424
mov dword [rsp - 0x38], 0x1566ad5e
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140075424
test rdx, rdx
xchg rsp, rsp
je 0x14007537e
mov r8d, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub r8, rax
mov r8, r8
add r8, rsi
add r8, r9
jmp 0x140075387
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x44], 0x6b8cb1b6
neg rdx
add rdx, 0xfffffffffffffffe
neg rdx
sub r9, 1
jne 0x1400753b5
xchg rdi, rdi
add ebx, dword [r11 + 4]
xchg r11, r14
mov r14, rdx
xchg r14, r11
cmp ebx, ebp
jb 0x1400752f8
mov rsi, rsi
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
mov rbp, qword [rsp + 0x38]
mov r15, r15
xchg rdx, rsi
mov rdx, qword [rsp + 0x40]
xchg rsi, rdx
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x3c], ebx
nop
sub rsp, 0x59d0b838
add rsp, 0x59d0b858
pop r14
mov dword [rsp - 0x38], ebp
ret
Function at 0x1400773b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
mov rdx, rdx
nop
push 0x7879ecd4
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0xe7edfaf
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x1c], esi
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x797b4946
mov rsi, rcx
mov dword [rsp - 0x40], ecx
cmp eax, 0x797b130b
jne 0x14007756b
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov dword [rsp - 0xc], 0x15baaa3
xor eax, 0x797b4946
cmp eax, 0x797b0c16
jne 0x14007756b
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0x30], 0x437196dd
call fcn.1400772e0
xchg rdx, rcx
mov rdx, rsi
xchg rdx, rcx
xchg r12, rax
mov r14, r12
xchg r12, rax
mov edx, dword [rax + 0x20]
mov r9, r9
call fcn.1400772e0
mov edx, dword [r14 + 0x24]
xchg rbx, rcx
mov rbx, rsi
xchg rbx, rcx
xchg rbp, r12
mov rbp, rax
xchg r12, rbp
call fcn.1400772e0
mov edx, dword [r14 + 0x1c]
xchg rcx, rsp
mov rsp, rsi
xchg rsp, rcx
xchg r9, r13
mov r9, rax
xchg r9, r13
call fcn.1400772e0
mov dword [rsp - 0x28], 0x7abeede
xor edi, edi
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x14007756b
xchg r12, r12
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rbx, rcx
mov rbx, rsi
xchg rcx, rbx
call fcn.1400772e0
mov ecx, 0x286264d1
add ecx, 0xf62db72
add ecx, 0x13455753
add ecx, 0xb4f56869
xchg rbx, r9
mov r9, rax
xchg rbx, r9
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov dword [rsp - 0x20], ebp
je 0x140077550
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x14], ebp
mov r8d, 0x13e4bb87
sub r8d, 0x1062a8e5
xor r8d, 0x4ff914c5
xor r8d, 0x230f44fe
sub r8d, 0x6f744298
inc rbx
mov dword [rsp - 0x14], ebp
call fcn.140083100
cmp byte [rbx], 0
jne 0x140077506
mov ecx, dword [rsp + 0x60]
xchg rdi, rdi
not ecx
cmp ecx, r15d
je 0x1400775ca
inc edi
mov dword [rsp - 0x20], edx
cmp edi, dword [r14 + 0x18]
jb 0x1400774c0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x1c], 0x41f6d2ae
nop
add rsp, 0x7a5d819
sub rsp, 0x7a5d7f9
pop r15
mov dword [rsp - 0xc], ebx
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
movzx edx, word [r13 + rdi*2]
xchg rbx, rsi
mov rcx, rbx
xchg rbx, rsi
xchg r15, rax
mov r15, qword [rsp + 0x70]
xchg r15, rax
mov edx, dword [rax + rdx*4]
call fcn.1400772e0
mov dword [rsp - 0x1c], esi
jmp 0x14007756d
Function at 0x14007b263
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x962adf1
sub rsp, 0x962ae51
xchg r13, rbx
mov r13, qword [rcx]
xchg rbx, r13
lea rax, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp - 0x14], 0x1ae8bdae
mov qword [rsp + 0x70], rsi
xchg r9, rsi
mov r9, qword [rcx + 0x38]
xchg r9, rsi
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x18], 0x28ab79de
xchg r15, rax
mov qword [rsp + 0x20], r15
xchg r15, rax
xchg rsp, r8
movups xmmword [r8 + 0x28], xmm0
xchg rsp, r8
lea rdx, [rsi + 1]
mov dword [rsp - 0x2c], ebx
movups xmmword [rsp + 0x38], xmm0
xchg rsp, rcx
movups xmmword [rcx + 0x48], xmm0
xchg rsp, rcx
call fcn.14000ef00
mov edx, 0x7f653f73
sub edx, 0x7d693978
xor edx, 0x5ae5fe4c
sub edx, 0x827b526
add edx, 0x189b18a3
test rsi, rsi
je 0x14007b2e4
xchg r12, r12
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
mov r8, rsi
mov r9d, 0x77dbf9f1
sub r9d, 0xd3ff2d3
add r9d, 0x908af3b
sub r9d, 0x55e64bad
sub r9d, 0x1dbe69ad
nop dword [rax]
mov dword [rsp - 0xc], esi
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x28], 0x1c2faca4
ror edx, 4
ror edx, 3
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov dword [rsp - 0x10], 0x5c5b9d4b
mov word [rdi - 2], cx
sub r8, 1
jne 0x14007b2a6
mov dword [rsp - 0x34], 0x449cca16
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg r10, rcx
mov r10, qword [rsp + 0x20]
xchg r10, rcx
call fcn.14007b390
mov dword [rsp - 0x18], esp
xchg rsi, rcx
mov rsi, qword [rsp + 0x20]
xchg rcx, rsi
mov ebx, eax
mov dword [rsp - 0x34], 0x622da7ae
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14007b366
xchg rdx, rdx
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x6f3db1c7
sub ecx, 0x395ad4c2
sub ecx, 0x205e7d5a
sub ecx, 0x15845f7b
rep stosb byte [rdi], al
mov eax, ebx
mov dword [rsp - 0x2c], edi
xchg r12, rbx
mov r12, qword [rsp + 0x78]
xchg rbx, r12
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
call fcn.1400996a0
mov eax, ebx
xchg r14, r14
mov rbx, qword [rsp + 0x78]
nop
add rsp, 0x297bd38d
sub rsp, 0x297bd32d
pop rdi
xchg r8, r8
ret
Function at 0x14007bfb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x240
xchg rbp, rbp
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x5a8fc2ee
add r8d, 0x24f17e90
xor r8d, 0x54a3304f
xor r8d, 0x2b227339
call fcn.140099c60
xchg r10, r10
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rsp, rax
mov rsp, qword [r8 + 0x10]
xchg rsp, rax
mov r8, qword [rax]
mov r9, r9
test r8, r8
je 0x14007c276
mov r8, qword [r8 + 0x50]
test r8, r8
xchg r10, r10
je 0x14007c276
mov edx, 0xda8d4ff
xor edx, 0x4ab10bd6
xor edx, 0x544cfaae
add edx, 0x3eba3b3b
sub edx, 0x520f5fbe
lea rcx, [rsp + 0x30]
mov rsp, rsp
mov r9d, 0x4264cf48
xor r9d, 0x2ad52768
xor r9d, 0x5938655c
xor r9d, 0x6ce0c030
sub r9d, 0x5d694c49
call fcn.14009a670
mov edx, 0x2a31aa18
xor edx, 0x216f6ec9
sub edx, 0x959a1c8
sub edx, 0x20522ad
lea rcx, [rsp + 0x30]
xchg rdi, rdi
call fcn.14009a740
test rax, rax
je 0x14007c23f
xor ecx, ecx
xchg rsp, rsp
xchg rdi, rdx
mov rdi, rdx
xchg rdi, rdx
mov word [rax], cx
movabs rcx, 0x7c0d0fdb4874886a
xor rcx, 0x4faa8bfb
add rcx, 0x20ed7f7f
add rcx, 0x7fffffff
add rcx, 0x36f9fb20
mov rax, qword [0x1404a8370]
mov dword [rsp - 0x2c], 0x520c93c4
rol rax, 0x1a
rol rax, 0xd
rol rax, 1
not rax
xchg r15, r15
ror rax, 0x19
ror rax, 0x1f
ror rax, 1
ror rax, 1
xor rax, rcx
movabs rcx, 0x1ffde1e50fbcb557
add rcx, 0x1e0284a7
xor rcx, 0x518fdc5
add rcx, 0x56c57a26
sub rcx, 0x7ef15588
ror rax, 0xe
ror rax, 1
ror rax, 3
ror rax, 1
xor rax, rcx
mov dword [rsp - 0x40], 0x241ed320
lea rcx, [rsp + 0x20]
rol rax, 4
rol rax, 1
rol rax, 1
call rax
mov rax, qword [0x1404a8360]
lea r8, [rsp + 0x20]
mov r12, r12
ror rax, 2
ror rax, 1
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x3c], 0x12b2445d
not rax
movabs rcx, 0x16cdf2c755cf999f
sub rcx, 0x42715019
xor rcx, 0x6bf24e49
xor rcx, 0x200201bf
rol rax, 0x11
rol rax, 4
rol rax, 1
xchg rbx, r9
mov rbx, r9
xchg r9, rbx
xor rax, rcx
xchg rsi, rsi
movabs rcx, 0x67799d46760a8a71
sub rcx, 0x342ffe00
sub rcx, 0x2e530e71
sub rcx, 0xbda5163
not rax
add rax, rcx
mov dword [rsp - 0xc], esp
lea rcx, [rsp + 0x30]
rol rax, 6
rol rax, 7
rol rax, 1
rol rax, 1
rol rax, 1
rol rax, 1
call rax
mov dword [rsp - 0x2c], edi
mov rbx, qword [rsp + 0x250]
sub rsp, 0x56e514d2
add rsp, 0x56e51712
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x5edbc81e
add eax, 0x153408df
sub eax, 0x3eb2377b
add eax, 0x8aa2667f
xchg rbx, r12
mov r12, qword [rsp + 0x250]
xchg r12, rbx
add rsp, 0x240
mov rbp, rbp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg r8, rbx
mov r8, qword [rsp + 0x250]
xchg rbx, r8
mov eax, 0x41c14488
sub eax, 0x19372804
add eax, 0x34e5f059
add eax, 0x628ff458
add rsp, 0x240
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140082480
Capabilities:
Encode data using xor

Disassembly:
push r12
mov qword [rsp], rbx
add rsp, 0xfffffffffffffdd0
mov rbp, rbp
mov r8, qword [0x1404a80f0]
xchg rcx, r14
mov rbx, r14
xchg rcx, r14
movabs rcx, 0x8c1fb4b632b5b430
add rcx, 0x3a9535a6
sub rcx, 0x32fc1116
sub rcx, 0x2ea901ea
add rcx, 0x7fffffff
add rcx, 0x5f0e158e
movabs rax, 0xe721dda20417d3f5
xor rax, 0x432e3152
xor rax, 0x2f8a81b4
add rax, 0x5f31a3c7
add r8, rcx
mov dword [rsp - 0x14], esp
mov edx, 0x6161c11a
xor edx, 0x6307754a
xor edx, 0x26671916
xor edx, 0x257de200
sub edx, 0x17c4e42
ror r8, 1
ror r8, 8
ror r8, 8
lea rcx, [rsp + 0x20]
xchg rdx, rdx
xor r8, rax
movabs rax, 0x7e35c121913e385
add rax, 0x1f5b28e2
add rax, 0x36d2ee50
sub rax, 0x67ff6f43
not r8
add r8, rax
mov dword [rsp - 0x38], 0x4c205f55
ror r8, 0xb
ror r8, 3
ror r8, 1
call r8
lea rax, [rbx + 8]
mov dword [rsp - 0x14], 0x5baf2c5b
xorps xmm0, xmm0
xchg rdx, rax
mov qword [rbx], rdx
xchg rdx, rax
nop
movabs rdx, 0xffffffff5002edb5
sub rdx, 0x17fe33ae
xor rdx, 0x19d8fe68
add rdx, 0x7fffffff
add rdx, 0x5e23bb91
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r9, rax
movups xmmword [r9 + 0x10], xmm0
xchg r9, rax
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
lea rax, [rsp + 0x20]
inc rdx
xchg rbp, rbp
cmp word [rax + rdx*2], 0
jne 0x1400825b7
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
mov qword [rbx + 0x38], rdx
call fcn.14000ef00
mov dword [rsp - 0x24], esp
xor r8d, r8d
mov ecx, 0x3ae2ac
add ecx, 0x4d547134
xor ecx, 0x70f5ef24
sub ecx, 0xcac7f10
add ecx, 0x3abf2180
cmp qword [rbx + 0x38], r8
jbe 0x14008267c
lea r9, [rsp + 0x20]
mov dword [rsp - 0x34], 0x74d2e894
mov r10d, 0x390d770d
xor r10d, 0x1344197
sub r10d, 0x54e1fd7
sub r10d, 0x1c128669
sub r10d, 0x16d88f5b
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0x34], edx
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
xchg r13, r13
ror ecx, 8
xor dx, word [rax + r9 - 2]
inc r8
mov dword [rsp - 0x44], 0x52e327f0
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
jb 0x140082649
xchg r13, r13
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x2a5f68f7
sub rsp, 0x2a5f66c7
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140083480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a9114], 0
mov r10, r10
jne 0x14008358a
xor edx, edx
lea r8, [0x1404a9110]
nop word [rax + rax]
xchg rbx, rbx
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov rdi, rdi
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x44], ebp
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg r10, r10
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg rcx, rcx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r9, r9
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x18], 0x696547a9
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x1c], 0x285ad8eb
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x24], 0xaaf1b75
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x40], 0x4f53a5ab
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xchg rsp, rsp
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rbx, rbx
shr eax, 1
and ecx, 1
neg ecx
xchg r9, r9
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x44], edx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x14], 0x1f41f0f8
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400834a6
mov rcx, rcx
ret