joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b380
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg rcx, r13
mov rdi, r13
xchg rcx, r13
xor edx, edx
xchg rcx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0xa6d4d77
add r8d, 0x1f2747ab
add r8d, 0x6f51011
sub r8d, 0x3089a32b
call fcn.1400997f0
mov rax, qword gs:[0x60]
mov r14, r14
mov r8, qword [rax + 0x18]
xchg rcx, rax
mov rcx, qword [r8 + 0x10]
xchg rcx, rax
xchg rbp, r8
mov rbp, qword [rax]
xchg rbp, r8
test r8, r8
je 0x14008b613
mov dword [rsp - 0x28], edx
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008b613
xchg rsi, rsi
mov edx, 0x4d9024e8
xor edx, 0x4300a028
xor edx, 0x2e4d08cc
add edx, 0x256253bd
sub edx, 0x463fdec5
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov dword [rsp - 0xc], edi
call fcn.14009a300
mov edx, 0x473b5938
xor edx, 0x4310289
sub edx, 0x3629a335
add edx, 0x34bd476f
sub edx, 0x419dff8f
lea rcx, [rsp + 0x30]
mov r15, r15
call fcn.14009a410
test rax, rax
je 0x14008b5e0
xor ecx, ecx
mov dword [rsp - 0x28], ecx
mov rdx, rdi
mov word [rax], cx
movabs rcx, 0xaa472db061d5f350
xor rcx, 0x775d3edf
add rcx, 0x412faa73
add rcx, 0x7fffffff
add rcx, 0x3566b5a
mov r8, qword [0x140142690]
xchg r12, r12
movabs rax, 0x3b8d3e49090bd02f
sub rax, 0x639974
add rax, 0x768438b5
sub rax, 0x424f46e2
add rax, 0xeb5464b
add r8, rcx
lea rcx, [rsp + 0x20]
ror r8, 0xb
ror r8, 1
ror r8, 3
ror r8, 1
ror r8, 1
xor r8, rax
xchg rdi, rdi
ror r8, 8
ror r8, 4
ror r8, 0xc
ror r8, 1
ror r8, 1
ror r8, 1
call r8
movabs rcx, 0xcb8af628409b2759
xor rcx, 0x2b2116ce
sub rcx, 0x5719f95
xor rcx, 0x730d56c
add rcx, 0x7fffffff
sub rcx, 0x406d16a6
lea r8, [rsp + 0x20]
mov dword [rsp - 0x24], esp
add rcx, qword [0x140142680]
lea rdx, [rsp + 0x260]
ror rcx, 8
ror rcx, 1
movabs rax, 0x954da767182c6a26
xor rax, 0x3eb585af
sub rax, 0xe52b169
xor rax, 0x1c43da0f
add rax, 0x2ea1f526
add rax, rcx
mov dword [rsp - 0x1c], 0x6dc3ef48
xchg r9, rbx
mov rbx, r9
xchg r9, rbx
movabs rcx, 0x7c2d9aea31a05ebb
sub rcx, 0x21f12ed9
add rcx, 0xd4f020d
sub rcx, 0x2bc1abd
xor rax, rcx
mov dword [rsp - 0xc], 0x6de55da2
lea rcx, [rsp + 0x30]
call rax
mov rbx, qword [rsp + 0x250]
add rsp, 0x4687061f
sub rsp, 0x468703df
pop rdi
mov dword [rsp - 0x44], edi
ret
mov eax, 0x4ca8b092
sub eax, 0x16dca510
sub eax, 0x92497fb
sub eax, 0x2636332b
add eax, 0xb98ebfa5
xchg r8, rbx
mov r8, qword [rsp + 0x250]
xchg r8, rbx
add rsp, 0x240
pop rdi
xchg r13, r13
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x721919b0
sub eax, 0x13f0f066
add eax, 0x82ec03c
xor eax, 0xf7664d6
add eax, 0x56df73e5
sub rsp, 0x6ebbfd9d
add rsp, 0x6ebbffdd
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008ec00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140142c24], 0
xchg r13, r13
jne 0x14008ecfd
xor edx, edx
lea r8, [0x140142c20]
mov dword [rsp - 0x1c], ecx
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov rbp, rbp
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov rsp, rsp
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x34], ebp
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov rsi, rsi
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rdx, rdx
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x30], esp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x28], ebx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x44], edi
shr eax, 1
and ecx, 1
neg ecx
mov rbp, rbp
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x1c], esp
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x20], esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xchg r14, r14
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x18], esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x18], 0x7e8ecbd8
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x44], edx
cmp edx, 0x100
jb 0x14008ec27
ret
Function at 0x1400940b4
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg r14, rbp
mov qword [rsp + 0x10], r14
xchg r14, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x14], esp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x3834d46a
add rsp, 0x3834d44a
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x24], ebp
xchg r9, r15
mov r9, r8
xchg r9, r15
movzx ebx, byte [rdx]
xchg r12, r12
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 7
shl ebx, 1
dec r8d
mov dword [rsp - 0x10], 0x4cfdb9d0
or ebx, eax
shl edi, 3
shl edi, 5
movzx eax, byte [rdx + 2]
xchg r10, r10
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 1
shl ebx, 2
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x44], 0x3b5dd0eb
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 6
shl edi, 2
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 8
mov dword [rsp - 0xc], ebp
or edi, eax
test r8d, r8d
jle 0x140094210
xchg rdx, r14
mov r14, qword [rcx + 8]
xchg r14, rdx
lea r14d, [r8 - 1]
mov dword [rsp - 0x18], 0x11df2fae
movsxd rax, r8d
shr r14d, 1
inc r14d
xchg r12, r12
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov r12, r12
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
mov dword [rsp - 0x30], 0x3bc7a997
call fcn.140094914
xor ebx, eax
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
mov ecx, ebx
mov dword [rsp - 0x2c], edx
call fcn.140094914
xor edi, eax
sub rsi, 0x18
mov dword [rsp - 0x14], esi
neg rbp
sub rbp, 0xffffffffffffffe8
neg rbp
sub r14, 1
jne 0x1400941bc
mov dword [rsp - 0x40], 0x58638eb8
lea rax, [r15 + 7]
mov ecx, 0x66cf28c7
sub ecx, 0x20bcfe5e
sub ecx, 0x3caf65f1
sub ecx, 0x962c474
mov byte [rax - 4], dil
mov r14, r14
mov byte [rax], bl
dec rax
shr ebx, 4
shr ebx, 3
shr ebx, 1
shr edi, 2
shr edi, 1
shr edi, 5
sub rcx, 1
xchg r10, r10
jne 0x14009422b
mov rbx, qword [rsp + 0x40]
xchg rbp, r12
mov r12, qword [rsp + 0x48]
xchg rbp, r12
xchg rsi, rdi
mov rdi, qword [rsp + 0x50]
xchg rdi, rsi
add rsp, 0x20
pop r15
mov dword [rsp - 0x28], ebx
pop r14
pop rdi
ret
Function at 0x140094280
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
mov qword [rax + 8], rbx
mov dword [rsp - 0x44], 0x1c490c92
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
xchg rdi, rsi
mov qword [rax + 0x20], rsi
xchg rsi, rdi
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
xchg r14, r14
xchg r14, r8
mov r8, r14
xchg r14, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
mov rdx, rdx
shl edi, 1
shl edi, 7
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x30], 0x4c16f1ad
shl ebx, 5
shl ebx, 1
shl ebx, 2
or ebx, eax
movzx eax, byte [rdx + 3]
mov r12, r12
shl ebx, 2
shl ebx, 3
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov rbx, rbx
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 7
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x40], 0x69ae6fd0
shl edi, 7
shl edi, 1
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0x18], edx
test eax, eax
jle 0x14009438b
xchg r11, rsi
mov r11, qword [rcx + 8]
xchg r11, rsi
lea ebp, [rax - 1]
shr ebp, 1
xchg rcx, rcx
inc ebp
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
call fcn.140094914
xor ebx, eax
mov r11, r11
lea rdx, [rsi + 0xc]
mov ecx, ebx
call fcn.140094914
mov rdx, rdx
xor edi, eax
sub rsi, 0xffffffffffffffe8
sub rbp, 1
mov dword [rsp - 0xc], 0x724cc8c2
jne 0x140094350
lea rax, [r14 + 7]
mov ecx, 0x234e5e13
sub ecx, 0x14c0e0f5
xor ecx, 0x5e1d476d
xor ecx, 0x5d067d50
xor ecx, 0xd964727
mov byte [rax - 4], dil
mov byte [rax], bl
xchg rbx, rbx
dec rax
shr ebx, 3
shr ebx, 2
shr ebx, 2
shr ebx, 1
shr edi, 8
sub rcx, 1
jne 0x1400943ac
mov dword [rsp - 0x18], 0x4f07eb81
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, rbp
mov rbp, qword [rsp + 0x40]
xchg rsi, rbp
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x38], edx
add rsp, 0x20
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400945e0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
xchg rcx, rsi
mov qword [rsp + 0x18], rcx
xchg rsi, rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
sub rsp, 0x12f5aec5
add rsp, 0x12f5ae25
movdqa xmm0, xmmword [0x140001e10]
mov r10, r10
xor edi, edi
movdqa xmm1, xmmword [0x140001e50]
xchg rcx, rdx
mov rbx, rcx
xchg rdx, rcx
movdqu xmmword [rbp - 0x39], xmm0
mov rdi, rdi
mov rsi, rcx
mov edx, edi
movdqa xmm0, xmmword [0x140001da0]
mov r12, r12
mov r8d, edi
xchg rsp, rbp
movdqu xmmword [rsp - 0x29], xmm1
xchg rsp, rbp
movdqa xmm1, xmmword [0x140001e40]
xchg rcx, rcx
xchg rbp, r13
movdqu xmmword [r13 - 0x19], xmm0
xchg rbp, r13
movdqu xmmword [rbp - 9], xmm1
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x40], esp
mov eax, 0x7622ef17
add eax, 0x3e31d3c
sub eax, 0x4afd31dd
xor eax, 0x42adf79a
inc rdx
rol eax, cl
mov r14, r14
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140094687
mov r9, r9
cmp dword [rsi + 4], 8
jne 0x140094722
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
mov rbx, rbx
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 6
shl cx, 1
shl cx, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov dword [rsp - 0x40], edi
cmp rdi, 4
jl 0x1400946d2
lea r9, [rbp + 7]
mov dword [rsp - 0x10], esi
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov rcx, rsi
mov r8, r8
call fcn.140094408
jmp 0x1400947e6
cmp dword [rsi], edi
jle 0x1400947e6
mov r15, r15
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x75883ec5
sub r8d, 0x420bbab7
add r8d, 0x283b9893
xor r8d, 0x5bb81ca5
movzx eax, byte [rbx]
mov dword [rsp - 0xc], edx
movzx ecx, byte [rbx + 1]
nop
add rbx, 0x6381afca
sub rbx, 0x6381afc8
shl ax, 8
mov dword [rsp - 0x20], esp
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
mov dword [rsp - 0x28], edi
jne 0x14009474f
lea r9, [rbp + 7]
mov r8d, r14d
mov dword [rsp - 0x30], 0x365324ff
lea rdx, [rbp + 0x67]
xchg rsi, r15
mov rcx, r15
xchg r15, rsi
call fcn.140094408
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
mov dword [rsp - 0x34], esi
sub r8d, r14d
lea rdx, [rbp + 0x67]
sub r8d, 8
mov rsp, rsp
xchg rsi, rbp
mov rcx, rbp
xchg rsi, rbp
call fcn.140094408
inc edi
xchg r8, r8
add r14d, 8
cmp edi, dword [rsi]
jl 0x140094730
mov rdi, rdi
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbx, rcx
mov rcx, qword [r11 + 0x28]
xchg rcx, rbx
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
mov dword [rsp - 0x40], 0x353c6553
rep stosb byte [rdi], al
xchg rsp, rbp
mov rbp, r11
xchg rsp, rbp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
nop
mov rbp, qword [rsp]
add rsp, 8
ret

Function at 0x1400948bc
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov dword [rsp - 0x14], 0x6c389f9e
mov r11d, ecx
test edx, edx
je 0x14009490d
lea ecx, [r11 + r11]
mov dword [rsp - 0xc], 0x4a1e6511
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov r10, r10
test dl, 1
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov dword [rsp - 0x38], 0x7742f27c
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
mov dword [rsp - 0x20], esp
jne 0x1400948ce
mov eax, r10d
ret
Function at 0x14009a670
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xchg rdx, r10
mov qword [rsp], rdx
xchg r10, rdx
xchg r11, rsi
mov qword [rsp + 8], rsi
xchg rsi, r11
xor r11, r11
mov dword [rsp - 0x38], 0x650e78c6
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov dword [rsp - 0x18], esi
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x14009a6e3
and r10w, 0xf000
mov dword [rsp - 0x24], edx
lea r11, [r11 - 0x1000]
mov byte [r11], 0x4f
add byte [r11], 9
xor byte [r11], 0x67
sub byte [r11], 0x3f
cmp r10, r11
bnd jne 0x14009a6c3
mov r14, r14
xchg r10, r13
mov r13, qword [rsp]
xchg r13, r10
xchg r11, rbx
mov rbx, qword [rsp + 8]
xchg rbx, r11
add rsp, 0x10
xchg rdx, rdx
bnd ret
Function at 0x14009fb38
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
mov r10, r10
xor r8d, r8d
xchg rdx, r9
mov rdx, r9
xchg r9, rdx
test rax, rax
mov dword [rsp - 0x20], 0x412d8383
je 0x14009fba8
mov ecx, r8d
mov edx, 0x506088b3
sub edx, 0x2d19f508
sub edx, 0x1ecbca3b
add edx, 0x7021824c
sub edx, 0x6f71dd0
rol edx, cl
mov rbx, rbx
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
xchg r13, r13
inc r8
cmp r8, 0x20
jb 0x14009fb5f
mov al, 0x5a
add al, 0x15
xor al, 0x67
xor al, 7
sub al, 0xe
ret
mov rax, qword [rcx + 0x100]
test rax, rax
je 0x14009fbdc
xchg rsp, rsp
xchg r9, rax
movups xmm0, xmmword [r9]
xchg r9, rax
movups xmmword [rdx], xmm0
xchg r10, r10
movups xmm1, xmmword [rax + 0x10]
xchg rbx, rdx
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rdx
jmp 0x14009fb9d
xorps xmm0, xmm0
xor al, al
xchg rsp, rsp
xchg rdx, r15
movups xmmword [r15], xmm0
xchg r15, rdx
xchg r13, rdx
movups xmmword [r13 + 0x10], xmm0
xchg r13, rdx
ret
Function at 0x1400b6830
Capabilities:
Encode data using xor

Disassembly:
xchg r15, r11
mov r15, rsp
xchg r15, r11
xchg r13, rbx
mov qword [r11 + 8], r13
xchg r13, rbx
xchg r13, rsi
mov qword [r11 + 0x18], r13
xchg rsi, r13
mov qword [r11 + 0x20], rdi
mov r11, r11
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffc0
mov dword [rsp - 0x20], ebp
mov r8, qword [0x1401424c8]
lea rdx, [r11 + 0x10]
xchg rcx, r13
mov rbx, r13
xchg r13, rcx
mov dword [rsp + 0x58], 0x52de09c3
add dword [rsp + 0x58], 0x925c80a
sub dword [rsp + 0x58], 0x4362a733
sub dword [rsp + 0x58], 0x18a12a8a
movabs rcx, 0x95ea59794bb0dfda
sub rcx, 0x338b89ec
xor rcx, 0x347a0fd7
add rcx, 0x7fffffff
add rcx, 0x23b7b90d
movabs rax, 0xe8890d90fe6bb11
add rax, 0x10c08e8a
add rax, 0x108054bf
xor rax, 0x7f15be5f
sub rax, 0x406f8c0e
add r8, rcx
xchg rcx, rcx
lea rcx, [r11 - 0x28]
not r8
sub r8, rax
ror r8, 0x14
ror r8, 0xa
ror r8, 2
ror r8, 2
ror r8, 6
ror r8, 1
ror r8, 1
call r8
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x38], ebx
xchg rsp, rdi
mov qword [rbx], rsp
xchg rdi, rsp
xor esi, esi
mov r13, r13
xchg rdi, r14
movups xmmword [r14], xmm0
xchg rdi, r14
movups xmmword [rdi + 0x10], xmm0
xchg rcx, rcx
xchg rdi, r9
movups xmmword [r9 + 0x20], xmm0
xchg rdi, r9
test eax, eax
xchg rcx, rcx
jne 0x1400b6957
mov qword [rbx + 0x38], rsi
jmp 0x1400b6a95
lea rax, [rsp + 0x20]
mov r9, r9
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
xchg r11, r11
jne 0x1400b6963
mov qword [rbx + 0x38], r14
cmp qword [rbx], rdi
je 0x1400b698c
mov r9, r9
mov rcx, qword [rbx]
call fcn.140099230
cmp r14, 0x18
mov dword [rsp - 0x44], 0x7943e681
jbe 0x1400b69cd
lea rcx, [r14 + r14]
call fcn.140099500
xchg r15, r15
mov qword [rbx], rax
test rax, rax
jne 0x1400b69d7
xchg r14, rdi
mov qword [rbx], r14
xchg rdi, r14
xchg rdi, rsi
mov rcx, rdi
xchg rdi, rsi
jmp 0x1400b6a00
mov qword [rbx], rdi
xchg r11, rax
mov r11, rdi
xchg r11, rax
xorps xmm0, xmm0
xchg r14, r14
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rax
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
xchg rcx, r11
mov r11, qword [rbx]
xchg r11, rcx
mov edx, 0x17f0df22
xor edx, 0x2efbbd4
add edx, 0x2a6e673d
xor edx, 0x786cfe85
add edx, 0x1ad0119f
cmp qword [rbx + 0x38], rsi
mov dword [rsp - 0x2c], 0x56985b68
jbe 0x1400b6a95
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x40], 0x276b6b0b
mov r9d, 0x708b9dd1
sub r9d, 0x97cb73b
xor r9d, 0x59e63444
add r9d, 0x11deef80
xor r9d, 0x50c7c2ad
and ax, r9w
mov dword [rsp - 0x28], esi
ror edx, 1
ror edx, 7
xor ax, word [r8 + rcx]
inc rsi
mov dword [rsp - 0x28], 0x5c1d250f
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400b6a37
mov rsi, rsi
xchg r11, rsi
mov r11, qword [rsp + 0x60]
xchg r11, rsi
xchg rcx, rax
mov rcx, rbx
xchg rcx, rax
xchg rbx, r14
mov r14, qword [rsp + 0x50]
xchg r14, rbx
xchg rdi, r15
mov r15, qword [rsp + 0x68]
xchg r15, rdi
sub rsp, 0xffffffffffffffc0
mov r13, r13
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400d749c
Capabilities:
Execute syscall

Disassembly:
push rbx
xchg rdi, rdi
sub rsp, 0x20
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
mov rcx, qword [rcx + 0x1a8]
cmp rcx, 0xffffffffffffffff
je 0x1400d756b
mov dword [rsp - 0x1c], ecx
xchg r13, rax
mov r13, qword [rbx + 0x258]
xchg r13, rax
movabs rdx, 0x59c0075e541f21b9
sub rdx, 0x273b7c69
add rdx, 0x38189e
add rdx, 0x7fffffff
xor rdx, 0x1d89748e
xor rax, rdx
movabs rdx, 0x685a93e31affcdff
xor rdx, 0x3bcfd5ad
sub rdx, 0x193c35a
add rdx, 0x159d7b2a
ror rax, 0xf
ror rax, 3
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
add rax, rdx
mov dword [rsp - 0x10], 0x9278e47
movabs rdx, 0xc47e7be2f1de66f
sub rdx, 0x23511176
xor rdx, 0x79748c46
xor rdx, 0x14dc8063
xor rdx, 0x29ed6530
not rax
mov dword [rsp - 0x40], 0xd3bdab
sub rax, rdx
call rax
xchg rcx, rsi
mov rsi, qword [rbx + 0x198]
xchg rcx, rsi
test rcx, rcx
mov dword [rsp - 0x18], 0x22da36f9
je 0x1400d75be
cmp qword [rbx + 0x1a0], 0
jne 0x1400d75be
mov rcx, qword [rcx + 0x20]
mov dword [rsp - 0x30], esp
call fcn.140099230
xchg rcx, r8
mov r8, qword [rbx + 0x198]
xchg r8, rcx
call fcn.140099230
mov dword [rsp - 0x44], 0x38eb39b0
mov rcx, qword [rbx + 0x1a0]
test rcx, rcx
je 0x1400d7698
mov rax, qword [rbx + 0x248]
mov dword [rsp - 0x28], ebp
movabs rdx, 0x292019121f332928
add rdx, 0x1bd9dc89
xor rdx, 0x3735f46f
add rdx, 0x7fffffff
xor rdx, 0x5b6d6769
sub rax, rdx
xchg r11, r11
movabs rdx, 0x595211137dfdd77e
xor rdx, 0x4fbda538
xor rdx, 0x387cfcc5
add rdx, 0x2a5e669f
sub rdx, 0x193d6bf6
xor rax, rdx
mov dword [rsp - 0x1c], ebx
movabs rdx, 0x792305444ea65569
xor rdx, 0x608cea38
add rdx, 0x3a32dcd7
add rdx, 0x4e4e4ac5
not rax
mov dword [rsp - 0x2c], ebp
add rax, rdx
movabs rdx, 0x940b2e477762271f
sub rdx, 0x23297feb
add rdx, 0x13ca3d0a
add rdx, 0xdc3187c
rol rax, 0xf
rol rax, 6
rol rax, 4
rol rax, 4
rol rax, 1
rol rax, 1
add rax, rdx
call rax
mov r15, r15
cmp qword [rbx + 0x200], 0
je 0x1400d774a
xchg rbp, rax
mov rbp, qword [rbx + 0x210]
xchg rbp, rax
movabs rcx, 0x52cd93035a1fed3f
add rcx, 0x731c92e
xor rcx, 0x2996d7f4
add rcx, 0x21d52743
not rax
mov dword [rsp - 0x18], esi
ror rax, 0xa
ror rax, 2
ror rax, 9
ror rax, 2
ror rax, 1
sub rax, rcx
movabs rcx, 0xd0b8c6f15859d1cc
sub rcx, 0x57bf7e6e
add rcx, 0x9125539
add rcx, 0x7fffffff
add rcx, 0x3b669f09
ror rax, 0x21
ror rax, 0xd
ror rax, 1
ror rax, 1
ror rax, 4
add rax, rcx
call rax
xchg r14, r14
xchg rcx, r14
mov r14, qword [rbx + 0x200]
xchg rcx, r14
call fcn.14008dc00
xchg r9, r9
and qword [rbx + 0x200], 0
mov rcx, qword [rbx + 0x1f0]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rbx, qword [rsp]
add rsp, 8
jmp fcn.140055f50
Function at 0x1400d9d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x20], 0x7bdb666f
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg r13, rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
mov rbp, rsp
sub rsp, 0x50
xchg rbp, rbp
xor esi, esi
mov dword [rbp - 0x30], 0x690bcac3
sub dword [rbp - 0x30], 0x542844e1
add dword [rbp - 0x30], 0x3212f964
xor dword [rbp - 0x30], 0x46c17f44
mov dword [rbp - 0x2c], 0x5d9a28f5
sub dword [rbp - 0x2c], 0x41c446ee
add dword [rbp - 0x2c], 0x5f779743
xor dword [rbp - 0x2c], 0x78fe3db1
xor dword [rbp - 0x2c], 0x38e4478
xchg rsp, rbx
mov rsp, rcx
xchg rbx, rsp
mov dword [rbp - 0x28], 0x24ebf098
add dword [rbp - 0x28], 0x4c27b3f2
sub dword [rbp - 0x28], 0x3822bc1
sub dword [rbp - 0x28], 0x6d1b7863
mov dword [rbp - 0x24], 0x782e131e
xor dword [rbp - 0x24], 0x72f1970e
add dword [rbp - 0x24], 0x6f9e2c43
sub dword [rbp - 0x24], 0x32670276
sub dword [rbp - 0x24], 0x4810ad3e
mov dword [rbp - 0x20], 0x37409643
add dword [rbp - 0x20], 0x4e3e66c
sub dword [rbp - 0x20], 0x578f4af
sub dword [rbp - 0x20], 0x368387c7
mov qword [rbp + 0x10], rsi
xchg rdi, rdi
mov rax, qword [rbp + 0x10]
xchg rcx, r13
mov r13, qword [rbp + 0x10]
xchg rcx, r13
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x44], edi
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov r12, r12
mov eax, 0x5965067c
add eax, 0x233960b5
xor eax, 0x4e16d7ce
sub eax, 0x21925308
add eax, 0x51bae65e
shr eax, cl
movzx ecx, al
mov rsi, rsi
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
inc rax
xchg r8, r8
xchg r8, rax
mov qword [rbp + 0x10], r8
xchg r8, rax
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
cmp rax, 0xa
jb 0x1400d9e40
mov dword [rsp - 0x14], 0x592e06dc
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.14008b650
mov dword [rsp - 0x38], edx
xchg rbp, rax
mov r8, rbp
xchg rbp, rax
mov qword [rbx + 0x200], rax
xor eax, eax
lea rdi, [rbp - 0x1c]
mov rbp, rbp
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
test r8, r8
mov rbx, rbx
je 0x1400d9f44
lea rdx, [rbx + 0x208]
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1400da650
mov dword [rsp - 0x34], 0x1e57b60f
test al, al
jne 0x1400d9f3c
mov rcx, qword [rbx + 0x200]
xchg r12, r12
call fcn.14008dc00
xor al, al
mov qword [rbx + 0x200], rsi
jmp 0x1400d9f44
mov al, 0x60
xor al, 0x43
add al, 0x5b
xor al, 0x7f
xchg rbx, rsi
mov rsi, qword [rsp + 0x68]
xchg rbx, rsi
xchg rsi, r9
mov r9, qword [rsp + 0x70]
xchg rsi, r9
mov rdi, qword [rsp + 0x78]
mov dword [rsp - 0x24], ecx
sub rsp, 0xffffffffffffffb0
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400deef0
Capabilities:
Encrypt data using curve25519

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
push rdi
xchg rbp, rbp
add rsp, 0x26f5ccfe
sub rsp, 0x26f5cdbe
xchg r8, rax
mov r8, rax
xchg r8, rax
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg r8, rsp
mov rsp, rdx
xchg r8, rsp
xchg r11, rdi
mov r11, rcx
xchg r11, rdi
mov edx, 0x13d505b9
add edx, 0x54be451b
sub edx, 0x63be7e7c
sub edx, 0x4d4cc38
mov rcx, rax
call fcn.1400df760
mov dword [rsp - 0x20], ebx
movzx eax, byte [rbx + 0x1f]
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
mov rbx, rbx
and al, 0x3f
or al, 0x40
xchg rdx, r13
mov r13, rbx
xchg rdx, r13
mov byte [rbx + 0x1f], al
mov dword [rsp - 0xc], ebx
call fcn.1400e2e10
lea rdx, [rsp + 0x20]
xchg rbx, rdi
mov rcx, rbx
xchg rbx, rdi
call fcn.1400e2d30
mov dword [rsp - 0x40], edi
mov rbx, qword [rsp + 0xd0]
neg rsp
add rsp, 0xffffffffffffff40
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret