joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011dae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x1401423e0]
mov rbx, rcx
mov dword [rsp - 0x34], ebx
movabs rcx, 0x750c990c6c928e82
sub rcx, 0x4237b8aa
add rcx, 0x27553a08
sub rcx, 0x2d5ad81b
xor rcx, 0x2d26c4a1
mov edx, 0x6726d3fa
add edx, 0x68e9d80
xor edx, 0x765b9d13
sub edx, 0x1beeeb65
xor rax, rcx
movabs rcx, 0x3fd842816c092fe2
add rcx, 0x65531d5
xor rcx, 0x41350e7
add rcx, 0x6fb4610a
sub rax, rcx
movabs rcx, 0x35e61d5f520eb6f2
sub rcx, 0x1a7b8967
add rcx, 0x346e71da
sub rcx, 0x4df5a2b2
add rcx, 0x7fffffff
xor rcx, 0x527b08b6
xor rax, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x30], esi
ror rax, 0x15
call rax
lea rax, [rbx + 8]
xchg r13, r13
xorps xmm0, xmm0
xchg rcx, rax
mov qword [rbx], rcx
xchg rcx, rax
nop
movabs rdx, 0xffffffff48ee9784
add rdx, 0x1d7a8e11
sub rdx, 0x3c2cc94b
xor rdx, 0x709714ff
add rdx, 0x7fffffff
add rdx, 0x2554b74b
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
lea rax, [rsp + 0x20]
nop dword [rax + rax]
mov rsp, rsp
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011dc04
mov dword [rsp - 0x1c], esp
xchg r10, rbx
mov rcx, r10
xchg rbx, r10
mov qword [rbx + 0x38], rdx
mov dword [rsp - 0x34], 0x3158ad89
call fcn.140017bbc
xor r8d, r8d
mov edx, 0x52d20486
sub edx, 0x2c3af856
xor edx, 0xaadad5f
add edx, 0x11cee86b
xor edx, 0xc0ae03c
cmp qword [rbx + 0x38], r8
jbe 0x14011dcbb
lea r9, [rsp + 0x20]
mov r8, r8
mov r10d, 0x1a564772
xor r10d, 0x6a063897
sub r10d, 0x6abdfad4
xor r10d, 0x76e11ea1
sub r10d, 0x73739ab1
sub r9, rax
movzx ecx, dx
mov dword [rsp - 0xc], esp
lea rax, [rax + 2]
and cx, r10w
ror edx, 8
mov r11, r11
xor cx, word [r9 + rax - 2]
inc r8
mov word [rax - 2], cx
mov dword [rsp - 0x24], 0x5640508a
cmp r8, qword [rbx + 0x38]
jb 0x14011dc87
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x451f9ae
sub rsp, 0x451f77e
pop rbx
mov dword [rsp - 0x20], 0x315fe262
ret
Function at 0x140133f70
Capabilities:
Execute syscall

Disassembly:
xchg r13, r10
mov r13, rcx
xchg r10, r13
mov eax, dword [0x140142ba4]
mov dword [rsp - 0x24], esi
cmp qword [0x140142bb8], 0
jne 0x14008d310
syscall
mov r10, r10
ret
jmp 0x14008de6c
Function at 0x1401365c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rsi, rsi
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
push r12
nop
sub rsp, 8
mov qword [rsp], r14
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
neg rsp
sub rsp, 0xffffffffffffff90
neg rsp
xchg r8, rdi
mov r8, rdi
xchg rdi, r8
xchg r14, r9
mov r9, rdx
xchg r9, r14
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
movabs r12, 0x648463817d8d362b
xor r12, 0x7840c07f
add r12, 0x213cd8af
xor r12, 0x7133ed70
cmp r9d, 0x60001
xchg r13, r13
jne 0x1401367cf
mov dword [rbp - 0x40], 0x5c285639
add dword [rbp - 0x40], 0x1ad1fe23
xor dword [rbp - 0x40], 0x6641820a
add dword [rbp - 0x40], 0x4b3a7c1a
sub dword [rbp - 0x40], 0x22195c0a
xor edx, edx
mov dword [rbp - 0x3c], 0x1936b10b
add dword [rbp - 0x3c], 0x34f6a862
xor dword [rbp - 0x3c], 0x45eb8e20
add dword [rbp - 0x3c], 0x678d1fec
sub dword [rbp - 0x3c], 0x5dcc0fc6
mov dword [rbp - 0x38], 0x6e2c0a2d
sub dword [rbp - 0x38], 0x6a93b617
xor dword [rbp - 0x38], 0x6aac99dc
add dword [rbp - 0x38], 0xb977291
sub dword [rbp - 0x38], 0x4e500c73
mov ecx, edx
mov eax, 0x26505316
sub eax, 0x214f5626
xor eax, 0x6666be4a
sub eax, 0x258f3a93
rol eax, cl
mov r10, r10
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
mov rbp, rbp
cmp rdx, 0xc
jb 0x1401366b6
mov r9d, 0x793f8554
xor r9d, 0x5c32f901
sub r9d, 0xb542f79
xor r9d, 0x19b94323
mov qword [rsp + 0x20], 0x3a23580b
sub qword [rsp + 0x20], 0x9765de5
add qword [rsp + 0x20], 0xfd56121
sub qword [rsp + 0x20], 0x40825b3b
lea r8, [rbp - 0x34]
mov dword [rsp - 0x20], ebp
xchg rsi, rdi
mov rdx, rsi
xchg rdi, rsi
mov rcx, r14
call fcn.140133bdc
mov dword [rsp - 0x20], 0x6212fd07
xchg rbx, rcx
mov rcx, rax
xchg rbx, rcx
lea rdi, [rbp - 0x34]
mov rdx, rdx
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
xchg rsi, rsi
test rbx, rbx
je 0x14013680c
lea rdx, [rbp - 0x28]
mov rbp, rbp
lea rcx, [rbx + 0xc]
call fcn.14008f640
test dword [rbp - 7], 0x1000
mov dword [rsp - 0x10], edx
jne 0x14013680c
cmp byte [rbp - 0x1d], 0xe8
jne 0x14013680c
mov rbx, rbx
lea rdx, [rbx + 0xc]
mov rcx, r14
call fcn.140085160
movzx edx, byte [rbp - 0x28]
mov dword [rsp - 0x14], ebx
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
mov r11, r11
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
mov dword [rsp - 0x44], 0x537d34a7
cmp qword [rsi + 0x20], r12
setne al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
xchg r11, r11
mov rsi, qword [r11 + 0x28]
xchg rdi, r12
mov r12, qword [r11 + 0x30]
xchg rdi, r12
mov rsp, r11
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rbp
mov r11, r11
ret
xor al, al
jmp 0x1401367d6