joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f4c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4030cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409760
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d420
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4030a0
cmp byte [0x005e89ef], 0
je 0x45f4d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45c520
jmp 0x4030a0

Function at 0x45f4e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e8ca0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e89ef], 0
je 0x45f515
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e8fe0]
aesenc xmm0, xmmword [0x005e8ff0]
aesenc xmm0, xmmword [0x005e9000]
movq rax, xmm0
ret
jmp 0x409960

Function at 0x45f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e8ca0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e89ef], 0
je 0x45f556
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e8fe0]
aesenc xmm0, xmmword [0x005e8ff0]
aesenc xmm0, xmmword [0x005e9000]
movq rax, xmm0
ret
jmp 0x4099c0

Function at 0x460f40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005e8f60]
mov qword [rsp + 8], rdx
lea r8d, [0x005e8a08]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045f400
add rsp, 0x30
ret

Function at 0x461480
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4614ac
call fcn.0045f400
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e8bc8], rcx
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140014f10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012d20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012d40
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d53
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d7d
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d91
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012da3
xor al, al
jmp 0x140012dc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012dbf
xor al, al
jmp 0x140012dc1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140156000
add rsp, 0x28
jmp 0x14000631c
Function at 0x1400164e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov dword [rsp - 0x44], 0x2a32fbbe
mov dword [rsp - 0xc], 0x2b3f9013
mov dword [rsp - 0x1c], 0x12b613f5
mov eax, 0xea
mov dword [rsp], 0x46009d
jmp 0x140016664
mov word [rsp + 0xc], ax
xor r9d, r9d
mov dword [rsp - 0x40], 0x415b2a79
mov dword [rsp - 0x34], ebp
mov dword [rsp - 0x44], 0x8e01e8e
jmp 0x1400166a7
mov dword [rsp + 4], 0x7300f0
mov r8, rcx
mov dword [rsp + 8], 0x5f00d1
mov qword [rsp + 0x20], r9
mov dword [rsp - 0x3c], 0x53a73e5f
mov rsp, rsp
xchg r14, r14
jmp 0x14001670d
mov dword [rsp - 0x24], 0x38ec8616
mov rax, qword [rsp + 0x20]
Function at 0x1400204b5
Capabilities:
Execute syscall

Disassembly:
sub eax, 0x7f000008
invalid
and al, 0xd4
xor dword [rdx + rax*2 - 0x78b2b8], 0xffffffc7
and al, 0xf0
ror dword [rcx + rcx*4], 0x6f
mov edi, 0xc75340de
and al, 0xc0
mov esi, 0x4d68415b
mov edx, edx
sub rsp, 0x20
lea rax, [0x1400011c0]
jmp 0x140020561
add rsp, 0x20
pop rbx
mov dword [rsp - 0x1c], 0x6def3a0a
xchg r9, r9
jne 0x140020486
je 0x140020486
syscall
test rdi, rdi
mul r12
call rcx
cmp r10, rdi
jb 0x140020e24
movabs r9, 0x42327c000000ebe9
pause
lea ebp, [rbp - 0x9d1b]
call rax
ret 0x30
jmp 0x140020576
mov qword [rcx], rax
test dl, 1
je 0x140020517
mov edx, 0x10
mov dword [rsp - 0x20], 0x33e7b7e4
je 0x1400204e4
jne 0x1400204e4
jns 0x14001fa15
rcr r13d, 0xe
jmp 0x14002051f
ret
pop rcx
mov rbp, rbp
call fcn.140097bd0
mov rax, rbx
jmp 0x14002045d
push rcx
movabs rcx, 0x75e2f37c0399eaeb
jne 0x140020522
jmp 0x14002050e
je 0x140020522
call 0x140020650
add rsp, 0x20
pop rcx
je 0x140020543
jne 0x140020543
dec r11
jmp rax
jmp 0x14002050d
push r13
movabs r13, 0x793572b11cb465eb
jne 0x140020565
jmp 0x1400205cc
je 0x140020565
jmp 0x140020577
ret
call 0x1400204b5
add rsp, 0x20
pop r13
je 0x1400205b1
jne 0x1400205b1
call rax
jp 0x140020342
and edi, 0x10cb1184
jp 0x14001f93f
lea r13d, [rbp + 0x6384]
add r8d, 0x3a247671
or r13d, 0x48dfa0d9
movabs rcx, 0x21c034e412b018eb
pause
dec r8
lea r11d, [rcx + 0x9e3c]
inc rdi
ret 0x28
jmp 0x1400205cb
ret
pop r13
mov rbx, rcx
xchg r14, r14
mov dword [rsp - 0x40], edx
mov dword [rsp - 0x1c], 0x3014947c
je 0x1400205f6
jne 0x1400205f6
neg rbx
rol r13d, 0x77
jo 0x1400207a0
inc r9
movabs rbx, 0x3660f0fffffea0e9
ror ebp, 0xa0
call rcx
call rcx
jmp fcn.14001f6cb
jmp 0x14002049b
add eax, 0x35c1c781
fiadd word [rdi - 0x21644b8]
invalid
outsb dx, byte [rsi]
mov ah, 0x41
or eax, 0xf775aeb6
mov dh, 0xae
jne 0x140020e1f
int3

Function at 0x140026436
Capabilities:
Execute syscall

Disassembly:
xor edx, 0xed93643d
call fcn.140026553
mov rsi, qword [rcx + 0x58]
mov rcx, rbx
call fcn.1400f66d0
lea rdx, [rsp + 0x30]
mov dword [rsp - 0x34], 0x5cbcda9f
xchg rsp, rsp
jmp 0x140025bba
Function at 0x14002f56a
Capabilities:
Encode data using xor

Disassembly:
test byte [rcx - 0x16000010], ah
add eax, dword [rax]
add byte [rax - 0x79], cl
xchg rsi, rsi
mov dword [rsp - 0xc], 0x18af894d
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r8, qword [rax + 0x10]
mov dword [rsp - 0x28], 0x20271dfe
jmp fcn.14002f534

Function at 0x140030348
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg r15, r15
mov dword [rsp - 0x1c], 0x7b881b42
jmp 0x1400304a2
push rbx
xchg rcx, rcx
mov dword [rsp - 0x20], 0x5aea3eff
push rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
je 0x140030380
jne 0x140030380
test ecx, 0xa58c8d67
jmp rax
jmp 0x14003050b
mov dword [rsp - 0x34], 0x729b53e0
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
jmp 0x14003035b
mov dword [rsp - 0x14], ebp
mov dword [rsp - 0x30], 0x44cc883f
mov dword [rsp - 0x20], 0x7353eba1
jmp 0x140030397
Function at 0x14003d7c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x18], esi
mov qword [rsp + 0x20], rdi
push rbp
jmp 0x14003d894
call fcn.14003d9c0
add rsp, 0x30
pop rdi
ret
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov dword [rsp - 0x3c], ecx
jne 0x14003d811
je 0x14003d811
xor r11d, 0x506348f5
jmp rcx
jmp 0x14003e194
mov rbp, rsp
mov dword [rsp - 0x34], 0x73fb4dbc
mov dword [rsp - 0xc], 0x4328d7b3
sub rsp, 0x30
jmp 0x14003da1b
mov dword [rsp - 0x44], 0x28059877
mov dword [rsp - 0x10], 0x280080f8
mov r11, r11
push rdi
jmp 0x14003df0b
mov qword [rbx], rdi
xorps xmm0, xmm0
mov dword [rsp - 0x28], 0x19c20179
jmp 0x14003d8b0
movabs r10, 0x32c5b3000000f5e9
jne 0x14003d979
jmp 0x14003da73
je 0x14003d979
call fcn.14003dad4
jmp 0x14003dd16
lea rdi, [rcx + 8]
mov dword [rbp + 0x10], 0x34e45ef4
mov dword [rsp - 0x40], 0x465eec9e
mov dword [rsp - 0xc], 0xf66a3
push r10
jmp 0x14003d977
pop r10
mov qword [rcx], rdi
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
jmp 0x14003dea6
jbe 0x14003e03b
mov dword [rsp - 0x3c], ebp
mov dword [rsp - 0x18], 0x716471a9
mov dword [rsp - 0x44], 0x2957832
mov rcx, qword [rcx]
mov dword [rsp - 0x28], 0x279c6bd7
mov dword [rsp - 0x2c], 0x3691ad46
mov dword [rsp - 0x18], edx
mov r14, r14
call fcn.140097d00
je 0x14003dbdd
jne 0x14003dbdd
mov ebp, 0x4bee63d1
call rcx
jmp rax
jmp 0x14003d93d
add rsp, 0x30
pop r10
ret
mov dword [rsp - 0x10], edx
mov dword [rsp - 0x44], 0x52d21005
mov dword [rsp - 0x20], 0x3edf858d
xor edi, edi
mov ecx, edi
cmp qword [rbx + 0x38], rdi
jmp 0x14003db11
mov rbx, rcx
xchg r14, r14
mov dword [rsp - 0x28], 0x37933e02
mov byte [rbp + 0x14], 0xd6
je 0x14003def4
jne 0x14003def4
test rdi, rbp
jmp rcx
invalid
jmp 0x14003d7ed
movabs rdi, 0x5a4e4f000000c5e9
jne 0x14003df0d
jmp 0x14003dfd7
je 0x14003df0d
jmp 0x14003d7dd
pop rdi
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov rdx, qword [rbx]
mov dword [rsp - 0x2c], 0x10267e07
mov dword [rsp - 0x38], edi
jmp 0x14003de4a
mov rcx, rcx
xchg r15, r15
mov qword [rcx + 0x38], 5
cmp qword [rcx], rdi
je 0x14003d93d
jmp 0x14003db9d
Function at 0x14003f275
Capabilities:
Execute syscall

Disassembly:
rcl dword [rdi + 0x2f], 0xf
test dword [rcx + 0xd], ebx
add byte [rax], al
je 0x14003f987
js 0x14003f4cf
syscall
dec r10
ret
inc ecx
shl byte [0xedd79f37], cl
add byte [rax], al
lea r15d, [rbp - 0x15e]
jmp 0x14003fcd5
and al, 0xc0
sub eax, 0x896c78aa
jl 0x14003f4fd
loopne 0x14003f4a2
and al, 0xdc
cmp edi, ebp
invalid
in al, dx
cld
invalid
rol edi, 0x58
jmp rax
clc
add byte [rax], al
add byte [rdx + 0x10], bh
add al, ch
in eax, dx
jle 0x14003fce7
add cl, ch
fld dword [rax]
add byte [rax], al
mov dword [rsp - 0x10], esi
push r10
movabs r10, 0xfe6130000015fe9
jne 0x14003fcf0
invalid
jmp 0x14003fe54
je 0x14003fcf0
call fcn.14003fc7d
jmp 0x14003fe4d
pop rbx
mov dword [rsp - 0x20], 0x467e260a
mov rdi, rdi
mov dword [rsp - 0x18], 0x3e00b452
mov dword [rsp - 0x20], 0x7f3f06ab
mov r11, r11
jmp 0x14003fce8
mov dword [rsp - 0x34], 0x7b730f36
mov dword [rsp - 0x2c], 0x98d7df2
mov rax, rbx
add rsp, 0x20
jmp 0x14003fd06
add rsp, 0x20
pop r10
ret
pop r10
ret
Function at 0x14004ca38
Capabilities:
Encode data using xor

Disassembly:
in al, 0xec
add byte [rdi], ch
add byte [rax - 0x77], cl
pop rsp
and al, 0x40
jmp 0x14004bf1f
mov rax, qword [rsp + 0x40]
mov dword [rsp - 0x38], 0x39f6d2d7
mov dword [rsp - 0x38], 0x6cb967c5
mov rsi, rsi
mov dword [rsp - 0x34], 0x1822f250
jmp 0x14004bea7
pop rbx
popf
jmp 0x14004bede
jo 0x14004c466
invalid
adc ch, ah
push rsp
cmp ecx, 0xd850528c
test r14d, 0xe02a6237
je 0x14004c46a
and r8d, 0x9e3f3ef2
jmp rax
Function at 0x140050bbf
Capabilities:
Encode data using xor

Disassembly:
int3
cmpsb byte [rsi], byte [rdi]
mov rcx, qword ds:[rdi + 8]
add esp, 0x20
add cl, byte [rax - 0x42]
jmp 0x140050d3f
movabs rcx, 0x75f48900000128e9
jne 0x140050be6
jmp 0x140050d13
je 0x140050be6
call 0x140050cb0
add rsp, 0x20
jmp 0x140050d11
movabs rdi, 0x314ab400000150e9
jne 0x140050c02
jmp 0x140050d57
je 0x140050c02
call 0x140050bf7
jmp 0x140050d51
add rsp, 0x20
mov dword [rsp - 0x34], edi
mov dword [rsp - 0x24], 0x9b4eddf
mov dword [rsp - 0x38], edx
jmp 0x140050d5d
mov dword [rsp - 0x18], 0x1a2f45da
xchg r11, r11
test bl, 1
je 0x140050c61
mov edx, 0xd10
jmp 0x140050c4f
mov rcx, rdi
mov r12, r12
mov dword [rsp - 0x2c], edi
mov r15, r15
call fcn.140097bd0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
je 0x140050c99
jne 0x140050c99
xor r13d, 0x14ab082
call rcx
push r15
jl 0x140050344
invalid
cmp r10, rbx
rcl edx, 0x8a
push r15
lea r13d, [rdx + 0xf914]
rcr ebp, 0x81
call rcx
test r8, rbp
pause
movabs r14, 0x594464ffffff7ae9
call rax
call rcx
push r11
test r11, rbx
jg 0x14004feb9
jmp 0x140050c18
jmp fcn.14005123d
mov rdi, rcx
mov ebx, edx
add rcx, 0xc88
mov dword [rsp - 0x1c], 0x1ccc9b91
mov r15, r15
mov rdi, rdi
push rcx
je 0x140050cf5
jne 0x140050cf5
xor ebp, 0xe9a684b1
div rsi
lea ebx, [rbx + 0x6aa]
inc rdi
div rsi
rcl r11d, 0x4c
syscall
push rsi
pop rdx
pushf
movabs rdi, 0x5e546ffffffeeae9
test r11, rdx
rcl ecx, 0xfe
pushf
bswap rdi
sub esi, 0x293d377e
ret 0x10
jmp 0x140050be4
pop rcx
ret
pop rcx
call fcn.14004f910
mov rcx, rdi
call fcn.14004e130
je 0x140050d29
jne 0x140050d29
call rcx
movabs rbp, 0x25ea2cffffff03e9
cmp ecx, 0xed30c979
mul rbx
jmp 0x140050ad3
jmp 0x140050c31
mov dword [rsp - 0x20], 0x125d4ae3
sub rsp, 0x20
push rdi
jmp 0x140050c00
add rsp, 0x20
pop rdi
ret
pop rdi
jmp 0x140050cb5
pop rdi
ret

Function at 0x140052600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
nop
sub rsp, 0x11d4ccc0
add rsp, 0x11d4cca0
mov rbx, rdx
mov rdi, rcx
nop
movabs rdx, 0xffffffff5607be95
xor rdx, 0x4daac8fb
xor rdx, 0x6970a329
add rdx, 0x7fffffff
add rdx, 0xd222ab9
nop word [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
xchg r9, r9
jne 0x14005264b
xchg rdx, r12
mov qword [rcx + 0x38], r12
xchg r12, rdx
call fcn.140017bec
mov r14, r14
xor r8d, r8d
mov edx, 0x549d9b09
xor edx, 0x7785df8b
add edx, 0x539def89
xor edx, 0x2b3505b3
cmp qword [rdi + 0x38], r8
jbe 0x1400526f7
mov dword [rsp - 0x30], ecx
sub rbx, rax
mov r9d, 0x410e704e
add r9d, 0xe963baa
add r9d, 0x80782ae
sub r9d, 0x57ac2da7
nop word [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
mov dword [rsp - 0x18], 0x53d72c23
and cx, r9w
ror edx, 4
ror edx, 2
ror edx, 2
xor cx, word [rbx + rax - 2]
inc r8
mov dword [rsp - 0xc], 0x11b90dbc
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x1400526ba
xchg rdx, rdx
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
sub rsp, 0xffffffffffffffe0
xchg r14, r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140052db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r12
mov qword [rsp + 0x10], r12
xchg r12, rsi
push rdi
mov dword [rsp - 0xc], 0x6a374538
sub rsp, 0x20
xchg rsi, r14
mov r14, qword [rcx + 0x38]
xchg r14, rsi
mov rbx, rdx
mov dword [rsp - 0x20], 0x3c1a575c
mov r8, qword [rdx + 0x38]
xchg r8, rcx
mov rdi, r8
xchg r8, rcx
add r8, rsi
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
mov qword [rcx + 0x38], r8
call fcn.140053a50
mov r13, r13
xchg r9, r12
mov r12, qword [rbx]
xchg r9, r12
mov ecx, esi
mov dword [rsp - 0x20], 0x3171d7c4
and ecx, 3
mov r8d, 0x271402e2
add r8d, 0x49aaf84b
sub r8d, 0xba1870c
sub r8d, 0x79a4269
shl ecx, 3
mov edx, r8d
xchg rbp, rbp
ror edx, cl
xchg r9, r10
mov r9, rax
xchg r10, r9
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
jbe 0x140052ee1
mov dword [rsp - 0x3c], 0x62d9ddd
lea rax, [rsi + rsi]
mov r11d, 0x79bbd9f1
xor r11d, 0x4d992597
add r11d, 0x3466fc1
xor r11d, 0xbb5d18e
sub r11d, 0x3cdcbcaa
sub rax, r9
add r10, rax
xchg rbp, rbp
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
mov dword [rsp - 0x14], 0x2e078ed1
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 4
ror edx, 1
and ax, r11w
xchg r11, r11
ror r8d, 6
ror r8d, 1
ror r8d, 1
xor ax, word [r9 - 2]
mov dword [rsp - 0x34], esi
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140052e92
mov dword [rsp - 0x24], edi
mov rbx, qword [rsp + 0x30]
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rsi, qword [rsp + 0x38]
sub rsp, 0xffffffffffffffe0
mov r8, r8
pop rdi
ret
Function at 0x140052f00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r9
mov qword [rsp + 0x10], r9
xchg r9, rsi
xchg rdi, r11
mov qword [rsp + 0x18], r11
xchg r11, rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
add rsp, 0x6569e869
sub rsp, 0x6569e889
xchg r14, r15
mov r15, qword [rcx + 0x38]
xchg r14, r15
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg rsi, r15
mov r15, rcx
xchg rsi, r15
nop
movabs rbx, 0xffffffff506027ef
sub rbx, 0x1e514b8d
xor rbx, 0x1025bf65
xor rbx, 0x19658b7d
add rbx, 0x7fffffff
add rbx, 0x44b11786
inc rbx
mov r15, r15
cmp word [rdx + rbx*2], 0
jne 0x140052f7d
lea r8, [r14 + rbx]
xchg rdi, rdi
xchg r11, rdx
mov r11, r14
xchg r11, rdx
xchg r15, r8
mov qword [rcx + 0x38], r15
xchg r15, r8
call fcn.140053a50
xchg rdx, rdx
mov ecx, r14d
mov edx, 0x608986d4
xor edx, 0x3d193a69
add edx, 0x1a20a14d
xor edx, 0xc7b6b5e
sub edx, 0x1e47039c
and ecx, 3
xchg rsp, rsp
shl ecx, 2
shl ecx, 1
ror edx, cl
test rbx, rbx
mov rsp, rsp
je 0x14005305a
lea r8, [r14 + r14]
mov ecx, 0x6cf82bf5
add ecx, 0xd923789
add ecx, 0x2bd6a44
sub ecx, 0x1b0f189b
xor ecx, 0x6238b5d8
sub r8, rdi
add r8, rax
mov dword [rsp - 0x14], 0x2a05ccf1
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov dword [rsp - 0x2c], 0x4fc7994b
lea rdi, [rdi + 2]
and ax, cx
ror edx, 3
ror edx, 4
ror edx, 1
xor ax, word [rdi - 2]
mov dword [rsp - 0x44], 0x43f2d7cf
mov word [r8 + rdi - 2], ax
sub rbx, 1
jne 0x140053024
mov rbx, qword [rsp + 0x30]
mov r10, r10
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg rsi, rbp
mov rbp, qword [rsp + 0x38]
xchg rbp, rsi
mov rdi, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0x30], 0x6ede40a7
pop r14
ret
Function at 0x140053881
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg r15, rbx
xchg rbp, rdx
mov qword [rsp + 0x18], rdx
xchg rbp, rdx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x10], 0x7c5d408a
xchg r10, rsi
mov qword [rdx], r10
xchg r10, rsi
xor edi, edi
xchg r14, rsi
movups xmmword [r14], xmm0
xchg r14, rsi
xchg r14, rsi
mov rsi, r9
xchg rsi, r14
xchg r8, rbp
mov r8, rbp
xchg r8, rbp
xchg rsi, r14
movups xmmword [r14 + 0x10], xmm0
xchg r14, rsi
xchg rbx, r15
mov r15, rdx
xchg rbx, r15
xchg r8, rsi
movups xmmword [r8 + 0x20], xmm0
xchg r8, rsi
mov qword [rdx + 0x38], rdi
mov dword [rsp - 0x18], 0x6491e936
mov rax, qword [rcx + 0x38]
cmp r8, rax
jae 0x1400539d9
mov dword [rsp - 0x44], esi
sub rax, r8
mov qword [rsp + 0x40], r15
cmp rax, r9
cmovb r14, rax
mov dword [rsp - 0x40], esi
mov qword [rdx + 0x38], r14
xchg r10, rax
mov r10, qword [rcx]
xchg r10, rax
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
cmp rcx, rsi
mov dword [rsp - 0x24], 0x609e2f52
je 0x140053863
call fcn.140097d00
cmp r14, 0x18
jbe 0x1400538a4
mov dword [rsp - 0x1c], ebp
lea rcx, [r14 + r14]
call fcn.140097fa0
xchg rcx, rax
mov qword [rbx], rcx
xchg rcx, rax
test rax, rax
jne 0x1400538b2
mov r12, r12
xchg rsi, r13
mov qword [rbx], r13
xchg rsi, r13
xchg rdi, r9
mov rdi, r9
xchg rdi, r9
jmp 0x1400538d7
mov qword [rbx], rsi
mov rax, rsi
mov dword [rsp - 0x14], 0x36d48771
xorps xmm0, xmm0
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rax
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
xchg r9, r11
mov r11, qword [rbx]
xchg r9, r11
and ebp, 3
mov r8d, 0x35c2e0d4
xor r8d, 0x6140ce24
xor r8d, 0x50dd34db
add r8d, 0x19973e12
add r8d, 0x3f8cd97b
shl ebp, 3
mov dword [rsp - 0xc], 0x3cb54cab
mov edx, r8d
movzx ecx, bpl
ror edx, cl
mov rbp, rbp
cmp qword [rbx + 0x38], rdi
jbe 0x140053998
sub r15, r9
mov ecx, 0x16c161ee
xor ecx, 0x10d39c68
add ecx, 0x167889e7
sub ecx, 0x5cbe7b6
sub ecx, 0x16bf9eb8
nop dword [rax]
mov dword [rsp - 0x10], 0x52d70b20
nop word [rax + rax]
movzx eax, dx
lea r9, [r9 + 2]
mov dword [rsp - 0x1c], 0x65fdc699
xor ax, r8w
ror edx, 6
ror edx, 1
ror edx, 1
and ax, cx
mov rsi, rsi
ror r8d, 5
ror r8d, 1
ror r8d, 2
xor ax, word [r15 + r9 - 2]
inc rdi
xchg rdx, rdx
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x140053952
mov r15, qword [rsp + 0x40]
mov dword [rsp - 0x1c], 0x526066ec
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rsi, rbx
mov rsi, qword [rsp + 0x48]
xchg rsi, rbx
mov rbp, qword [rsp + 0x50]
mov r10, r10
add rsp, 0x20
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
ret
xchg r9, rax
mov r9, rbx
xchg r9, rax
jmp 0x1400539ac

Function at 0x140053df0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008c846
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140141f30]
mov dword [rsp - 0x2c], 0x72cf00c0
cmp qword [0x140142018], 0
jne 0x14008c5b0
syscall
ret