joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5934
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
add rsp, 0xffffffffffffffa0
mov rbx, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rbp - 0x20]
mov r12, r9
call fcn.14007f184
mov r8d, 0x6a2add65
sub r8d, 0x44eb0605
add r8d, 0x1b03b9ec
sub r8d, 0x4043914a
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.14007f214
test al, al
je 0x1400f5bc8
mov eax, dword [rdi + 0x2e8]
lea rdx, [rbp - 0x40]
and dword [rbp - 0x28], 0
mov ecx, 0x36b54f51
add ecx, 0x1c87cc0a
sub ecx, 0xe060d01
and dword [rbp - 0x24], 0
xor eax, ecx
mov dword [rbp - 0x38], eax
mov r8d, 0x1774b8f4
sub r8d, 0x1404b6ed
sub r8d, 0x37001e7
mov eax, dword [rdi + 0x2ec]
xor eax, ecx
mov dword [rbp - 0x40], 0xda1258c
xor dword [rbp - 0x40], 0xd31c869
xor dword [rbp - 0x40], 0x32d8aea3
mov dword [rbp - 0x34], eax
mov eax, dword [rdi + 0x2f4]
xor eax, ecx
mov dword [rbp - 0x3c], 0x3d680be0
xor dword [rbp - 0x3c], 0x3f334a0c
sub dword [rbp - 0x3c], 0x25b41cc
mov dword [rbp - 0x30], eax
mov eax, dword [rdi + 0x30c]
xor eax, ecx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
call fcn.140081070
test al, al
je 0x1400f5bc8
mov r14d, dword [rdi + 0x2d8]
mov edx, 0x7ba5919a
sub edx, 0x1a4ea516
xor edx, 0x2de7994
sub edx, 0x63889500
and r14d, 0x2000
mov eax, r14d
neg eax
sbb rbx, rbx
and rbx, 0xffffffffffff0100
add rbx, 0xffff
mov r15, rbx
shl r15, 4
mov rcx, r15
call fcn.140099740
mov rsi, rax
test rax, rax
je 0x1400f5bc8
mov rdx, qword [rdi + 0x300]
xor r8d, r8d
sub rdx, rax
lea edi, [r8 + 1]
movups xmm0, xmmword [rdx + rax]
add r8, rdi
xorps xmm0, xmmword [0x140147580]
movups xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp r8, rbx
jl 0x1400f5a96
mov rcx, r15
call fcn.1400996c0
neg r14d
mov rdx, rax
mov rcx, rsi
mov rbx, rax
sbb r8d, r8d
and r8d, 0xfff01000
sub r8d, 0x1bb3503d
add r8d, 0x1bc3502d
mov r9d, r8d
call fcn.1400955b0
mov r8d, eax
mov dword [rbp - 0x28], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140081070
mov rcx, rsi
test al, al
jne 0x1400f5b12
call fcn.1400996e0
mov rcx, rbx
jmp 0x1400f5b6d
call fcn.1400996e0
mov rcx, rbx
call fcn.1400996d0
mov eax, dword [rbp - 0x34]
imul eax, dword [rbp - 0x38]
movsxd rcx, eax
shl rcx, 2
call fcn.1400996c0
mov r8d, dword [rbp - 0x34]
mov rdx, rax
imul r8d, dword [rbp - 0x38]
mov rcx, r12
mov rbx, rax
shl r8d, 2
mov r9d, r8d
call fcn.1400955b0
mov r8d, eax
mov dword [rbp - 0x24], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140081070
mov rcx, rbx
test al, al
jne 0x1400f5b77
call fcn.1400996d0
jmp 0x1400f5bc8
call fcn.1400996d0
lea rcx, [rbp - 0x20]
call fcn.1400812f0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140080838
test al, al
je 0x1400f5bc8
mov r8d, 0x62ef5e1
add r8d, 0x4a8bb08d
xor r8d, 0x9373d79
sub r8d, 0x598d9af7
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140081070
test al, al
jne 0x1400f5bcb
xor dil, dil
lea rcx, [rbp - 0x20]
call fcn.14007f20c
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400f85c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
sub rsp, 0x46361c4c
add rsp, 0x46361bec
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140017bb4
mov edi, 0x1f961b61
sub edi, 0x100096fb
add edi, 0x20c89de2
mov r9, rax
mov ecx, edi
mov r15d, 0x12dbd585
sub r15d, 0xe3fb366
sub r15d, 0x49c2120
test rbp, rbp
je 0x1400f868a
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x1400f8669
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400f86d5
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400f86d5
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400f86b5
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff16b3ae1c
add rdx, 0x57a8e1da
add rdx, 0x7fffffff
xor rdx, 0x11a3700a
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400f8712
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140017bb4
cmp qword [r14 + 0x38], rbx
jbe 0x1400f875e
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x1400f873a
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400f8790
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x7a270649
sub ecx, 0x579823fa
sub ecx, 0x228ee21f
rep stosb byte [rdi], al
jmp 0x1400f8795
call fcn.140099810
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140105cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140105d26
mov rdi, qword [rcx + 0x640]
jmp 0x140105d2d
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140105d46
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140105d49
mov rcx, rsi
cmp rdi, rcx
je 0x140105f79
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140105d73
nop
add rdi, 0x58250054
sub rdi, 0x5825004c
jmp 0x140105d2d
test r8, r8
je 0x140105e37
cmp rdi, qword [rbx + 0x640]
jb 0x140105e37
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140105e37
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140105dca
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140105dcd
mov rax, rsi
neg rax
add rax, 8
neg rax
cmp rdx, rax
jae 0x140105df0
mov rax, qword [rdx + 8]
mov qword [rdx], rax
sub rdx, 0xfffffffffffffff8
jmp 0x140105daa
test rcx, rcx
je 0x140105e37
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140105e37
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140105e29
call fcn.140099810
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140105e5f
mov rax, qword [rcx]
mov edx, 0x5b010f0e
xor edx, 0x71695e5d
xor edx, 0xa332505
sub edx, 0x205b7455
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x140105f79
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f0390
mov rcx, qword [rsp + 0x30]
mov r10d, 0x3bb34915
xor r10d, 0x579de7bc
sub r10d, 0x6c2eae09
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140105f2a
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140105f2a
mov r9d, r10d
xor r9d, 0x45370e5a
xor r8d, 0x45370e5a
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x45370e5a
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x195a952e
add dword [rcx + 0x34], 0x1c1e9d1d
add dword [rcx + 0x34], 0xfbddc0f
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140105ee6
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105f71
sub ecx, r8d
mov dword [rax + 0x14], 0x7e0aec78
sub dword [rax + 0x14], 0x5941cc02
add dword [rax + 0x14], 0x1e9964f
xor dword [rax + 0x14], 0x6385b89f
xor ecx, 0x45370e5a
xor r8d, 0x45370e5a
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400efb00
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
nop
sub rsp, 0x2c081cd8
add rsp, 0x2c081cf8
pop rdi
ret
Function at 0x140105fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140102450
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1400ff760
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140105fa0
push rbx
nop
add rsp, 0x202a6077
sub rsp, 0x202a6097
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1401060ed
lea rdx, [rsp + 0x30]
call fcn.1400f0390
mov r8, qword [rsp + 0x30]
mov r11d, 0x5c4f0034
add r11d, 0x11edc244
sub r11d, 0x17d79229
sub r11d, 0x56652faf
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x14010609c
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140106097
mov r8d, r11d
xor r8d, 0x45370e5a
xor r9d, 0x45370e5a
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x45370e5a
add r10d, r11d
nop
add rax, 0x7cc7d548
sub rax, 0x7cc7d540
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x14f54b21
add dword [rdx + 0x34], 0x3514869e
sub dword [rdx + 0x34], 0x4d2c365
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140106048
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1401060e5
sub r8d, r9d
mov dword [rax + 0x14], 0x26d7a15d
xor dword [rax + 0x14], 0x254653dc
xor dword [rax + 0x14], 0x701c1fd5
xor dword [rax + 0x14], 0x36bae30e
xor r8d, 0x45370e5a
xor r9d, 0x45370e5a
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400efb00
nop
add rsp, 0x69089018
sub rsp, 0x69088ff8
pop rbx
ret
Function at 0x140119c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x20], 0xaa3f157
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov dword [rsp - 0x38], edi
xor esi, esi
mov dword [rbp - 0x50], 0x76575d56
sub dword [rbp - 0x50], 0x28f0868c
sub dword [rbp - 0x50], 0xafc6a29
xor dword [rbp - 0x50], 0x421a6cb9
mov dword [rbp - 0x4c], 0x677a4c12
add dword [rbp - 0x4c], 0xda5ca2f
xor dword [rbp - 0x4c], 0x6fe62b55
xor dword [rbp - 0x4c], 0x1ab53d05
mov dword [rbp - 0x48], 0x44890ff1
xor dword [rbp - 0x48], 0x53e4a03b
add dword [rbp - 0x48], 0x51e0e5f1
sub dword [rbp - 0x48], 0x64ffc282
xor dword [rbp - 0x48], 0x434d334
mov dword [rbp - 0x44], 0x5293d1b3
xor dword [rbp - 0x44], 0x61359ab8
sub dword [rbp - 0x44], 0x2b24750d
xor dword [rbp - 0x44], 0x8fdd5f0
xchg r15, rsi
mov qword [rbp + 0x10], r15
xchg rsi, r15
lea ebx, [rsi + 1]
mov r12, r12
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
mov dword [rsp - 0x14], esp
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x3285ea4a
xor eax, 0x1d38c00a
add eax, 0x48af35d5
sub eax, 0x480e3dcd
shr eax, cl
movzx ecx, al
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov r13, r13
mov rax, qword [rbp + 0x10]
add rax, rbx
xchg rdx, rax
mov qword [rbp + 0x10], rdx
xchg rdx, rax
xchg r13, rax
mov r13, qword [rbp + 0x10]
xchg r13, rax
cmp rax, 8
jb 0x140119d4d
xchg rsp, rsp
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
xchg r14, rax
mov qword [rbp - 0x38], r14
xchg r14, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x5f082109
sub dword [rbp - 0x40], 0x501128e1
add dword [rbp - 0x40], 0x3199b3da
xor dword [rbp - 0x40], 0x4082ac12
lea r8, [rbp - 0x40]
xchg rbp, rbp
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
mov r9, r9
xchg rbp, r13
movups xmmword [r13 - 0x30], xmm0
xchg rbp, r13
call fcn.140134490
mov r13, r13
xchg rcx, rax
mov rdi, rcx
xchg rcx, rax
test rax, rax
mov dword [rsp - 0x40], ebp
je 0x140119e59
xchg r13, rcx
mov r13, rax
xchg rcx, r13
call fcn.140110190
test al, al
xchg r10, r10
je 0x140119e59
lea rdx, [rbp - 0x40]
xchg rdi, rcx
mov rdi, rcx
xchg rdi, rcx
call fcn.14010f0c0
test al, al
xchg r14, r14
jne 0x140119e5c
mov bl, sil
xor eax, eax
xchg rcx, rcx
lea r11, [rsp + 0x80]
xchg rsi, rcx
mov rcx, qword [r11 + 0x20]
xchg rsi, rcx
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
mov dword [rsp - 0x10], edi
rep stosb byte [rdi], al
xchg rdx, rdi
mov rdx, qword [r11 + 0x28]
xchg rdi, rdx
mov al, bl
mov r11, r11
mov rbx, qword [r11 + 0x18]
xchg r11, rsp
mov r11, rsp
xchg r11, rsp
pop rbp
mov dword [rsp - 0x34], 0x3028def9
ret
Function at 0x14011e050
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1401422b0]
xchg r8, r8
lea rdx, [rsp + 0x20]
xchg rdx, rcx
mov rbx, rdx
xchg rdx, rcx
xor r9d, r9d
movabs rcx, 0x6cd9dbc80f0a04f0
xor rcx, 0x2303ddb1
xor rcx, 0x5f1106a7
sub rcx, 0x6672c5c4
add rcx, 0x61ec23f4
xor rax, rcx
xchg rsi, rsi
movabs rcx, 0x5d5ec119336de7a6
xor rcx, 0x5ab9297a
sub rcx, 0x4621edbc
sub rcx, 0x10e611d2
ror rax, 0xb
ror rax, 9
ror rax, 0xe
ror rax, 1
xor rax, rcx
lea r8d, [r9 + 8]
mov r13, r13
movabs rcx, 0x455f8f6b37536c76
sub rcx, 0x2100da09
xor rcx, 0xba4f14a
sub rcx, 0xdabe98d
add rcx, 0x14355c02
add rax, rcx
xchg rbp, rbp
movabs rcx, 0x2baad47601873a50
add rcx, 0x3bdc1ba4
xor rcx, 0x71c68e44
add rcx, 0x7fffffff
sub rcx, 0x2ca760a9
ror rax, 0x12
ror rax, 2
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
mov dword [rsp - 0x24], ebp
xor ecx, ecx
call rax
lea rcx, [rbx + 8]
mov r13, r13
xorps xmm0, xmm0
mov qword [rbx], rcx
xchg rcx, r12
movups xmmword [r12], xmm0
xchg r12, rcx
xchg r14, rcx
movups xmmword [r14 + 0x10], xmm0
xchg rcx, r14
xchg rbp, rcx
movups xmmword [rbp + 0x20], xmm0
xchg rcx, rbp
test eax, eax
xchg rcx, rcx
je 0x14011e298
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff378cf6a7
xor rdx, 0x6dcad686
add rdx, 0xced71fa
sub rdx, 0x5b262615
add rdx, 0x7fffffff
add rdx, 0x73f293fa
inc rdx
mov dword [rsp - 0xc], 0x56b11c2a
cmp word [rax + rdx*2], 0
jne 0x14011e1b4
mov rcx, rbx
mov dword [rsp - 0x2c], 0x5f5d76fd
xchg r12, rdx
mov qword [rbx + 0x38], r12
xchg r12, rdx
call fcn.140017bb4
xor r8d, r8d
xchg r13, r13
xchg r15, rax
mov rdx, r15
xchg r15, rax
mov ecx, 0x1bf3acc2
sub ecx, 0x34cff56
add ecx, 0x3f48c179
sub ecx, 0x27914c9d
cmp qword [rbx + 0x38], r8
jbe 0x14011e2a9
lea r9, [rsp + 0x20]
mov dword [rsp - 0x18], 0x5c3ea9ef
mov r10d, 0x69cf815d
add r10d, 0x120f453a
sub r10d, 0x1e719ba2
add r10d, 0x1f20c462
xor r10d, 0x7c8defa8
sub r9, rax
xchg rbp, rbp
nop dword [rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov dword [rsp - 0x10], ebp
ror ecx, 3
ror ecx, 3
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
mov dword [rsp - 0x18], 0x2b2ad87
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011e24e
xchg r12, rbx
mov rax, r12
xchg r12, rbx
add rsp, 0x230
pop rbx
ret
xor r8d, r8d
mov dword [rsp - 0xc], edx
xchg rdi, r8
mov qword [rbx + 0x38], rdi
xchg r8, rdi
mov rax, rbx
xchg r13, r13
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
pop rbx
mov rbp, rbp
ret
Function at 0x14011e510
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rsi, rsi
sub rsp, 0x77015825
add rsp, 0x770155f5
mov r8, qword [0x1401423e0]
mov rbx, rcx
xchg rdi, rdi
not r8
movabs rcx, 0x2bb7d94722b4d3ed
add rcx, 0x245478b5
add rcx, 0x1a212d47
sub rcx, 0xc01d2d4
add rcx, 0x22af8167
sub r8, rcx
mov dword [rsp - 0x40], 0xa1add3f
mov edx, 0x2a2d863d
xor edx, 0x2c1d6d19
add edx, 0x44a2cc4d
add edx, 0x317a1448
sub edx, 0x7c4dcab5
rol r8, 0xc
rol r8, 1
rol r8, 0xa
rol r8, 4
rol r8, 2
rol r8, 2
rol r8, 1
rol r8, 1
movabs rcx, 0x111df74d3bb883f9
add rcx, 0x11834f9e
sub rcx, 0x1bb2236b
add rcx, 0x6bd4ce99
add r8, rcx
lea rcx, [rsp + 0x20]
mov r9, r9
not r8
ror r8, 3
ror r8, 1
ror r8, 4
not r8
call r8
lea rax, [rbx + 8]
mov dword [rsp - 0x24], 0x456c8038
xorps xmm0, xmm0
xchg rcx, rax
mov qword [rbx], rcx
xchg rcx, rax
nop
movabs rdx, 0xffffffff1903dde7
add rdx, 0x15e2fadc
xor rdx, 0x736fd1f7
sub rdx, 0x368c4321
add rdx, 0x7fffffff
add rdx, 0x590339ed
movups xmmword [rax], xmm0
xchg rdi, rdi
xchg r9, rax
movups xmmword [r9 + 0x10], xmm0
xchg r9, rax
xchg rcx, rax
movups xmmword [rcx + 0x20], xmm0
xchg rcx, rax
lea rax, [rsp + 0x20]
xchg rsi, rsi
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011e643
xchg r8, r8
xchg r13, rbx
mov rcx, r13
xchg rbx, r13
mov qword [rbx + 0x38], rdx
call fcn.140017bb4
xor r8d, r8d
mov dword [rsp - 0x2c], 0x584de07d
mov ecx, 0xba3fb25
xor ecx, 0x7052ee55
sub ecx, 0x4f2d28c8
add ecx, 0x39a35a0
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x24], ebp
jbe 0x14011e6f3
lea r9, [rsp + 0x20]
mov r10d, 0x27a21fa4
sub r10d, 0x3567362
xor r10d, 0x274a1c6
add r10d, 0x37a4bd32
sub r10d, 0x5de3c9b7
sub r9, rax
mov r14, r14
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
ror ecx, 6
ror ecx, 1
ror ecx, 1
xor dx, word [r9 + rax - 2]
xchg r15, r15
inc r8
mov word [rax - 2], dx
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x38], esp
jb 0x14011e6c3
xchg rcx, rax
mov rcx, rbx
xchg rcx, rax
sub rsp, 0x6d434a96
add rsp, 0x6d434cc6
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140134490
Capabilities:
Execute syscall

Disassembly:
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x140142ba4]
xchg r14, r14
cmp qword [0x140142bb8], 0
jne 0x14008e1c0
syscall
xchg r13, r13
ret
jmp 0x14008ecfd
Function at 0x140136b74
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
mov rbp, rbp
mov rbp, rsp
nop
sub rsp, 0x148cdda
add rsp, 0x148cd6a
xchg rsi, rdi
mov rsi, r8
xchg rdi, rsi
xchg r14, r15
mov r15, rdx
xchg r15, r14
xchg rcx, r8
mov rsi, r8
xchg r8, rcx
movabs r12, 0x272443bc76d3b8da
sub r12, 0x63bc7fbe
add r12, 0x15d5b581
sub r12, 0x1cd10efc
sub r12, 0x991dd58
cmp r9d, 0x60001
jne 0x140136d88
mov dword [rbp - 0x40], 0x1f63451
add dword [rbp - 0x40], 0x4f5cb322
sub dword [rbp - 0x40], 0x11da5c01
sub dword [rbp - 0x40], 0xec5a0ff
add dword [rbp - 0x40], 0x62d6f200
xor edx, edx
mov dword [rbp - 0x3c], 0x36729f60
sub dword [rbp - 0x3c], 0x356f8e41
add dword [rbp - 0x3c], 0x7990753a
sub dword [rbp - 0x3c], 0x4c2e9be5
add dword [rbp - 0x3c], 0x8e6e62b2
mov dword [rbp - 0x38], 0x35b3bb1f
add dword [rbp - 0x38], 0x13a64ede
xor dword [rbp - 0x38], 0x7c5272e0
xor dword [rbp - 0x38], 0x8b38eea6
mov ecx, edx
mov eax, 0x5291f9af
add eax, 0x5a73740
xor eax, 0x5869d467
add eax, 0x6e8624aa
rol eax, cl
mov dword [rsp - 0x14], ebx
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov dword [rsp - 0x18], edi
jb 0x140136c65
mov r9d, 0x6124bac5
sub r9d, 0x436302f2
sub r9d, 0x15f87810
sub r9d, 0x7c92fc4
mov qword [rsp + 0x20], 0x5bec8228
xor qword [rsp + 0x20], 0x3960f529
xor qword [rsp + 0x20], 0x587f6cc9
add qword [rsp + 0x20], 0x2f7fa72d
xor qword [rsp + 0x20], 0x6a72c2f9
lea r8, [rbp - 0x34]
xchg rdi, rdx
mov rdi, rdx
xchg rdi, rdx
xchg rcx, r15
mov r15, r14
xchg r15, rcx
call fcn.1401340e0
xchg rbx, r12
mov r12, rax
xchg r12, rbx
lea rdi, [rbp - 0x34]
xor eax, eax
mov rsi, rsi
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
je 0x140136dd6
xchg rsi, rsi
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.140090608
mov rsi, rsi
test dword [rbp - 7], 0x1000
jne 0x140136dd6
cmp byte [rbp - 0x1d], 0xe8
mov dword [rsp - 0x3c], edi
jne 0x140136dd6
lea rdx, [rbx + 0xc]
xchg r14, rsp
mov rcx, rsp
xchg r14, rsp
call fcn.140085dc0
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
mov dword [rsp - 0x1c], 0x19a07d77
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
add rdx, rax
xchg r8, r8
xor rdx, r12
xchg r12, rdx
mov qword [rsi + 0x20], r12
xchg rdx, r12
cmp qword [rsi + 0x20], r12
mov dword [rsp - 0x3c], 0x7f23e6ef
setne al
lea r11, [rsp + 0x70]
xchg r13, rbx
mov r13, qword [r11 + 0x20]
xchg rbx, r13
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov dword [rsp - 0x10], 0x71e0df25
xchg r13, rsp
mov r13, r11
xchg r13, rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r12
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
xor al, al
jmp 0x140136d97
Function at 0x1400957f2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140173800
mov rax, rcx
neg rcx
test rax, 7
je 0x14017381d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140173878
test al, 7
jne 0x140173810
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140173831
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401738a2
test dh, dh
je 0x14017389c
shr rdx, 0x10
test dl, dl
je 0x140173896
test dh, dh
je 0x140173890
shr rdx, 0x10
test dl, dl
je 0x14017388a
test dh, dh
je 0x140173884
shr edx, 0x10
test dl, dl
je 0x14017387e
test dh, dh
jne 0x140173831
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140095b4e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140105230
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140104bb0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14010526f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140235020]
jmp 0x140105279
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret