joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9944
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
push rdi
sub rsp, 0x3ac948b3
add rsp, 0x3ac94773
xchg r8, r13
mov rdi, r13
xchg r13, r8
mov rbx, rcx
mov r8d, 0x4cce0a3f
add r8d, 0x21c7e79a
add r8d, 0xa7fbc17
sub r8d, 0x7915acf0
lea rcx, [rsp + 0x40]
mov r15, r15
xor edx, edx
call fcn.140098cf0
xchg rbp, rax
mov rbp, qword [rbx + 0x238]
xchg rbp, rax
lea r8, [rsp + 0x40]
mov rbp, rbp
mov edx, dword [rdi + 0x10]
not rax
movabs rcx, 0x4eead5617955d80e
sub rcx, 0x3b76bc3c
xor rcx, 0x7f45c545
sub rcx, 0x3f742949
add rcx, 0x7fffffff
add rcx, 0x14edada6
mov dword [rsp + 0x30], 0x310b3df7
xor dword [rsp + 0x30], 0x1788caba
add dword [rsp + 0x30], 0xc2b3fee
sub dword [rsp + 0x30], 0x32af3739
and dword [rsp + 0x28], 0
sub rax, rcx
xchg r15, r15
and qword [rsp + 0x20], 0
movabs rcx, 0xb53e1e0a4aa43937
sub rcx, 0x255192ae
add rcx, 0x2c13bbad
add rcx, 0x1f5482bd
add rcx, 0x7fffffff
xor rcx, 0x3491324
ror rax, 0x23
ror rax, 0x14
ror rax, 1
ror rax, 1
ror rax, 1
mov r9d, 0x74cdc906
sub r9d, 0x5a501fba
add r9d, 0x6318e0f4
xor r9d, 0x7d968b40
add rax, rcx
mov dword [rsp - 0x24], 0x26380e32
mov rcx, qword [rdi + 0x20]
call rax
test eax, eax
mov dword [rsp - 0x20], edi
jne 0x1400d9b23
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
cmp byte [rsp + 0x40], 0
xchg rdi, rdi
mov dword [rsp + 0x150], eax
je 0x1400d9af4
xchg rbx, r12
mov rdx, r12
xchg rbx, r12
lea rcx, [rsp + 0x150]
mov dword [rsp - 0x40], esp
mov r8d, 0x776908d1
xor r8d, 0x597b6259
sub r8d, 0xb6b08a0
xor r8d, 0x49a49059
sub r8d, 0x6b03f1b0
inc rbx
xchg r9, r9
call fcn.14008dd20
cmp byte [rbx], 0
jne 0x1400d9a9e
mov eax, dword [rsp + 0x150]
mov dword [rsp - 0x20], ebp
not eax
cmp eax, 0xa2ca6717
je 0x1400d9b16
cmp eax, 0xd7b7e7a8
mov dword [rsp - 0x10], 0x4f3683e2
sete al
jmp 0x1400d9b29
mov al, 0x59
sub al, 0x2a
add al, 0xc
sub al, 0x3a
jmp 0x1400d9b29
xor al, al
mov dword [rsp - 0x10], edi
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
mov dword [rsp - 0x40], 0x7d181f07
ret

Function at 0x1400de1a0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, r11
push rdi
add rsp, 0x1f5e6881
sub rsp, 0x1f5e6941
xchg r13, rax
mov r13, r8
xchg r13, rax
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
xchg rsp, r8
mov rsp, rdx
xchg r8, rsp
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
mov edx, 0x777c2c72
sub edx, 0x2f69af4
sub edx, 0x59fdae08
sub edx, 0x1a87e356
mov rcx, rax
mov rbp, rbp
call fcn.1400dea10
movzx eax, byte [rbx + 0x1f]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x14], 0x55781e0d
and byte [rbx], 0xf8
and al, 0x3f
or al, 0x40
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
mov byte [rbx + 0x1f], al
mov dword [rsp - 0x10], esi
call fcn.1400e1fe0
lea rdx, [rsp + 0x20]
xchg r9, rdi
mov rcx, r9
xchg rdi, r9
call fcn.1400e1f20
mov rbx, qword [rsp + 0xd0]
mov dword [rsp - 0x34], edi
neg rsp
add rsp, 0xffffffffffffff40
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400f2754
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov rsi, rcx
lea rdx, [rcx + 0x298]
lea rcx, [rsp + 0x20]
call fcn.140073bd0
or ebx, 0xffffffff
mov dword [rsp + 0xc0], ebx
mov rdi, qword [rax]
cmp byte [rdi], 0
je 0x1400f27cd
mov rdx, rdi
lea rcx, [rsp + 0xc0]
mov r8d, 0x46eb063
xor r8d, 0x3d17c959
sub r8d, 0x39797939
inc rdi
call fcn.14008dd20
cmp byte [rdi], 0
jne 0x1400f2796
mov ebx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
not ebx
cmp rcx, rax
jne 0x1400f2807
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x479a1423
sub ecx, 0x2dcf06cb
xor ecx, 0x18327a91
sub ecx, 0x1f97749
rep stosb byte [rdi], al
jmp 0x1400f280c
call fcn.1400986e0
mov eax, dword [rsi + 0x2f0]
lea r11, [rsp + 0xb0]
xor eax, 0x5c35
shl eax, 0x10
or eax, dword [rsi + 0x2d8]
mov rsi, qword [r11 + 0x20]
xor eax, ebx
mov rbx, qword [r11 + 0x18]
xor eax, 2
mov rsp, r11
pop rdi
ret

Function at 0x1400f2954
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x708a727e
xor r10d, 0x65727f51
xor r10d, 0x2ecd511a
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x77053f3f
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x1400f29ea
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140147620]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x1400f29ae
mov eax, r9d
ret

Function at 0x1400f2ae8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x3039e8b8
add r10d, 0x2066a80c
add r10d, 0x75dad22
sub r10d, 0x1cc8e1b1
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x77053f3f
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400f2b93
mov r10, qword [rcx + 0x300]
movzx eax, ax
neg rdx
add rdx, 0xfffffffffffffffe
neg rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140147620]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x1400f2b4e
mov eax, r9d
ret
Function at 0x1400f2b98
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
add rsp, 0xffffffffffffff60
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400f2c31
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x692b9bfd
sub ecx, 0x3b0fcd5d
sub ecx, 0x2163dfa2
add ecx, 0x2e7d6d37
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140098590
test rsi, rsi
jle 0x1400f2c4e
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x528a073c
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x1400f2c0d
jmp 0x1400f2c4e
lea rdx, [rsp + 0xb0]
call fcn.1400f2d98
test al, al
je 0x1400f2c99
mov rax, qword [rsp + 0xb0]
lea rcx, [0x14000bb80]
mov qword [rsp + 0x98], 0x369eb4bc
sub qword [rsp + 0x98], 0x2a8d7fc1
xor qword [rsp + 0x98], 0xc1134e3
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1400f1c9c
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400f7690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
nop
add rsp, 0x6142c912
sub rsp, 0x6142c972
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14001794c
mov edi, 0x4b68e259
sub edi, 0x321bd015
add edi, 0x370e05a3
mov r9, rax
mov ecx, edi
mov r15d, 0x121fcc1d
add r15d, 0x256d0ec6
add r15d, 0x26b09d31
sub r15d, 0x5e3d7715
test rbp, rbp
je 0x1400f7761
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x1400f7740
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400f77ac
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400f77ac
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400f778c
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff3f0149ba
add rdx, 0x50165e9
xor rdx, 0x746b22ee
add rdx, 0x7fffffff
add rdx, 0x4f9672b3
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400f77f0
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14001794c
cmp qword [r14 + 0x38], rbx
jbe 0x1400f783c
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x1400f7818
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400f7874
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x19abfb52
add ecx, 0x5db25f67
sub ecx, 0x5dc29083
xor ecx, 0x199bca06
rep stosb byte [rdi], al
jmp 0x1400f7879
call fcn.1400986e0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140104e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffffe0
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140104e30
mov rdi, qword [rcx + 0x640]
jmp 0x140104e37
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140104e50
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140104e53
mov rcx, rsi
cmp rdi, rcx
je 0x14010508d
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140104e7d
nop
sub rdi, 0x524e0524
add rdi, 0x524e052c
jmp 0x140104e37
test r8, r8
je 0x140104f46
cmp rdi, qword [rbx + 0x640]
jb 0x140104f46
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140104f46
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140104ed4
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140104ed7
mov rax, rsi
add rax, 0xfffffffffffffff8
cmp rdx, rax
jae 0x140104eff
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x21e25555
sub rdx, 0x21e2554d
jmp 0x140104eb4
test rcx, rcx
je 0x140104f46
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140104f46
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140104f38
call fcn.1400986e0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140104f68
mov rax, qword [rcx]
mov edx, 0xb853d5e
add edx, 0xba7650f
xor edx, 0x172ca26c
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14010508d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400ef740
mov rcx, qword [rsp + 0x30]
mov r10d, 0x2c6c8816
add r10d, 0x3d56bc23
xor r10d, 0x62ff55e5
sub r10d, 0xb3c113c
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140105045
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140105045
mov r9d, r10d
xor r9d, 0x3b355c35
xor r8d, 0x3b355c35
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x3b355c35
add esi, r10d
nop
sub rdx, 0x49f2f928
add rdx, 0x49f2f930
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x57549ecf
add dword [rcx + 0x34], 0x103c9309
xor dword [rcx + 0x34], 0x5ca46ded
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140104ff6
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105085
sub ecx, r8d
mov dword [rax + 0x14], 0x5472f7de
sub dword [rax + 0x14], 0x7efe641
sub dword [rax + 0x14], 0x114db568
xor ecx, 0x3b355c35
xor r8d, 0x3b355c35
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400eee40
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
nop
sub rsp, 0x2c5d5e52
add rsp, 0x2c5d5e72
pop rdi
ret
Function at 0x140105169
Capabilities:
Encode data using xor

Disassembly:
push rbx
nop
add rsp, 0x62f5bd4f
sub rsp, 0x62f5bd6f
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1401013b0
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140104cc0
mov rcx, rbx
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rbx
jmp 0x1401050b0
push rbx
add rsp, 0xffffffffffffffe0
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1401051eb
lea rdx, [rsp + 0x30]
call fcn.1400ef740
mov r8, qword [rsp + 0x30]
mov r11d, 0x75716030
sub r11d, 0x24cd9e48
sub r11d, 0x50a3c148
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x1401051a1
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x14010519c
mov r8d, r11d
xor r8d, 0x3b355c35
xor r9d, 0x3b355c35
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x3b355c35
add r10d, r11d
nop
sub rax, 0x797a03f7
add rax, 0x797a03ff
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x1be112f2
xor dword [rdx + 0x34], 0x35ac6e3a
xor dword [rdx + 0x34], 0x55842d9c
sub dword [rdx + 0x34], 0x4093f51f
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140105146
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1401051e3
sub r8d, r9d
mov dword [rax + 0x14], 0x68d88896
add dword [rax + 0x14], 0x59cce04
sub dword [rax + 0x14], 0x333ffa65
xor r8d, 0x3b355c35
xor r9d, 0x3b355c35
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400eee40
sub rsp, 0xffffffffffffffe0
pop rbx
ret
Function at 0x140118be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rsi
mov qword [rsp + 0x18], rdi
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x24], 0x338da540
push rbp
xchg rsp, rdx
mov rbp, rdx
xchg rsp, rdx
sub rsp, 0x580d7e8c
add rsp, 0x580d7e0c
xor esi, esi
mov dword [rbp - 0x50], 0x2a93bc3
xor dword [rbp - 0x50], 0x3b89b8bf
add dword [rbp - 0x50], 0x401eea79
xor dword [rbp - 0x50], 0x797a6d42
mov dword [rbp - 0x4c], 0x38440ae
add dword [rbp - 0x4c], 0x5ccbc3c8
sub dword [rbp - 0x4c], 0x18941d18
add dword [rbp - 0x4c], 0x3586f571
sub dword [rbp - 0x4c], 0x7d2fdcbb
mov dword [rbp - 0x48], 0x3ae8915c
add dword [rbp - 0x48], 0x2a2df650
xor dword [rbp - 0x48], 0x170caca8
xor dword [rbp - 0x48], 0x72552ba6
mov dword [rbp - 0x44], 0x3747fba
add dword [rbp - 0x44], 0x7571310
add dword [rbp - 0x44], 0x5d5486d3
sub dword [rbp - 0x44], 0x68041992
mov qword [rbp + 0x10], rsi
mov dword [rsp - 0x24], esp
lea ebx, [rsi + 1]
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
and cl, 3
mov dword [rsp - 0x40], 0x485794ec
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x2909931b
add eax, 0x48659c98
sub eax, 0x39761ad7
add eax, 0x29a881d8
sub eax, 0x11467ecd
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
mov r9, r9
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
add rax, rbx
mov dword [rsp - 0xc], ebp
mov qword [rbp + 0x10], rax
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
cmp rax, 8
mov r15, r15
jb 0x140118c9d
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
mov dword [rsp - 0x3c], esp
xorps xmm0, xmm0
xchg rdx, rax
mov qword [rbp - 0x38], rdx
xchg rdx, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x6e0ff297
xor dword [rbp - 0x40], 0x414500b2
sub dword [rbp - 0x40], 0x1d45a21f
sub dword [rbp - 0x40], 0x11f34ff6
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
mov dword [rsp - 0x10], esi
xor edx, edx
xor ecx, ecx
movups xmmword [rbp - 0x30], xmm0
xchg r13, r13
call fcn.140133e30
xchg r13, rdi
mov r13, rax
xchg r13, rdi
test rax, rax
je 0x140118db5
mov dword [rsp - 0x28], edx
xchg rcx, rsp
mov rsp, rax
xchg rcx, rsp
call fcn.14010f1c0
xchg r12, r12
test al, al
je 0x140118db5
lea rdx, [rbp - 0x40]
xchg rcx, rdi
mov rdi, rcx
xchg rdi, rcx
call fcn.14010e110
test al, al
jne 0x140118db8
mov dword [rsp - 0x10], 0x10870a98
mov bl, sil
xor eax, eax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
xchg rbp, rbp
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov dword [rsp - 0x30], ebx
mov rdi, qword [r11 + 0x28]
mov al, bl
xchg rbx, rsp
mov rsp, qword [r11 + 0x18]
xchg rsp, rbx
mov rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140133e30
Capabilities:
Execute syscall

Disassembly:
xchg r11, r10
mov r11, rcx
xchg r11, r10
mov eax, dword [0x140143004]
cmp qword [0x140143018], 0
jne 0x14008d140
xchg r15, r15
syscall
ret
jmp 0x14008dc78
Function at 0x14013642c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov rdi, rdi
mov qword [rsp + 0x18], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push r12
nop
sub rsp, 8
mov qword [rsp], r14
xchg r12, rsp
mov rbp, r12
xchg r12, rsp
nop
sub rsp, 0xd46c3c0
add rsp, 0xd46c350
xchg r9, rdi
mov r9, r8
xchg rdi, r9
xchg rdi, r14
mov rdi, rdx
xchg r14, rdi
xchg rcx, r13
mov rsi, r13
xchg rcx, r13
movabs r12, 0x165b5c4530a35b86
sub r12, 0x3c1f52b
add r12, 0x155e9cb2
add r12, 0x2ce6ac38
xor r12, 0x28a9023
cmp r9d, 0x60001
mov rsp, rsp
jne 0x14013662c
mov dword [rbp - 0x40], 0x4310d558
sub dword [rbp - 0x40], 0x23db45ec
xor dword [rbp - 0x40], 0x56955866
add dword [rbp - 0x40], 0x2fdb4f04
xor edx, edx
mov dword [rbp - 0x3c], 0xfec2a10
xor dword [rbp - 0x3c], 0x4ece0178
sub dword [rbp - 0x3c], 0x383e4452
add dword [rbp - 0x3c], 0x159efedc
mov dword [rbp - 0x38], 0x435db79d
xor dword [rbp - 0x38], 0x63d60bfd
add dword [rbp - 0x38], 0x5b8699ff
add dword [rbp - 0x38], 0x60520c
add dword [rbp - 0x38], 0x19b17793
mov ecx, edx
mov eax, 0x64d349b3
sub eax, 0x28c569c3
xor eax, 0x4e61d0c9
sub eax, 0x46a4b1ea
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
xchg rsp, rsp
inc rdx
cmp rdx, 0xc
jb 0x140136519
mov r9d, 0x42908320
add r9d, 0x3679373b
sub r9d, 0x70ebf769
xor r9d, 0x299ed46d
xor r9d, 0x21831960
mov qword [rsp + 0x20], 0x217e39da
sub qword [rsp + 0x20], 0x822e07a
add qword [rsp + 0x20], 0x44f116ca
sub qword [rsp + 0x20], 0x5e4c701e
lea r8, [rbp - 0x34]
xchg rsi, rsi
xchg r11, rdi
mov rdx, r11
xchg r11, rdi
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140133a78
mov rbx, rax
lea rdi, [rbp - 0x34]
mov dword [rsp - 0x34], edx
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
xchg rcx, rcx
je 0x140136676
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
mov r10, r10
call fcn.14008f4ac
test dword [rbp - 7], 0x1000
jne 0x140136676
xchg rdx, rdx
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136676
lea rdx, [rbx + 0xc]
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140084de0
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
mov dword [rsp - 0x38], 0x40dfa7db
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
xchg rdi, rdi
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
mov dword [rsp - 0x20], 0x66ba930a
setne al
lea r11, [rsp + 0x70]
xchg r12, rbx
mov r12, qword [r11 + 0x20]
xchg r12, rbx
xchg rsi, r14
mov r14, qword [r11 + 0x28]
xchg rsi, r14
mov rdi, qword [r11 + 0x30]
xchg rsp, r13
mov r13, r11
xchg r13, rsp
nop
mov r14, qword [rsp]
add rsp, 8
pop r12
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
jmp 0x14013663b
Function at 0x6099b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6099bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x6099cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6099b5
lea eax, [rcx + 1]
jmp 0x6099db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x6099ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x6099d4
sub eax, 3
jb 0x609a0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x609a5d
sar eax, 1
movsxd rbp, eax
jb 0x609a44
jmp 0x609a1c
add ebx, ebx
jne 0x609a1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x609a44
inc ecx
add ebx, ebx
jne 0x609a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x609a44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x609a3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x609a2c
add ecx, 2
jmp 0x609a49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00609972
jmp 0x6099bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
mov ecx, 0x190a00
mov dl, 0x1d
mov rbx, rdi
jmp 0x609a9d
mov al, byte [rdi]
add rdi, 1
cmp al, 0x80
jb 0x609a85
cmp al, 0x8f
ja 0x609a85
cmp byte [rdi - 2], 0xf
je 0x609a8b
sub al, 0xe8
cmp al, 1
ja 0x609aae
cmp byte [rdi], dl
jne 0x609aae
mov eax, dword [rdi]
and eax, 0xffffff00
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
sub rcx, 4
mov al, byte [rdi]
add rdi, 1
dec rcx
jne 0x609a85
jmp 0x609ab3
dec rcx
jne 0x609a71
sub rsp, 0x28
lea rdi, [rsi + 0x207000]
mov eax, dword [rdi]
or eax, eax
je 0x609b0e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x209000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x609abe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x609b08
mov qword [rbx], rax
add rbx, 8
jmp 0x609ade
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00609b91], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00609b91
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x609b81
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x14001d2f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1401e2ca8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14001d32d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001d334
mov al, 1
jmp 0x14001d48e
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.1400229b0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.1400229b0
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140022a00
movzx eax, al
test eax, eax
je 0x14001d38b
xor al, al
jmp 0x14001d48e
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001d3fb
cmp dword [rsp + 0x30], 1
je 0x14001d407
cmp dword [rsp + 0x30], 3
je 0x14001d47c
jmp 0x14001d48c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14001d453
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14001d453
xor al, al
jmp 0x14001d48e
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001d46d
mov dword [rsp + 0x34], 1
jmp 0x14001d475
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14001d48e
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001d48e
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401315c0
add rsp, 0xa8
ret