joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f35e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400f3679
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x1daeec61
sub ecx, 0x1b17469b
add ecx, 0x4a6db42e
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400993a0
test rsi, rsi
jle 0x1400f3696
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x7f884e56
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x1400f3655
jmp 0x1400f3696
lea rdx, [rsp + 0xb0]
call fcn.1400f37f0
test al, al
je 0x1400f36e1
mov rax, qword [rsp + 0xb0]
lea rcx, [0x14000bb80]
mov qword [rsp + 0x98], 0x7b7b1a4f
sub qword [rsp + 0x98], 0x336600cf
sub qword [rsp + 0x98], 0x48151968
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1400f2788
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400f56cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rbp - 0x20]
mov r12, r9
call fcn.14007f248
mov r8d, 0x76b18e28
xor r8d, 0x7510be2a
xor r8d, 0x3a13000
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.14007f2dc
test al, al
je 0x1400f595e
mov eax, dword [rdi + 0x2e8]
lea rdx, [rbp - 0x40]
and dword [rbp - 0x28], 0
mov ecx, 0x60b8278e
add ecx, 0x7d9f91b
sub ecx, 0x170e47e7
sub ecx, 0x47e7ece
and dword [rbp - 0x24], 0
xor eax, ecx
mov dword [rbp - 0x38], eax
mov r8d, 0x1255e51d
add r8d, 0x5a6b6ed8
xor r8d, 0x6cc153d5
mov eax, dword [rdi + 0x2ec]
xor eax, ecx
mov dword [rbp - 0x40], 0x6de70f07
sub dword [rbp - 0x40], 0x61595aa8
xor dword [rbp - 0x40], 0x157ddf88
xor dword [rbp - 0x40], 0x2bb82891
mov dword [rbp - 0x34], eax
mov eax, dword [rdi + 0x2f4]
xor eax, ecx
mov dword [rbp - 0x3c], 0x2a09982c
xor dword [rbp - 0x3c], 0x4387575a
sub dword [rbp - 0x3c], 0x698ecf56
mov dword [rbp - 0x30], eax
mov eax, dword [rdi + 0x30c]
xor eax, ecx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], eax
call fcn.140081260
test al, al
je 0x1400f595e
mov r14d, dword [rdi + 0x2d8]
mov edx, 0x57d0ea38
sub edx, 0x21aea3d7
xor edx, 0x5d2d1008
sub edx, 0x6b0f5659
and r14d, 0x2000
mov eax, r14d
neg eax
sbb rbx, rbx
and rbx, 0xffffffffffff0100
neg rbx
add rbx, 0xffffffffffff0001
neg rbx
mov r15, rbx
shl r15, 4
mov rcx, r15
call fcn.140099410
mov rsi, rax
test rax, rax
je 0x1400f595e
mov rdx, qword [rdi + 0x300]
xor r8d, r8d
sub rdx, rax
lea edi, [r8 + 1]
movups xmm0, xmmword [rdx + rax]
add r8, rdi
xorps xmm0, xmmword [0x140146620]
movups xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp r8, rbx
jl 0x1400f583a
mov rcx, r15
call fcn.1400993a0
neg r14d
mov rdx, rax
mov rcx, rsi
mov rbx, rax
sbb r8d, r8d
and r8d, 0xfff01000
sub r8d, 0xfff00010
mov r9d, r8d
call fcn.1400951e0
mov r8d, eax
mov dword [rbp - 0x28], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140081260
mov rcx, rsi
test al, al
jne 0x1400f58af
call fcn.1400993c0
mov rcx, rbx
jmp 0x1400f590a
call fcn.1400993c0
mov rcx, rbx
call fcn.1400993b0
mov eax, dword [rbp - 0x34]
imul eax, dword [rbp - 0x38]
movsxd rcx, eax
shl rcx, 2
call fcn.1400993a0
mov r8d, dword [rbp - 0x34]
mov rdx, rax
imul r8d, dword [rbp - 0x38]
mov rcx, r12
mov rbx, rax
shl r8d, 2
mov r9d, r8d
call fcn.1400951e0
mov r8d, eax
mov dword [rbp - 0x24], eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140081260
mov rcx, rbx
test al, al
jne 0x1400f5914
call fcn.1400993b0
jmp 0x1400f595e
call fcn.1400993b0
lea rcx, [rbp - 0x20]
call fcn.1400814cc
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1400808e0
test al, al
je 0x1400f595e
mov r8d, 0x77b31816
sub r8d, 0xa18a39d
sub r8d, 0x6d9a7459
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140081260
test al, al
jne 0x1400f5961
xor dil, dil
lea rcx, [rbp - 0x20]
call fcn.14007f2d4
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400f8270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14001781c
mov edi, 0x2f8d1ab6
add edi, 0x4ef1f770
xor edi, 0x7fcc2c57
mov r9, rax
mov ecx, edi
mov r15d, 0x48fd08bf
add r15d, 0x25f4d287
sub r15d, 0x4c19956a
sub r15d, 0x22d844dd
test rbp, rbp
je 0x1400f8336
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x1400f8315
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400f8381
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400f8381
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400f8361
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff3143b875
add rdx, 0x59abbf9
xor rdx, 0x3db1d679
add rdx, 0x7fffffff
xor rdx, 0x74905de9
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400f83c5
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.14001781c
cmp qword [r14 + 0x38], rbx
jbe 0x1400f8411
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x1400f83ed
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400f8449
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x127267ed
add ecx, 0x373cc04e
sub ecx, 0x16ebf239
sub ecx, 0x32c335d2
rep stosb byte [rdi], al
jmp 0x1400f844e
call fcn.140099570
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140105780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x1401057b6
mov rdi, qword [rcx + 0x640]
jmp 0x1401057bd
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x1401057d6
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x1401057d9
mov rcx, rsi
cmp rdi, rcx
je 0x140105a09
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x1401057fe
neg rdi
add rdi, 0xfffffffffffffff8
neg rdi
jmp 0x1401057bd
test r8, r8
je 0x1401058c7
cmp rdi, qword [rbx + 0x640]
jb 0x1401058c7
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x1401058c7
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x140105855
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x140105858
mov rax, rsi
sub rax, 8
cmp rdx, rax
jae 0x140105880
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x741faf9b
sub rdx, 0x741faf93
jmp 0x140105835
test rcx, rcx
je 0x1401058c7
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x1401058c7
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x1401058b9
call fcn.140099570
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401058ef
mov rax, qword [rcx]
mov edx, 0xc00c73a
add edx, 0x4842103f
xor edx, 0x560a3b20
sub edx, 0x248ec58
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x140105a09
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f02d0
mov rcx, qword [rsp + 0x30]
mov r10d, 0x1e36a76f
sub r10d, 0x187b4eba
sub r10d, 0x5bb5815
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x1401059ba
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x1401059ba
mov r9d, r10d
xor r9d, 0x4d0559f4
xor r8d, 0x4d0559f4
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x4d0559f4
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0xa0ced96
xor dword [rcx + 0x34], 0x77722895
xor dword [rcx + 0x34], 0x307b9cf7
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140105976
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105a01
sub ecx, r8d
mov dword [rax + 0x14], 0x6af1d155
sub dword [rax + 0x14], 0xfa31f48
sub dword [rax + 0x14], 0x4dcf56fb
add dword [rax + 0x14], 0x3f85fee2
xor ecx, 0x4d0559f4
xor r8d, 0x4d0559f4
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400ef9b0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
pop rdi
ret
Function at 0x140105ad9
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140101d40
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140105630
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140105a20
push rbx
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140105b66
lea rdx, [rsp + 0x30]
call fcn.1400f02d0
mov r8, qword [rsp + 0x30]
mov r11d, 0x5c7e6224
xor r11d, 0x83944aa
sub r11d, 0x1db12f1
xor r11d, 0x526c133d
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140105b15
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140105b10
mov r8d, r11d
xor r8d, 0x4d0559f4
xor r9d, 0x4d0559f4
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x4d0559f4
add r10d, r11d
add rax, 8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x7c5d082a
sub dword [rdx + 0x34], 0xd0cfced
sub dword [rdx + 0x34], 0x1feea3d2
xor dword [rdx + 0x34], 0x2643e9f
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140105ac3
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140105b5e
sub r8d, r9d
mov dword [rax + 0x14], 0x7a32ad36
sub dword [rax + 0x14], 0x1e294f7d
xor dword [rax + 0x14], 0x12fe0850
sub dword [rax + 0x14], 0x1f1fbf5
xor r8d, 0x4d0559f4
xor r9d, 0x4d0559f4
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400ef9b0
nop
sub rsp, 0x1f593f56
add rsp, 0x1f593f76
pop rbx
ret
Function at 0x140119654
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x2c], esi
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
mov qword [rsp + 0x20], rdi
push rbp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
neg rsp
sub rsp, 0xffffffffffffff80
neg rsp
xor esi, esi
mov dword [rbp - 0x50], 0x6a5f9670
xor dword [rbp - 0x50], 0x757a0d20
xor dword [rbp - 0x50], 0x3c3d1e40
sub dword [rbp - 0x50], 0x22ac84ef
mov dword [rbp - 0x4c], 0x7caf2b54
xor dword [rbp - 0x4c], 0x413c42c1
sub dword [rbp - 0x4c], 0xb75c3d2
xor dword [rbp - 0x4c], 0x325fa53f
mov dword [rbp - 0x48], 0x7ccfedb5
xor dword [rbp - 0x48], 0x157a5ad6
sub dword [rbp - 0x48], 0x44d4d975
xor dword [rbp - 0x48], 0x2486ddda
mov dword [rbp - 0x44], 0x29616ccc
xor dword [rbp - 0x44], 0x3a98e33f
xor dword [rbp - 0x44], 0x4c6b844e
xor dword [rbp - 0x44], 0x5fdf0b5e
mov qword [rbp + 0x10], rsi
lea ebx, [rsi + 1]
mov rbp, rbp
mov rax, qword [rbp + 0x10]
xchg rdx, rcx
mov rdx, qword [rbp + 0x10]
xchg rcx, rdx
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x14], edx
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x745626c9
sub eax, 0x6d5360db
xor eax, 0x5c7c8ee
add eax, 0x15112c15
sub eax, 0x1622faa4
shr eax, cl
mov rsp, rsp
movzx ecx, al
xchg r14, rax
mov r14, qword [rbp + 0x10]
xchg r14, rax
xor cx, dx
mov r11, r11
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x10]
add rax, rbx
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
mov rax, qword [rbp + 0x10]
cmp rax, 8
mov rcx, rcx
jb 0x140119701
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov dword [rsp - 0x30], 0x2f626d14
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x49bf16ef
sub dword [rbp - 0x40], 0x2230895e
sub dword [rbp - 0x40], 0xce9fe26
sub dword [rbp - 0x40], 0x1a928f5b
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
xor edx, edx
xchg r15, r15
xor ecx, ecx
xchg rbp, r14
movups xmmword [r14 - 0x30], xmm0
xchg r14, rbp
call fcn.140133c60
mov dword [rsp - 0x24], 0x4e8bf1ad
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
test rax, rax
mov dword [rsp - 0x34], esp
je 0x140119815
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14010fbbc
test al, al
je 0x140119815
mov dword [rsp - 0x44], esi
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14010ead0
test al, al
mov r9, r9
jne 0x140119818
mov bl, sil
xor eax, eax
xchg rcx, rcx
lea r11, [rsp + 0x80]
xchg r9, rsi
mov r9, qword [r11 + 0x20]
xchg r9, rsi
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
mov dword [rsp - 0x24], 0x21c53564
rep stosb byte [rdi], al
xchg rdi, r10
mov r10, qword [r11 + 0x28]
xchg rdi, r10
mov al, bl
xchg r8, rbx
mov r8, qword [r11 + 0x18]
xchg r8, rbx
xchg rsp, rbp
mov rbp, r11
xchg rbp, rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14011da00
Capabilities:
Encode data using xor

Disassembly:
push r12
mov qword [rsp], rbx
sub rsp, 0x31eee1fa
add rsp, 0x31eedfca
mov rdx, qword [0x1401412b0]
mov dword [rsp - 0x3c], ecx
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
movabs rcx, 0xad60528f7ebd3c43
sub rcx, 0x44c1e260
sub rcx, 0x22d48d36
add rcx, 0xe4cb65c
add rcx, 0x605ed49f
movabs rax, 0xb740c572079b6f
sub rax, 0x452c2d0b
add rax, 0x3d6a5a24
xor rax, 0x69152aed
add rdx, rcx
xor r9d, r9d
xchg rsi, rsi
rol rdx, 0x13
rol rdx, 4
rol rdx, 2
rol rdx, 3
rol rdx, 1
xor ecx, ecx
xchg r10, r10
xor rdx, rax
movabs rax, 0xad873d7b839c30
sub rax, 0x4abd490d
sub rax, 0x2be3ef5a
add rax, 0xbcbe894
add rax, 0x7fffffff
add rax, 0x138172d6
ror rdx, 1
mov dword [rsp - 0x38], edx
add rax, rdx
lea r8d, [r9 + 8]
lea rdx, [rsp + 0x20]
xchg r14, r14
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg rsi, rcx
mov qword [rbx], rsi
xchg rcx, rsi
xchg r9, rcx
movups xmmword [r9], xmm0
xchg rcx, r9
xchg rcx, r9
movups xmmword [r9 + 0x10], xmm0
xchg r9, rcx
xchg rcx, rsi
movups xmmword [rsi + 0x20], xmm0
xchg rcx, rsi
test eax, eax
je 0x14011dc21
lea rax, [rsp + 0x20]
mov dword [rsp - 0x10], 0x2f9b3a9e
nop
movabs rdx, 0xffffffff481b1636
sub rdx, 0x2c77e5ba
add rdx, 0x4ded156c
add rdx, 0x7fffffff
add rdx, 0x166fba18
inc rdx
mov dword [rsp - 0x10], 0x34f21624
cmp word [rax + rdx*2], 0
jne 0x14011db39
mov rcx, rbx
mov dword [rsp - 0x10], ecx
mov qword [rbx + 0x38], rdx
call fcn.14001781c
xor r8d, r8d
xchg r11, r11
mov rdx, rax
mov ecx, 0x64771eed
xor ecx, 0x5524acf3
xor ecx, 0x294f2250
sub ecx, 0x11eb76a0
sub ecx, 0x47ddb3d
cmp qword [rbx + 0x38], r8
xchg rdx, rdx
jbe 0x14011dc31
lea r9, [rsp + 0x20]
mov r10d, 0x3d634f8d
sub r10d, 0x37030e54
add r10d, 0x79125657
sub r10d, 0x2c5457df
sub r10d, 0x531e3eb2
sub r9, rax
nop dword [rax + rax]
mov dword [rsp - 0x2c], ebp
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov dword [rsp - 0xc], 0x7252c196
ror ecx, 2
ror ecx, 1
ror ecx, 3
ror ecx, 1
ror ecx, 1
xor ax, word [r9 + rdx - 2]
mov dword [rsp - 0x44], 0x3bcdfb3a
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011dbc5
mov dword [rsp - 0x38], edx
xchg r14, rax
mov r14, rbx
xchg r14, rax
sub rsp, 0x49f62aab
add rsp, 0x49f62cdb
pop rbx
xchg r11, r11
ret
xor r8d, r8d
xchg r8, r8
xchg r8, rdi
mov qword [rbx + 0x38], rdi
xchg r8, rdi
xchg r10, rax
mov r10, rbx
xchg r10, rax
sub rsp, 0x22f5e492
add rsp, 0x22f5e6c2
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14011de60
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov r8, qword [0x1401413e0]
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
rol r8, 5
rol r8, 2
rol r8, 1
rol r8, 1
movabs rcx, 0xee343a907fcbe8f5
sub rcx, 0x4e2b32e4
add rcx, 0x19216a7a
sub rcx, 0x3a8c06e2
add rcx, 0x7fffffff
add rcx, 0x19ec411f
add r8, rcx
movabs rax, 0x613e83cb77b0d6fc
xor rax, 0x184fe895
sub rax, 0x32cf42fb
add rax, 0x3dddf27a
xor rax, 0x5ec9029b
xor r8, rax
mov dword [rsp - 0x28], ebx
lea rcx, [rsp + 0x20]
rol r8, 0x2b
rol r8, 3
rol r8, 9
rol r8, 1
rol r8, 1
rol r8, 1
mov edx, 0x6a47a719
xor edx, 0x2e35520d
sub edx, 0x3831c6be
add edx, 0x3f887256
sub edx, 0x4bc99fa8
not r8
rol r8, 3
rol r8, 0xb
rol r8, 8
call r8
lea rax, [rbx + 8]
mov dword [rsp - 0x44], 0x33095eb4
xorps xmm0, xmm0
xchg r11, rax
mov qword [rbx], r11
xchg r11, rax
nop
movabs rdx, 0xffffffff4a6c6717
xor rdx, 0x7eed951c
sub rdx, 0x4ea27a9
add rdx, 0x7fffffff
add rdx, 0x5068359e
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
xchg r8, rax
movups xmmword [r8 + 0x10], xmm0
xchg r8, rax
movups xmmword [rax + 0x20], xmm0
lea rax, [rsp + 0x20]
mov dword [rsp - 0x28], 0x584f348e
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011df93
mov rdx, rdx
mov rcx, rbx
mov qword [rbx + 0x38], rdx
call fcn.14001781c
xor r8d, r8d
mov dword [rsp - 0x30], edx
mov ecx, 0x304653ad
add ecx, 0x3aae390d
sub ecx, 0x3a012e2e
sub ecx, 0x2f40201b
cmp qword [rbx + 0x38], r8
jbe 0x14011e037
lea r9, [rsp + 0x20]
mov dword [rsp - 0x40], 0x164ceb21
mov r10d, 0x7ebfe394
sub r10d, 0x10ee82cf
add r10d, 0x10b49d23
sub r10d, 0x7e85fce9
sub r9, rax
mov rdi, rdi
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
xchg r15, r15
ror ecx, 5
ror ecx, 2
ror ecx, 1
xor dx, word [r9 + rax - 2]
inc r8
mov word [rax - 2], dx
mov dword [rsp - 0x18], ebp
cmp r8, qword [rbx + 0x38]
jb 0x14011e006
xchg r14, rbx
mov rax, r14
xchg rbx, r14
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
pop rbx
mov dword [rsp - 0xc], 0x5f02ccca
ret
Function at 0x140133c60
Capabilities:
Execute syscall

Disassembly:
xchg r10, rbp
mov rbp, rcx
xchg rbp, r10
mov eax, dword [0x140142004]
cmp qword [0x140142018], 0
mov dword [rsp - 0x1c], esi
jne 0x14008e1b0
syscall
ret
jmp 0x14008eceb
Function at 0x1401363e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r11, r11
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0x1486fb74
mov qword [rsp], r14
xchg r14, rsp
mov rbp, r14
xchg rsp, r14
nop
add rsp, 0x48cc292e
sub rsp, 0x48cc299e
xchg rdi, r8
mov r8, rdi
xchg r8, rdi
xchg rdi, r14
mov rdi, rdx
xchg rdi, r14
xchg rcx, rdx
mov rsi, rdx
xchg rcx, rdx
movabs r12, 0x62d05284659b2040
sub r12, 0x4e3bbe48
add r12, 0x4e36159b
xor r12, 0x892e66d
xor r12, 0x3340dca1
cmp r9d, 0x60001
mov dword [rsp - 0x44], 0x7ac3c475
jne 0x140136622
mov dword [rbp - 0x40], 0x75532688
sub dword [rbp - 0x40], 0xf5f3133
sub dword [rbp - 0x40], 0x574dd65
add dword [rbp - 0x40], 0xaa09d54
sub dword [rbp - 0x40], 0x2a3ecc5b
xor edx, edx
xchg r12, r12
mov dword [rbp - 0x3c], 0x72b5a18
add dword [rbp - 0x3c], 0x3abc7ba5
add dword [rbp - 0x3c], 0x18aebfab
add dword [rbp - 0x3c], 0x2ab86e19
mov dword [rbp - 0x38], 0x462931ae
xor dword [rbp - 0x38], 0x28e1b73a
sub dword [rbp - 0x38], 0x34d122ef
add dword [rbp - 0x38], 0x3b748ec8
sub dword [rbp - 0x38], 0x4b7081a4
mov ecx, edx
mov dword [rsp - 0x24], ebx
mov eax, 0x6560469b
add eax, 0x81a62c2
xor eax, 0x3ebaad7c
xor eax, 0x4ff42089
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
mov dword [rsp - 0x40], ebp
inc rdx
cmp rdx, 0xc
jb 0x1401364ec
mov r9d, 0x754c7f83
sub r9d, 0x5cca929a
xor r9d, 0x4460b391
xor r9d, 0x12bcb785
sub r9d, 0x4e5dd8fe
mov qword [rsp + 0x20], 0x79c5bfff
sub qword [rsp + 0x20], 0x37131965
add qword [rsp + 0x20], 0xf10b253
sub qword [rsp + 0x20], 0x3d0e8bf2
xor qword [rsp + 0x20], 0x14b4ccf7
lea r8, [rbp - 0x34]
xchg rbx, rdi
mov rdx, rbx
xchg rbx, rdi
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.1401338b0
mov rbx, rax
mov rbx, rbx
lea rdi, [rbp - 0x34]
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
mov dword [rsp - 0x24], 0x3c8908da
test rbx, rbx
je 0x14013666d
lea rdx, [rbp - 0x28]
mov dword [rsp - 0x40], edx
lea rcx, [rbx + 0xc]
call fcn.1400905a8
test dword [rbp - 7], 0x1000
xchg rsi, rsi
jne 0x14013666d
cmp byte [rbp - 0x1d], 0xe8
jne 0x14013666d
lea rdx, [rbx + 0xc]
mov dword [rsp - 0x3c], esp
xchg r11, r14
mov rcx, r11
xchg r14, r11
call fcn.140085e80
mov dword [rsp - 0x34], 0x67073aa0
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
mov dword [rsp - 0x20], esp
xchg rcx, rax
mov rcx, qword [rsi + 8]
xchg rcx, rax
xor rax, r12
mov dword [rsp - 0x10], esp
add rdx, rax
xor rdx, r12
xchg rdx, rbp
mov qword [rsi + 0x20], rbp
xchg rbp, rdx
cmp qword [rsi + 0x20], r12
xchg r9, r9
setne al
lea r11, [rsp + 0x70]
xchg rbx, rsp
mov rsp, qword [r11 + 0x20]
xchg rsp, rbx
mov rsi, qword [r11 + 0x28]
mov dword [rsp - 0x20], edi
mov rdi, qword [r11 + 0x30]
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x18], 0x79c15eaf
ret
xor al, al
jmp 0x14013662c
Function at 0x1400020c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
mov rbx, rcx
mov dword [rsp + 0x28], 9
lea rax, str.V_panic:
mov dword [rsp + 0x2c], 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.140002680
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140002770
lea rax, str.v_hash:
mov dword [rsp + 0x58], 8
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x5c], 1
mov dword [rsp + 0x60], 0xfe10
call fcn.140086c00
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [rax]
lea rax, [0x140088494]
mov qword [rsp + 0x84], 1
mov qword [rsp + 0x78], rax
xor eax, eax
movups xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x90], eax
lea edx, [rax + 2]
mov qword [rsp + 0x94], rax
mov dword [rsp + 0x9c], eax
call fcn.140080e60
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140002770
mov ecx, 1
call fcn.140080550
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140002680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
mov rbx, rcx
test rdi, rdi
jne 0x1400026c6
lea rax, str.eprint_NIL_
mov dword [rsp + 0x28], 0xb
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2c], 1
call fcn.140002680
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movsxd rax, dword [rbx + 8]
test eax, eax
jle 0x140002744
mov ecx, 1
mov qword [rsp + 0x40], rsi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rax
test rbx, rbx
jle 0x14000273f
nop dword [rax]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, rax
sub rbx, rax
test rbx, rbx
jg 0x140002720
mov rsi, qword [rsp + 0x40]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]