joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400761e0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x140076203
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor al, byte [rcx - 1]
or r9b, al
sub r8, 1
jne 0x1400761f0
movzx eax, r9b
ret

Function at 0x140076210
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1400d2b70
sub rsp, rax
mov edi, r9d
mov rsi, r8
mov ebx, edx
mov ebp, ecx
test edx, edx
jns 0x1400762a0
cmp qword [0x1401c1b50], 0
je 0x1400762ae
mov ecx, edx
call fcn.140075b20
test rax, rax
je 0x14007626b
mov r9d, edi
mov r8, rsi
mov rdx, rax
mov ecx, ebp
call qword [0x1401c1b50]
mov ecx, ebx
call fcn.140075a20
jmp 0x1400762ae
lea r9, str.pointer___NULL
lea rdx, str..cryptocryptlib.c
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x253
call fcn.140075ed0
mov ecx, 0x16
call fcn.1400d3cc8
mov ecx, 3
call fcn.1400d3980
int3
mov rax, qword [0x1401c1b28]
test rax, rax
je 0x1400762ae
call rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140076f50
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x140076fa7
movzx eax, byte [rcx]
test al, al
je 0x140076fa7
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
mov al, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x140076f70
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x14007a4a0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x28
call fcn.1400d2b70
sub rsp, rax
lea r8, [0x14018b4d0]
lea edx, [rax - 0x26]
lea ecx, [rax - 0x1f]
mov r9d, 0xcb
call fcn.140076210
mov rax, qword [0x1401c1be8]
mov edx, 2
test rax, rax
lea r11, [0x14018b4a0]
lea r8, [0x14018b4e8]
cmovne r11, rax
lea ecx, [rdx + 8]
mov r9d, 0xce
mov qword [0x1401c1be8], r11
add rsp, 0x28
jmp fcn.140076210
Function at 0x1400888e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
mov eax, 0x68
call fcn.1400d2b70
sub rsp, rax
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r12, qword [rsp + 0xb0]
lea edi, [rdx - 1]
mov esi, r9d
lea eax, [rdi - 0x29]
mov r13, r8
cmp r9d, eax
jle 0x140088943
mov edx, 0x79
lea r9, [0x14019fd78]
mov dword [rsp + 0x20], 0x2d
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 0xb]
call fcn.1400700a0
xor eax, eax
jmp 0x140088b1d
cmp edi, 0x29
jge 0x14008896f
mov edx, 0x79
lea r9, [0x14019fd90]
mov dword [rsp + 0x20], 0x33
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 1]
call fcn.1400700a0
xor eax, eax
jmp 0x140088b1d
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov byte [rcx], 0
lea rbp, [rcx + 0x15]
lea rbx, [rcx + 1]
call fcn.1400932c0
movsxd rdx, dword [rsp + 0xb8]
xor r9d, r9d
mov r8, rbp
mov rcx, r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.14009a040
test eax, eax
je 0x140088a36
mov eax, edi
lea rcx, [rbp + 0x14]
xor edx, edx
sub eax, esi
sub eax, 0x29
movsxd r8, eax
call fcn.1400d2f00
movsxd r11, esi
movsxd rax, edi
sub rax, r11
mov r8, rsi
mov rdx, r13
lea rcx, [rax + rbp - 0x14]
mov byte [rax + rbp - 0x15], 1
call fcn.1400cdaf0
mov edx, 0x14
mov rcx, rbx
call fcn.140076460
test eax, eax
jle 0x140088a36
add edi, 0xffffffec
lea rdx, [0x14019fda8]
mov r8d, 0x49
mov ecx, edi
call fcn.140077450
mov rsi, rax
test rax, rax
jne 0x140088a3d
lea r9, [0x14019fdc0]
lea edx, [rax + 0x79]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0x4c
call fcn.1400700a0
xor eax, eax
jmp 0x140088b13
mov r9d, 0x14
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.140088880
test eax, eax
js 0x140088a36
test edi, edi
jle 0x140088a81
mov r11, rsi
mov rcx, rbp
mov r10d, edi
sub r11, rbp
nop word [rax + rax]
movzx eax, byte [r11 + rcx]
inc rcx
xor byte [rcx - 1], al
sub r10, 1
jne 0x140088a70
call fcn.1400932c0
lea rcx, [rsp + 0x30]
mov r9d, edi
mov r8, rbp
mov edx, 0x14
mov qword [rsp + 0x20], rax
call fcn.140088700
test eax, eax
js 0x140088a36
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x31]
lea r9, [rsp + 0x32]
lea r10, [rsp + 0x33]
lea r11, [rsp + 0x34]
sub rdx, rbx
sub r8, rbx
sub r9, rbx
sub r10, rbx
sub r11, rbx
mov ecx, 4
movzx eax, byte [rdx + rbx]
add rbx, 5
xor byte [rbx - 5], al
movzx eax, byte [r8 + rbx - 5]
xor byte [rbx - 4], al
movzx eax, byte [r9 + rbx - 5]
xor byte [rbx - 3], al
movzx eax, byte [r10 + rbx - 5]
xor byte [rbx - 2], al
movzx eax, byte [r11 + rbx - 5]
xor byte [rbx - 1], al
sub rcx, 1
jne 0x140088ad1
mov rcx, rsi
call fcn.1400776e0
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140088ed0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1400d2b70
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x140088fbd
movzx eax, byte [r8]
cmp al, 0x6a
je 0x140088efb
cmp al, 0x6b
jne 0x140088fbd
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp al, 0x6b
jne 0x140088f6c
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x140088f28
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x140088f28
cmp cl, 0xbb
jne 0x140088f5b
inc eax
cmp eax, ebx
jl 0x140088f12
sub ebx, eax
test eax, eax
jne 0x140088f70
mov dword [rsp + 0x20], 0x8a
lea r9, [0x14019fe80]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400700a0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x81
lea r9, [0x14019fe68]
jmp 0x140088f3d
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x140088fa6
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], 0x93
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400700a0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.1400cdaf0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x14019fe50]
mov dword [rsp + 0x20], 0x72
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400700a0
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x14008ef50
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1400d2b70
sub rsp, rax
xor r11d, r11d
mov r10, rdx
mov r9, rcx
test r8d, r8d
jle 0x14008f066
mov qword [rsp], rbx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop word [rax + rax]
cmp r8d, 3
jl 0x14008efe3
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 2]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and edx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
add r9, 4
movzx eax, byte [rax + rbx]
mov byte [r9 - 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 - 1], al
jmp 0x14008f041
movzx ecx, byte [r10]
shl ecx, 0x10
cmp r8d, 2
jne 0x14008effa
movzx eax, byte [r10 + 1]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x14008f029
lea eax, [r8 + 0x3c]
jmp 0x14008f034
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
add r9, 4
sub r8d, 3
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x14008ef80
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x14009a170
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1400d2b70
sub rsp, rax
cmp dword [0x1401adca4], 0
je 0x14009a1b9
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14009a19d
mov dword [0x1401adca4], eax
jmp 0x14009a1b9
xorpd xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.140076410
cmp dword [0x1401adca4], 0
jne 0x14009a1d6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorpd xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.140076410
add rsp, 0x28
ret
Function at 0x1400b3a30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2e8
call fcn.1400d2b70
sub rsp, rax
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rsi, qword [rsp + 0x348]
mov rbp, qword [rsp + 0x358]
mov rdi, rcx
mov rcx, rsi
mov dword [rsp + 0x34], r9d
mov qword [rsp + 0x38], r8
mov ebx, edx
mov r14d, 1
call fcn.1400905b0
movsxd r15, eax
test eax, eax
jns 0x1400b3a93
xor eax, eax
jmp 0x1400b3ccc
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x2e0], r12
call fcn.1400c4330
mov r12d, dword [rsp + 0x350]
test rdi, rdi
jne 0x1400b3ab9
xor ebx, ebx
jmp 0x1400b3add
cmp ebx, 0xffffffff
jne 0x1400b3add
xor ebx, ebx
mov rax, rdi
cmp byte [rdi], bl
je 0x1400b3ad9
cmp ebx, 0x80000000
jae 0x1400b3ad9
inc rax
inc ebx
cmp byte [rax], 0
jne 0x1400b3ac7
btr ebx, 0x1f
lea rcx, [rsp + 0x160]
mov r9, rsi
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x20], 0
call fcn.1400c3fe0
test eax, eax
jne 0x1400b3b14
lea rcx, [rsp + 0x160]
call fcn.1400c4410
xor eax, eax
jmp 0x1400b3cc4
mov qword [rsp + 0x2d8], r13
test r12d, r12d
je 0x1400b3caa
mov esi, dword [rsp + 0x340]
nop dword [rax]
mov eax, r14d
mov r13d, r12d
cmp r12d, r15d
cmovg r13d, r15d
shr eax, 0x18
lea rdx, [rsp + 0x160]
mov byte [rsp + 0x30], al
mov eax, r14d
lea rcx, [rsp + 0x40]
shr eax, 0x10
mov byte [rsp + 0x33], r14b
mov byte [rsp + 0x31], al
mov eax, r14d
shr eax, 8
mov byte [rsp + 0x32], al
call fcn.1400c4370
test eax, eax
je 0x1400b3d07
movsxd r8, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1400c4260
test eax, eax
je 0x1400b3cec
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 4
call fcn.1400c4260
test eax, eax
je 0x1400b3cec
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.1400c4280
test eax, eax
je 0x1400b3cec
lea rcx, [rsp + 0x40]
call fcn.1400c4410
movsxd rdi, r13d
lea rdx, [rsp + 0x280]
mov r8, rdi
mov rcx, rbp
call fcn.1400cdaf0
mov ebx, 1
cmp esi, ebx
jle 0x1400b3c9b
nop word [rax + rax]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.1400c4370
test eax, eax
je 0x1400b3d07
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.1400c4260
test eax, eax
je 0x1400b3cec
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.1400c4280
test eax, eax
je 0x1400b3cec
lea rcx, [rsp + 0x40]
call fcn.1400c4410
test r13d, r13d
jle 0x1400b3c91
lea r8, [rsp + 0x280]
mov rcx, rbp
mov rdx, rdi
sub r8, rbp
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
sub rdx, 1
jne 0x1400b3c80
inc ebx
cmp ebx, esi
jl 0x1400b3c00
inc r14d
add rbp, rdi
sub r12d, r13d
jne 0x1400b3b30
lea rcx, [rsp + 0x160]
call fcn.1400c4410
mov eax, 1
mov r13, qword [rsp + 0x2d8]
mov r12, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x2e8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x160]
call fcn.1400c4410
lea rcx, [rsp + 0x40]
call fcn.1400c4410
xor eax, eax
jmp 0x1400b3cbc
lea rcx, [rsp + 0x160]
call fcn.1400c4410
xor eax, eax
jmp 0x1400b3cbc
Function at 0x1400bcaa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1400d2b70
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1400bcacc
mov rbx, r8
jmp 0x1400bcad2
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1400bcadf
mov rax, rcx
jmp 0x1400bcae4
call fcn.1400720a0
test rax, rax
jne 0x1400bcaf9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1400bcb34
mov r9, r8
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1400bcb10
cmp r8d, dword [rbx + 8]
movsxd rdx, r8d
jge 0x1400bcb5d
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1400bcb41
mov edx, dword [rbx + 8]
mov dword [rdi + 8], edx
test edx, edx
jle 0x1400bcb89
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
sub r8, 8
test rax, rax
jne 0x1400bcb86
dec edx
test edx, edx
jg 0x1400bcb74
mov dword [rdi + 8], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400c3fe0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0xd0
call fcn.1400d2b70
sub rsp, rax
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, qword [rsp + 0x120]
xor eax, eax
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
test r9, r9
je 0x1400c402d
mov eax, 1
mov qword [rcx], r9
jmp 0x1400c4030
mov r12, qword [rcx]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xb8], r13
test rdx, rdx
je 0x1400c4129
mov rcx, r12
call fcn.140090590
mov ebx, 0x80
cmp eax, ebx
mov ebp, eax
jle 0x1400c407a
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x18]
lea rcx, [0x1401b89f8]
call fcn.1400761a0
cmp ebp, edi
jge 0x1400c40d0
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.140099a90
test eax, eax
je 0x1400c4211
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.140099ce0
test eax, eax
je 0x1400c4211
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.140099d00
test eax, eax
je 0x1400c4211
jmp 0x1400c410c
test edi, edi
js 0x1400c40d8
cmp edi, ebx
jle 0x1400c40f0
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x75
call fcn.1400761a0
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call fcn.1400cdaf0
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x1400c4131
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call fcn.1400d2f00
jmp 0x1400c4131
test eax, eax
je 0x1400c4200
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop dword [rax + rax]
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
sub r8, 1
mov byte [rcx - 2], al
jne 0x1400c4150
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.140099a90
test eax, eax
je 0x1400c4211
mov rcx, r12
call fcn.140090590
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.140099ce0
test eax, eax
je 0x1400c4211
lea rdx, [rsp + 0x21]
nop dword [rax]
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
sub rdi, 1
mov byte [rdx - 2], al
jne 0x1400c41b0
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.140099a90
test eax, eax
je 0x1400c4211
mov rcx, r12
call fcn.140090590
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.140099ce0
test eax, eax
je 0x1400c4211
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.140099e60
test eax, eax
jne 0x1400c4215
xor eax, eax
jmp 0x1400c421a
mov eax, 1
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c5f60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.1400d2b70
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x1400c5f98
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x1400c602f
test rdx, rdx
je 0x1400c5ff3
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.1400772e0
test rax, rax
jne 0x1400c601b
lea rdx, [0x1401b9b18]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400c5fe2
inc rbx
test eax, eax
jne 0x1400c5fd0
test ecx, ecx
jne 0x1400c5ff3
mov rcx, rdi
call fcn.1400d326c
test rax, rax
jne 0x1400c6037
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.1400772e0
test rax, rax
je 0x1400c5f86
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call fcn.1400d326c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d3bf8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400d3a60
Function at 0x1400f5e40
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400f5e60
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400f5e60
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x1400f62a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400f7c40]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400f6030
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x1400f62ad
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400f7c40]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400f6030
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x1400f6380
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400f63a0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x1400f63a0
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret