joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
push rdi
mov dword [rsp - 0x44], ecx
sub rsp, 0x20
movzx eax, word [rcx]
mov edi, edx
xor eax, 0x58fa27f9
xchg r13, r13
xchg rdx, rcx
mov rbx, rdx
xchg rcx, rdx
cmp eax, 0x58fa7db4
jne 0x1400991c2
movsxd rdx, dword [rcx + 0x3c]
xchg rdx, rdx
mov eax, dword [rdx + rcx]
xor eax, 0x58fa27f9
cmp eax, 0x58fa62a9
xchg rdx, rdx
jne 0x1400991c2
mov edx, dword [rdx + rcx + 0x88]
call fcn.140098e10
sub edi, dword [rax + 0x10]
mov dword [rsp - 0x20], 0x16492d0
cmp edi, dword [rax + 0x14]
jae 0x1400991c2
mov edx, dword [rax + 0x1c]
xchg r14, r14
mov rcx, rbx
call fcn.140098e10
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
mov edx, dword [rax + rdi*4]
mov rbx, qword [rsp + 0x30]
xchg rdi, rdi
nop
sub rsp, 0x72642e33
add rsp, 0x72642e53
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.140098e10
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov dword [rsp - 0x18], ebp
add rsp, 0x20
pop rdi
ret
Function at 0x14009d5c5
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r10, r10
push rdi
add rsp, 0xffffffffffffffa0
mov rbx, qword [rcx]
lea rax, [rsp + 0x28]
mov dword [rsp - 0x2c], esp
xorps xmm0, xmm0
xchg r13, rsi
mov qword [rsp + 0x70], r13
xchg r13, rsi
xchg rsi, r11
mov r11, qword [rcx + 0x38]
xchg rsi, r11
lea rcx, [rsp + 0x20]
xchg rsi, rax
mov qword [rsp + 0x20], rsi
xchg rsi, rax
movups xmmword [rsp + 0x28], xmm0
xchg r9, r9
lea rdx, [rsi + 1]
xchg rsp, r8
movups xmmword [r8 + 0x38], xmm0
xchg r8, rsp
xchg rsp, rcx
movups xmmword [rcx + 0x48], xmm0
xchg rcx, rsp
call fcn.1400110e0
mov edx, 0x3f3b86eb
sub edx, 0x1caf74df
add edx, 0x4e2ae653
sub edx, 0x14444060
xor edx, 0x5576a62b
test rsi, rsi
mov dword [rsp - 0x34], esi
je 0x14009d6a8
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x790ad887
sub r9d, 0x76d686ef
xor r9d, 0x36b32f78
xor r9d, 0x34877e1f
nop dword [rax]
mov dword [rsp - 0x10], 0x25060339
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 4
ror edx, 3
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov r12, r12
mov word [rdi - 2], cx
sub r8, 1
jne 0x14009d67c
xchg rcx, rcx
xor ecx, ecx
mov word [rax + rsi*2], cx
mov rcx, qword [rsp + 0x20]
call fcn.14009d740
mov r11, r11
xchg rsi, rcx
mov rsi, qword [rsp + 0x20]
xchg rcx, rsi
mov ebx, eax
mov rsi, qword [rsp + 0x70]
mov r15, r15
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x14009d71a
xor eax, eax
mov r11, r11
lea rdi, [rsp + 0x28]
mov ecx, 0x118e7607
xor ecx, 0x18f264cb
xor ecx, 0x210cd8ef
sub ecx, 0x2870c9f3
rep stosb byte [rdi], al
mov eax, ebx
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0xc], ebx
add rsp, 0x60
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400bb8f0
mov eax, ebx
xchg rbx, rbp
mov rbp, qword [rsp + 0x78]
xchg rbx, rbp
sub rsp, 0xffffffffffffffa0
pop rdi
mov r9, r9
ret
Function at 0x14009ed26
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x60
mov rbx, qword [rcx]
mov rdi, rdi
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov dword [rsp - 0x2c], 0x29775c1
mov ebp, r8d
xchg rsi, r15
mov qword [r11 + 0x10], r15
xchg rsi, r15
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
xchg r15, r15
xchg rsi, r14
mov qword [r11 + 0x18], rsi
xchg rsi, r14
xchg rdx, r14
mov rdx, r14
xchg rdx, r14
xchg rcx, rsp
movups xmmword [rcx + 0x28], xmm0
xchg rcx, rsp
lea rdx, [rsi + 1]
xchg r13, rsp
movups xmmword [r13 + 0x38], xmm0
xchg rsp, r13
xchg rsp, rbx
movups xmmword [rbx + 0x48], xmm0
xchg rbx, rsp
call fcn.1400110e0
mov dword [rsp - 0x44], ebp
mov edx, 0x7e9832d
add edx, 0x6ecd7e5a
sub edx, 0x2c8dba72
add edx, 0x21f147b2
sub edx, 0x63167cf3
test rsi, rsi
je 0x14009ed80
mov rdi, rdi
xchg rbp, rdi
mov rbp, rax
xchg rdi, rbp
sub rbx, rax
mov r8, rsi
mov r11, r11
mov r9d, 0x55770c4a
add r9d, 0x14f5e7c7
xor r9d, 0x4e76226
xor r9d, 0x31d5132
xor r9d, 0x6d96c7fa
nop word [rax + rax]
xchg rdx, rdx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov r8, r8
ror edx, 3
ror edx, 1
ror edx, 2
ror edx, 2
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
xchg r10, r10
sub r8, 1
jne 0x14009ed51
xor ecx, ecx
mov rsp, rsp
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rdx, r15
mov r15, r14
xchg rdx, r15
mov rcx, qword [rsp + 0x20]
mov rsp, rsp
call fcn.14009ee40
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov dword [rsp - 0x3c], 0x50015582
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rbp, rsi
mov rbp, qword [rsp + 0x78]
xchg rbp, rsi
mov rbp, qword [rsp + 0x70]
mov rbp, rbp
cmp rcx, rax
jne 0x14009ee18
xor eax, eax
lea rdi, [rsp + 0x28]
mov rdi, rdi
mov ecx, 0x108c2b21
add ecx, 0xbef10e2
add ecx, 0xb89cb07
sub ecx, 0x280506da
rep stosb byte [rdi], al
mov eax, ebx
xchg rdx, rdx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400bb8f0
mov dword [rsp - 0x1c], 0x2b782043
mov eax, ebx
mov rbx, qword [rsp + 0x88]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
ret
Function at 0x14009ee40
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov r14, r14
push rdi
mov qword [rsp], rdi
add rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x24], esi
xchg r8, rbx
mov r8, rdx
xchg r8, rbx
mov rdi, rcx
mov r8, r8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x44c1a077
sub r8d, 0x43bc35fb
add r8d, 0x26eccd3b
sub r8d, 0x27f235af
call fcn.1400bbec0
mov dword [rsp - 0x14], 0x25444782
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
xchg rdx, rdx
xchg rbp, r8
mov rbp, qword [rax]
xchg r8, rbp
test r8, r8
xchg r11, r11
je 0x14009f114
mov r8, qword [r8 + 0x50]
test r8, r8
xchg rsp, rsp
je 0x14009f114
mov edx, 0xcb98c8e
add edx, 0x4b0a6214
sub edx, 0x1d96727f
xor edx, 0x726cd2d1
xor edx, 0x4841aff6
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.1400bca90
mov dword [rsp - 0x40], 0x5ff1f71d
mov edx, 0x57e3840e
sub edx, 0x12474eed
xor edx, 0x3c58c5c3
sub edx, 0x79c4f086
lea rcx, [rsp + 0x30]
call fcn.1400bcbb0
xchg r8, r8
test rax, rax
je 0x14009f0e5
xor ecx, ecx
mov r8, r8
xchg rdi, r14
mov rdx, r14
xchg rdi, r14
mov word [rax], cx
movabs rcx, 0x327b99734fcb32f1
add rcx, 0x29057614
xor rcx, 0x419fab76
xor rcx, 0x2eaa5c93
add rcx, 0x7fffffff
xor rcx, 0x5baa6e02
mov rax, qword [0x1404e2800]
rol rax, 4
rol rax, 0xc
rol rax, 1
sub rax, rcx
lea rcx, [rsp + 0x20]
rol rax, 0x1b
rol rax, 7
rol rax, 5
rol rax, 1
rol rax, 1
rol rax, 1
rol rax, 1
rol rax, 1
not rax
mov dword [rsp - 0x20], edi
rol rax, 6
rol rax, 4
rol rax, 0x1b
rol rax, 1
rol rax, 3
rol rax, 1
rol rax, 1
not rax
call rax
mov dword [rsp - 0x3c], ecx
mov rax, qword [0x1404e27f0]
lea r8, [rsp + 0x20]
movabs rcx, 0x605c7e4341382cb5
add rcx, 0x32d6e3b2
xor rcx, 0x5ae80a5
add rcx, 0x7fffffff
xor rcx, 0x5e25ffb9
lea rdx, [rsp + 0x260]
mov dword [rsp - 0x30], esp
xor rax, rcx
xchg rdx, rbx
mov r9, rdx
xchg rdx, rbx
movabs rcx, 0x60b0aa350e6f962a
xor rcx, 0x1998b325
add rcx, 0x2f34f65c
add rcx, 0xb915a8f
add rcx, 0xadbe18c
add rax, rcx
mov dword [rsp - 0x18], 0x12ae87e5
movabs rcx, 0x7e5576771b19e19b
sub rcx, 0x1912a31c
add rcx, 0x662b0eb3
add rcx, 0x13c4b848
not rax
sub rax, rcx
xchg r15, r15
movabs rcx, 0x6c06aaab574dd1d8
sub rcx, 0x16752e4d
sub rcx, 0x5ee3c81
xor rcx, 0x1235570d
add rcx, 0x7fffffff
add rcx, 0x2cecf515
xor rax, rcx
lea rcx, [rsp + 0x30]
mov r14, r14
ror rax, 0x2a
ror rax, 0x11
ror rax, 1
ror rax, 1
not rax
call rax
xchg r14, rbx
mov r14, qword [rsp + 0x250]
xchg r14, rbx
add rsp, 0x240
mov dword [rsp - 0x20], 0x1cc29ce9
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x528bf940
xor eax, 0x6d870679
xor eax, 0x60c2b768
add eax, 0x6031b7b0
mov rbx, qword [rsp + 0x250]
mov rcx, rcx
add rsp, 0x33ca0c99
sub rsp, 0x33ca0a59
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x4495155c
add eax, 0xe0e48c7
xor eax, 0x22ee0f5f
add eax, 0x4fb2afb9
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
ret
Function at 0x1400a2f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404e30f4], 0
jne 0x1400a3022
xor edx, edx
mov rcx, rcx
lea r8, [0x1404e30f0]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov rbx, rbx
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
xchg r13, r13
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov r13, r13
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x10], edi
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [rsp - 0x18], 0x6dcaac84
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x3c], ebx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x34], esp
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r11, r11
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r15, r15
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x18], 0x11db44b
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x18], ecx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rdx, rdx
shr eax, 1
and ecx, 1
neg ecx
mov r13, r13
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x40], 0x47c5be51
shr ecx, 1
and eax, 1
neg eax
mov r13, r13
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov r11, r11
cmp edx, 0x100
jb 0x1400a2f43
ret
Function at 0x1400a8f13
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rcx
mov qword [rsp + 8], rdx
xchg rcx, rdx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x34], 0x4fc76ee8
push r14
nop
push 0x4ffb6f03
mov qword [rsp], r15
nop
add rsp, 0x6efa1ca
sub rsp, 0x6efa1f2
mov r14, rdx
mov rsp, rsp
mov r13d, r8d
mov edx, 0x6d41076b
sub edx, 0x4d19fa30
add edx, 0x5d4b4f02
sub edx, 0x7d6e5c3d
cmp r8d, edx
mov dword [rsp - 0x24], 0x75d8674
jae 0x1400a8f27
mov edx, r13d
nop
movabs rcx, 0xffffffff35d98487
add rcx, 0xe7334c5
sub rcx, 0x7e332e3
sub rcx, 0xea7e4e8
add rcx, 0x7fffffff
xor rcx, 0x523e5e7f
mov eax, 0x646300ff
xor eax, 0x43ccf3e9
add eax, 0x53e47f4e
sub eax, 0x7b947260
mul rdx
cmovo rax, rcx
mov dword [rsp - 0xc], ecx
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.1400bb700
xchg r8, rax
mov r15, r8
xchg r8, rax
mov byte [rsp + 0x70], 0x10
xor byte [rsp + 0x70], 0x60
xor byte [rsp + 0x70], 0x65
xor byte [rsp + 0x70], 0x14
xchg rdx, rax
mov rdx, qword [rsp + 0x60]
xchg rdx, rax
lea r12d, [r13 + 0xfffff]
mov dword [rsp - 0x18], 0x6b05983
xor esi, esi
shr r12d, 0x10
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
mov r12, r12
je 0x1400a90e8
mov qword [rsp + 0x68], rbx
mov ecx, 0x71ac9506
sub ecx, 0x6a7a8711
xor ecx, 0x8227e35
add ecx, 0x661071cc
sub ecx, 0x7510e58c
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg r13, rdi
mov edi, esi
mov dword [rsp - 0x38], 0x3068c051
mov ebx, r13d
shl edi, 2
shl edi, 0x12
xchg r12, rdx
mov r12, r15
xchg rdx, r12
sub ebx, edi
cmp ebx, ecx
mov dword [rsp - 0x40], ebp
cmova ebx, ecx
xchg rdi, rax
mov rcx, rdi
xchg rdi, rax
mov r8d, ebx
call fcn.1400a5800
mov rdi, rdi
test al, al
je 0x1400a90be
shr ebx, 2
xor eax, eax
xchg r14, r14
shr edi, 1
shr edi, 1
test ebx, ebx
mov r12, r12
je 0x1400a9087
mov r9, r15
lea ecx, [rdi + rax]
mov r8d, ebp
mov dword [rsp - 0x34], 0x6bc15645
xor r8d, dword [r9]
lea r9, [r9 + 4]
xor r8d, 0x58fa27f9
xchg r9, r9
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
mov r11, r11
jb 0x1400a9057
xchg r13, rax
mov r13, qword [rsp + 0x60]
xchg r13, rax
inc esi
mov r8, r8
mov ecx, 0x4bd86c64
sub ecx, 0x3e705a4a
add ecx, 0x535ffc00
sub ecx, 0x60b80e1a
cmp esi, r12d
mov dword [rsp - 0x30], esp
jb 0x1400a8ffc
jmp 0x1400a90d2
mov byte [rsp + 0x70], 0x42
sub byte [rsp + 0x70], 0x2a
add byte [rsp + 0x70], 0x26
sub byte [rsp + 0x70], 0x3e
xchg r9, rbx
mov r9, qword [rsp + 0x68]
xchg r9, rbx
xchg rdi, rbx
mov rbx, qword [rsp + 0x20]
xchg rdi, rbx
xchg r15, rdx
mov rcx, rdx
xchg r15, rdx
call fcn.1400bb710
mov rsi, rsi
movzx eax, byte [rsp + 0x70]
sub rsp, 0xffffffffffffffd8
pop r15
mov dword [rsp - 0x30], edi
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
xchg r9, r9
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400a9150
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rbp
xchg r8, rsi
mov qword [rsp + 0x20], r8
xchg r8, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
push r13
mov dword [rsp - 0x14], 0x20f62c0e
push r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x2c], 0x44bc151
mov r14d, r8d
mov rdi, rdx
mov r9d, r14d
mov r13, rcx
mov rsp, rsp
cmp r8d, 0x40000
jb 0x1400a91d5
mov r9d, 0x18ff289b
sub r9d, 0x1e57157
sub r9d, 0x13ea7452
add r9d, 0x60963b46
xor r9d, 0x63c17e38
nop
movabs rcx, 0xffffffff6c9ae4e3
add rcx, 0x134ef1df
sub rcx, 0x1b2e35d6
sub rcx, 0x551234e2
add rcx, 0x7fffffff
xor rcx, 0x705693f6
mov eax, 0x543e598c
xor eax, 0x5224fc39
add eax, 0x280ebc5d
xor eax, 0x54c6d035
sub eax, 0x7aefb223
mul r9
cmovo rax, rcx
mov r13, r13
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400bb700
mov r14, r14
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 0xc
shr r15d, 7
shr r15d, 1
xor ebx, ebx
mov r15, r15
xchg rdx, rbp
mov rdx, rax
xchg rbp, rdx
mov r12b, 0x3d
xor r12b, 0x69
sub r12b, 0x25
add r12b, 0x2e
sub r12b, 0x5c
test r15d, r15d
je 0x1400a9380
nop
mov rbx, rbx
mov r8d, ebx
mov r10d, r14d
shl r8d, 7
shl r8d, 0xa
shl r8d, 1
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov dword [rsp - 0x14], edx
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov r12, r12
jbe 0x1400a92f2
mov r10d, 0x3d8cb344
add r10d, 0x2a5e69b0
sub r10d, 0x6727523c
sub r10d, 0xb3cab8
mov r11d, 0x216a9560
add r11d, 0x41142d0f
sub r11d, 0x4fa7e59
add r11d, 0x1300732d
sub r11d, 0x7080b743
jmp 0x1400a930a
mov r11d, r10d
mov dword [rsp - 0x3c], esi
shr r11d, 2
test r11d, r11d
je 0x1400a934b
mov dword [rsp - 0x34], esp
xchg r9, r10
mov r10, rbp
xchg r9, r10
nop dword [rax]
mov dword [rsp - 0x34], 0x200b6809
lea edx, [r8 + rax]
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
xchg r15, r15
lea r9, [r9 + 4]
xor ecx, 0x58fa27f9
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0x1c], esp
cmp eax, r11d
jb 0x1400a9322
mov r8d, r10d
xchg r8, rdx
mov r8, rbp
xchg r8, rdx
mov rcx, r13
mov r12, r12
call fcn.1400a5e00
test al, al
je 0x1400a937d
inc ebx
xchg r8, r8
cmp ebx, r15d
jb 0x1400a927a
jmp 0x1400a9380
xor r12b, r12b
xchg rcx, r10
mov r10, rbp
xchg rcx, r10
call fcn.1400bb710
mov r15, r15
xchg r10, rbx
mov r10, qword [rsp + 0x50]
xchg rbx, r10
movzx eax, r12b
mov rbp, qword [rsp + 0x58]
xchg rbx, rbx
xchg r15, rsi
mov r15, qword [rsp + 0x68]
xchg rsi, r15
nop
sub rsp, 0x63d132ef
add rsp, 0x63d1330f
pop r15
mov dword [rsp - 0x28], ebp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400a93f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
xchg rcx, rbp
mov qword [rsp + 0x18], rcx
xchg rcx, rbp
nop
push 0x548ddafc
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
xchg r9, r9
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov eax, 0x2f429ed1
add eax, 0x36cb0b5c
sub eax, 0x16cee270
xor eax, 0x4f3ed79d
call fcn.1400bc070
mov dword [rsp - 0x14], 0x65bf6fb9
sub rsp, rax
xchg rsp, rcx
mov r15, rsp
xchg rsp, rcx
call fcn.1400bd460
mov dword [rsp - 0x2c], esp
mov ebp, eax
and ebp, 0x3fc
jbe 0x1400a94c0
mov dword [rsp - 0x38], 0x1104653d
lea rdi, [rsp + 0x20]
mov esi, ebp
call fcn.1400bd460
movzx ebx, ax
xchg rbp, rbp
shl ebx, 7
shl ebx, 5
shl ebx, 3
shl ebx, 1
call fcn.1400bd460
movzx ecx, ax
mov dword [rsp - 0x34], 0x469ae9d8
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
mov r15, r15
sub rsi, 1
jne 0x1400a9484
lea r14d, [rbp*4]
mov dword [rsp - 0x18], edi
mov eax, 0x101277f4
add eax, 0x60bb6a2e
sub eax, 0x1741eb2
xor eax, 0x6cf80527
xor eax, 0x3a1c653
mov ecx, r14d
xchg r10, r10
mul rcx
pushf
movabs rcx, 0xffffffff24f63e35
xor rcx, 0x18731df2
add rcx, 0xfdd9264
add rcx, 0x7fffffff
xor rcx, 0x339d49d5
popf
cmovo rax, rcx
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.1400bb700
mov edi, dword [r15 + 0x18]
xchg rbx, rbx
lea ebp, [r14 + 0xfffff]
shr ebp, 0xd
shr ebp, 6
shr ebp, 1
xor ebx, ebx
mov rsi, rax
mov dword [rsp - 0x2c], edi
mov r12b, 0x19
xor r12b, 0x68
xor r12b, 7
xor r12b, 0x77
test ebp, ebp
xchg r12, r12
je 0x1400a967a
nop
mov r8d, ebx
mov dword [rsp - 0x30], 0x18396ce2
mov r10d, r14d
shl r8d, 0xe
shl r8d, 5
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov rbp, rbp
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
jbe 0x1400a95e1
mov dword [rsp - 0x3c], 0x10cbcd6b
mov r10d, 0x34cdb85d
sub r10d, 0x1c16f0e7
add r10d, 0x34a5c11b
xor r10d, 0x488e7df2
xor r10d, 0x5c2f563
mov r11d, 0x81574ef
add r11d, 0x76b63839
sub r11d, 0x6353e182
xor r11d, 0x1b73cba6
jmp 0x1400a95f9
mov r11d, r10d
shr r11d, 2
test r11d, r11d
mov dword [rsp - 0x20], 0x2f566fa3
je 0x1400a963f
xchg rsi, r9
mov rsi, r9
xchg r9, rsi
nop dword [rax]
mov dword [rsp - 0x38], 0x6e27522
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
mov dword [rsp - 0x20], 0x549bc92c
xor ecx, 0x58fa27f9
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
xchg r8, r8
jb 0x1400a9611
mov r8d, r10d
xchg rdx, r15
mov r15, rsi
xchg r15, rdx
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.1400a5e00
mov dword [rsp - 0x10], edi
test al, al
je 0x1400a9677
inc ebx
cmp ebx, ebp
mov r11, r11
jb 0x1400a9563
jmp 0x1400a967a
xor r12b, r12b
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400bb710
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov dword [rsp - 0x2c], edx
xchg r15, rbx
mov r15, qword [r11 + 0x38]
xchg rbx, r15
xchg rdi, rbp
mov rdi, qword [r11 + 0x40]
xchg rdi, rbp
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
pop r15
mov dword [rsp - 0x1c], ebp
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x1400ac5e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae1bd
xchg r14, rcx
mov r10, r14
xchg r14, rcx
mov eax, dword [0x1404e30a4]
cmp qword [0x1404e30b8], 0
mov dword [rsp - 0x44], 0x40296e98
jne 0x1400ad660
syscall
ret
Function at 0x1400af150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r8d, ecx
mov dword [rsp - 0x10], edi
test ecx, ecx
jne 0x1400af174
xor eax, eax
xchg rbx, r13
mov r13, qword [rsp + 8]
xchg rbx, r13
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
mov dword [rsp - 0x20], 0x52741bb9
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
mov rbp, rbp
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
xchg r15, r15
mov r9d, eax
test r11b, 1
cmove ecx, edx
xor r9d, ebx
mov dword [rsp - 0x34], 0x29a9b466
cmp eax, 0x100
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
mov rsi, rsi
jne 0x1400af199
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov dword [rsp - 0x14], 0x237e3a5a
je 0x1400af225
lea eax, [r11 + r11]
mov ecx, r9d
mov r12, r12
xor ecx, r11d
mov r11d, eax
test dl, 1
mov dword [rsp - 0x20], esi
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
mov dword [rsp - 0x24], esi
cmovb r11d, eax
shr edx, 1
jne 0x1400af1e7
mov dword [rsp - 0x44], 0x2231b895
mov r11d, r9d
mov edx, r10d
test r9d, r9d
je 0x1400af283
mov rsi, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
mov dword [rsp - 0x38], ebp
xor ecx, r11d
mov r11d, eax
test r9b, 1
cmove ecx, edx
mov dword [rsp - 0x24], 0x5184956b
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
cmovb r11d, eax
mov dword [rsp - 0x44], 0x42352914
shr r9d, 1
jne 0x1400af245
test edx, edx
xchg rdx, rdx
je 0x1400af2d7
nop word [rax + rax]
mov ecx, r10d
mov dword [rsp - 0x38], 0x1dc9d0cf
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov dword [rsp - 0x18], ebp
mov r10d, ecx
lea ecx, [r8 + r8]
mov r8d, ecx
mov dword [rsp - 0x40], 0x418b52d1
xor r8d, ebx
cmp ecx, 0x100
cmovb r8d, ecx
xchg r15, r15
shr edx, 1
jne 0x1400af294
xchg r14, rbx
mov r14, qword [rsp + 8]
xchg rbx, r14
mov eax, r10d
mov dword [rsp - 0x44], edi
ret
Function at 0x1400bc070
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x10
xchg r10, rsi
mov qword [rsp], rsi
xchg r10, rsi
mov qword [rsp + 8], r11
xor r11, r11
lea r10, [rsp + 0x18]
mov dword [rsp - 0x44], 0x7d8bd816
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
mov dword [rsp - 0x14], ebx
bnd jae 0x1400bc0d6
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov rbx, rbx
mov byte [r11], 0x15
xor byte [r11], 0x33
add byte [r11], 0x57
sub byte [r11], 0x7d
cmp r10, r11
bnd jne 0x1400bc0b3
xchg rbx, rbx
mov r10, qword [rsp]
mov r11, qword [rsp + 8]
sub rsp, 0xfffffffffffffff0
bnd ret
Function at 0x140001d90
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14007a080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x14007d120]
mov ebx, ecx
cmp eax, 0x434f4e53
jne 0x140001e09
cmp dword [0x14007d978], 3
je 0x140001e09
cmp eax, eax
jne 0x140001dd2
mov rcx, qword [0x14007d128]
test rcx, rcx
je 0x140001dd2
call fcn.14003b7f0
mov rcx, qword [0x14007d140]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [rsp + 0x2e]
mov rcx, qword [0x14007d140]
sub ax, bx
mov word [rsp + 0x22], ax
xor eax, eax
mov word [rsp + 0x20], ax
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140035970
add rsp, 0x50
pop rbx
ret
Function at 0x1400020a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov r14d, dword [rbp + 0x40]
mov r15d, edx
mov esi, r9d
mov ebx, r8d
mov r12, rcx
mov r9, rcx
mov r8d, 4
lea rcx, str.RIFF
lea eax, [r14 + 7]
cdq
and edx, 7
lea edi, [rdx + rax]
mov edx, 1
sar edi, 3
call fcn.14003c718
lea edx, [r15 + 0x24]
mov r9, r12
mov ecx, edx
mov byte [rbp + 0x40], dl
sar ecx, 8
mov r8d, 4
mov byte [rbp + 0x41], cl
mov ecx, edx
sar ecx, 0x10
sar edx, 0x18
mov byte [rbp + 0x42], cl
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x43], dl
mov edx, 1
call fcn.14003c718
mov r9, r12
lea rcx, str.WAVEfmt
mov edx, 2
mov r8d, 4
call fcn.14003c718
mov r9, r12
mov dword [rbp + 0x40], 0x10
mov edx, 1
lea rcx, [rbp + 0x40]
mov r8d, 4
call fcn.14003c718
mov r9, r12
mov word [rbp + 0x40], 1
mov edx, 1
lea rcx, [rbp + 0x40]
mov r8d, 2
call fcn.14003c718
mov eax, esi
mov byte [rbp + 0x40], sil
sar eax, 8
lea rcx, [rbp + 0x40]
mov r9, r12
mov byte [rbp + 0x41], al
mov edx, 1
mov r8d, 2
call fcn.14003c718
mov eax, ebx
mov byte [rbp + 0x40], bl
sar eax, 8
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x41], al
mov r9, r12
mov eax, ebx
mov edx, 1
sar eax, 0x10
mov r8d, 4
mov byte [rbp + 0x42], al
mov eax, ebx
sar eax, 0x18
mov byte [rbp + 0x43], al
call fcn.14003c718
mov ecx, edi
imul ecx, ebx
imul ecx, esi
mov eax, ecx
mov byte [rbp + 0x40], cl
sar eax, 8
mov byte [rbp + 0x41], al
mov eax, ecx
sar eax, 0x10
mov byte [rbp + 0x42], al
sar ecx, 0x18
mov r9, r12
mov byte [rbp + 0x43], cl
mov edx, 1
lea rcx, [rbp + 0x40]
mov r8d, 4
call fcn.14003c718
imul edi, esi
lea rcx, [rbp + 0x40]
mov r9, r12
mov edx, 1
mov r8d, 2
mov byte [rbp + 0x40], dil
sar edi, 8
mov byte [rbp + 0x41], dil
call fcn.14003c718
mov byte [rbp + 0x40], r14b
lea rcx, [rbp + 0x40]
sar r14d, 8
mov r9, r12
mov edx, 1
mov byte [rbp + 0x41], r14b
mov r8d, 2
call fcn.14003c718
mov r9, r12
lea rcx, str.data
mov edx, 1
mov r8d, 4
call fcn.14003c718
mov eax, r15d
mov byte [rbp + 0x40], r15b
sar eax, 8
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x41], al
mov r9, r12
mov eax, r15d
mov edx, 1
sar eax, 0x10
mov r8d, 4
sar r15d, 0x18
mov byte [rbp + 0x42], al
mov byte [rbp + 0x43], r15b
call fcn.14003c718
mov rcx, r12
call fcn.14003ba04
mov rbx, qword [rsp + 0x40]
neg eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
sbb eax, eax
mov r12, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret