joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007350
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140007350
sub rsp, 0x38
movzx eax, word [0x14009e100]
mov dword [rsp + 0x24], eax
movzx eax, word [0x14009e100]
cmp eax, 0x270
jl 0x14000737d
call fcn.140007270
movzx eax, word [0x14009e100]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x14009d740]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
inc eax
mov word [0x14009e100], ax
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x14009d740]
mov eax, dword [rcx + rax*4]
shr eax, 0xb
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140008cfc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140008cfc
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008d46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008d46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008d46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008d46
cmp dword [rcx + 0x84], 0xe
jbe 0x140008d46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008d48
xor al, al
add rsp, 0x28
ret
Function at 0x14006d620
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14006d636
mov al, 1
jmp 0x14006d696
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14006d647
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14006d694
mov ecx, dword [rcx + 0x18]
nop
call fcn.140003e27
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006d694
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14006d694
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14006d694
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14006d696
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1004039e0
Capabilities:
Encode data using xor

Disassembly:
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
xor dword [rcx], esi
Function at 0x140016bc5
Capabilities:
Execute syscall

Disassembly:
cmp r15d, 0x8773b718
ror esi, 0xc4
cmp r8d, 0xe26adc7b
and r8d, 0xe4af7859
syscall
mov r14d, 0xd8a06c31
ret 0x20
Function at 0x14002028f
Capabilities:
Encode data using xor

Disassembly:
xchg r10, r10
je 0x14001fc85
mov rcx, rdi
call fcn.1400740f0
mov dword [rsp - 0x20], 0x41517c52
mov dword [rsp - 0x38], esp
jne 0x1400202bb
je 0x1400202bb
mul rdx
or edx, 0xc5dc34ea
movabs rdi, 0x3b8414fffff9bae9
cmp r12, rbp
push rdx
jmp 0x140020f7d
jmp fcn.14001fc7a
mov rcx, rcx
mov dword [rsp - 0x38], 0x2c12e054
mov dword [rsp - 0x10], 0x113ce54c
mov dword [rsi], 0
jmp 0x140021f65
mov dword [rsp - 0x20], 0xc706bcb
call fcn.1400ef060
lea r15, [r14 + 0x910]
mov r12d, 0x64
test al, al
mov dword [rsp - 0x24], 0x31106da8
jne 0x140020f28
je 0x140020f28
jmp rax
jmp 0x140020f3e
mov dword [rsp - 0x40], 0x5cdeea3a
jne 0x140020fc7
cmp byte [r15], al
jne 0x140020fc7
lea rsi, [r14 + 0x914]
mov dword [rsp - 0x3c], 0x5495a48b
mov dword [rsp - 0x20], ebx
jmp 0x140020e55
mov esp, 0x8824
add byte [rcx + rcx*4 - 0x5c], cl
and al, 0x80
add byte [rax], al
add cl, ch
add byte [rax], al
add byte [rax], al
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r15
and al, 0x70
xchg rdx, rdx
mov rsp, rsp
jmp 0x140020eb9
lea rsi, [r14 + 0x914]
inc dword [rsi]
mov dword [rsp - 0xc], esi
mov dword [rsp - 0x14], esi
jmp 0x14002187f
lea rcx, [r14 + 0x28]
call fcn.1400ef060
test al, al
je 0x140021f65
mov dword [rsp - 0x2c], 0x813a2e6
mov dword [rsp - 0x14], esp
mov dword [rsi], r12d
jmp 0x140021f65
mov rcx, r14
call fcn.1400eee30
Function at 0x1400237a6
Capabilities:
Execute syscall

Disassembly:
add ebx, 0x10be3844
add eax, dword [rax]
add bh, al
and al, 0xe0
cmp bh, dl
movsb byte [rdi], byte [rsi]
pop rbp
Function at 0x14002a4dd
Capabilities:
Execute syscall

Disassembly:
ror r14d, 0x9d
syscall
ret 0x28

Function at 0x140030b3c
Capabilities:
Execute syscall

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov dword [rsp - 0x44], 0x3ffdcbca
mov dword [rsp - 0x24], ecx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
jmp 0x140030c73
mov qword [rsp + 0x28], rsi
mov r9, rbx
and qword [rsp + 0x20], 0
mov r8d, 0x400
mov dword [rsp - 0x3c], ecx
mov rsi, rsi
je 0x140030c16
jne 0x140030c16
dec rdi
test r13, rdx
syscall
sub r15d, 0xa0a68908
sub r9d, 0xcd65eab8
bswap rcx
call rax
dec r13
movabs r14, 0x1217b0000000b6e9
pause
ret
jmp 0x140030cd1
push rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
xchg rcx, rcx
mov dword [rsp - 0x20], 0x290f554d
jmp 0x140030ce3
push rbx
mov dword [rsp - 0x3c], 0x21094f6
mov dword [rsp - 0xc], 0x52eebbde
jmp 0x140030c24
mov dword [rsp - 0x20], 0x339ec3dc
lea rsi, [rax + 0x18]
mov rdi, rcx
call fcn.140018240
mov dword [rsp - 0x14], ecx
mov dword [rsp - 0x40], 0x72ddec92
mov dword [rsp - 0x34], 0x3651669f
je 0x140030d46
jne 0x140030d46
jmp rax
jmp 0x140030bd7
Function at 0x1400310b7
Capabilities:
Execute syscall

Disassembly:
cmc
sbb byte [eax - 9], cl
ffreep st(2)
adc byte [rax], al
movabs r15, 0x385e6d00000126e9
jne 0x140030b5e
jmp 0x140030c89
je 0x140030b5e
call fcn.140030a94
add rsp, 0x30
pop r15
ret
mov dword [rsp - 0x1c], 0x5a76ec25
mov dword [rsp - 0x2c], ecx
test eax, eax
cmovs eax, ecx
add rsp, 0x30
pop r15
mov rcx, qword [rax]
call fcn.140098fb0
or ecx, 0xffffffff
mov dword [rsp - 0x10], 0x7de8e9c4
mov dword [rsp - 0xc], 0x22e24705
jne 0x140030cb8
je 0x140030cb8
rol r12d, 0x92
pause
popfq
rol r8d, 0xfe
pushfq
movabs rcx, 0x73cf917e74bc83eb
lea ebx, [rbp + 0x2458]
lea ebp, [rdi - 0xb403]
call fcn.14002fdd2
jmp 0x140030c3d
mov dword [rsp - 0x24], 0x51d8e272
mov rdx, rdi
push r15
jmp 0x140030b5c
push rsi
mov dword [rsp - 0x3c], 0x2da91623
mov dword [rsp - 0x40], 0x624c78e7
jmp 0x1400311d8
mov rcx, rax
call fcn.1400ffc90
xchg rbx, rbx
mov rcx, rcx
mov rcx, qword [0x140142a70]
movzx edx, ax
jmp 0x1400312dd
movabs rcx, 0x1b8bf000001d1e9
jne 0x1400310ec
jmp 0x1400312c2
je 0x1400310ec
call fcn.1400312c3
add rsp, 0xb80
pop rcx
jmp 0x1400312c1
xor ebx, ebx
test rax, rax
je 0x140032b5b
mov rcx, qword [r14]
mov r12, r12
jmp 0x140031235
je 0x1400313fe
call fcn.1400310b7
add rsp, 0xb80
pop r11
ret
pop r11
jmp 0x1400310cd
je 0x1400313a7
call fcn.140031213
add rsp, 0xb80
jmp 0x140031415
push rdi
push r12
push r13
mov r13, r13
mov dword [rsp - 0x10], ecx
push r14
jmp 0x140031324
mov dword [rsp - 0x2c], 0x37e4fed4
mov dword [rsp - 0x24], edi
mov rdi, rdi
mov rcx, qword [rcx + 8]
call fcn.1400ffbb0
jne 0x14003128c
je 0x14003128c
rcl ebx, 0x2a
jmp fcn.140031f0e
jmp 0x1400313fa
ret
pop rcx
call fcn.14009fcd0
mov rcx, qword [r14]
mov dword [rsp - 0x28], 0x4cd90918
push rcx
je 0x1400312f4
jne 0x1400312f4
movabs rsi, 0x259e17fffffdf1e9
cmp edx, 0x5a8551fe
jmp 0x140030882
jmp 0x1400310ea
push r15
lea rbp, [rsp - 0xa80]
sub rsp, 0xb80
mov dword [rsp - 0x2c], 0x4fd258fc
mov dword [rsp - 0x44], 0x629a8596
mov dword [rsp - 0x10], 0xae86b44
mov r14, rcx
jne 0x14003136e
je 0x14003136e
call rcx
jbe 0x140031750
syscall
lea esi, [rbp + 0x61f5]
ret
jmp 0x1400313a3
push r8
movabs r8, 0x1de79f8327386feb
jne 0x1400313a7
jmp 0x140031418
jmp 0x1400311c1
push r11
movabs r11, 0x39b365fffffda7e9
jne 0x1400313fe
jmp 0x1400311aa
jmp 0x140031195
pop r8
ret
pop r8
mov rcx, qword [rcx]
mov rcx, qword [rcx + 8]
call fcn.1400ffbb0
mov dword [rsp - 0x38], 0x6b54cd48
jne 0x14003144c
je 0x14003144c
cmp r14d, 0xe27566fa
jge 0x140031a3c
call fcn.140032112
lea edx, [rbx - 0xdc6e]
movabs rdi, 0x47486afffffd1ae9
lea r14d, [rcx + 0x90a]
or r10d, 0xbde93cd4
jb 0x140030cd1
jmp 0x14003116b
cmp r8, rbx
pushf
ret

Function at 0x140034736
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x2c], 0x797b44d6
mov dword [rsp - 0x18], 0x7c6d2b8a
mov dword [rsp - 0x34], 0x320b71cd
jmp fcn.14003408a

Function at 0x14003ee0f
Capabilities:
Execute syscall

Disassembly:
loop 0x14003ee53
push rsp
xchg edx, eax
sar dword [rcx - 1], cl
rol dword [rbp + rcx*4 - 0x75], 1
mov edi, 0xc3000099
Function at 0x140041c34
Capabilities:
Execute syscall

Disassembly:
add byte [rax], al
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov rbp, rbp
mov dword [rsp - 0x1c], 0x50fbeb4b
xchg r10, r10
je 0x140041c7f
jne 0x140041c7f
ja 0x1400417bc
rol ebp, 0x9a
pause
ror r8d, 0xc0
jmp rax
jmp 0x140041ee0
push rbp
push rdi
push r12
mov dword [rsp - 0x10], esp
xchg rbp, rbp
jne 0x140041f15
je 0x140041f15
pushf
jl 0x1400414d6
call rcx
rcl r9d, 0x37
call rax
invalid
invalid
invalid
Function at 0x140045b93
Capabilities:
Encode data using xor

Disassembly:
pushfq
rcr esi, 0x9e
lea ecx, [rbx + 0xc322]
movabs rcx, 0x51600ffffffbdce9
pause
popf
xor r15d, 0xa1e4eaaf
popfq
rcl ebx, 0x36
call fcn.14004452b
add rsp, 0x75
pop r12
ret
pop rdx
ret
pop rdx
movups xmmword [rbp + 0x1d8], xmm0
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
test r15, r15
je 0x1400455c8
jne 0x1400455c8
call rax
or edi, 0x19da0d59
popfq
jp 0x1400448b5
add ecx, 0xf53ea339
jne 0x1400445bd
jmp 0x1400459ab
xchg rcx, rcx
mov dword [rsp - 0x2c], 0x5cc9f50
movups xmmword [rbp + 0x1d8], xmm0
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov dword [rsp - 0x1c], esp
jne 0x140045623
je 0x140045623
syscall
call rcx
movabs rsi, 0x7b7c1c0000055ce9
add ebp, 0xc4977f6a
cmp edi, 0x13fd1257
div r15
lea ebx, [rdi + 0x8523]
ror esi, 0x7c
ror r8d, 0xbe
call fcn.140046606
jmp 0x140045b84
mov byte [rbp + 0x754], 0x89
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x208], r15
jmp 0x1400455f5
lea rdx, [rbp + 0x1d8]
xor ecx, ecx
mov qword [rbp + 0x1d0], rdx
xchg rsi, rsi
mov dword [rsp - 0x34], 0x78df156d
mov dword [rsp - 0x38], ecx
xchg rdx, rdx
jmp 0x140045a90
jne 0x140045b77
je 0x140045b77
call fcn.1400458d4
jne 0x1400457e5
je 0x1400457e5
lea esi, [rcx + 0xa7f7]
jmp rcx
jmp 0x14004598a
add rsp, 0x55
pop rdx
ret
pop rdx
xorps xmm0, xmm0
jmp 0x140045753
xchg rbp, rbp
xchg rsi, rsi
mov dword [rsp - 0x28], 0x4bbba2f
je 0x140045a88
je 0x1400459c5
xor r9d, r9d
jmp 0x140045999
push rdx
movabs rdx, 0x5adf31fffffad7e9
jne 0x140045a93
jmp 0x14004556f
je 0x140045a93
call fcn.140045b1b
add rsp, 0x55
jmp 0x14004556d
sal dl, 1
mov ebp, 0x89487325
and eax, 0xed894873
jmp 0x1400456cc
mov r15, qword [rbp + 0x208]
mov dword [rsp - 0x40], 0x6c8a70aa
mov dword [rsp - 0xc], 0x5b6ca244
mov dword [rsp - 0x3c], 0x7a8a63b9
push rdx
movabs rdx, 0x441872fffffe14e9
jmp 0x140045790
jmp 0x140045990
mov dword [rsp - 0x44], edx
mov dword [rsp - 0x44], ebx
mov dword [rsp - 0x10], 0x56e19f16
push rsi
cmp rcx, rax
je 0x140045991
call fcn.1400986e0
jmp 0x140045b55
Function at 0x140047ea3
Capabilities:
Execute syscall

Disassembly:
mov dword [rbp + 0x1fc], 0x790088
mov qword [rsp + 0x40], rbx
mov dword [rsp - 0x40], 0x17347f3c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
jmp 0x140047ca7
mov dword [rsp - 0x40], edx
push rbx
movabs rbx, 0x2f3a8a000003a0e9
jne 0x140047cae
je 0x140047cae
call fcn.140047e4a
add rsp, 0x7d
ret
pop rdi
mov dword [rbp + 0x1cc], 0x610086
mov dword [rbp + 0x1d0], 0x70003e
mov dword [rbp + 0x1d4], 0x790086
mov dword [rsp - 0x38], 0x4259127a
jmp 0x14004805c
jne 0x140047f09
je 0x140047f09
call fcn.140047eb4
add rsp, 0x7d
pop rdi
jne 0x140047e97
je 0x140047e97
sub esi, 0x8cd6fb5c
cpuid
cmp r13, rdi
rcl r10d, 0x98
dec r13
call rax
movabs r9, 0x28705efffffeace9
xor r8d, 0xa0b6684d
push 0xffffffffd0ffa0b6
jmp 0x140047d48
syscall
rol r12d, 0xe0
ret
mov dword [rsp - 0x2c], 0x722f0f02
mov dword [rsp - 0x40], 0x12805182
push rdi
movabs rdi, 0x49f8b4fffffe3be9
jne 0x140047f1e
jmp 0x140047d49
je 0x140047f1e
lea r8d, [rcx + 0x2f2]
movabs rbp, 0x165ed3ffffff44e9
lea edi, [rbp - 0x497c]
jmp rax
jmp 0x140047e67
mov dword [rsp - 0x18], 0x2b9ff0ab
mov dword [rbp + 0x1f4], 0x67008e
mov dword [rbp + 0x1f8], 0x39002f
jmp 0x140047b4d
mov dword [rsp - 0x20], ebp
mov dword [rsp - 0x44], 0x3b58bb23
mov dword [rsp - 0x28], 0x4efa9343
mov dword [rbp + 0x1d8], 0x31007b
mov dword [rbp + 0x1dc], 0x630084
mov dword [rbp + 0x1e0], 0x260032
mov rsi, rsi
jmp 0x1400480b2
mov r8, r8
mov dword [rbp + 0x1e4], 0x370082
mov dword [rbp + 0x1e8], 0x250028
mov dword [rbp + 0x1ec], 0x640085
mov dword [rbp + 0x1f0], 0x220038
mov dword [rsp - 0x14], 0x7abe24b5
mov r13, r13
jmp 0x140048011
Function at 0x140054290
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
nop
push r10
mov qword [rsp], rdi
nop
sub rsp, 0x1ac6fe1e
add rsp, 0x1ac6fdfe
xchg rdx, rbp
mov rbx, rbp
xchg rdx, rbp
mov rdi, rcx
mov dword [rsp - 0x18], 0x7e08a4b0
nop
movabs rdx, 0xffffffff1e83d022
add rdx, 0x60c9d4bd
xor rdx, 0x5e6dadcf
add rdx, 0x7fffffff
xor rdx, 0x5edff6f0
nop word [rax + rax]
xchg r9, r9
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x1400542f8
xchg rsi, rdx
mov qword [rcx + 0x38], rsi
xchg rsi, rdx
call fcn.14001794c
mov dword [rsp - 0x3c], edx
xor r8d, r8d
mov edx, 0x248c030
add edx, 0x31e21f2e
sub edx, 0xfba531
xor edx, 0x135bbd43
xor edx, 0x702f9089
cmp qword [rdi + 0x38], r8
mov dword [rsp - 0x34], edx
jbe 0x1400543a0
sub rbx, rax
mov r9d, 0x1b82155f
xor r9d, 0x4da5b753
add r9d, 0x1b6af76c
xor r9d, 0x71929987
nop word [rax + rax]
movzx ecx, dx
xchg r9, r9
lea rax, [rax + 2]
and cx, r9w
ror edx, 2
ror edx, 2
ror edx, 1
ror edx, 3
xor cx, word [rbx + rax - 2]
mov r8, r8
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x14005436b
mov rsp, rsp
mov rbx, qword [rsp + 0x30]
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop rdi
xchg r12, r12
ret
Function at 0x1400543c0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
xchg rbp, rdi
mov qword [rsp + 0x10], rdi
xchg rbp, rdi
xchg r10, rsi
mov qword [rsp + 0x18], r10
xchg rsi, r10
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x64bdc53f
mov qword [rsp], r12
push r11
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov rsi, rsi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r13, qword [r8 + 0x38]
mov dword [rsp - 0xc], 0x3953faf5
xchg rsi, rdx
mov r15, rsi
xchg rsi, rdx
add r13, qword [rdx + 0x38]
xchg r15, r15
xchg r10, r14
mov r10, rcx
xchg r10, r14
mov eax, 0x5d1e6c7b
xor eax, 0x413a4f8f
add eax, 0x381f01af
sub eax, 0x544325a1
nop
movabs rdi, 0xffffffff2511aaa1
add rdi, 0x34f2c730
sub rdi, 0x452f66da
xor rdi, 0x394ab91e
add rdi, 0x7fffffff
add rdi, 0x52604c17
xchg r13, r8
mov r12, r13
xchg r8, r13
lea r9, [r13 + 1]
xchg r11, r11
mul r9
cmovo rax, rdi
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140098590
mov dword [rsp - 0x40], 0x2d5ec8f4
xor ebp, ebp
mov ebx, 0x6df0c8b4
xor ebx, 0x1aaade7
add ebx, 0xc27ce7
sub ebx, 0x1cc1ca53
xchg r11, rsi
mov r11, rax
xchg r11, rsi
mov eax, ebx
mov r8d, ebp
xchg r11, r11
mov r10d, 0x3746a7b7
xor r10d, 0x5d3871fe
add r10d, 0x14c0dd03
sub r10d, 0x26b1b375
sub r10d, 0x588dfed8
cmp qword [r15 + 0x38], rbp
mov dword [rsp - 0x18], 0x3d6d1f42
jbe 0x14005453e
nop word [rax + rax]
mov rcx, qword [r15]
movzx edx, ax
xchg r12, r12
and dx, r10w
ror eax, 6
ror eax, 1
ror eax, 1
xor dx, word [rcx + r8*2]
mov dword [rsp - 0x14], esi
mov word [rsi + r8*2], dx
inc r8
cmp r8, qword [r15 + 0x38]
xchg rdi, rdi
jb 0x14005450c
mov r8d, ebx
mov r9, rbp
cmp qword [r12 + 0x38], rbp
xchg rsp, rsp
jbe 0x14005459f
nop dword [rax]
mov rax, qword [r12]
mov dword [rsp - 0x34], esp
movzx edx, r8w
xchg r13, rcx
mov r13, qword [r15 + 0x38]
xchg r13, rcx
and dx, r10w
mov r12, r12
add rcx, r9
ror r8d, 2
ror r8d, 6
xor dx, word [rax + r9*2]
mov dword [rsp - 0x38], 0x38ba33db
inc r9
mov word [rsi + rcx*2], dx
cmp r9, qword [r12 + 0x38]
jb 0x140054555
mov rdi, rdi
lea rax, [r14 + 8]
mov word [rsi + r13*2], bp
xorps xmm0, xmm0
xchg rdi, rax
mov qword [r14], rdi
xchg rdi, rax
movups xmmword [rax], xmm0
mov r14, r14
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
xchg r10, rax
movups xmmword [r10 + 0x20], xmm0
xchg r10, rax
inc rdi
mov dword [rsp - 0x34], edi
cmp word [rsi + rdi*2], bp
jne 0x1400545c9
xchg rdx, rbx
mov rbx, rdi
xchg rdx, rbx
xchg rdi, r8
mov qword [r14 + 0x38], r8
xchg rdi, r8
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
call fcn.14001794c
cmp qword [r14 + 0x38], rbp
xchg r10, r10
jbe 0x14005465d
mov rdx, rsi
mov r8d, 0x358893fc
xor r8d, 0x62fd7417
sub r8d, 0x26de4ddf
xor r8d, 0x30979af3
sub rdx, rax
xchg rdx, rdx
Function at 0x1400546d0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rbp, r12
mov qword [rsp + 0x10], r12
xchg rbp, r12
mov qword [rsp + 0x20], rsi
mov dword [rsp - 0x44], 0x3b900778
mov word [rsp + 0x18], r8w
nop
push 0x28ccbd53
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x60
mov r11, r11
mov r12, qword [rdx + 0x38]
mov rdi, rdx
xchg rdi, r15
mov rdi, rcx
xchg r15, rdi
add r12, 2
mov r12, r12
mov eax, 0x69b5a394
sub eax, 0x361ab77d
xor eax, 0x7d99bea6
sub eax, 0x4e0352af
nop
movabs rsi, 0xffffffff1f740476
xor rsi, 0x2021276c
xor rsi, 0x7c09162f
sub rsi, 0x3b14f482
add rsi, 0x7fffffff
add rsi, 0x77b8bf4d
mul r12
mov dword [rsp - 0x40], 0x3adaffc5
cmovo rax, rsi
xchg rbx, rcx
mov rbx, rax
xchg rbx, rcx
call fcn.140098590
mov dword [rsp - 0x28], ebp
mov r13, qword [rdi + 0x38]
lea rcx, [rsp + 0x20]
mov rbp, qword [rdi]
mov r8, r8
xorps xmm0, xmm0
xchg r14, rcx
mov rcx, rax
xchg r14, rcx
lea rax, [rsp + 0x28]
xchg r15, rax
mov qword [rsp + 0x20], r15
xchg r15, rax
lea rdx, [r13 + 1]
mov dword [rsp - 0x20], edx
xchg rsp, r12

Function at 0x140054a80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg r13, r13
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
mov r8, qword [rdx + 0x38]
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
add r8, rsi
mov dword [rsp - 0x28], 0x4de9da0b
xchg rbp, rdx
mov rbp, rsi
xchg rdx, rbp
mov qword [rcx + 0x38], r8
mov dword [rsp - 0x44], 0x39229813
call fcn.140055770
mov r9, qword [rbx]
mov ecx, esi
mov rbp, rbp
and ecx, 3
mov r8d, 0x3380e9c5
xor r8d, 0x4fdcb524
sub r8d, 0xf5db529
sub r8d, 0x1ca38fd1
shl ecx, 1
shl ecx, 2
mov edx, r8d
ror edx, cl
mov dword [rsp - 0x1c], 0x7bbcabd5
xchg r10, rdx
mov rdx, rax
xchg rdx, r10
xor ecx, ecx
mov dword [rsp - 0x14], 0x7e2065b4
cmp qword [rbx + 0x38], rcx
jbe 0x140054b97
lea rax, [rsi + rsi]
mov r11d, 0x5959efd8
sub r11d, 0x3b964be2
xor r11d, 0x4a788204
xor r11d, 0x57bb210d
sub rax, r9
add r10, rax
mov dword [rsp - 0x20], edx
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
mov dword [rsp - 0x14], 0x50351be4
xor ax, r8w
ror edx, 1
ror edx, 5
ror edx, 1
ror edx, 1
and ax, r11w
ror r8d, 6
ror r8d, 1
ror r8d, 1
xor ax, word [r9 - 2]
inc rcx
mov word [r10 + r9 - 2], ax
mov rbp, rbp
cmp rcx, qword [rbx + 0x38]
jb 0x140054b52
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rsi, qword [rsp + 0x38]
nop
add rsp, 0x523a07f5
sub rsp, 0x523a07d5
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140054bd0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rsi, r10
mov qword [rsp + 0x10], r10
xchg r10, rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp - 0x38], edx
push r14
nop
add rsp, 0x6e89d38f
sub rsp, 0x6e89d3af
xchg r14, r11
mov r11, qword [rcx + 0x38]
xchg r14, r11
mov rdi, rdx
mov dword [rsp - 0x2c], edi
xchg rsi, rdx
mov rdx, rcx
xchg rsi, rdx
nop
movabs rbx, 0xffffffff43c23da1
sub rbx, 0x17bad8c1
add rbx, 0x1d96054
xor rbx, 0x62914d7d
add rbx, 0x7fffffff
add rbx, 0x308e77b7
inc rbx
cmp word [rdx + rbx*2], 0
mov dword [rsp - 0x20], 0x75de0a52
jne 0x140054c48
lea r8, [r14 + rbx]
mov rdx, r14
xchg rdi, r8
mov qword [rcx + 0x38], rdi
xchg rdi, r8
call fcn.140055770
mov dword [rsp - 0x24], 0x2ae05ecf
mov ecx, r14d
mov edx, 0x683a7c62
sub edx, 0x27e1fa4d
xor edx, 0x11318768
sub edx, 0x10ded96
and ecx, 3
mov dword [rsp - 0x14], ebp
shl ecx, 3
ror edx, cl
test rbx, rbx
je 0x140054d18
mov dword [rsp - 0xc], 0xcb32c8e
lea r8, [r14 + r14]
mov ecx, 0x246482ed
add ecx, 0x4f0a291a
sub ecx, 0x628ac42f
add ecx, 0xd955559
sub ecx, 0x1e793c32
sub r8, rdi
mov rsp, rsp
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rdi, rdi
movzx eax, dx
lea rdi, [rdi + 2]
and ax, cx
mov dword [rsp - 0x2c], 0x7a5ac5a0
ror edx, 8
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
sub rbx, 1
xchg r15, r15
jne 0x140054cec
mov rbx, qword [rsp + 0x30]
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x38]
xchg rbp, rdi
mov rbp, qword [rsp + 0x40]
xchg rdi, rbp
nop
add rsp, 0x27cda329
sub rsp, 0x27cda309
pop r14
ret
Function at 0x140055591
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
xchg rbp, r10
mov qword [rsp + 0x18], r10
xchg r10, rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 0x27fc3efe
add rsp, 0x27fc3ede
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov qword [rdx], rsi
xchg rdx, rdx
xor edi, edi
xchg rbp, rsi
movups xmmword [rbp], xmm0
xchg rbp, rsi
xchg r9, r13
mov r14, r13
xchg r13, r9
xchg r8, rbp
mov r8, rbp
xchg rbp, r8
xchg rsi, rdi
movups xmmword [rdi + 0x10], xmm0
xchg rsi, rdi
xchg rbx, r11
mov r11, rdx
xchg rbx, r11
movups xmmword [rsi + 0x20], xmm0
xchg r10, rdi
mov qword [rdx + 0x38], r10
xchg rdi, r10
xchg r13, rax
mov r13, qword [rcx + 0x38]
xchg r13, rax
cmp r8, rax
jae 0x1400556e8
mov dword [rsp - 0x10], 0x7196303a
sub rax, r8
xchg r15, r11
mov qword [rsp + 0x40], r11
xchg r15, r11
cmp rax, r9
mov rdx, rdx
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov rax, qword [rcx]
mov dword [rsp - 0x30], 0x66d18e5c
xchg r12, rcx
mov r12, qword [rdx]
xchg rcx, r12
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14005557c
xchg r13, r13
call fcn.1400986e0
cmp r14, 0x18
jbe 0x1400555c2
lea rcx, [r14 + r14]
mov dword [rsp - 0x14], 0x9c8d2e7
call fcn.1400989b0
xchg r14, rax
mov qword [rbx], r14
xchg r14, rax
test rax, rax
mov dword [rsp - 0x1c], ecx
jne 0x1400555ce
xchg r14, rsi
mov qword [rbx], r14
xchg rsi, r14
xchg r8, rdi
mov r9, r8
xchg r8, rdi
jmp 0x1400555f4
xchg rsi, r11
mov qword [rbx], r11
xchg r11, rsi
mov rax, rsi
xorps xmm0, xmm0
xchg r14, rax
movups xmmword [r14], xmm0
xchg r14, rax
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
xchg rsp, r9
mov rsp, qword [rbx]
xchg r9, rsp
and ebp, 3
mov r8d, 0x35b304b5
sub r8d, 0x17a3cee2
add r8d, 0x446ee1e9
sub r8d, 0x1222ffd5
shl ebp, 1
shl ebp, 1
shl ebp, 1
mov edx, r8d
mov r12, r12
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x1400556aa
mov dword [rsp - 0x1c], ecx
sub r15, r9
mov ecx, 0x15f67588
add ecx, 0x655b261c
sub ecx, 0x76f94fdb
add ecx, 0x51898af1
sub ecx, 0x55e1d5bb
nop dword [rax]
mov rsp, rsp
nop word [rax + rax]
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
mov rdx, rdx
ror edx, 4
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
and ax, cx
xchg rdi, rdi
ror r8d, 1
ror r8d, 1
ror r8d, 6
xor ax, word [r15 + r9 - 2]
xchg r10, r10
inc rdi
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
mov dword [rsp - 0x18], ecx
jb 0x140055662
mov r15, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
xchg rbp, rbp
xchg rbp, rcx
mov rcx, qword [rsp + 0x50]
xchg rcx, rbp
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
mov rdx, rdx
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x2c], 0x59bf17ac
ret
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x1400556b2

Function at 0x140055ad0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008d3b4
xchg rcx, r12
mov r10, r12
xchg r12, rcx
mov eax, dword [0x140142f30]
xchg r13, r13
cmp qword [0x140143018], 0
jne 0x14008d140
syscall
mov r13, r13
ret