joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001740
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx]
xor r9d, r9d
shl eax, 2
mov r10, r8
mov r11, rcx
test eax, eax
je 0x180001776
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
mov byte [r9 + r8], al
inc r9d
mov eax, dword [rcx]
shl eax, 2
cmp r9d, eax
jb 0x180001760
mov eax, dword [rcx + 4]
mov r9d, dword [rcx]
inc eax
shl eax, 4
shl r9d, 2
cmp r9d, eax
jae 0x18000198c
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x20], rsi
lea esi, [r9 + 2]
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r12
lea r12, [0x18001d160]
mov qword [rsp + 8], r14
mov qword [rsp], r15
nop dword [rax + rax]
mov edi, dword [r11]
lea eax, [r9 - 4]
movzx ebx, byte [rax + r10]
xor edx, edx
lea eax, [r9 - 3]
movzx ebp, byte [rax + r10]
lea eax, [r9 - 2]
movzx r14d, byte [rax + r10]
lea eax, [r9 - 1]
movzx r15d, byte [rax + r10]
mov eax, r9d
shr eax, 2
div edi
test edx, edx
jne 0x18000188a
movzx eax, bpl
lea r8d, [rdi*4]
mov ecx, eax
movzx edx, bl
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
mov eax, edx
and eax, 0xf
movzx r14d, byte [rcx + r12]
mov ecx, edx
and rcx, 0xfffffffffffffff0
xor edx, edx
add rcx, rax
mov eax, r9d
div r8d
movzx r15d, byte [rcx + r12]
mov cl, 1
sub eax, 1
je 0x180001886
mov r8d, eax
nop dword [rax + rax]
movzx eax, cl
add cl, cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
xor cl, dl
sub r8, 1
jne 0x180001870
xor bl, cl
jmp 0x1800018e7
cmp edi, 6
jbe 0x1800018e7
cmp edx, 4
jne 0x1800018e7
movzx eax, bl
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, bpl
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx r14d, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx r15d, byte [rcx + r12]
mov ecx, r9d
lea eax, [rdi*4]
sub ecx, eax
movzx ecx, byte [rcx + r10]
xor cl, bl
mov byte [r9 + r10], cl
mov ecx, r9d
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
lea eax, [rsi - 1]
inc ecx
movzx edx, byte [rcx + r10]
mov ecx, r9d
xor dl, bpl
mov byte [rax + r10], dl
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
add ecx, 2
movzx ecx, byte [rcx + r10]
xor cl, r14b
mov byte [rsi + r10], cl
mov ecx, r9d
mov eax, dword [r11]
add r9d, 4
shl eax, 2
sub ecx, eax
lea eax, [rsi + 1]
add ecx, 3
add esi, 4
movzx edx, byte [rcx + r10]
xor dl, r15b
mov byte [rax + r10], dl
mov eax, dword [r11 + 4]
inc eax
shl eax, 4
cmp r9d, eax
jb 0x1800017c0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x180002340
Capabilities:
Delete file
Get file size
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call fcn.180005890
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.180005388
inc rax
lea r8, [rsp + 0x164]
sub r8, rax
mov rcx, rax
xor edx, edx
call fcn.180005890
lea r8, [0x180022dd0]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.180008304
xor ebp, ebp
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800024d3
mov qword [rsp + 0x190], rbx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x198], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
lea ecx, [rbp + 1]
mov ebx, eax
call fcn.18000829c
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
mov r8d, ebx
mov qword [rsp + 0x20], rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rax, [rsp + 0x5c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [0x180022d60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800024c3
mov rcx, qword [rsp + 0x50]
lea r9d, [rbp + 3]
mov dword [rsp + 0x28], ebx
lea rdx, [0x180022dd0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800029e0
mov rbp, qword [rsp + 0x1a0]
add rsp, 0x180
pop rsi
ret
Function at 0x180002500
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, byte [0x18001e180]
lea rdx, [0x180022d60]
movups xmm0, xmmword [str.CToAjr5P_pis5S]
mov byte [rsp + 0x58], al
mov rdi, rcx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], ebx
mov rcx, 0xffffffff80000001
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000260a
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x180022dd0]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800025ff
mov eax, dword [rsp + 0x38]
lea ecx, [rbx + 1]
mov edx, eax
mov dword [rdi], eax
call fcn.18000829c
mov rcx, qword [rsp + 0x30]
lea rdx, [0x180022dd0]
mov rbx, rax
xor r9d, r9d
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rdi]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov dword [rsp + 0x40], 4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xa
call fcn.180001100
jmp 0x18000260c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800029e0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.140195000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x140016bac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov dword [rsp - 0x40], 0x584c5f44
mov r15, r15
jmp 0x140016c41
pop r11
jne 0x140016bd4
je 0x140016bd4
lea esi, [rdi - 0x10ae]
movabs r13, 0x641e0200000099e9
lea r12d, [rdi - 0x6cfc]
jmp rcx
jmp 0x140016c72
mov rdi, rdi
mov dword [rsp - 0x1c], 0x6eb981da
mov dword [rsp - 0x44], esp
jmp 0x140016d35
push rdi
sub rsp, 0x30
mov dword [rsp - 0x2c], 0x57974771
mov dword [rsp - 0x1c], 0x4895f203
jmp 0x140016c20
mov rbx, rdx
push r11
movabs r11, 0x49376c3261cf9deb
jne 0x140016c27
jmp 0x140016bc6
je 0x140016c27
call fcn.140016d78
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
mov rbx, rbx
mov dword [rsp - 0x10], 0x2666170f
push rsi
jmp 0x140016c06
mov r9, rbx
and qword [rsp + 0x20], 0
mov r8d, 0x40
mov rcx, rcx
jmp 0x140016cc9
lea rsi, [rax + 0x18]
mov rdi, rcx
call fcn.140018420
mov rdi, rdi
mov qword [rsp + 0x28], rsi
je 0x140016ca4
jne 0x140016ca4
cmp rdi, rbp
rol r15d, 0x36
cmp r9, rdx
call fcn.140015ecf
call rax
cmp r9, rcx
ror esi, 0x22
popfq
movabs r8, 0x75ca71b239f6b5eb
pause
call rax
test r10d, 0x2ddd1fd7
invalid
sub eax, 0x2c8f8d44
mov dh, 0
add bh, dh
ret
imul esp, dword [rbp - 3], 0xffffffcb
jmp 0x140016d7c
jmp 0x140016c5b
mov rdx, rdi
mov rcx, qword [rax]
call fcn.140098fd0
or ecx, 0xffffffff
mov rsi, rsi
jne 0x140016d22
je 0x140016d22
xor ecx, 0x59073901
pop r10
jmp rcx
jmp 0x140016d4c
pop rdi
pop rsi
pop rbx
xchg rbx, rbx
mov dword [rsp - 0x28], 0x687b0d7c
mov dword [rsp - 0x14], 0x54b8f5d7
ret
mov dword [rsp - 0x24], ebx
mov rdi, rdi
test eax, eax
cmovs eax, ecx
add rsp, 0x30
jmp 0x140016bf2
push rsi
Function at 0x14002357f
Capabilities:
Encode data using xor

Disassembly:
call fcn.140098620
mov rdi, rdi
xchg r10, r10
xchg r8, r8
mov rax, rbx
jmp 0x1400235ff
je 0x140023550
mov edx, 0x10
jmp 0x140023542
ret
pop r10
pop rbx
ret
add rsp, 0x20
push r10
movabs r10, 0x436cb1e13256f2eb
jmp 0x140023614
jmp 0x1400235fb
jne 0x140023607
je 0x140023607
call fcn.14002351a
add rsp, 0x20
pop r10
jmp 0x1400235fa

Function at 0x140026482
Capabilities:
Execute syscall

Disassembly:
jne 0x1400273ae
je 0x1400273ae
call fcn.140026440
add rsp, 0x48
jmp 0x140026608
pop rbp
ret

Function at 0x14002a755
Capabilities:
Execute syscall

Disassembly:
cmp ecx, ecx
call rcx
call rcx
call rcx
ja 0x14002abfb
bswap rdi
call fcn.14002ae29
mov ecx, 0x2a7126c3
pushf
movabs r10, 0x4038aefffffb85e9
add r10d, 0x731aba61
bswap r12
lea r12d, [rdi - 0x4107]
test r10, rbx
jmp rcx
Function at 0x140031798
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0x3b223100000407e9
rcl r8d, 0x9d
call 0x140030a59
Function at 0x14003533f
Capabilities:
Execute syscall

Disassembly:
jb 0x140034f34
lea rdx, [rbp + 0x9f2]
mov word [rbp + 0xa52], r9w
lea rcx, [rbp + 0xf50]
mov dword [rsp - 0x10], 0x71f82661
xchg rdi, rdi
je 0x140034fdd
jne 0x140034fdd
rcr r12d, 0xd2
pop r12
rcl ebx, 0xcd
jmp rax
jmp 0x1400357c8
mov rax, qword [rbp + 0x10a8]
mov r13, r13
xchg rsp, rsp
inc rax
mov qword [rbp + 0x10a8], rax
jmp 0x1400357e0
movabs r10, 0x6d0dde0000019de9
jne 0x1400352a7
jmp 0x140035449
je 0x1400352a7
call 0x14003533f
jne 0x1400352f1
je 0x1400352f1
call rcx
test r9, rdi
lea ecx, [rdx + 0x81e9]
mul r15
dec rcx
rcl ebp, 0x19
lea r14d, [rdi + 0x5597]
sub r14d, 0x55cb30c3
test r10, rbp
lea esi, [rdx - 0xfb4b]
rol edx, 0x99
call rax
ror ebp, 0x13
movabs rdx, 0x4acdce0000014ce9
syscall
lea r9d, [rdi - 0x8246]
call fcn.1400353a4
mov dword [rsp - 0x30], 0x711c8173
jmp 0x140035442
pop rcx
ret
pop rcx
mov rax, qword [rbp + 0x10a8]
xor cx, dx
mov word [rbp + rax*2 + 0x9f2], cx
jmp 0x140035125
mov ebp, 0x510238b3
movabs rcx, 0x6664affffff1fe9
jne 0x140035410
jmp 0x140035334
jmp 0x1400356de
add rsp, 0x61
pop r10
ret
pop r10
mov rcx, r13
mov dword [rbp - 0xe], 0x2e0015
lea rdi, [rbp + 0x9f2]
je 0x140035471
jne 0x140035471
lea r13d, [rdx + 0x3063]
lea r12d, [rbx - 0xa2e4]
ret
jmp 0x1400357f7
xor r13d, r13d
mov dword [rsp - 0x40], 0x66532a1c
mov dword [rsp - 0x14], 0xe095689
mov dword [rbp - 6], 0x620041
mov dword [rbp - 2], 0x1700d0
jmp 0x140035684
call fcn.140016bac
xor eax, eax
mov dword [rbp - 0x12], 0x3f00a3
mov dword [rsp - 0x40], 0x7c72d491
mov r14, r14
mov dword [rsp - 0x38], 0xa0e1e05
push r10
jmp 0x1400352a5
mov dword [rbp + 2], 0x25000f
mov dword [rbp + 6], 0x3d0095
mov dword [rsp - 0x40], 0x5c74cada
mov dword [rsp - 0x44], 0x3b27282c
je 0x1400356ca
jne 0x1400356ca
call rax
jmp fcn.140035616
je 0x140035410
call fcn.1400356b4
add rsp, 0x61
jmp 0x140035332
mov dword [rsp - 0x1c], 0x155ad3e7
xchg rbx, rbx
mov dword [rsp - 0x20], 0x1a172b8d
jmp 0x140035630
mov rax, qword [rbp + 0x10a8]
cmp rax, r13
mov dword [rsp - 0x10], 0x2992dd99
jmp 0x140034f7f
mov rdx, rdx
xchg rbp, rbp
mov rcx, rcx
mov dword [rsp - 0x34], 0x7f5d2da0
mov dword [rsp - 0x28], 0x46791a06
mov dword [rbp - 0xa], 0x6b009e
rep stosb byte [rdi], al
jmp 0x140035591

Function at 0x140036fe3
Capabilities:
Execute syscall

Disassembly:
mov dword [rbp + 0x2e], 0x1700d0
xchg r11, r11
mov dword [rsp - 0x30], ebp
mov dword [rsp - 0x30], esi
jmp 0x140036b63
lea r14d, [rcx + 0x18]
mov dword [rbp + 0x32], 0x25000f
mov dword [rbp + 0x36], 0x3d0095
mov dword [rbp + 0x3a], 0x260015
mov dword [rsp - 0x2c], 0x118da748
mov dword [rsp - 0x30], 0x3a35ce2e
mov dword [rsp - 0x34], ebx
mov dword [rbp + 0x26], 0x6b009e
mov dword [rbp + 0x2a], 0x620041
jmp 0x1400367c6

Function at 0x140037ef4
Capabilities:
Execute syscall

Disassembly:
push rbx
movabs r12, 0x6103e8000006f0e9
Function at 0x14003902c
Capabilities:
Execute syscall

Disassembly:
xchg rsp, rsp
mov dword [rsp - 0x34], ebp
mov dword [rsp - 0x3c], 0x77378ff6
jb 0x14003909e
xor eax, eax
mov dword [rbp + 0x1cc], 0x3100a9
mov dword [rsp - 0x1c], 0x1a54ef7a
jmp 0x1400392a2
shl cl, 3
movzx edx, word [rbp + rax*2 + 0x10e]
mov eax, r15d
mov r8, r8
jmp 0x140038cfa
movabs r11, 0x65431800000401e9
jne 0x140038ce0
jmp 0x1400390e6
je 0x140038ce0
call fcn.140038e60
add rsp, 0x46
jmp 0x1400390e3
mov dword [rsp - 0x3c], ecx
mov dword [rsp - 0x14], esi
shr eax, cl
jmp 0x14003900f
mov dword [rsp - 0x34], esi
mov dword [rsp - 0x20], ebp
mov dword [rsp - 0x20], 0x40f58af7
mov r15, r15
jmp 0x140038b96
mov qword [rbp + 0x10a8], rax
mov dword [rsp - 0x38], 0x640360ae
mov dword [rsp - 0x40], 0x7db61aac
mov dword [rsp - 0x18], 0x93e52f1
mov dword [rsp - 0x10], 0x50b5f3ea
jmp 0x1400390ff
push r15
movabs r15, 0x427803000001c7e9
jne 0x140039013
jmp 0x1400391df
je 0x140039013
call 0x1400391f5
add rsp, 0x46
pop r15
jmp 0x1400391de
pop r8
ret
pop r8
mov rax, qword [rbp + 0x10a8]
jmp 0x14003909e
mov rcx, qword [rbp + 0x10a8]
mov rax, qword [rbp + 0x10a8]
and cl, sil
je 0x1400390c4
jne 0x1400390c4
ja 0x1400395b7
xor edx, 0x63e8b7d
neg rdx
movabs rbx, 0x6d507fffffcb9e9
ret
jmp 0x140038d82
pop r11
mov qword [rbp + 0x10a8], rax
mov rax, qword [rbp + 0x10a8]
cmp rax, 0x19
jmp 0x140038a9c
push r8
movabs r8, 0x7f5670ffffff4ae9
jne 0x140039103
jmp 0x140039052
je 0x140039103
call 0x14003902c
add rsp, 0x46
jmp 0x14003904f
ret
pop r15
movzx ecx, al
mov rax, qword [rbp + 0x10a8]
xor cx, dx
mov dword [rsp - 0x34], 0x71e57c4b
jl 0x1400391da
jno 0x14003923f
mov ebx, ebx
jmp 0x140039416
mov dword [rbp + 0x12e], 0x7e0089
mov dword [rbp + 0x132], 0x2e0036
mov dword [rsp - 0x30], 0x41dd5ab0
mov dword [rsp - 0xc], 0x76c96807
mov dword [rsp - 0x20], 0x39dc8fc3
mov dword [rbp + 0x136], 0x300082
mov dword [rbp + 0x13a], 0x210008
jmp 0x140038eb2
mov dword [rsp - 0x1c], 0xa661e29
mov word [rbp + rax*2 + 0x8ba], cx
add byte [rax - 0x75], cl
test dword [rax + 0x48000010], ebp
inc eax
xchg rdi, rdi
mov dword [rsp - 0x1c], edi
push r11
jmp 0x140038cde
call rax
ret
Function at 0x140040f03
Capabilities:
Encode data using xor

Disassembly:
insd dword [rdi], dx
fsubr dword [rdx]
mov rdx, rdx
mov r9, r9
sub rsp, 0x20
push r8
jmp 0x140040f2f
xchg rsp, rsp
mov dword [rsp - 0x10], 0xad67d50
call fcn.140098620
mov rax, rbx
jmp 0x140040f4b
movabs r8, 0x3249ab7148cd31eb
jne 0x140040f31
jmp 0x140040f64
je 0x140040f31
call 0x140040f60
add rsp, 0x20
jmp 0x140040f61
add rsp, 0x20
pop rbx
mov dword [rsp - 0x44], 0x20cf2c0a
mov dword [rsp - 0x34], 0x3bb5662e
ret
pop r8
ret
pop r8
lea rax, [0x1400016c8]
mov rbx, rcx
mov dword [rsp - 0x3c], 0x75bf68c
mov r13, r13
jmp 0x140040f80
xchg rbx, rbx
mov dword [rsp - 0x10], 0x8bc16e3
mov qword [rcx], rax
test dl, 1
je 0x140040f27
mov edx, 0x10
jmp 0x140040f17

Function at 0x1400422f4
Capabilities:
Execute syscall

Disassembly:
pop rcx
mov dword [rsp - 0x18], esi
jmp 0x1400424b8
mov dword [rsp - 0x2c], 0x17f6bd20
mov dword [rsp - 0x34], ebp
mov word [rax], cx
jmp 0x1400420b4
Function at 0x14004def1
Capabilities:
Execute syscall

Disassembly:
movabs dword [0x15c445c7003f00], eax
add bh, al
enter 0x9e, 0x6b
add byte [rcx - 0x1623db84], cl
add rax, qword [rax]
add bh, al
mov dword [rsp - 0x40], 0x4b4f9b4b
mov dword [rsp - 0x30], 0x7cc1eb8
mul r9
call rcx
syscall
call rax
test r13d, 0x207bb64e
cmp ecx, 0x9d7ce5eb
jns 0x14004ed21
or r14d, 0xcc1a1d39
add r13d, 0x80256280
mul r8
je 0x14004d8b5
jmp rcx
wait
mov word [rax], es
add byte [rax - 0x75], cl
lea edx, [rax + 0x48000006]
lea eax, [rbp + 0x698]

Function at 0x14005324c
Capabilities:
Execute syscall

Disassembly:
test rax, rax
xchg rsp, rsp
jmp 0x140052fc3
Function at 0x140054400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
xchg rcx, rcx
add rsp, 0xffffffffffffffe0
mov rbx, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
nop
movabs rdx, 0xffffffff74cd1486
sub rdx, 0x6a4ca265
xor rdx, 0x731dd556
sub rdx, 0x1ccc5202
add rdx, 0x7fffffff
add rdx, 0x232eaa8b
nop word [rax + rax]
xchg rsi, rsi
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140054453
mov dword [rsp - 0x30], esp
mov qword [rcx + 0x38], rdx
call fcn.140017984
xor r8d, r8d
mov dword [rsp - 0x3c], esp
mov edx, 0x7248d7f7
sub edx, 0x636a1f9c
add edx, 0x5e232491
xor edx, 0x2e08dd96
xor edx, 0xc685f8a
cmp qword [rdi + 0x38], r8
jbe 0x140054506
mov dword [rsp - 0x10], esi
sub rbx, rax
mov r9d, 0x42fb6023
xor r9d, 0x1c0ecff8
int1
clc
iretd
invalid
sbb al, 0x41
xor ecx, 0x645de6b5
sub r9d, 0x3aa8486f
Function at 0x140054bd0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rsi
xchg r8, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
xchg r13, r13
mov rbx, rdx
xchg r12, r8
mov r12, qword [rdx + 0x38]
xchg r12, r8
mov rdi, rcx
add r8, rsi
xchg r15, r15
xchg rsi, rcx
mov rdx, rcx
xchg rsi, rcx
xchg r8, r9
mov qword [rcx + 0x38], r9
xchg r8, r9
call fcn.1400558e0
xchg r15, r15
xchg rbp, r9
mov rbp, qword [rbx]
xchg r9, rbp
mov ecx, esi
mov dword [rsp - 0x14], ebx
and ecx, 3
mov r8d, 0x3e2062b
add r8d, 0xecd5785
add r8d, 0x2219e522
add r8d, 0x4a87129
xor r8d, 0x7610ed0b
shl ecx, 2
shl ecx, 1
mov edx, r8d
mov dword [rsp - 0x20], 0xd183696
ror edx, cl
xchg r8, r10
mov r8, rax
xchg r8, r10
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
jbe 0x140054d0e
mov dword [rsp - 0x24], 0x2a22734d
lea rax, [rsi + rsi]
mov r11d, 0x51e445f6
xor r11d, 0xac0590f
sub r11d, 0x118fc765
xor r11d, 0x5a09b3d2
xor r11d, 0x139de6b9
sub rax, r9
add r10, rax
xchg rbp, rbp
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
mov dword [rsp - 0x44], 0x1b013b61
xor ax, r8w
ror edx, 1
ror edx, 1
ror edx, 6
and ax, r11w
ror r8d, 4
ror r8d, 2
ror r8d, 1
ror r8d, 1
xor ax, word [r9 - 2]
mov dword [rsp - 0x34], 0x77df6747
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
mov dword [rsp - 0x1c], ebp
jb 0x140054cbe
mov rbx, qword [rsp + 0x30]
xchg rdx, rdi
mov rax, rdx
xchg rdx, rdi
xchg r15, rsi
mov r15, qword [rsp + 0x38]
xchg r15, rsi
sub rsp, 0xffffffffffffffe0
mov r14, r14
nop
mov rdi, qword [rsp]

Function at 0x140054d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rsi
mov qword [rsp + 0x10], rbx
xchg rsi, rbx
mov qword [rsp + 0x18], rdi
push r14
xchg r11, r11
nop
add rsp, 0x4b87333a
sub rsp, 0x4b87335a
mov r14, qword [rcx + 0x38]
xchg rdx, rsp
mov rdi, rsp
xchg rdx, rsp
xchg rsi, r9
mov r9, rcx
xchg rsi, r9
nop
movabs rbx, 0xffffffff08a048a0
add rbx, 0x4f178b5c
sub rbx, 0x2fd10051
add rbx, 0x7fffffff
add rbx, 0x58192c55
inc rbx
mov dword [rsp - 0xc], ecx
cmp word [rdx + rbx*2], 0
jne 0x140054da6
lea r8, [r14 + rbx]
mov dword [rsp - 0x28], esi
xchg r13, r14
mov rdx, r13
xchg r13, r14
mov qword [rcx + 0x38], r8
mov dword [rsp - 0x2c], ebp
call fcn.1400558e0
mov ecx, r14d
mov edx, 0x65548fd0
xor edx, 0x548ec91c
xor edx, 0x3cd564a9
add edx, 0x42523c8b
and ecx, 3
shl ecx, 1
shl ecx, 2
ror edx, cl
xchg r11, r11
test rbx, rbx
je 0x140054e64
lea r8, [r14 + r14]
mov rdi, rdi
mov ecx, 0x605ec166
xor ecx, 0x1edaeccd
sub ecx, 0x14ec1ea9
sub ecx, 0x69980e03
sub r8, rdi
mov rsi, rsi
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov dword [rsp - 0xc], ebx
lea rdi, [rdi + 2]
and ax, cx
ror edx, 5
ror edx, 3
xor ax, word [rdi - 2]
xchg r8, r8
mov word [r8 + rdi - 2], ax
sub rbx, 1
jne 0x140054e39
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xchg r13, r13
nop
add rsp, 0x73604857
sub rsp, 0x73604837
pop r14
mov dword [rsp - 0x20], ebx
ret