joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050f70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg rbx, r14
push rdi
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x695a72382d08b7bd
add rbx, 0xe93e351
add rbx, 0x6cb3040
add rbx, 0x2264607d
xchg rcx, rsp
mov rdi, rsp
xchg rsp, rcx
cmp qword [rcx + 0x20], rbx
jne 0x1400511c3
mov rcx, rcx
mov eax, 0x10858318
add eax, 0x606b0193
sub eax, 0x1e2ed8
sub eax, 0x22eae3ce
sub eax, 0x4de771f7
mov dword [rsp + 0x20], 0x27c9f0af
add dword [rsp + 0x20], 0x400261aa
add dword [rsp + 0x20], 0x1442504f
xor dword [rsp + 0x20], 0x2b0e8d00
sub dword [rsp + 0x20], 0x56852f50
mov word [rsp + 0x34], ax
xchg r10, r10
xor r8d, r8d
mov dword [rsp + 0x24], 0x7505c4b4
sub dword [rsp + 0x24], 0x6c16068d
add dword [rsp + 0x24], 0x670c4356
sub dword [rsp + 0x24], 0x5f7fb694
sub dword [rsp + 0x24], 0x10214ae2
mov dword [rsp + 0x28], 0x6f18ee12
sub dword [rsp + 0x28], 0x43829c71
sub dword [rsp + 0x28], 0x6dd2271
add dword [rsp + 0x28], 0x2f151c63
sub dword [rsp + 0x28], 0x53ae4b2c
mov dword [rsp + 0x2c], 0x48a1115d
sub dword [rsp + 0x2c], 0x15ff3a22
xor dword [rsp + 0x2c], 0x4a17ac55
xor dword [rsp + 0x2c], 0x78af7b3e
mov dword [rsp + 0x30], 0x53d048b4
add dword [rsp + 0x30], 0x1f95ebf3
xor dword [rsp + 0x30], 0x5cda5f89
sub dword [rsp + 0x30], 0x2f3d6abf
xchg r13, r8
mov qword [rsp + 0x60], r13
xchg r8, r13
xchg rbx, rax
mov rbx, qword [rsp + 0x60]
xchg rbx, rax
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x3c], esi
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
and cl, 3
mov dword [rsp - 0x18], 0x6f8b04e
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x5e32a911
xor eax, 0x2f56e7f0
xor eax, 0x5b38ecaa
sub eax, 0x16216985
xor eax, 0x23592bcd
shr eax, cl
movzx ecx, al
mov rax, qword [rsp + 0x60]
xchg rdx, rdx
xor cx, dx
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
inc rax
mov r14, r14
mov qword [rsp + 0x60], rax
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
cmp rax, 0xb
jb 0x1400510ab
mov dword [rsp - 0x38], 0x233b72b1
xor edx, edx
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
mov r9, r9
call fcn.1400a3160
xchg r14, rax
mov rdx, r14
xchg r14, rax
mov r8, rax
xor rdx, rbx
xchg r9, r9
xor eax, eax
xchg rdx, rbp
mov qword [rdi + 0x20], rbp
xchg rdx, rbp
lea rdi, [rsp + 0x36]
mov ecx, 0x7635cb61
sub ecx, 0x47c6e4c3
add ecx, 0x4d70848d
sub ecx, 0x5ffd6c48
sub ecx, 0x1be1fed8
rep stosb byte [rdi], al
mov dword [rsp - 0x44], esp
cmp rdx, rbx
je 0x1400511cb
lea rdx, [0x1404ec890]
mov r12, r12
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.140067160
mov dword [rsp - 0x34], ebx
test al, al
setne al
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffb0
mov dword [rsp - 0x10], edx
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x70
sub al, 0x27
xor al, 6
sub al, 0x4e
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x1c], edx
sub rsp, 0xffffffffffffffb0
pop rdi
ret
Function at 0x14006d220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x6bd26453
add rsp, 0x6bd26433
mov rbx, rdx
mov dword [rsp - 0x28], 0x2bd5ccc
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
nop
movabs rdx, 0xffffffff45ba722b
sub rdx, 0x26deb82
sub rdx, 0x21042ad
add rdx, 0x7fffffff
add rdx, 0x3ec3bc04
nop word [rax + rax]
mov dword [rsp - 0x38], 0x73e4a9ba
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x14006d289
xchg r12, r12
mov qword [rcx + 0x38], rdx
call fcn.140011430
xor r8d, r8d
mov edx, 0x12e7f221
add edx, 0x38209191
sub edx, 0x3bc07411
xor edx, 0x382a1caa
cmp qword [rdi + 0x38], r8
jbe 0x14006d333
mov dword [rsp - 0x1c], esi
sub rbx, rax
mov r9d, 0x3af95e4
xor r9d, 0x79d6cfee
sub r9d, 0x685f1e53
xor r9d, 0x42125793
xor r9d, 0x50086cdb
nop word [rax + rax]
mov r12, r12
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
mov r8, r8
ror edx, 2
ror edx, 3
ror edx, 2
ror edx, 1
xor cx, word [rax + rbx - 2]
mov dword [rsp - 0x28], 0x20e9992f
inc r8
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x14006d2f9
xchg r15, r15
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
xchg r9, rdi
mov rax, r9
xchg rdi, r9
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14006dd10
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg rsi, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 0x136c6ba6
add rsp, 0x136c6b86
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x2c], 0x677c223e
mov rbx, rdx
mov r8, qword [rdx + 0x38]
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
add r8, rsi
mov dword [rsp - 0x34], esi
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r13, r8
mov qword [rcx + 0x38], r13
xchg r8, r13
call fcn.14006e920
mov r9, qword [rbx]
mov dword [rsp - 0x30], ecx
mov ecx, esi
and ecx, 3
mov r8d, 0x50c288fe
xor r8d, 0x57bb96bb
add r8d, 0x2ba92258
xor r8d, 0x4405396
shl ecx, 2
shl ecx, 1
mov edx, r8d
mov dword [rsp - 0x20], 0x3ec758f3
ror edx, cl
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov dword [rsp - 0xc], 0x775fd0b8
jbe 0x14006de49
lea r10, [rsi + rsi]
mov r11d, 0xa77ba1e
add r11d, 0x646de252
xor r11d, 0x7dbd91fd
add r11d, 0x433babc2
xor r11d, 0x5693b9b0
sub r10, r9
add r10, rax
nop word [rax + rax]
mov dword [rsp - 0x34], ecx
movzx eax, r8w
lea r9, [r9 + 2]
xor ax, dx
mov dword [rsp - 0x14], 0x56bc5691
ror r8d, 4
ror r8d, 1
ror r8d, 2
ror r8d, 1
and ax, r11w
ror edx, 1
ror edx, 6
ror edx, 1
xor ax, word [r9 - 2]
inc rcx
mov dword [rsp - 0x34], 0x7ed1620e
mov word [r9 + r10 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x14006ddfd
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
xchg r8, rdi
mov rax, r8
xchg rdi, r8
xchg rsi, rdx
mov rdx, qword [rsp + 0x38]
xchg rdx, rsi
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0x1c], esi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14006de80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rbx
xchg rsi, r11
mov qword [rsp + 0x10], r11
xchg r11, rsi
xchg rdx, rdi
mov qword [rsp + 0x18], rdx
xchg rdx, rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
add rsp, 0x379148cf
sub rsp, 0x379148ef
mov r14, qword [rcx + 0x38]
mov r11, r11
mov rdi, rdx
xchg rsi, r13
mov r13, rcx
xchg rsi, r13
nop
movabs rbx, 0xffffffff68605d1c
sub rbx, 0x1e29ea7e
sub rbx, 0x16d38781
add rbx, 0x7fffffff
xor rbx, 0x4c9d14e3
inc rbx
mov dword [rsp - 0x38], 0x3a59d8b7
cmp word [rdx + rbx*2], 0
jne 0x14006def0
lea r8, [r14 + rbx]
mov dword [rsp - 0x34], edi
xchg rdx, rbx
mov rbx, r14
xchg rbx, rdx
mov qword [rcx + 0x38], r8
xchg r13, r13
call fcn.14006e920
mov ecx, r14d
mov edx, 0x63664d9e
xor edx, 0x2a25b209
add edx, 0x1d7ca6ca
sub edx, 0x2f5e9356
and ecx, 3
mov dword [rsp - 0x3c], 0x353310f8
shl ecx, 3
ror edx, cl
test rbx, rbx
je 0x14006dfbb
xchg r8, r8
lea rcx, [r14 + r14]
mov r8d, 0x39d4a42b
xor r8d, 0x5515f8a4
xor r8d, 0x27e57eec
sub r8d, 0x4b242164
sub rcx, rdi
mov r10, r10
add rcx, rax
nop word [rax + rax]
movzx eax, dx
mov dword [rsp - 0x30], esi
lea rdi, [rdi + 2]
and ax, r8w
ror edx, 4
ror edx, 2
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov word [rdi + rcx - 2], ax
mov rdi, rdi
sub rbx, 1
jne 0x14006df8c
mov rbx, qword [rsp + 0x30]
mov rsp, rsp
xchg rdi, rax
mov rdi, rsi
xchg rdi, rax
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x1c], esp
xchg r11, rdi
mov r11, qword [rsp + 0x40]
xchg rdi, r11
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x14006e791
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x44], edi
push rsi
push rdi
push r14
xchg r15, r15
sub rsp, 0x20
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x18], edx
xchg rsi, rsp
mov qword [rdx], rsp
xchg rsi, rsp
xor edi, edi
xchg rcx, rcx
xchg rsp, rsi
movups xmmword [rsp], xmm0
xchg rsp, rsi
xchg r9, r11
mov r14, r11
xchg r11, r9
xchg rbp, r8
mov r8, rbp
xchg r8, rbp
xchg r8, rsi
movups xmmword [r8 + 0x10], xmm0
xchg rsi, r8
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg rsi, rsp
movups xmmword [rsp + 0x20], xmm0
xchg rsi, rsp
xchg r14, rdi
mov qword [rdx + 0x38], r14
xchg r14, rdi
xchg rdx, rax
mov rdx, qword [rcx + 0x38]
xchg rdx, rax
cmp r8, rax
jae 0x14006e8b9
mov dword [rsp - 0x38], esp
sub rax, r8
mov qword [rsp + 0x40], r15
cmp rax, r9
cmovb r14, rax
mov dword [rsp - 0x3c], ebx
xchg r14, rsp
mov qword [rdx + 0x38], rsp
xchg rsp, r14
xchg rdi, rax
mov rdi, qword [rcx]
xchg rdi, rax
xchg rcx, r8
mov r8, qword [rdx]
xchg r8, rcx
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14006e75e
mov rbp, rbp
call fcn.1400c1b60
cmp r14, 0x18
jbe 0x14006e79f
lea rcx, [r14 + r14]
mov r8, r8
call fcn.1400c1e00
mov qword [rbx], rax
test rax, rax
mov dword [rsp - 0x24], 0x27fb90bd
jne 0x14006e7a9
xchg rsi, rsp
mov qword [rbx], rsp
xchg rsi, rsp
xchg r8, rsp
mov rsp, rdi
xchg rsp, r8
jmp 0x14006e7d0
mov qword [rbx], rsi
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xorps xmm0, xmm0
mov dword [rsp - 0x28], ebx
movups xmmword [rax], xmm0
xchg r14, rax
movups xmmword [r14 + 0x10], xmm0
xchg r14, rax
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
mov r8, qword [rbx]
mov dword [rsp - 0x28], 0x4985a5fb
and ebp, 3
mov r9d, 0x5f9eea65
sub r9d, 0xccdb0e8
add r9d, 0x2a060b2b
sub r9d, 0x6c711957
xor r9d, 0x2704385a
shl ebp, 2
shl ebp, 1
mov edx, r9d
movzx ecx, bpl
ror edx, cl
xchg rdx, rdx
cmp qword [rbx + 0x38], rdi
jbe 0x14006e880
sub r15, r8
mov rsp, rsp
mov ecx, 0x4ad37576
sub ecx, 0x135ad430
sub ecx, 0x1597f9bf
sub ecx, 0x21e0a688
nop dword [rax]
nop word [rax + rax]
xchg r8, r8
movzx eax, r9w
lea r8, [r8 + 2]
xor ax, dx
ror r9d, 6
ror r9d, 1
ror r9d, 1
and ax, cx
ror edx, 2
ror edx, 5
ror edx, 1
xor ax, word [r8 + r15 - 2]
inc rdi
mov dword [rsp - 0x14], 0x549f51f3
mov word [r8 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x14006e83d
mov r14, r14
mov r15, qword [rsp + 0x40]
mov rax, rbx
xchg rcx, rbx
mov rcx, qword [rsp + 0x48]
xchg rbx, rcx
mov rbp, qword [rsp + 0x50]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
mov rax, rbx
mov r12, r12
jmp 0x14006e888
Function at 0x140071ca0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 0x10], r13
xchg rbx, r13
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
sub rsp, 0x69d13517
add rsp, 0x69d13467
mov r14d, edx
xchg r14, r14
xchg rsi, r14
mov r14, rcx
xchg r14, rsi
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
lea rcx, [rsp + 0x20]
mov ebp, r8d
call fcn.14003e990
mov dword [rsp - 0x2c], 0x5f23876f
mov rax, qword [rsp + 0xa8]
mov edi, 0x56e61ba4
xor edi, 0x2dc9995
sub edi, 0x9c47851
xor edi, 0x1f671e29
xor edi, 0x55116836
cmp rax, rdi
jbe 0x140071d48
mov ecx, edi
mov r13, r13
call fcn.1400c1980
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
mov r8, rax
xor eax, eax
jmp 0x140071d89
xchg rdi, rax
mov rcx, rdi
xchg rdi, rax
mov rdi, rax
call fcn.1400c1980
mov dword [rsp - 0x3c], 0x303d0276
xchg r11, rbx
mov r11, rax
xchg rbx, r11
xchg r8, rbp
mov rbp, rax
xchg r8, rbp
xor eax, eax
xchg r8, r8
test rdi, rdi
je 0x140071db1
nop word [rax + rax]
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x28], 0x5fee2d63
movzx edx, byte [rcx + rax]
xor dl, 0x37
mov byte [r8 + rax], dl
inc rax
mov dword [rsp - 0x20], ebp
cmp rax, rdi
jb 0x140071d89
xchg r15, rax
mov r15, qword [rsi]
xchg r15, rax
mov r8d, ebp
mov edx, r14d
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call qword [rax + 0x60]
xchg rbx, rcx
mov qword [rax + 8], rcx
xchg rcx, rbx
mov byte [rax + 4], 0x17
add byte [rax + 4], 0x1c
xor byte [rax + 4], 0x59
sub byte [rax + 4], 0x66
mov word [rax + 5], di
lea rax, [rsp + 0x28]
mov dword [rsp - 0x28], 0x831beb
xchg rbp, rcx
mov rbp, qword [rsp + 0x20]
xchg rcx, rbp
mov byte [rsi + 8], 0xa
sub byte [rsi + 8], 5
add byte [rsi + 8], 0xd
xor byte [rsi + 8], 0x13
cmp rcx, rax
jne 0x140071e41
xchg r13, r13
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x403016db
sub ecx, 0x16a9ad9e
add ecx, 0x50c75f25
sub ecx, 0x7a4dc7e2
rep stosb byte [rdi], al
jmp 0x140071e46
call fcn.1400c1b60
lea r11, [rsp + 0xb0]
xchg rbp, rbp
mov rbx, qword [r11 + 0x28]
xchg r15, rbp
mov r15, qword [r11 + 0x30]
xchg rbp, r15
xchg rsp, rdx
mov rdx, r11
xchg rdx, rsp
pop r14
mov r14, r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x14], 0x55d3ef30
ret
Function at 0x140072cc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1ecf
mov r10, rcx
mov eax, dword [0x1404ed0cc]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x24], 0xa3f5f54
jne 0x1400b1380
syscall
ret
Function at 0x1400952c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1600
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404ecff0]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x2c], ebx
jne 0x1400b1380
syscall
ret

Function at 0x1400952e0
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov r11, r11
mov byte [rsp + 0x28], al
jmp 0x1400b1c23
xchg rcx, rdi
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1404ed088]
mov rcx, rcx
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095300
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b13fe
mov r10, rcx
mov eax, dword [0x1404ecfc0]
mov dword [rsp - 0x20], esp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
xchg rsi, rsi
ret

Function at 0x140095310
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1988
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404ed048]
cmp qword [0x1404ed0e0], 0
mov rcx, rcx
jne 0x1400b1380
syscall
ret

Function at 0x140095320
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1849
mov r10, rcx
mov eax, dword [0x1404ed028]
xchg r9, r9
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095340
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1455
xchg r10, rdi
mov rdi, rcx
xchg r10, rdi
mov eax, dword [0x1404ecfc8]
mov dword [rsp - 0xc], ebp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov r9, r9
ret

Function at 0x140095350
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1abe
mov r10, rcx
mov eax, dword [0x1404ed064]
mov rdx, rdx
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095360
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1ae1
mov r10, rcx
mov r10, r10
mov eax, dword [0x1404ed068]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
xchg r11, r11
ret

Function at 0x140095370
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1a10
mov r10, rcx
xchg r13, r13
mov eax, dword [0x1404ed054]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
mov dword [rsp - 0x3c], 0x52d329b5
syscall
ret

Function at 0x140095380
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1a3b
xchg r11, r10
mov r11, rcx
xchg r11, r10
mov eax, dword [0x1404ed058]
xchg r10, r10
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0xc], ebx
ret

Function at 0x140095390
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b162a
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404ecff4]
cmp qword [0x1404ed0e0], 0
mov r15, r15
jne 0x1400b1380
syscall
ret

Function at 0x1400953b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1933
mov r10, rcx
mov rsp, rsp
mov eax, dword [0x1404ed040]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
mov dword [rsp - 0x10], esp
syscall
ret

Function at 0x1400953c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1429
mov r10, rcx
mov eax, dword [0x1404ecfc4]
mov dword [rsp - 0xc], 0x26f04fa4
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret
Function at 0x1400953d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b19b1
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404ed04c]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
mov dword [rsp - 0x38], 0x2e403a6a
syscall
ret

Function at 0x1400953e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b17f7
xchg rdx, rcx
mov r10, rdx
xchg rdx, rcx
mov eax, dword [0x1404ed020]
xchg r12, r12
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x1400953f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1820
xchg r10, r15
mov r15, rcx
xchg r15, r10
mov eax, dword [0x1404ed024]
cmp qword [0x1404ed0e0], 0
xchg rbx, rbx
jne 0x1400b1380
syscall
ret

Function at 0x140095400
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b16a9
xchg r13, rcx
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404ed000]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x2c], esi
jne 0x1400b1380
syscall
ret

Function at 0x140095410
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
xchg r15, r15
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x1400b1bfc
mov r10, rcx
xchg rcx, rcx
mov eax, dword [0x1404ed084]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0x40], ebp
ret

Function at 0x140095430
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1531
xchg r10, rsp
mov rsp, rcx
xchg r10, rsp
mov eax, dword [0x1404ecfdc]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
xchg rsp, rsp
syscall
ret

Function at 0x140095440
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b155a
xchg rcx, rdi
mov r10, rdi
xchg rcx, rdi
mov eax, dword [0x1404ecfe0]
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
mov r12, r12
syscall
ret

Function at 0x140095450
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1583
mov r10, rcx
mov eax, dword [0x1404ecfe4]
mov dword [rsp - 0x20], ebp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0x30], 0x29afee21
ret

Function at 0x140095460
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b15af
xchg r14, r10
mov r14, rcx
xchg r10, r14
mov eax, dword [0x1404ecfe8]
xchg r11, r11
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095470
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1508
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404ecfd8]
mov r11, r11
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095480
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1a68
xchg r10, r11
mov r11, rcx
xchg r10, r11
mov eax, dword [0x1404ed05c]
cmp qword [0x1404ed0e0], 0
mov r14, r14
jne 0x1400b1380
syscall
ret

Function at 0x140095490
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b15d8
mov r10, rcx
mov eax, dword [0x1404ecfec]
mov dword [rsp - 0x14], ebp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0x24], edi
ret

Function at 0x1400954a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1482
xchg r12, r10
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1404ecfcc]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x20], 0x5a7f468f
jne 0x1400b1380
syscall
ret
Function at 0x1400954b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1653
mov r10, rcx
mov eax, dword [0x1404ecff8]
mov dword [rsp - 0x44], edi
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0x34], ebx
ret

Function at 0x1400954e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1c4c
sub rsp, 0x120
lea rcx, [0x1400b13f1]
mov rsp, rsp
nop
sub rsp, 8
mov qword [rsp], rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
push 0x78cb1452
mov qword [rsp], rdi
push qword [0x1404ed0e8]
xchg rsi, rsi
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov ecx, 0x2802c245
add ecx, 0x4069f791
sub ecx, 0x26bf8fdf
xor ecx, 0x41ad29e7
rep movsq qword [rdi], qword [rsi]
mov r14, r14
jmp qword [0x1404ed0e0]
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404ed08c]
mov r13, r13
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x1400954f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b14da
xchg rcx, r15
mov r10, r15
xchg r15, rcx
mov eax, dword [0x1404ecfd4]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x14], 0x25ff5e33
jne 0x1400b1380
syscall
ret

Function at 0x140095500
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1bd0
xchg r8, rcx
mov r10, r8
xchg rcx, r8
mov eax, dword [0x1404ed080]
mov rsp, rsp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
xchg rcx, rcx
ret

Function at 0x140095510
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1a91
xchg rcx, r12
mov r10, r12
xchg r12, rcx
mov eax, dword [0x1404ed060]
mov rbp, rbp
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0x10], esp
ret

Function at 0x140095520
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1b7c
xchg r15, r10
mov r15, rcx
xchg r10, r15
mov eax, dword [0x1404ed078]
mov dword [rsp - 0x30], edi
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095530
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b195a
xchg rcx, r13
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404ed044]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x10], 0x1c1f45d7
jne 0x1400b1380
syscall
ret

Function at 0x140095540
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b1ba6
xchg rcx, rdx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x1404ed07c]
mov dword [rsp - 0x34], edi
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
ret

Function at 0x140095550
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b14b0
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x1404ecfd0]
cmp qword [0x1404ed0e0], 0
mov dword [rsp - 0x38], esi
jne 0x1400b1380
syscall
ret

Function at 0x140095560
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b167b
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1404ecffc]
mov dword [rsp - 0x1c], esi
cmp qword [0x1404ed0e0], 0
jne 0x1400b1380
syscall
mov dword [rsp - 0xc], esi
ret
Function at 0x14009aff0
Capabilities:
Enumerate pe sections

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rcx, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x38], edi
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdx, rdi
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 0x697feb91
add rsp, 0x697feb71
movsxd rbx, dword [rcx + 0x3c]
mov rsi, rsi
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
xchg rbx, rcx
mov rsi, rbx
xchg rcx, rbx
mov edx, dword [rbx + rcx + 0xb0]
xchg r15, r15
call fcn.14009d5b0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rbx, rbx
mov r11, rax
mov ebx, r14d
test ebp, ebp
mov rcx, rcx
je 0x14009b1ee
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
xchg rsi, rsi
lea rdx, [rsi + 0x18]
mov r9d, dword [r11]
add rdx, rcx
movzx r8d, r14w
xchg rdx, rdx
movzx eax, word [rcx + rsi + 0x14]
movzx r10d, word [rcx + rsi + 6]
add rdx, rax
mov dword [rsp - 0xc], edx
cmp r14w, r10w
jae 0x14009b0f8
mov eax, dword [rdx + 8]
mov rsi, rsi
test eax, eax
jne 0x14009b0c5
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
mov rbp, rbp
cmp r9d, ecx
jb 0x14009b0e3
add eax, ecx
cmp r9d, eax
mov dword [rsp - 0x18], esp
jb 0x14009b182
inc r8w
add rdx, 0x28
xchg rbp, rbp
cmp r8w, r10w
jb 0x14009b0b4
xchg r13, r14
mov r8, r13
xchg r14, r13
mov eax, dword [r11 + 4]
mov r9, r9
lea rdx, [r11 + 8]
nop
sub rax, 0x4947ae88
add rax, 0x4947ae80
shr rax, 1
mov dword [rsp - 0x24], 0xfa02a81
test eax, eax
je 0x14009b1ce
mov r9d, eax
mov dword [rsp - 0x38], 0x103f11b3
nop word [rax + rax]
movzx eax, word [rdx]
mov ecx, eax
mov dword [rsp - 0x44], ebp
shr ecx, 5
shr ecx, 6
shr ecx, 1
cmp ecx, 3
je 0x14009b1a8
mov dword [rsp - 0x3c], 0x64cd485d
cmp ecx, 0xa
jne 0x14009b1b5
and eax, 0xfff
mov dword [rsp - 0x10], 0x6bc1709b
add qword [rax + r8], rdi
jmp 0x14009b1b5
test rdx, rdx
mov dword [rsp - 0x30], edx
je 0x14009b0f8
mov r8d, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub r8, rax
mov dword [rsp - 0x2c], edi
add r8, rsi
add r8, r9
jmp 0x14009b101
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x40], edx
nop
add rdx, 0x352f33f0
sub rdx, 0x352f33ee
sub r9, 1
jne 0x14009b141
add ebx, dword [r11 + 4]
mov dword [rsp - 0xc], 0x69be6a00
xchg rdx, rsp
mov r11, rsp
xchg rsp, rdx
cmp ebx, ebp
xchg r15, r15
jb 0x14009b080
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
mov rbp, qword [rsp + 0x38]
mov r15, r15
xchg rsi, r8
mov r8, qword [rsp + 0x40]
xchg r8, rsi
xchg rdi, r15
mov r15, qword [rsp + 0x48]
xchg r15, rdi
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret