joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140095770
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae232
xchg rcx, r13
mov r10, r13
xchg r13, rcx
mov eax, dword [0x140489fd8]
mov dword [rsp - 0x20], ebx
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
xchg r11, r11
ret

Function at 0x140095780
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae157
xchg rdx, rcx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x140489fc4]
mov dword [rsp - 0x24], ebp
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x140095790
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae181
mov r10, rcx
mov eax, dword [0x140489fc8]
mov dword [rsp - 0x30], 0x672069ca
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
mov dword [rsp - 0x10], edi
ret

Function at 0x1400957a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add5f
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140489f64]
xchg r9, r9
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x1400957c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae083
xchg rbx, rcx
mov r10, rbx
xchg rbx, rcx
mov eax, dword [0x140489fb0]
xchg r10, r10
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x1400957d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adb4c
xchg r10, r9
mov r9, rcx
xchg r9, r10
mov eax, dword [0x140489f34]
cmp qword [0x14048a048], 0
xchg rbx, rbx
jne 0x1400adab0
syscall
ret

Function at 0x1400957e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae100
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140489fbc]
cmp qword [0x14048a048], 0
jne 0x1400adab0
mov r10, r10
syscall
ret

Function at 0x1400957f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf2a
xchg r14, r10
mov r14, rcx
xchg r10, r14
mov eax, dword [0x140489f90]
mov dword [rsp - 0x44], esp
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
xchg r9, r9
ret

Function at 0x140095800
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf57
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140489f94]
cmp qword [0x14048a048], 0
jne 0x1400adab0
mov r11, r11
syscall
ret

Function at 0x140095810
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400addd4
xchg rcx, r13
mov r10, r13
xchg r13, rcx
mov eax, dword [0x140489f70]
xchg r14, r14
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
mov dword [rsp - 0x24], edi
ret

Function at 0x140095820
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
mov dword [rsp - 0x24], esp
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x1400ae359
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x140489ff4]
cmp qword [0x14048a048], 0
jne 0x1400adab0
xchg r9, r9
syscall
ret

Function at 0x140095840
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc54
xchg rcx, r11
mov r10, r11
xchg r11, rcx
mov eax, dword [0x140489f4c]
cmp qword [0x14048a048], 0
jne 0x1400adab0
xchg r9, r9
syscall
ret

Function at 0x140095850
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc7d
mov r10, rcx
mov dword [rsp - 0x30], 0x569dc26c
mov eax, dword [0x140489f50]
cmp qword [0x14048a048], 0
jne 0x1400adab0
xchg r14, r14
syscall
ret
Function at 0x140095860
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adca8
xchg rdx, r10
mov rdx, rcx
xchg rdx, r10
mov eax, dword [0x140489f54]
mov dword [rsp - 0x1c], 0x56d88505
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x140095870
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adcd6
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140489f58]
cmp qword [0x14048a048], 0
mov dword [rsp - 0x38], 0x7da41ef3
jne 0x1400adab0
syscall
ret

Function at 0x140095880
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc2b
xchg r12, r10
mov r12, rcx
xchg r10, r12
mov eax, dword [0x140489f48]
cmp qword [0x14048a048], 0
jne 0x1400adab0
mov rcx, rcx
syscall
ret

Function at 0x140095890
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae1ad
xchg r12, rcx
mov r10, r12
xchg rcx, r12
mov eax, dword [0x140489fcc]
mov rsi, rsi
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
mov dword [rsp - 0x44], 0x6051a5e1
ret

Function at 0x1400958a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add04
xchg r15, r10
mov r15, rcx
xchg r10, r15
mov eax, dword [0x140489f5c]
cmp qword [0x14048a048], 0
mov r14, r14
jne 0x1400adab0
syscall
ret

Function at 0x1400958b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adba7
mov r10, rcx
mov eax, dword [0x140489f3c]
mov dword [rsp - 0x3c], esp
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
mov dword [rsp - 0x14], 0x53a3ef18
ret

Function at 0x1400958c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add88
xchg r10, r12
mov r12, rcx
xchg r12, r10
mov eax, dword [0x140489f68]
cmp qword [0x14048a048], 0
mov r9, r9
jne 0x1400adab0
syscall
ret

Function at 0x1400958f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae3ac
sub rsp, 0x738d8102
add rsp, 0x738d7fe2
lea rcx, [0x1400adb0f]
push rdi
mov qword [rsp], rcx
push rbp
push rsi
mov r12, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push qword [0x14048a050]
lea rsi, [rsp + 0x170]
xchg rcx, rcx
lea rdi, [rsp + 0x28]
mov ecx, 0x31ce65a8
xor ecx, 0x213de429
sub ecx, 0xac7b012
sub ecx, 0x62bd15f
rep movsq qword [rdi], qword [rsi]
jmp qword [0x14048a048]
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140489ffc]
mov r10, r10
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x140095900
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adbfd
xchg r10, r11
mov r11, rcx
xchg r10, r11
mov eax, dword [0x140489f44]
cmp qword [0x14048a048], 0
mov dword [rsp - 0x20], 0x11f392fa
jne 0x1400adab0
syscall
ret

Function at 0x140095910
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae32b
xchg r11, r10
mov r11, rcx
xchg r10, r11
mov eax, dword [0x140489ff0]
mov dword [rsp - 0x18], 0x46c5e6f7
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
ret

Function at 0x140095920
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae1de
mov r10, rcx
mov eax, dword [0x140489fd0]
cmp qword [0x14048a048], 0
mov dword [rsp - 0x3c], 0x32263a6c
jne 0x1400adab0
syscall
ret

Function at 0x140095930
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae2e5
mov r10, rcx
mov eax, dword [0x140489fe8]
cmp qword [0x14048a048], 0
xchg rbx, rbx
jne 0x1400adab0
syscall
ret
Function at 0x140095940
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae0ac
xchg r14, rcx
mov r10, r14
xchg r14, rcx
mov eax, dword [0x140489fb4]
mov rbp, rbp
cmp qword [0x14048a048], 0
jne 0x1400adab0
syscall
mov r8, r8
ret

Function at 0x140095950
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae308
mov r10, rcx
mov eax, dword [0x140489fec]
cmp qword [0x14048a048], 0
xchg rsi, rsi
jne 0x1400adab0
syscall
ret

Function at 0x140095960
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adbd3
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140489f40]
cmp qword [0x14048a048], 0
jne 0x1400adab0
mov dword [rsp - 0x24], ebx
syscall
ret

Function at 0x140095970
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400addb1
mov r10, rcx
mov eax, dword [0x140489f6c]
cmp qword [0x14048a048], 0
mov rdi, rdi
jne 0x1400adab0
syscall
ret
Function at 0x14009b374
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
xchg rcx, rbx
mov qword [rsp + 8], rbx
xchg rbx, rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push r8
mov qword [rsp], rsi
push rdi
mov r15, r15
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x10], ecx
nop
sub rsp, 8
mov qword [rsp], r14
push rax
mov qword [rsp], r15
nop
sub rsp, 0x51ef1bd1
add rsp, 0x51ef1bb1
xchg rcx, r10
mov rbx, r10
xchg r10, rcx
mov r13d, r8d
mov dword [rsp - 0x40], 0x30c1b5b0
mov r9d, 0x65e71698
xor r9d, 0x43acde1c
xor r9d, 0x6c0e3a83
xor r9d, 0x4a41f207
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff5b4823d6
add rcx, 0xab01d7e
xor rcx, 0x3f510ae2
add rcx, 0xddd03d9
add rcx, 0x7fffffff
add rcx, 0x1779b071
popf
pushf
mov eax, 0x30af5ef3
add eax, 0x45dc0f1f
sub eax, 0x41f6789c
sub eax, 0x3494f572
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x3c], ebx
cmovo rax, rcx
mov rcx, rax
call fcn.1400bb5d0
lea r15d, [r13 + 0xfffff]
mov r15, r15
xor esi, esi
shr r15d, 0x14
mov rbp, rax
mov dword [rsp - 0x2c], esp
mov eax, dword [rbx + 0x18]
mov ebx, 0x40da2ef1
xor ebx, 0x7de45bd9
sub ebx, 0x3cf667ae
xor ebx, 0x480d7b
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r15d
mov r12, r12
test r15d, r15d
je 0x14009b593
mov eax, 0x1b39e335
xor eax, 0x215fc2e9
sub eax, 0x1b3a7d34
xor eax, 0x7e0047e7
xor eax, 0x613be34f
xchg rcx, r15
mov r15, qword [rsp + 0x60]
xchg rcx, r15
mov r14d, esi
shl r14d, 0xc
shl r14d, 4
shl r14d, 4
mov edi, r13d
xchg r12, r12
sub edi, r14d
xchg rbp, r15
mov rdx, r15
xchg rbp, r15
cmp edi, eax
cmova edi, eax
mov dword [rsp - 0x18], 0xa143ec9
mov r8d, edi
call fcn.140098060
test al, al
je 0x14009b591
xchg r15, r15
shr edi, 2
xor r8d, r8d
shr r14d, 1
shr r14d, 1
test edi, edi
mov r9, r9
je 0x14009b567
mov r15d, dword [rsp + 0x70]
mov r9, rbp
mov dword [rsp - 0x30], 0x64603ea6
lea eax, [r14 + r8]
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
mov r9, r9
xor edx, 0x255e503b
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
xchg rbx, rbx
jb 0x14009b538
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov r12, r12
mov eax, 0x498562cb
sub eax, 0x297fae4a
add eax, 0x1e5ad991
xor eax, 0x3e708e12
cmp esi, r15d
jb 0x14009b4c5
xchg r10, r10
jmp 0x14009b593
xor bl, bl
xchg rbp, r8
mov rcx, r8
xchg rbp, r8
call fcn.1400bb5e0
mov al, bl
mov dword [rsp - 0x34], esp
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffe0
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14009b5f0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rbp, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbp
mov qword [rsp + 0x18], rsi
nop
push 0x1869d117
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
mov dword [rsp - 0xc], ebp
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
mov dword [rsp - 0x34], 0x41d1bb21
xchg r15, rbp
mov rbp, rcx
xchg r15, rbp
mov r14d, r8d
mov dword [rsp - 0x18], 0x1a3fd1b
mov r9d, 0x44e922c8
sub r9d, 0x1b6128ba
xor r9d, 0x203182d5
xor r9d, 0x7e3d5838
sub r9d, 0x778720e3
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
cmp r8d, r9d
pushf
movabs rcx, 0xffffffff3ae3f8a0
add rcx, 0x22ed8aa8
add rcx, 0x1c2cbee8
sub rcx, 0x645b795b
add rcx, 0x7fffffff
add rcx, 0x6a5d372b
popf
pushf
mov eax, 0x6d371dc2
sub eax, 0x19159eb
sub eax, 0x7500e4e
sub eax, 0x6455b585
popf
cmovb r9d, r14d
mul r9
cmovo rax, rcx
mov dword [rsp - 0x40], 0x30ceee2d
mov rcx, rax
call fcn.1400bb5d0
mov r13d, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
xchg rbp, rbp
shr ebp, 0x12
shr ebp, 1
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x20], ebp
xchg r11, rax
mov rsi, r11
xchg r11, rax
mov ebx, 0x4cae268
add ebx, 0x7a185e6
add ebx, 0x36d3b724
add ebx, 0x1943dffd
sub ebx, 0x5c83ff6e
test ebp, ebp
mov dword [rsp - 0x44], edi
je 0x14009b829
mov eax, 0x5b15739
add eax, 0x539ffa5b
sub eax, 0x2717b1c3
add eax, 0x2770ad82
sub eax, 0x599a4d53
mov r9d, edi
mov dword [rsp - 0x44], edi
mov r8d, r14d
shl r9d, 6
shl r9d, 4
shl r9d, 2
shl r9d, 2
shl r9d, 3
shl r9d, 2
shl r9d, 1
sub r8d, r9d
xchg r14, r14
cmp r8d, eax
cmova r8d, eax
shr r9d, 2
mov r11d, r8d
mov dword [rsp - 0x1c], 0x172da5c3
xor r10d, r10d
shr r11d, 2
test r11d, r11d
je 0x14009b7d6
mov r12, r12
mov rdx, rsi
lea ecx, [r9 + r10]
mov eax, r13d
xor eax, dword [r12 + rcx*4]
mov dword [rsp - 0x30], 0x41127af6
add r10d, ebx
xor eax, 0x255e503b
mov dword [rdx], eax
mov dword [rsp - 0x3c], 0x5e15ffe4
lea rdx, [rdx + 4]
cmp r10d, r11d
jb 0x14009b7a4
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
xchg r15, rcx
mov r15, rcx
xchg r15, rcx
call fcn.140098650
mov dword [rsp - 0x30], edx
test al, al
je 0x14009b824
add edi, ebx
mov eax, 0x7d37f5c0
sub eax, 0x2344d29e
sub eax, 0x5490ac4b
xor eax, 0x28cb7123
xor eax, 0x2db907f4
cmp edi, ebp
jb 0x14009b74d
xchg r12, r12
jmp 0x14009b829
xor bl, bl
xchg rbp, rbp
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400bb5e0
xchg rbp, rbp
xchg rbp, r9
mov r9, qword [rsp + 0x58]
xchg r9, rbp
mov al, bl
mov rbx, qword [rsp + 0x50]
xchg rsi, r13
mov r13, qword [rsp + 0x60]
xchg rsi, r13
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
pop r12
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009c640
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x692c19c7
add rsp, 0x692c1797
mov r10, qword [0x1404892d0]
mov dword [rsp - 0x10], ebp
lea rdx, [rsp + 0x20]
ror r10, 7
ror r10, 0xa
ror r10, 5
ror r10, 6
ror r10, 1
xchg rbx, r10
mov r10, rcx
xchg r10, rbx
movabs rcx, 0x7c6a279253939a5c
sub rcx, 0x456c1e1b
xor rcx, 0x4e23e896
sub rcx, 0x1a96e406
add rcx, 0x7fffffff
add rcx, 0x41cacd43
movabs rax, 0x58b9c29452075de1
sub rax, 0x249ed98c
xor rax, 0x1ded7600
add rax, 0x2eb0709a
xor rax, 0x12f763ab
xor r10, rcx
mov dword [rsp - 0x34], 0x2b87dce
xor r9d, r9d
rol r10, 0x2a
rol r10, 2
rol r10, 1
movabs rcx, 0x548b60e914448dc3
add rcx, 0x238766fc
sub rcx, 0x2a0d840c
add rcx, 0x25e7faf6
add r10, rcx
xor ecx, ecx
xor r10, rax
mov dword [rsp - 0x28], 0x3522fe0f
movabs rax, 0x58795d444c595ead
add rax, 0x47414ef
xor rax, 0x5339364d
add rax, 0x7fffffff
xor rax, 0x2f494b1c
sub r10, rax
mov dword [rsp - 0x28], esp
lea r8d, [r9 + 8]
call r10
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x30], esp
mov qword [rbx], rcx
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
xchg r12, rcx
movups xmmword [r12 + 0x20], xmm0
xchg rcx, r12
test eax, eax
mov r9, r9
je 0x14009c876
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff3ff4a356
xor rdx, 0x7e0ba76d
sub rdx, 0x3e0b6d1a
add rdx, 0x2f4a3d36
add rdx, 0x7fffffff
xor rdx, 0x4cc22ba9
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14009c7a2
mov rbx, rbx
mov rcx, rbx
mov qword [rbx + 0x38], rdx
call fcn.140016fb8
xor r8d, r8d
xchg rdx, rdx
mov rdx, rax
mov ecx, 0x70daaca1
xor ecx, 0x807bb8e
xor ecx, 0x5444ce25
add ecx, 0x3de0ffa3
sub ecx, 0x2717776b
cmp qword [rbx + 0x38], r8
xchg r11, r11
jbe 0x14009c886
lea r9, [rsp + 0x20]
mov r10d, 0x3c06e4c7
add r10d, 0x11aa9fb0
xor r10d, 0x656057c5
add r10d, 0x46bf1e8
sub r10d, 0x2d3dc49b
sub r9, rax
mov r9, r9
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
mov dword [rsp - 0x38], esp
and ax, r10w
ror ecx, 8
xor ax, word [r9 + rdx - 2]
inc r8
xchg rdx, rdx
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14009c825
mov dword [rsp - 0x28], edi
xchg rbx, rsp
mov rax, rsp
xchg rbx, rsp
sub rsp, 0x5296ff13
add rsp, 0x52970143
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
mov r10, r10
xchg rdi, r8
mov qword [rbx + 0x38], rdi
xchg rdi, r8
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x14009caa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rdi, rdi
add rsp, 0x504d4f15
sub rsp, 0x504d5145
mov rax, qword [0x140489400]
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
movabs rcx, 0x25bbb9ca0894638a
xor rcx, 0x396b6696
xor rcx, 0x4439971e
add rcx, 0x1d707cb4
mov edx, 0x4c0b9a81
sub edx, 0x35daa725
sub edx, 0x12f5d73f
xor edx, 0x33b1d19
xor rax, rcx
movabs rcx, 0x2055c8c459cdb964
xor rcx, 0x6821ce14
add rcx, 0x1baaccc4
xor rcx, 0x55af5a38
ror rax, 1
ror rax, 2
xor rax, rcx
mov dword [rsp - 0x28], 0x4cd05b69
lea rcx, [rsp + 0x20]
ror rax, 0x1e
call rax
mov dword [rsp - 0x3c], 0xecc7081
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff5e875850
xor rdx, 0x440728e1
add rdx, 0x58c28ea5
add rdx, 0x7fffffff
add rdx, 0xcbd00aa
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
movups xmmword [rax + 0x10], xmm0
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
lea rax, [rsp + 0x20]
inc rdx
xchg rcx, rcx
cmp word [rax + rdx*2], 0
jne 0x14009cb8b
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
mov qword [rbx + 0x38], rdx
call fcn.140016fb8
xor r8d, r8d
mov dword [rsp - 0x34], esp
mov edx, 0x3b8314df
sub edx, 0x54ba009
xor edx, 0x181e4b0b
xor edx, 0x6d4a5e9f
cmp qword [rbx + 0x38], r8
jbe 0x14009cc47
xchg r12, r12
lea r9, [rsp + 0x20]
mov r10d, 0x21e3ba3e
xor r10d, 0x4c67f80e
add r10d, 0x5240e62
sub r10d, 0x72a84f93
sub r9, rax
nop dword [rax]
xchg r13, r13
nop dword [rax + rax]
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
xchg rsp, rsp
ror edx, 3
ror edx, 2
ror edx, 2
ror edx, 1
xor cx, word [r9 + rax - 2]
mov dword [rsp - 0x30], 0x50d50b36
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
mov dword [rsp - 0x38], ebp
jb 0x14009cc0b
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x230
mov dword [rsp - 0x20], 0xe9a12b8
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14009fdc0
Capabilities:
Enumerate pe sections

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x2c], esp
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg r9, rdi
mov qword [rsp + 0x20], r9
xchg rdi, r9
push r14
mov dword [rsp - 0x24], edx
nop
add rsp, 0x443a57e2
sub rsp, 0x443a5802
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x40], 0x78ca8039
mov rdi, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
xchg rdi, rdi
call fcn.1400a1bc0
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov rcx, rcx
mov ebp, dword [rbx + rsi + 0xb4]
xchg r13, r10
mov r13, rax
xchg r13, r10
mov ebx, r14d
mov dword [rsp - 0xc], 0x2f6f3ae0
test ebp, ebp
je 0x14009ffa4
nop dword [rax]
mov dword [rsp - 0x40], esi
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r11d, dword [r10]
mov dword [rsp - 0x40], esi
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
mov r11, r11
add rdx, rax
cmp r14w, cx
jae 0x14009fee0
mov dword [rsp - 0x38], esi
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14009fea1
mov eax, dword [rdx + 0x10]
mov dword [rsp - 0x14], ecx
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14009fec0
xchg rsi, rsi
add eax, r9d
cmp r11d, eax
jb 0x14009ff62
mov rdx, rdx
inc r8w
nop
add rdx, 0x4b783709
sub rdx, 0x4b7836e1
cmp r8w, cx
xchg r10, r10
jb 0x14009fe8f
xchg r8, r14
mov r14, r8
xchg r8, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov dword [rsp - 0x3c], ebp
neg rax
sub rax, 0xfffffffffffffff8
neg rax
nop
add r10, 0x13672c04
sub r10, 0x13672bfc
shr rax, 1
mov dword [rsp - 0x28], 0x2046964
test eax, eax
je 0x14009ff99
mov edx, eax
mov dword [rsp - 0x24], ebp
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
shr ecx, 0xc
mov dword [rsp - 0x30], 0x61eb82f5
cmp ecx, 3
je 0x14009ff77
cmp ecx, 0xa
mov dword [rsp - 0x20], ebp
jne 0x14009ff83
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x14009ff83
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov rdi, rdi
add r8, rsi
add r8, r11
jmp 0x14009fee9
and eax, 0xfff
add dword [rax + r8], edi
mov rcx, rcx
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x14009ff2d
mov dword [rsp - 0x28], 0x7a8de115
add ebx, dword [r9]
cmp ebx, ebp
jb 0x14009fe5b
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x14], 0x3ad5520f
xchg rbp, r11
mov r11, qword [rsp + 0x38]
xchg rbp, r11
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xchg r9, r9
nop
sub rsp, 0x3b05c98e
add rsp, 0x3b05c9ae
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400a1c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x2c], 0x16241a06
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x32a12b2c
sub rsp, 0x32a12b4c
movzx eax, word [rcx]
mov dword [rsp - 0x1c], 0x552097b4
mov r15d, edx
xor eax, 0x255e503b
mov rsi, rcx
cmp eax, 0x255e0a76
mov dword [rsp - 0x44], edi
jne 0x1400a1e5b
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x255e503b
mov dword [rsp - 0x1c], edi
cmp eax, 0x255e156b
jne 0x1400a1e5b
mov edx, dword [rdx + rcx + 0x88]
mov r12, r12
call fcn.1400a1bc0
xchg rsi, rbx
mov rcx, rbx
xchg rsi, rbx
xchg r14, rsi
mov rsi, rax
xchg r14, rsi
mov edx, dword [rax + 0x20]
call fcn.1400a1bc0
mov edx, dword [r14 + 0x24]
mov dword [rsp - 0x38], ecx
mov rcx, rsi
xchg r12, rax
mov rax, r12
xchg r12, rax
call fcn.1400a1bc0
mov r15, r15
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg rbx, rax
mov r13, rbx
xchg rbx, rax
call fcn.1400a1bc0
xchg rbx, rbx
xor edi, edi
xchg r13, rax
mov qword [rsp + 0x70], r13
xchg r13, rax
cmp dword [r14 + 0x18], edi
jbe 0x1400a1e5b
mov dword [rsp - 0x20], 0x10cf89a7
nop dword [rax]
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.1400a1bc0
mov rsp, rsp
mov ecx, 0x75cf9acf
xor ecx, 0x456d2f38
add ecx, 0x5a5751c
xor ecx, 0xc9b7d4ec
xchg rbx, r12
mov r12, rax
xchg rbx, r12
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x10], 0x111cd322
cmp byte [rax], 0
je 0x1400a1e3e
nop dword [rax]
xchg rsp, rdx
mov rsp, rbx
xchg rsp, rdx
lea rcx, [rsp + 0x60]
mov rdx, rdx
mov r8d, 0x71eb81e6
add r8d, 0x51d0608
add r8d, 0x3f07108
sub r8d, 0x416bc38e
sub r8d, 0x398d3567
inc rbx
mov dword [rsp - 0xc], edi
call fcn.140095260
cmp byte [rbx], 0
jne 0x1400a1dee
mov dword [rsp - 0x24], edx
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
xchg r8, r8
je 0x1400a1ea8
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400a1da7
mov r12, r12
xor eax, eax
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffe0
mov rsp, rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x30], ecx
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x40], 0x15a0f633
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, r11
mov rcx, r11
xchg rsi, r11
xchg r10, rax
mov r10, qword [rsp + 0x70]
xchg r10, rax
mov edx, dword [rax + rdx*4]
call fcn.1400a1bc0
xchg rbp, rbp
jmp 0x1400a1e5d
Function at 0x1400a6140
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
xchg rbx, r14
mov r14, qword [rcx]
xchg r14, rbx
lea rax, [rsp + 0x28]
xchg rdi, rdi
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
xchg rbp, rsi
mov rbp, qword [rcx + 0x38]
xchg rsi, rbp
lea rcx, [rsp + 0x20]
mov dword [rsp - 0xc], esp
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg rsp, r11
movups xmmword [r11 + 0x38], xmm0
xchg r11, rsp
xchg rsp, rbp
movups xmmword [rbp + 0x48], xmm0
xchg rbp, rsp
call fcn.140016fb8
mov dword [rsp - 0x24], esp
mov edx, 0x5a40550c
sub edx, 0xb0e0580
add edx, 0x2486e17
xor edx, 0x1219dce1
test rsi, rsi
je 0x1400a6233
mov rdi, rax
mov dword [rsp - 0x10], 0x4d4b88d1
sub rbx, rax
xchg rsi, r15
mov r8, r15
xchg rsi, r15
mov r9d, 0xb758808
add r9d, 0x48e29a7e
sub r9d, 0x443bec94
xor r9d, 0x101c350d
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
mov rbx, rbx
and cx, r9w
ror edx, 8
xor cx, word [rbx + rdi - 2]
mov r13, r13
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400a6209
mov r13, r13
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg r15, rcx
mov r15, qword [rsp + 0x20]
xchg rcx, r15
call fcn.1400a62e0
xchg r8, rcx
mov r8, qword [rsp + 0x20]
xchg r8, rcx
mov ebx, eax
mov r15, r15
xchg rsi, r9
mov r9, qword [rsp + 0x70]
xchg r9, rsi
lea rax, [rsp + 0x28]
cmp rcx, rax
xchg r9, r9
jne 0x1400a62b9
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x1dcb1405
add ecx, 0x4064c615
sub ecx, 0xf73af0f
xor ecx, 0x4ebc2b3b
rep stosb byte [rdi], al
mov eax, ebx
mov r11, r11
xchg rcx, rbx
mov rcx, qword [rsp + 0x78]
xchg rcx, rbx
nop
add rsp, 0x7e038878
sub rsp, 0x7e038818
pop rdi
xchg rsp, rsp
ret
call fcn.1400bb730
mov r14, r14
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
mov r8, r8
ret