joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cf14
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x70941beb
repne stosd dword [rdi], eax
push rbp
sub cl, byte [rax - 9]
test dword [rcx - 0x3f], 0xd1ff80cd
push rbx
popf
ror r9d, 0x38
jmp fcn.14003cd81
movabs rsi, 0x3d6f7900000326e9
rcr edi, 0x66
call rax
jmp fcn.14003c42d
cmp rax, 5
jae fcn.14003d180
mov rsi, rax
xchg rbp, rbp
mov dword [rsp - 0x20], 0x58322f74
xchg r15, r15
jmp 0x14003d05e
mov qword [rbp - 0x18], r14
mov dword [rsp - 0x14], 0x936e247
mov dword [rsp - 0x34], esp
mov rax, qword [rcx + 0x280]
jmp 0x14003ce72
mov dword [rsp - 0x44], 0x27f9a962
mov rcx, qword [rbp + 0x58]
mov qword [rsi + 0x78], rcx
cmp rcx, 0x78
jbe 0x14003d0a4
jmp 0x14003cff5
je 0x14003d071
call 0x14003cf14
add rsp, 0x7d
jmp 0x14003d00d
mov qword [rcx + 0x280], rax
mov dword [rsp - 0x34], 0x48a07fe1
mov dword [rsp - 0x28], 0x508d3433
xchg rsi, rsi
jmp 0x14003ceae
mov rbx, qword [rbp - 0x20]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
jmp 0x14003d080
mov dword [rsp - 0x38], 0x10514650
mov dword [rsp - 0x20], 0x4de8db7c
xchg r12, r12
jmp 0x14003cf33
pop r12
ret
pop r12
add rsi, rcx
inc rax
jmp 0x14003cf14
mov rcx, qword [r14 + 8]
lea rdx, [0x140001630]
mov dword [rsp - 0x18], 0x609085ca
mov dword [rsp - 0x10], ecx
add rcx, 0x5f0
mov qword [rbp + 0x58], 0x10
mov qword [rbp - 0x20], rdx
jmp 0x14003ce92
mov dword [rsp - 0xc], 0x43d8a7f6
mov rsi, rsi
shl rsi, 7
push r12
movabs r12, 0x7604bea5636a9deb
jne 0x14003d071
jmp 0x14003d010
jmp 0x14003cf00
call fcn.140099500
mov dword [rsp - 0x2c], 0x40f04398
mov r13, r13
mov dword [rsp - 0x34], esi
xchg rcx, rcx
xchg ecx, ecx
mov dword [rsp - 0x3c], 0x59196c34
jmp loc.14003cf43
test rcx, rcx
je fcn.14003d180
mov rax, qword [rbp - 0x20]
mov dword [rsp - 0x20], edx
jne 0x14003d0ec
je 0x14003d0ec
jae 0x14003c911
jns 0x14003c683
syscall
lea r8d, [rdx - 0x4a18]
dec r13
call rcx
cmp r15, rdi
rcr edi, 0xa8
mul rsi
sub ecx, 0x8b269856
lea r13d, [rdi + 0x8600]
pushfq
movabs rdi, 0x214c304f7f6c36eb
cmp r9d, 0xc8fa3ba2
ror r11d, 0xce
ret
jmp 0x14003d124
mov dword [rsp - 0x34], 0x69c99802
lea rcx, [0x14003bf80]
mov rax, qword [rax + 0x10]
jmp loc.14003d115
Function at 0x1400412f4
Capabilities:
Execute syscall

Disassembly:
mov ebp, 0x22eee0eb
retf
add ebx, 0
add byte [rax], al
popf
jp 0x140041e23
jg 0x1400419fc
call rax
lea ebx, [rdi + 0x44af]
rcr edx, 0xe
jae 0x140040f63
rcr r9d, 0xd9
movabs r10, 0x319ff4b183b11eb
pushfq
call fcn.140040cef
ret
pushfq
invalid
cmp al, 2
add byte [rax], al
Function at 0x140054720
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x44], edx
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg rcx, r13
mov rdi, r13
xchg r13, rcx
nop
movabs rdx, 0xffffffff188b0cea
xor rdx, 0xafeb7ab
add rdx, 0x5495195e
add rdx, 0x7fffffff
add rdx, 0x18f52b61
nop word [rax + rax]
mov r8, r8
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140054782
mov r11, r11
mov qword [rcx + 0x38], rdx
call fcn.140017954
xor r8d, r8d
mov edx, 0x5e44d1d6
sub edx, 0x2eefcc40
xor edx, 0x2a60262e
add edx, 0x5d7c209d
cmp qword [rdi + 0x38], r8
jbe 0x140054821
sub rbx, rax
mov dword [rsp - 0x34], 0x3491bce9
mov r9d, 0x76105d90
sub r9d, 0x2b43226a
sub r9d, 0x40aa6c36
xor r9d, 0xa22ce0f
nop word [rax + rax]
mov dword [rsp - 0x38], edx
Function at 0x140054b40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg rbp, r15
xchg rsi, r15
mov qword [rsp + 0x20], r15
xchg r15, rsi
mov word [rsp + 0x18], r8w
mov dword [rsp - 0x28], 0x4fb33721
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov dword [rsp - 0x1c], esp
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov rdi, rdi
nop
sub rsp, 0x5d841125

Function at 0x140054ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x44], 0x33ebc413
mov qword [rsp + 0x10], rsi
push rdi
nop
sub rsp, 0x4562f035
add rsp, 0x4562f015
mov rsi, qword [rcx + 0x38]
xchg rdx, r11
mov rbx, r11
xchg r11, rdx
mov r8, qword [rdx + 0x38]
mov dword [rsp - 0x18], esp
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
add r8, rsi
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg r8, r12
mov qword [rcx + 0x38], r12
xchg r12, r8
call fcn.140055bf0
mov r9, qword [rbx]
mov dword [rsp - 0x38], 0x40561ba2
mov ecx, esi
and ecx, 3
mov r8d, 0x4274e3da
xor r8d, 0x4d3bff88
add r8d, 0x3ba88ff1
xor r8d, 0x2846e816
shl ecx, 3
mov rbx, rbx
mov edx, r8d
ror edx, cl
xchg rsp, rax
mov r10, rsp
xchg rsp, rax
xor ecx, ecx
xchg r11, r11
cmp qword [rbx + 0x38], rcx
jbe 0x140054ff4
lea rax, [rsi + rsi]
mov rbp, rbp
mov r11d, 0x46892b81
xor r11d, 0x3a7c4fbe
sub r11d, 0x53cfe6a
xor r11d, 0x2f43def
sub r11d, 0x754c573b
sub rax, r9
add r10, rax
mov dword [rsp - 0x24], 0x47eadafc
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
mov r12, r12
xor ax, r8w
ror edx, 6
ror edx, 1
ror edx, 1
and ax, r11w
ror r8d, 4
ror r8d, 1
ror r8d, 3
xor ax, word [r9 - 2]
xchg rdx, rdx
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140054fb1
mov dword [rsp - 0x34], edi
mov rbx, qword [rsp + 0x30]
mov rax, rdi
xchg rcx, rsi
mov rcx, qword [rsp + 0x38]
xchg rcx, rsi
nop
add rsp, 0x7848661c
sub rsp, 0x784865fc
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140055030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xchg r11, r11
push r14
nop
sub rsp, 0x25ba778c
add rsp, 0x25ba776c
xchg r14, rbp
mov rbp, qword [rcx + 0x38]
xchg rbp, r14
Function at 0x140055920
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x24], ebp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
add rsp, 0x160f0f91
sub rsp, 0x160f0fb1
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov r8, r8
mov qword [rdx], rsi
xor edi, edi
xchg rsi, rbp
movups xmmword [rbp], xmm0
xchg rbp, rsi
mov r14, r9
mov dword [rsp - 0x44], 0x58eaf18b
xchg r8, rbp
mov r8, rbp
xchg rbp, r8
xchg rsi, r13
movups xmmword [r13 + 0x10], xmm0
xchg rsi, r13
xchg r9, rdx
mov rbx, r9
xchg rdx, r9
xchg rbp, rsi
movups xmmword [rbp + 0x20], xmm0
xchg rbp, rsi
mov qword [rdx + 0x38], rdi
xchg rdx, rax
mov rdx, qword [rcx + 0x38]
xchg rdx, rax
cmp r8, rax
mov dword [rsp - 0x24], ebp
jae 0x140055b64
sub rax, r8
mov qword [rsp + 0x40], r15
xchg r10, r10
cmp rax, r9
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov rax, qword [rcx]
mov dword [rsp - 0x1c], ebp
xchg rbx, rcx
mov rbx, qword [rdx]
xchg rbx, rcx
lea r15, [rax + r8*2]
mov dword [rsp - 0x10], 0x56cd7b4b
cmp rcx, rsi
je 0x1400559ff
call fcn.140099230
xchg r15, r15
cmp r14, 0x18
jbe 0x140055a40
lea rcx, [r14 + r14]
call fcn.140099500
xchg r15, r15
xchg r9, rax
mov qword [rbx], r9
xchg r9, rax
test rax, rax
mov dword [rsp - 0x20], edx
jne 0x140055a4a
xchg rsi, r12
mov qword [rbx], r12
xchg r12, rsi
xchg r9, r15
mov r15, rdi
xchg r9, r15
jmp 0x140055a6a
mov qword [rbx], rsi
xchg rdx, rax
mov rdx, rsi
xchg rdx, rax
xorps xmm0, xmm0
xchg r14, rax
movups xmmword [r14], xmm0
xchg r14, rax
movups xmmword [rax + 0x10], xmm0
mov rbx, rbx
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
mov r9, qword [rbx]
mov rsi, rsi
and ebp, 3
mov r8d, 0x652146fb
sub r8d, 0x271fc13f
xor r8d, 0x427b1d08
xor r8d, 0x4a542ec7
add r8d, 0x2c828de2
shl ebp, 1
shl ebp, 2
mov edx, r8d
mov rcx, rcx
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x140055b1e
xchg r12, r12
sub r15, r9
mov ecx, 0xfd2509b
add ecx, 0x65355d08
sub ecx, 0x88d5fb9
xor ecx, 0x6c7a4d15
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
mov dword [rsp - 0x2c], 0xcfbb439
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 2
ror edx, 5
ror edx, 1
and ax, cx
ror r8d, 1
ror r8d, 4
ror r8d, 1
ror r8d, 1
ror r8d, 1
xor ax, word [r15 + r9 - 2]
inc rdi
mov dword [rsp - 0x40], ecx
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x140055ad4
mov r15, qword [rsp + 0x40]
mov dword [rsp - 0x18], edx
mov rax, rbx
xchg r12, rbx
mov r12, qword [rsp + 0x48]
xchg r12, rbx
xchg rbp, r8
mov r8, qword [rsp + 0x50]
xchg r8, rbp
nop
sub rsp, 0x1784f887
add rsp, 0x1784f8a7
pop r14
mov rdx, rdx
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x24], esi
ret
xchg rbx, r11
mov rax, r11
xchg r11, rbx
jmp 0x140055b2a

Function at 0x140055f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008df27
xchg r14, rcx
mov r10, r14
xchg rcx, r14
mov eax, dword [0x140142ad0]
mov dword [rsp - 0x30], 0x1598ac94
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
xchg r12, r12
ret
Function at 0x140055f60
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
xchg rdi, rdi
jmp 0x14008e570
xchg r10, r15
mov r15, rcx
xchg r10, r15
mov eax, dword [0x140142b68]
mov dword [rsp - 0x30], 0x7e0beb47
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x10], edi
ret

Function at 0x140055f80
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dd17
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142aa0]
cmp qword [0x140142bb8], 0
mov r12, r12
jne 0x14008dca0
syscall
ret

Function at 0x140055f90
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e2d9
xchg rcx, rdx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x140142b28]
cmp qword [0x140142bb8], 0
mov r10, r10
jne 0x14008dca0
syscall
ret

Function at 0x140055fa0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e193
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142b08]
cmp qword [0x140142bb8], 0
xchg rbx, rbx
jne 0x14008dca0
syscall
ret

Function at 0x140055fb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dd73
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142aa8]
xchg r13, r13
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
ret

Function at 0x140055fc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e3f9
xchg r10, rbp
mov rbp, rcx
xchg r10, rbp
mov eax, dword [0x140142b44]
cmp qword [0x140142bb8], 0
xchg rdx, rdx
jne 0x14008dca0
syscall
ret

Function at 0x140055fd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e422
xchg r10, r14
mov r14, rcx
xchg r14, r10
mov eax, dword [0x140142b48]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
mov dword [rsp - 0x44], ebx
syscall
ret

Function at 0x140055fe0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e355
mov r10, rcx
xchg r8, r8
mov eax, dword [0x140142b34]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
xchg r12, r12
syscall
ret

Function at 0x140055ff0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e37b
mov r10, rcx
mov r12, r12
mov eax, dword [0x140142b38]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x38], ebx
ret

Function at 0x140056000
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008df58
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x140142ad4]
xchg rcx, rcx
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x30], 0x3445d01e
ret

Function at 0x140056010
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e23c
mov r10, rcx
mov eax, dword [0x140142b18]
cmp qword [0x140142bb8], 0
mov r13, r13
jne 0x14008dca0
syscall
ret

Function at 0x140056020
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e288
mov r10, rcx
mov eax, dword [0x140142b20]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x10], 0x79752846
jne 0x14008dca0
syscall
ret

Function at 0x140056030
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dd44
mov r10, rcx
mov rdi, rdi
mov eax, dword [0x140142aa4]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x44], 0x2829ad79
ret
Function at 0x140056040
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e302
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140142b2c]
mov dword [rsp - 0x3c], edx
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
ret

Function at 0x140056050
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e141
xchg r8, r10
mov r8, rcx
xchg r8, r10
mov eax, dword [0x140142b00]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
mov rsi, rsi
syscall
ret

Function at 0x140056060
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e16a
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140142b04]
cmp qword [0x140142bb8], 0
mov rbx, rbx
jne 0x14008dca0
syscall
ret

Function at 0x140056070
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dfe5
xchg rcx, rbx
mov r10, rbx
xchg rbx, rcx
mov eax, dword [0x140142ae0]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
mov dword [rsp - 0x28], 0x3ca065cc
syscall
ret

Function at 0x140056080
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov dword [rsp - 0x14], 0x5116b82c
mov byte [rsp + 0x48], al
jmp 0x14008e547
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142b64]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
xchg rbp, rbp
syscall
ret

Function at 0x1400560a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008de45
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140142abc]
mov dword [rsp - 0x1c], ecx
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x30], 0x54686908
ret

Function at 0x1400560b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008de77
xchg rcx, r11
mov r10, r11
xchg r11, rcx
mov eax, dword [0x140142ac0]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0xc], 0x48074724
jne 0x14008dca0
syscall
ret

Function at 0x1400560c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dea5
xchg rsi, r10
mov rsi, rcx
xchg r10, rsi
mov eax, dword [0x140142ac4]
cmp qword [0x140142bb8], 0
xchg r15, r15
jne 0x14008dca0
syscall
ret

Function at 0x1400560d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dece
mov r10, rcx
mov eax, dword [0x140142ac8]
mov r8, r8
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x2c], 0x5d60e6e1
ret

Function at 0x1400560e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008de1c
xchg rdi, rcx
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x140142ab8]
cmp qword [0x140142bb8], 0
xchg rdi, rdi
jne 0x14008dca0
syscall
ret

Function at 0x1400560f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e3a2
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142b3c]
cmp qword [0x140142bb8], 0
mov rdx, rdx
jne 0x14008dca0
syscall
ret

Function at 0x140056100
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008def9
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142acc]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x38], 0x340b1793
jne 0x14008dca0
syscall
ret

Function at 0x140056110
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dd9c
mov r10, rcx
mov eax, dword [0x140142aac]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x18], 0x5b00b805
jne 0x14008dca0
syscall
ret
Function at 0x140056120
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008df89
xchg r14, rcx
mov r10, r14
xchg r14, rcx
mov eax, dword [0x140142ad8]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x3c], 0x1b2871e7
jne 0x14008dca0
syscall
ret

Function at 0x140056130
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e1e6
xchg rcx, r9
mov r10, r9
xchg rcx, r9
mov eax, dword [0x140142b10]
xchg rbp, rbp
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov r14, r14
ret

Function at 0x140056140
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e25f
xchg rcx, rdx
mov r10, rdx
xchg rdx, rcx
mov eax, dword [0x140142b1c]
cmp qword [0x140142bb8], 0
mov rbp, rbp
jne 0x14008dca0
syscall
ret

Function at 0x140056160
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ddf2
xchg rcx, r12
mov r10, r12
xchg rcx, r12
mov eax, dword [0x140142ab4]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
mov dword [rsp - 0x18], ecx
syscall
ret

Function at 0x140056170
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e524
mov r10, rcx
mov eax, dword [0x140142b60]
cmp qword [0x140142bb8], 0
xchg r14, r14
jne 0x14008dca0
syscall
ret

Function at 0x140056180
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e3cb
xchg r10, rdi
mov rdi, rcx
xchg r10, rdi
mov eax, dword [0x140142b40]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x24], 0x28bff723
jne 0x14008dca0
syscall
ret

Function at 0x140056190
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e4c4
xchg r15, rcx
mov r10, r15
xchg rcx, r15
mov eax, dword [0x140142b58]
mov dword [rsp - 0x10], 0x41e5ab19
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0x24], 0x6bbc1590
ret

Function at 0x1400561a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e2b0
xchg r10, rdx
mov rdx, rcx
xchg rdx, r10
mov eax, dword [0x140142b24]
cmp qword [0x140142bb8], 0
xchg rsp, rsp
jne 0x14008dca0
syscall
ret

Function at 0x1400561b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008e4fa
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142b5c]
cmp qword [0x140142bb8], 0
mov dword [rsp - 0x44], edi
jne 0x14008dca0
syscall
ret

Function at 0x1400561c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008ddc4
xchg r10, rsi
mov rsi, rcx
xchg r10, rsi
mov eax, dword [0x140142ab0]
mov dword [rsp - 0x34], 0x1821b04f
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
ret

Function at 0x1400561d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008dfb7
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140142adc]
mov dword [rsp - 0x10], 0x33a325e6
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
ret
Function at 0x140057d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
xchg r10, r10
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
xchg rdi, rdi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov rbx, rbx
push r14
push r14
mov qword [rsp], r15
lea rbp, [rsp - 0x1f0]
xchg r10, r10
neg rsp
sub rsp, 0xfffffffffffffd10
neg rsp
xchg rcx, r13
mov rcx, r13
xchg rcx, r13
mov edx, 0x24e7ab5c
add edx, 0xb868681
xor edx, 0x74f61038
xor edx, 0x449821c5
xchg r11, r9
mov rcx, r11
xchg r9, r11
mov r12, r9
call fcn.140055e00
xchg r10, r10
test al, al
jne 0x1400582ab
mov edx, 0x35ab7bc4
add edx, 0x6ebb31f
xor edx, 0x4ee4a131
xor edx, 0x1b0dbe16
xor edx, 0x697e31e4
in al, 0x31
jle 0x140057e52
Function at 0x1400696c4
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x34], ebx
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
push rbp
mov r15, r15
xchg rbp, rsp
mov rsp, rbp
xchg rbp, rsp
add rsp, 0xffffffffffffffa0
xchg rsi, rsi
movabs rbx, 0x703a3e7f72e70b16
sub rbx, 0x2edaa30f
add rbx, 0x213d77d4
xor rbx, 0x7f68a840
xor rbx, 0x120447c5
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
cmp qword [rcx + 0x30], rbx
mov r10, r10
jne 0x1400698f7
xor esi, esi
mov dword [rbp - 0x40], 0x53197a38
sub dword [rbp - 0x40], 0xcc9b6a0
add dword [rbp - 0x40], 0x2228d044
sub dword [rbp - 0x40], 0x40a8c833
xor dword [rbp - 0x40], 0x27efcbbd
mov dword [rbp - 0x3c], 0x5fa31a35
xor dword [rbp - 0x3c], 0x5aecae83
add dword [rbp - 0x3c], 0x316d4506
sub dword [rbp - 0x3c], 0x36b9f8f5
mov r8d, 0x31fa33fb
add r8d, 0x1cf0d00e
sub r8d, 0x217d0493
xor r8d, 0x2d6dff75
mov dword [rbp - 0x38], 0x1c9a33d8
add dword [rbp - 0x38], 0x26456ece
sub dword [rbp - 0x38], 0x3721e356
sub dword [rbp - 0x38], 0xb90bf2b
mov dword [rbp - 0x34], 0x419d90dd
xor dword [rbp - 0x34], 0x4ff9e1f5
xor dword [rbp - 0x34], 0x2684116a
xor dword [rbp - 0x34], 0x6ad8ecab
sub dword [rbp - 0x34], 0x41e88c67
mov dword [rbp - 0x30], 0x68bd42a0
sub dword [rbp - 0x30], 0x1a2a99a2
sub dword [rbp - 0x30], 0x40301e4b
xor dword [rbp - 0x30], 0x5198a196
xor dword [rbp - 0x30], 0x5fda2b5e
mov dword [rbp - 0x2c], 0x5f7c83af
add dword [rbp - 0x2c], 0x772ac52
xor dword [rbp - 0x2c], 0x343c7f8e
sub dword [rbp - 0x2c], 0x2324f9b2
xor dword [rbp - 0x2c], 0x2fa05500
xchg rsi, rdi
mov qword [rbp + 0x10], rdi
xchg rsi, rdi
mov rax, qword [rbp + 0x10]
xchg r15, rcx
mov r15, qword [rbp + 0x10]
xchg rcx, r15
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x24], ebx
and cl, r8b
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x40]
mov r10, r10
mov eax, 0x680287
xor eax, 0x6602d86c
xor eax, 0x5acad259
sub eax, 0x1339d0e7
add eax, 0x394b0c8a
shr eax, cl
movzx ecx, al
xchg r9, r9
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x28], cx
mov rax, qword [rbp + 0x10]
xchg r14, r14
inc rax
xchg r11, rax
mov qword [rbp + 0x10], r11
xchg r11, rax
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
cmp rax, 0xc
jb 0x140069822
xchg r12, r12
xor edx, edx
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x28]
mov dword [rsp - 0x40], edi
call fcn.14008b650
xchg rdx, r9
mov r9, rax
xchg r9, rdx
mov r8, rax
xor eax, eax
xchg rsp, rsp
xor rdx, rbx
mov qword [rdi + 0x30], rdx
lea rdi, [rbp - 0x28]
lea ecx, [rax + 0xc]
mov r9, r9
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x1400698ff
lea rdx, [0x1401422c0]
mov rbp, rbp
mov rcx, r8
call fcn.14006e098
test al, al
xchg rdi, rdi
setne al
jmp 0x1400698ff
mov al, 0x7b
sub al, 0x2a
add al, 0xf
sub al, 0x5f
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
xchg r11, r11
xchg r12, rsi
mov r12, qword [r11 + 0x20]
xchg rsi, r12
xchg rdi, rsi
mov rsi, qword [r11 + 0x28]
xchg rsi, rdi
xchg rsp, r15
mov r15, r11
xchg r15, rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x140069934
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
mov qword [rsp + 0x18], rsi
xchg r11, rdi
mov qword [rsp + 0x20], r11
xchg r11, rdi
push rbp
mov dword [rsp - 0x14], 0x4a5d87eb
xchg r8, rbp
mov r8, rsp
xchg rbp, r8
nop
sub rsp, 0x191e8e64
add rsp, 0x191e8e14
movabs rbx, 0x703a3e7f32874dab
add rbx, 0x479f92dc
sub rbx, 0x12e3e39c
sub rbx, 0x5f1dcc8d
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x28], rbx
jne 0x140069b3f
mov dword [rsp - 0x10], 0xfcad861
mov eax, 0x6b0d2724
xor eax, 0x52278321
add eax, 0x3a7eba2b
sub eax, 0x73a95df7
mov dword [rbp - 0x30], 0x1ebd2ab8
sub dword [rbp - 0x30], 0x8d9eff9
add dword [rbp - 0x30], 0x20d8aa63
sub dword [rbp - 0x30], 0x3693e508
mov word [rbp - 0x20], ax
xor esi, esi
mov dword [rbp - 0x2c], 0x388e907a
xor dword [rbp - 0x2c], 0x3fb897e0
add dword [rbp - 0x2c], 0x533d8e12
sub dword [rbp - 0x2c], 0x575899b9
xor dword [rbp - 0x2c], 0x34bfb27
mov dword [rbp - 0x28], 0x25d016d9
add dword [rbp - 0x28], 0x14623d66
add dword [rbp - 0x28], 0x4a60c84
add dword [rbp - 0x28], 0x336279e9
sub dword [rbp - 0x28], 0x71d0da45
mov dword [rbp - 0x24], 0x7bdfdb2f
sub dword [rbp - 0x24], 0x70ff35c1
add dword [rbp - 0x24], 0x4d06e011
sub dword [rbp - 0x24], 0x32345e89
sub dword [rbp - 0x24], 0x25a52621
xchg r10, rsi
mov qword [rbp + 0x10], r10
xchg r10, rsi
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
xchg rcx, r14
mov r14, qword [rbp + 0x10]
xchg r14, rcx
xchg r10, rax
mov r10, qword [rbp + 0x10]
xchg r10, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov dword [rsp - 0x30], 0x708ad156
mov eax, 0x3ed31ecf
sub eax, 0xea0bd69
xor eax, 0x1c32dfa9
add eax, 0x36b08586
shr eax, cl
mov r8, r8
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x1e], cx
mov dword [rsp - 0x18], 0x53555025
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
inc rax
xchg rcx, rcx
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 9
jb 0x140069a5b
mov dword [rsp - 0x20], ebx
xor edx, edx
mov word [rbp - 0xc], si
lea rcx, [rbp - 0x1e]
call fcn.14008b650
xchg rbx, rbx
mov rdx, rax
xchg r11, rax
mov r8, r11
xchg r11, rax
xor eax, eax
xchg r11, r11
xor rdx, rbx
xchg rdx, r13
mov qword [rdi + 0x28], r13
xchg r13, rdx
lea rdi, [rbp - 0x1e]
mov r13, r13
lea ecx, [rax + 9]
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140069b47
mov rbp, rbp
lea rdx, [0x140142810]
xchg rsi, rcx
mov rsi, r8
xchg rsi, rcx
call fcn.1400722a8
test al, al
setne al
xchg r12, r12
jmp 0x140069b47
mov al, 0x1f
sub al, 4
add al, 0x48
sub al, 0x62
xchg rbx, r9
mov r9, qword [rsp + 0x68]
xchg r9, rbx
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rsi, rbp
xchg rdi, r14
mov r14, qword [rsp + 0x78]
xchg r14, rdi
sub rsp, 0xffffffffffffffb0
mov dword [rsp - 0x38], ebx
pop rbp
ret