joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov r14, r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rsi, qword [rcx + 0x38]
mov r10, r10
xchg r14, rbx
mov r14, rdx
xchg rbx, r14
xchg r9, r8
mov r9, qword [rdx + 0x38]
xchg r8, r9
mov rdi, rcx
xchg rbx, rbx
add r8, rsi
mov rdx, rsi
xchg r8, r13
mov qword [rcx + 0x38], r13
xchg r8, r13
call fcn.140053a80
xchg rbx, rbx
xchg r10, r9
mov r10, qword [rbx]
xchg r10, r9
mov ecx, esi
mov dword [rsp - 0x18], ebx
and ecx, 3
mov r8d, 0x20e84fc0
sub r8d, 0x1c03861a
add r8d, 0x8c6132c
add r8d, 0x1e944235
add r8d, 0x3f4e402d
shl ecx, 3
xchg r15, r15
mov edx, r8d
ror edx, cl
xor ecx, ecx
mov dword [rsp - 0x14], 0x33fb0ee2
cmp qword [rbx + 0x38], rcx
jbe 0x140052d04
lea r10, [rsi + rsi]
mov r11d, 0x465aad21
sub r11d, 0x322cf059
xor r11d, 0x3f56f7f0
add r11d, 0x2247ff6c
xor r11d, 0x4dc34a5b
sub r10, r9
add r10, rax
mov dword [rsp - 0x30], esi
nop word [rax + rax]
movzx eax, r8w
lea r9, [r9 + 2]
xchg r8, r8
xor ax, dx
ror r8d, 2
ror r8d, 2
ror r8d, 2
ror r8d, 1
ror r8d, 1
and ax, r11w
mov dword [rsp - 0x38], 0x2bd9ddc6
ror edx, 8
xor ax, word [r9 - 2]
inc rcx
mov dword [rsp - 0x18], esp
mov word [r9 + r10 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x140052cb9
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x14], 0x7c99fcff
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rsi, qword [rsp + 0x38]
nop
add rsp, 0x6a4776db
sub rsp, 0x6a4776bb
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140052d40
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rsi, r12
mov qword [rsp + 0x10], r12
xchg r12, rsi
xchg rdi, r9
mov qword [rsp + 0x18], r9
xchg r9, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r14, qword [rcx + 0x38]
mov rbp, rbp
xchg rdi, rcx
mov rcx, rdx
xchg rcx, rdi
mov rsi, rcx
xchg rdx, rdx
nop
movabs rbx, 0xffffffff11786116
sub rbx, 0x10292827
add rbx, 0x3a21dd4
add rbx, 0x7fffffff
add rbx, 0x7b0ea93d
inc rbx
mov dword [rsp - 0x30], edx
cmp word [rdx + rbx*2], 0
jne 0x140052db2
lea r8, [r14 + rbx]
xchg rdx, r14
mov r14, rdx
xchg r14, rdx
xchg r8, rbx
mov qword [rcx + 0x38], rbx
xchg r8, rbx
call fcn.140053a80
mov ecx, r14d
mov r11, r11
mov edx, 0x4d2f22f7
sub edx, 0x23350ad4
add edx, 0x761e54d
add edx, 0x32be77bd
add edx, 0x772ea07
and ecx, 3
mov dword [rsp - 0x40], edx
shl ecx, 3
ror edx, cl
test rbx, rbx
je 0x140052e86
mov dword [rsp - 0x10], 0x74b83000
lea rcx, [r14 + r14]
mov r8d, 0x4c1f9d95
sub r8d, 0x2b4caa3e
add r8d, 0x331e937d
sub r8d, 0x53f185d5
sub rcx, rdi
mov r11, r11
add rcx, rax
nop word [rax + rax]
movzx eax, dx
lea rdi, [rdi + 2]
mov dword [rsp - 0x20], 0x4d2fcf5
and ax, r8w
ror edx, 2
ror edx, 1
ror edx, 4
ror edx, 1
xor ax, word [rdi - 2]
mov word [rdi + rcx - 2], ax
sub rbx, 1
mov rdx, rdx
jne 0x140052e53
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rcx, rcx
xchg r12, rdi
mov r12, qword [rsp + 0x40]
xchg r12, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r14
ret
Function at 0x140053806
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rbx
xchg rbx, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov rbp, rbp
mov qword [rdx], rsi
xor edi, edi
movups xmmword [rsi], xmm0
mov dword [rsp - 0x40], 0x1d50bae5
xchg r14, r9
mov r9, r14
xchg r14, r9
xchg rbp, rsi
mov rsi, r8
xchg rbp, rsi
xchg rdx, rsi
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rsi
mov rbx, rdx
mov r14, r14
xchg rdi, rsi
movups xmmword [rdi + 0x20], xmm0
xchg rsi, rdi
mov qword [rdx + 0x38], rdi
xchg rsp, rax
mov rsp, qword [rcx + 0x38]
xchg rsp, rax
cmp r8, rax
mov rcx, rcx
jae 0x140053a0b
sub rax, r8
mov qword [rsp + 0x40], r15
mov dword [rsp - 0x3c], ebx
cmp rax, r9
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov rsp, rsp
mov rax, qword [rcx]
xchg r12, rcx
mov r12, qword [rdx]
xchg rcx, r12
lea r15, [rax + r8*2]
cmp rcx, rsi
mov dword [rsp - 0x44], 0x6856e506
je 0x14005389b
call fcn.1400996a0
cmp r14, 0x18
jbe 0x1400538e1
mov dword [rsp - 0x30], 0x1177937c
lea rcx, [r14 + r14]
call fcn.140099990
mov qword [rbx], rax
test rax, rax
mov dword [rsp - 0x40], 0x623163a4
jne 0x1400538f1
xchg rdi, rsi
mov qword [rbx], rdi
xchg rsi, rdi
xchg r8, rbp
mov rbp, rdi
xchg rbp, r8
jmp 0x14005390e
xchg r9, rsi
mov qword [rbx], r9
xchg r9, rsi
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rsp - 0xc], edi
movups xmmword [rax + 0x10], xmm0
xchg rbx, rax
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rax
mov r8, qword [rbx]
mov dword [rsp - 0x38], esp
and ebp, 3
mov r9d, 0x41251147
sub r9d, 0xd13689a
add r9d, 0xb606d3b
add r9d, 0x200c1b15
add r9d, 0xc0f2e37
shl ebp, 3
mov dword [rsp - 0x24], esp
mov edx, r9d
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
mov r8, r8
jbe 0x1400539cb
sub r15, r8
mov ecx, 0x47af0f48
xor ecx, 0x1e66e0d0
xor ecx, 0x248b94d8
sub ecx, 0x7d427a41
nop dword [rax]
nop word [rax + rax]
xchg rsp, rsp
movzx eax, r9w
lea r8, [r8 + 2]
xor ax, dx
ror r9d, 1
ror r9d, 5
ror r9d, 1
ror r9d, 1
and ax, cx
mov dword [rsp - 0x3c], 0x11ca0cd8
ror edx, 6
ror edx, 2
xor ax, word [r8 + r15 - 2]
inc rdi
mov dword [rsp - 0x24], 0x15978660
mov word [r8 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x14005397a
mov dword [rsp - 0x20], 0x94ca7ee
mov r15, qword [rsp + 0x40]
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x48]
xchg rdi, rbx
xchg rcx, rbp
mov rcx, qword [rsp + 0x50]
xchg rbp, rcx
nop
add rsp, 0x399f65df
sub rsp, 0x399f65bf
nop
mov r14, qword [rsp]
add rsp, 8
pop rdi
xchg rbx, rbx
pop rsi
ret
mov rax, rbx
mov dword [rsp - 0x3c], 0x42d4710e
jmp 0x1400539d7
Function at 0x140053db0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov dword [rsp - 0xc], 0x7d80688
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov dword [rsp - 0x28], 0x19f67e62
mov qword [r11 + 0x20], rdi
push r12
push r14
mov r11, r11
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0x7b2d7c07
add rsp, 0x7b2d7ba7
mov r15, qword [rcx + 0x38]
xchg rbp, rbp
lea rax, [r11 - 0x50]
mov rsi, qword [rcx]
xorps xmm0, xmm0
xchg r12, r12
mov qword [r11 - 0x58], rax
mov r14, rcx
lea rcx, [r11 - 0x58]
mov dword [rsp - 0x28], ebx
lea rdx, [r15 + 1]
xchg r9, rsp
movups xmmword [r9 + 0x28], xmm0
xchg r9, rsp
movups xmmword [rsp + 0x38], xmm0
xchg r9, rsp
movups xmmword [r9 + 0x48], xmm0
xchg r9, rsp
call fcn.14000ef00
mov dword [rsp - 0x38], edx
mov ebx, 0x1147e8ef
xor ebx, 0x6c2e586e
sub ebx, 0x72dce4df
add ebx, 0x61009392
xchg r8, rax
mov rax, r8
xchg r8, rax
mov ecx, ebx
mov dword [rsp - 0x3c], 0x5228569e
mov r12d, 0x4c052703
sub r12d, 0x23c186de
add r12d, 0x263e91a0
xor r12d, 0x591e3e1b
sub r12d, 0x179c0edf
test r15, r15
mov dword [rsp - 0x24], ecx
je 0x140053edc
mov rdx, rax
sub rsi, rax
mov r15, r15
xchg r10, rdi
mov r10, r15
xchg r10, rdi
nop dword [rax]
movzx eax, cx
mov dword [rsp - 0x18], 0x66272858
lea rdx, [rdx + 2]
and ax, r12w
ror ecx, 5
ror ecx, 1
ror ecx, 1
ror ecx, 1
xor ax, word [rdx + rsi - 2]
mov word [rdx - 2], ax
xchg rsp, rsp
sub rdi, 1
jne 0x140053eaa
xor ebp, ebp
mov dword [rsp - 0xc], 0x3990f544
mov word [r8 + r15*2], bp
mov esi, ebp
mov rdi, qword [rsp + 0x20]
cmp qword [r14 + 0x38], rbp
mov r15, r15
jbe 0x140053f26
movzx ecx, word [rdi]
call fcn.14009a490
mov word [rdi], ax
xchg r11, r11
lea rdi, [rdi + 2]
inc rsi
cmp rsi, qword [r14 + 0x38]
jb 0x140053eff
xchg r12, r12
mov rdi, qword [rsp + 0x20]
nop
movabs rdx, 0xffffffff5db9c2e1
sub rdx, 0x3e863db0
add rdx, 0x2cf036a9
add rdx, 0x7fffffff
add rdx, 0x33dc4426
inc rdx
xchg rcx, rcx
cmp word [rdi + rdx*2], bp
jne 0x140053f4d
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
mov qword [r14 + 0x38], rdx
mov dword [rsp - 0x3c], 0x57bcdf2
call fcn.14000ef00
cmp qword [r14 + 0x38], rbp
jbe 0x140053fcc
mov dword [rsp - 0x28], 0x1dd31499
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, bx
xchg rdx, rdx
lea rax, [rax + 2]
and cx, r12w
ror ebx, 2
ror ebx, 2
ror ebx, 4
xor cx, word [rax + rdi - 2]
xchg r8, r8
inc rbp
mov word [rax - 2], cx
cmp rbp, qword [r14 + 0x38]
xchg r13, r13
jb 0x140053f99
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
mov dword [rsp - 0x2c], edi
jne 0x14005400b
lea rdi, [rsp + 0x28]
xor eax, eax
mov r13, r13
mov ecx, 0x15ebc239
xor ecx, 0x7a5a333f
sub ecx, 0x3c33feb9
xor ecx, 0x337df27d
rep stosb byte [rdi], al
jmp 0x140054013
call fcn.1400996a0
mov r12, r12
lea r11, [rsp + 0x60]
xchg rbx, r14
mov r14, qword [r11 + 0x20]
xchg rbx, r14
mov rbp, qword [r11 + 0x28]
xchg rbp, rbp
xchg rsi, rsp
mov rsp, qword [r11 + 0x30]
xchg rsi, rsp
mov rdi, qword [r11 + 0x38]
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
ret
Function at 0x140054060
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a03e
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a8ff0]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0x10], esp
jne 0x140089dc0
syscall
ret

Function at 0x140054080
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
jmp 0x14008a67e
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a9088]
cmp qword [0x1404a90e0], 0
xchg rcx, rcx
jne 0x140089dc0
syscall
ret

Function at 0x140054090
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089e3a
xchg r15, r10
mov r15, rcx
xchg r10, r15
mov eax, dword [0x1404a8fc0]
cmp qword [0x1404a90e0], 0
mov rsi, rsi
jne 0x140089dc0
syscall
ret

Function at 0x1400540a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a28d
mov r10, rcx
mov dword [rsp - 0x18], edx
mov eax, dword [0x1404a9028]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
mov rdx, rdx
syscall
ret

Function at 0x1400540c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089e94
mov r10, rcx
xchg rcx, rcx
mov eax, dword [0x1404a8fc8]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
mov dword [rsp - 0x20], edi
syscall
ret

Function at 0x1400540d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a479
xchg rdx, rcx
mov r10, rdx
xchg rcx, rdx
mov eax, dword [0x1404a9058]
mov dword [rsp - 0x28], ebx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
ret

Function at 0x1400540e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a068
mov r10, rcx
mov dword [rsp - 0x24], 0x7fe8b48f
mov eax, dword [0x1404a8ff4]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x2c], esp
ret

Function at 0x140054100
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089e67
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a8fc4]
mov rdx, rdx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
ret

Function at 0x140054110
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a3f7
xchg r11, r10
mov r11, rcx
xchg r10, r11
mov eax, dword [0x1404a904c]
mov dword [rsp - 0x14], ecx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
xchg rbp, rbp
ret

Function at 0x140054120
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a23c
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a9020]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
mov dword [rsp - 0x3c], ecx
syscall
ret

Function at 0x140054130
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a266
mov r10, rcx
mov eax, dword [0x1404a9024]
mov r12, r12
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x14], ebp
ret

Function at 0x140054140
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a0ea
xchg rcx, r8
mov r10, r8
xchg r8, rcx
mov eax, dword [0x1404a9000]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
xchg r15, r15
syscall
ret
Function at 0x140054150
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov dword [rsp - 0x30], esp
mov byte [rsp + 0x48], al
jmp 0x14008a650
xchg rcx, r14
mov r10, r14
xchg r14, rcx
mov eax, dword [0x1404a9084]
mov dword [rsp - 0x28], 0x67565530
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
ret

Function at 0x140054170
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089f63
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a8fdc]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0xc], esp
jne 0x140089dc0
syscall
ret

Function at 0x140054180
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089f8d
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a8fe0]
mov dword [rsp - 0x10], ebp
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x34], esp
ret

Function at 0x140054190
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089fbb
xchg r10, rsp
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1404a8fe4]
xchg rbx, rbx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
xchg rdi, rdi
ret

Function at 0x1400541a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089fe7
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x1404a8fe8]
mov dword [rsp - 0x1c], ebx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
xchg rdi, rdi
ret

Function at 0x1400541b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089f3b
mov r10, rcx
mov eax, dword [0x1404a8fd8]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0x14], 0x6e201013
jne 0x140089dc0
syscall
ret

Function at 0x1400541c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a4a3
mov r10, rcx
mov eax, dword [0x1404a905c]
cmp qword [0x1404a90e0], 0
xchg r15, r15
jne 0x140089dc0
syscall
ret

Function at 0x1400541d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a014
xchg rsp, r10
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1404a8fec]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0x40], ebx
jne 0x140089dc0
syscall
ret

Function at 0x1400541e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089ebb
mov r10, rcx
mov eax, dword [0x1404a8fcc]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0x28], ebp
jne 0x140089dc0
syscall
ret

Function at 0x1400541f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a094
mov r10, rcx
mov eax, dword [0x1404a8ff8]
mov dword [rsp - 0x40], esi
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x10], 0x5c107d5c
ret

Function at 0x140054220
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a6a7
sub rsp, 0x653844f5
add rsp, 0x653843d5
lea rcx, [0x140089e2d]
push rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push qword [0x1404a90e8]
lea rsi, [rsp + 0x170]
mov dword [rsp - 0x38], 0x5eab122d
lea rdi, [rsp + 0x28]
mov ecx, 0x5b77f7bf
sub ecx, 0x49ba28a2
sub ecx, 0xe4b0c5e
sub ecx, 0x372c2af
rep movsq qword [rdi], qword [rsi]
jmp qword [0x1404a90e0]
mov r10, rcx
mov dword [rsp - 0x28], 0x32f7e4b8
mov eax, dword [0x1404a908c]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
mov dword [rsp - 0x38], 0x69208fa1
syscall
ret
Function at 0x140054230
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089f0d
xchg r10, r15
mov r15, rcx
xchg r10, r15
mov eax, dword [0x1404a8fd4]
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
mov dword [rsp - 0x44], 0x2a5d151e
syscall
ret

Function at 0x140054240
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a61a
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a9080]
mov dword [rsp - 0x24], 0x7097f8e0
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x24], 0x77bbb187
ret

Function at 0x140054250
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a5b7
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a9078]
mov dword [rsp - 0x34], ebp
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x1c], 0xcf01ec0
ret

Function at 0x140054260
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a5e9
xchg rcx, r8
mov r10, r8
xchg r8, rcx
mov eax, dword [0x1404a907c]
mov rcx, rcx
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
mov dword [rsp - 0x1c], 0x4a0af8ac
ret

Function at 0x140054270
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089edf
xchg r12, r10
mov r12, rcx
xchg r12, r10
mov eax, dword [0x1404a8fd0]
mov dword [rsp - 0x14], 0x607f221c
cmp qword [0x1404a90e0], 0
jne 0x140089dc0
syscall
ret

Function at 0x140054280
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008a0c0
xchg rdi, r10
mov rdi, rcx
xchg r10, rdi
mov eax, dword [0x1404a8ffc]
cmp qword [0x1404a90e0], 0
mov dword [rsp - 0x30], esp
jne 0x140089dc0
syscall
ret
Function at 0x140057a10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
nop
push r8
mov qword [rsp], rdi
nop
add rsp, 0x2db49d4b
sub rsp, 0x2db49dab
movabs rbx, 0x21895caf0f4655de
xor rbx, 0x146b8c5a
add rbx, 0x540b7923
xor rbx, 0xa910853
sub rbx, 0x37fc1114
mov rdi, rcx
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0x28], 0x7a62148f
jne 0x140057c85
mov dword [rax - 0x48], 0x2e70d961
add dword [rax - 0x48], 0x273c9b03
xor dword [rax - 0x48], 0x760e034a
add dword [rax - 0x48], 0x1fa1734f
sub dword [rax - 0x48], 0x4309ea08
xor r8d, r8d
xchg r12, r12
mov dword [rax - 0x44], 0x5cc7cdb0
xor dword [rax - 0x44], 0x769f4a8b
xor dword [rax - 0x44], 0x13eba1d
sub dword [rax - 0x44], 0x120180c
sub dword [rax - 0x44], 0x2a3c241f
mov dword [rax - 0x40], 0x3327ddea
add dword [rax - 0x40], 0x3106a6af
sub dword [rax - 0x40], 0x607b731
sub dword [rax - 0x40], 0xa643b5a
sub dword [rax - 0x40], 0x538c91ca
mov dword [rax - 0x3c], 0x7c89fc04
xor dword [rax - 0x3c], 0x3174a6e6
sub dword [rax - 0x3c], 0x1f861dd3
xor dword [rax - 0x3c], 0x5f6e0a72
sub dword [rax - 0x3c], 0x70c036bf
mov dword [rax - 0x38], 0xf85523f
add dword [rax - 0x38], 0x56fbae32
xor dword [rax - 0x38], 0x1ae425bc
xor dword [rax - 0x38], 0x301d8191
sub dword [rax - 0x38], 0x4c3da442
mov dword [rax - 0x34], 0x2ab774d1
add dword [rax - 0x34], 0x178cdfa9
add dword [rax - 0x34], 0x26db449c
sub dword [rax - 0x34], 0x4cb247d6
sub dword [rax - 0x34], 0x1c66505f
xchg r8, r11
mov qword [rsp + 0x70], r11
xchg r11, r8
xchg r12, rax
mov r12, qword [rsp + 0x70]
xchg r12, rax
nop word [rax + rax]
mov r14, r14
xchg r13, rcx
mov r13, qword [rsp + 0x70]
xchg r13, rcx
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x44], 0x1bdf9ee0
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
xchg rbp, rbp
mov eax, 0x527272c9
add eax, 0x1e7cf542
sub eax, 0x21aa4a0
xor eax, 0x5599c5f
shr eax, cl
mov dword [rsp - 0x3c], esi
movzx ecx, al
mov rax, qword [rsp + 0x70]
xor cx, dx
mov word [rsp + rax*2 + 0x38], cx
mov rbp, rbp
xchg r12, rax
mov r12, qword [rsp + 0x70]
xchg r12, rax
inc rax
mov dword [rsp - 0x44], 0x12eea7cc
xchg r15, rax
mov qword [rsp + 0x70], r15
xchg r15, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x70]
xchg rbx, rax
cmp rax, 0xc
jb 0x140057b5d
mov r11, r11
xor edx, edx
mov word [rsp + 0x50], r8w
lea rcx, [rsp + 0x38]
mov dword [rsp - 0x10], 0x6e25486d
call fcn.14007c2b0
xchg rbx, rdx
mov rbx, rax
xchg rbx, rdx
mov r8, rax
mov dword [rsp - 0x24], ebp
xor rdx, rbx
xor eax, eax
mov qword [rdi + 0x30], rdx
mov r12, r12
lea rdi, [rsp + 0x38]
mov ecx, 0x2abae7b0
xor ecx, 0x49a05344
sub ecx, 0x3c6ac590
add ecx, 0x5501b475
sub ecx, 0x7bb1a3cd
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x24], ecx
je 0x140057c8f
lea rdx, [0x1404a8420]
xchg rcx, rsi
mov rsi, r8
xchg rsi, rcx
call fcn.14005f690
test al, al
mov dword [rsp - 0x38], esi
setne al
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
mov dword [rsp - 0x28], 0x675ed8f
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x10
add al, 0x50
sub al, 0xe
xor al, 0x12
sub al, 0x3f
xchg rbx, r15
mov r15, qword [rsp + 0x78]
xchg r15, rbx
nop
add rsp, 0x6c619e31
sub rsp, 0x6c619dd1
pop rdi
xchg rbp, rbp
ret
Function at 0x140057cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rax
mov qword [rsp], rdi
add rsp, 0xffffffffffffffb0
movabs rbx, 0x21895caf3d054834
xor rbx, 0xe953224
xor rbx, 0x64c53275
xor rbx, 0x17ffdf16
sub rbx, 0x12fe4d93
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
cmp qword [rcx + 0x28], rbx
jne 0x140057ee7
mov ecx, 0x5c2bdadf
sub ecx, 0x262e99c4
xor ecx, 0x1c487a54
add ecx, 0x12150189
sub ecx, 0x3bca3c80
mov dword [rsp + 0x20], 0x27fa9313
xor dword [rsp + 0x20], 0x266768f1
add dword [rsp + 0x20], 0x21055d50
xor dword [rsp + 0x20], 0x2ff2fb0b
sub dword [rsp + 0x20], 0xd1ea1be
xor r8d, r8d
xchg rsp, rsp
mov word [rsp + 0x30], cx
mov dword [rsp + 0x24], 0x2130b807
add dword [rsp + 0x24], 0x389bd111
xor dword [rsp + 0x24], 0x3de1c7ca
sub dword [rsp + 0x24], 0x2187e8ca
sub dword [rsp + 0x24], 0x424d6520
mov dword [rsp + 0x28], 0xe36870d
add dword [rsp + 0x28], 0x1c6ea495
add dword [rsp + 0x28], 0x2b56f15d
sub dword [rsp + 0x28], 0x558b1cf9
mov dword [rsp + 0x2c], 0x535f2083
add dword [rsp + 0x2c], 0xd541add
xor dword [rsp + 0x2c], 0x702d379d
xor dword [rsp + 0x2c], 0x10990c14
mov qword [rsp + 0x60], r8
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0xc], 0x2379e6c5
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0x18], ebp
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov dword [rsp - 0xc], 0x498ee93c
mov eax, 0x1916a7fd
add eax, 0x33510b63
xor eax, 0x48a7c7c
add eax, 0x229f9018
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x14], esi
xchg r8, rax
mov r8, qword [rsp + 0x60]
xchg r8, rax
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg r9, r9
xchg r8, rax
mov r8, qword [rsp + 0x60]
xchg r8, rax
inc rax
mov qword [rsp + 0x60], rax
xchg rbp, rax
mov rbp, qword [rsp + 0x60]
xchg rbp, rax
cmp rax, 9
mov dword [rsp - 0x34], edx
jb 0x140057dc9
xor edx, edx
mov word [rsp + 0x44], r8w
mov dword [rsp - 0xc], 0x1dc9dbd8
lea rcx, [rsp + 0x32]
call fcn.14007c2b0
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor rdx, rbx
xchg rdi, rdi
xor eax, eax
mov qword [rdi + 0x28], rdx
lea rdi, [rsp + 0x32]
mov ecx, 0x17c56c44
add ecx, 0x3698b759
xor ecx, 0x1bb94a49
sub ecx, 0x55e769cb
rep stosb byte [rdi], al
mov dword [rsp - 0x1c], edx
cmp rdx, rbx
je 0x140057ef1
lea rdx, [0x1404a85a0]
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.14006caf0
test al, al
mov dword [rsp - 0x3c], edi
setne al
xchg rdi, rbx
mov rdi, qword [rsp + 0x68]
xchg rdi, rbx
nop
add rsp, 0x45f87d15
sub rsp, 0x45f87cc5
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x28
xor al, 0x17
add al, 0x11
sub al, 0xb
sub al, 0x44
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
mov rsp, rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret