joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2c40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
push rbp
sub rsp, 0x78
mov rbp, qword [0x1404dfaa0]
mov rbx, qword [0x1404dfa98]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
movabs r12, 0xabc29ce444222325
mov qword [rax - 0x18], r13
movabs r13, 0x9938441eb4e5f215
mov qword [rax - 0x20], r14
movabs r14, 0xfffffe539f
mov qword [rax - 0x28], r15
movabs r15, 0xb76d2b05c51c634d
cmp rbx, rbp
je 0x1401a2d9a
nop dword [rax]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call fcn.14008b160
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1401a2cba
mov r9, qword [rax]
mov rdi, r12
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rdi, rax
imul rdi, r14
test r8b, r8b
jne 0x1401a2cc0
lea rcx, [rsp + 0x20]
call fcn.1400166a0
cmp rdi, r13
je 0x1401a2cfe
cmp rdi, r15
jne 0x1401a2d07
add rbx, 0x10
cmp rbx, rbp
jne 0x1401a2ca0
cmp rbx, rbp
je 0x1401a2d9a
mov qword [rsp + 0x90], rsi
lea rsi, [rbx + 0x10]
cmp rsi, rbp
je 0x1401a2d92
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call fcn.14008b160
cmp qword [rax + 0x18], 0xf
jbe 0x1401a2d38
mov rax, qword [rax]
mov rdi, r12
nop dword [rax + rax]
movzx r9d, byte [rax]
lea rax, [rax + 1]
lea ecx, [r9 + 0x20]
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
movsx rcx, dl
xor rdi, rcx
imul rdi, r14
test r9b, r9b
jne 0x1401a2d40
lea rcx, [rsp + 0x40]
call fcn.1400166a0
cmp rdi, r13
je 0x1401a2d7f
cmp rdi, r15
jne 0x1401a2d89
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
add rbx, 0x10
add rsi, 0x10
cmp rsi, rbp
jne 0x1401a2d21
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
cmp rbx, rbp
je 0x1401a2dd7
mov rdx, qword [0x1404dfaa0]
mov r8, rbx
mov rcx, rbp
call fcn.140017530
mov qword [0x1404dfaa0], rax
add rsp, 0x78
pop rbp
pop rbx
ret
Function at 0x1401a31d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
push rbp
sub rsp, 0x68
mov rbp, qword [0x1404dfc08]
mov rbx, qword [0x1404dfc00]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
movabs r12, 0xb3e994f6c58ef674
mov qword [rax + 0x20], r14
movabs r14, 0xfffffe539f
mov qword [rax - 0x18], r15
movabs r15, 0xabc29ce444222325
cmp rbx, rbp
je 0x1401a3314
nop
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call fcn.14008b160
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1401a323a
mov r9, qword [rax]
mov rdi, r15
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rdi, rax
imul rdi, r14
test r8b, r8b
jne 0x1401a3240
lea rcx, [rsp + 0x20]
call fcn.1400166a0
cmp rdi, r12
jne 0x1401a3282
add rbx, 8
cmp rbx, rbp
jne 0x1401a3220
cmp rbx, rbp
je 0x1401a3314
mov qword [rsp + 0x80], rsi
lea rsi, [rbx + 8]
cmp rsi, rbp
je 0x1401a330c
nop dword [rax]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call fcn.14008b160
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1401a32ba
mov r9, qword [rax]
mov rdi, r15
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rdi, rax
imul rdi, r14
test r8b, r8b
jne 0x1401a32c0
lea rcx, [rsp + 0x40]
call fcn.1400166a0
cmp rdi, r12
jne 0x1401a3303
mov rax, qword [rsi]
mov qword [rbx], rax
add rbx, 8
add rsi, 8
cmp rsi, rbp
jne 0x1401a32a0
mov rsi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
cmp rbx, rbp
je 0x1401a334f
mov rdx, qword [0x1404dfc08]
mov r8, rbx
mov rcx, rbp
call fcn.140017530
mov qword [0x1404dfc08], rax
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x1401ca4d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1401ca531
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1401ca4f0
mov ecx, dword [r9]
jmp 0x1401ca618
cmp ecx, 0x4e0
jb 0x1401ca618
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1401ca550
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1401ca5a0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1401d36e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbp
mov rsi, rcx
lea rbp, [r8 - 1]
mov qword [rsp + 0x58], r12
sar rbp, 1
mov r14, r9
mov qword [rsp + 0x60], r13
mov r13, r8
mov rbx, rdx
mov r15, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x1401d3750
nop dword [rax]
lea rdi, [rcx + rcx]
mov r8, qword [rsi + rdi*8 + 8]
mov rdx, qword [rsi + rdi*8 + 0x10]
call fcn.140142660
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rdi
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rbx*8], rax
mov rbx, rcx
cmp rcx, rbp
jl 0x1401d3720
cmp rcx, rbp
mov rbp, qword [rsp + 0x50]
jne 0x1401d376d
test r13b, 1
jne 0x1401d376d
mov rax, qword [rsi + r13*8 - 8]
mov qword [rsi + rbx*8], rax
lea rbx, [r13 - 1]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
cmp r15, rbx
jge 0x1401d37ba
nop dword [rax]
mov r8, qword [r14]
lea rdi, [rbx - 1]
sar rdi, 1
mov rdx, qword [rsi + rdi*8]
call fcn.140142660
test al, al
je 0x1401d37ba
mov rax, qword [rsi + rdi*8]
mov qword [rsi + rbx*8], rax
mov rbx, rdi
cmp r15, rdi
jl 0x1401d3780
mov rax, qword [r14]
mov qword [rsi + rdi*8], rax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [r14]
mov qword [rsi + rbx*8], rax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401dff10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r11, qword [rsp + 0x70]
mov rsi, rcx
mov qword [rsp + 0x50], rbp
mov r15, r9
lea rbp, [r8 - 1]
mov qword [rsp + 0x58], r13
sar rbp, 1
mov r14, r8
mov rbx, rdx
mov r12, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x1401dff84
nop
lea rdi, [rcx + rcx]
mov rcx, r11
lea rdx, [rsi + 8]
lea rdx, [rdx + rdi*4]
lea r8, [rdx - 4]
call fcn.1401c9e00
movzx eax, al
lea rcx, [rdi + 1]
xor rax, 1
add rcx, rax
mov eax, dword [rsi + rcx*4]
mov dword [rsi + rbx*4], eax
mov rbx, rcx
cmp rcx, rbp
jl 0x1401dff50
cmp rcx, rbp
mov rbp, qword [rsp + 0x50]
jne 0x1401dffa0
test r14b, 1
jne 0x1401dffa0
mov eax, dword [rsi + r14*4 - 4]
mov dword [rsi + rbx*4], eax
lea rbx, [r14 - 1]
mov r13, qword [rsp + 0x58]
cmp r12, rbx
jge 0x1401dfff3
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
mov rcx, r11
lea r14, [rsi + rdi*4]
mov rdx, r14
call fcn.1401c9e00
test al, al
je 0x1401dfff3
mov eax, dword [r14]
mov dword [rsi + rbx*4], eax
mov rbx, rdi
cmp r12, rdi
jl 0x1401dffb0
mov eax, dword [r15]
mov dword [rsi + rdi*4], eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov eax, dword [r15]
mov dword [rsi + rbx*4], eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401e0380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x1401e0413
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.1401c7b60
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
movups xmm0, xmmword [r14 + rcx*8]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x1401e03c0
jne 0x1401e0441
test r12b, 1
jne 0x1401e0441
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
movups xmm0, xmmword [r14 + rcx*8 - 0x18]
lea rbx, [r12 - 1]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 - 8]
movsd qword [r14 + rax*8 + 0x10], xmm1
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x1401e04a3
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.1401c7b60
test al, al
je 0x1401e04a3
lea rax, [rbx + rbx*2]
mov rbx, rdi
movups xmm0, xmmword [rsi]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rsi + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x1401e0460
movups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rbp + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e0850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1401e08e2
nop dword [rax + rax]
lea rdi, [r10 + r10]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*4]
lea r8, [rdx - 0xc]
lea rcx, [rsp + 0x70]
call fcn.1401c82f0
movzx r10d, al
lea rax, [rbx + rbx*2]
xor r10, 1
lea rdx, [r14 + rax*4]
inc r10
add r10, rdi
mov rbx, r10
lea rcx, [r10 + r10*2]
movsd xmm0, qword [r14 + rcx*4]
movsd qword [rdx], xmm0
mov eax, dword [r14 + rcx*4 + 8]
mov dword [rdx + 8], eax
cmp r10, rsi
jl 0x1401e0890
cmp r10, rsi
jne 0x1401e0911
test r12b, 1
jne 0x1401e0911
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*4]
lea rcx, [r12 + r12*2]
movsd xmm0, qword [r14 + rcx*4 - 0xc]
lea rbx, [r12 - 1]
movsd qword [rdx], xmm0
mov eax, dword [r14 + rcx*4 - 4]
mov dword [rdx + 8], eax
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x1401e0973
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*4]
mov rdx, rsi
call fcn.1401c82f0
test al, al
je 0x1401e0973
movsd xmm0, qword [rsi]
lea rax, [rbx + rbx*2]
movsd qword [r14 + rax*4], xmm0
lea rcx, [r14 + rax*4]
mov eax, dword [rsi + 8]
mov rbx, rdi
mov dword [rcx + 8], eax
cmp r15, rdi
jl 0x1401e0930
movsd xmm0, qword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
lea rcx, [r14 + rax*4]
movsd qword [rcx], xmm0
mov eax, dword [rbp + 8]
mov dword [rcx + 8], eax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e09a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x1401e0a33
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.1401c8600
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
movups xmm0, xmmword [r14 + rcx*8]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x1401e09e0
jne 0x1401e0a61
test r12b, 1
jne 0x1401e0a61
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
movups xmm0, xmmword [r14 + rcx*8 - 0x18]
lea rbx, [r12 - 1]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 - 8]
movsd qword [r14 + rax*8 + 0x10], xmm1
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x1401e0ac3
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.1401c8600
test al, al
je 0x1401e0ac3
lea rax, [rbx + rbx*2]
mov rbx, rdi
movups xmm0, xmmword [rsi]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rsi + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x1401e0a80
movups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rbp + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e0af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x1401e0b83
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.1401c8a50
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
movups xmm0, xmmword [r14 + rcx*8]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x1401e0b30
jne 0x1401e0bb1
test r12b, 1
jne 0x1401e0bb1
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
movups xmm0, xmmword [r14 + rcx*8 - 0x18]
lea rbx, [r12 - 1]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [r14 + rcx*8 - 8]
movsd qword [r14 + rax*8 + 0x10], xmm1
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x1401e0c13
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.1401c8a50
test al, al
je 0x1401e0c13
lea rax, [rbx + rbx*2]
mov rbx, rdi
movups xmm0, xmmword [rsi]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rsi + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x1401e0bd0
movups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
movups xmmword [r14 + rax*8], xmm0
movsd xmm1, qword [rbp + 0x10]
movsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401e23f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rsp + 0x70]
mov r14, rcx
mov rcx, rdx
mov qword [rsp + 0x50], r13
mov rdi, rdx
mov r12, rdx
lea rdx, [r8 - 1]
mov rbp, r9
mov r15, rdx
mov r13, r8
sar r15, 1
cmp rcx, r15
jge 0x1401e246a
lea rsi, [rcx + rcx]
mov rcx, rbx
lea rdx, [r14 + 0x10]
lea rdx, [rdx + rsi*8]
lea r8, [rdx - 8]
call fcn.1401ca930
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rsi
mov rax, qword [r14 + rcx*8]
mov qword [r14 + rdi*8], rax
mov rdi, rcx
cmp rcx, r15
jl 0x1401e2431
lea rdx, [r13 - 1]
cmp rcx, r15
jne 0x1401e2481
test r13b, 1
jne 0x1401e2481
mov rax, qword [r14 + r13*8 - 8]
mov qword [r14 + rdi*8], rax
mov rdi, rdx
mov r13, qword [rsp + 0x50]
cmp r12, rdi
jge 0x1401e24c6
nop dword [rax + rax]
lea rsi, [rdi - 1]
mov r8, rbp
sar rsi, 1
mov rcx, rbx
lea r15, [r14 + rsi*8]
mov rdx, r15
call fcn.1401ca930
test al, al
je 0x1401e24c6
mov rax, qword [r15]
mov qword [r14 + rdi*8], rax
mov rdi, rsi
cmp r12, rsi
jl 0x1401e2490
mov rax, qword [rbp]
mov qword [r14 + rsi*8], rax
jmp 0x1401e24ce
mov rax, qword [rbp]
mov qword [r14 + rdi*8], rax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401f46d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x1401f46db
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x26
syscall
ret

Function at 0x1401f46e6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x1401f6d44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rsi
call 0x14078d9b0
test rax, rax
je 0x1401f6d8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401f6d8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401f6d8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401f6d8e
cmp dword [rcx + 0x84], 0xe
jbe 0x1401f6d8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401f6d90
xor al, al
add rsp, 0x28
ret

Function at 0x140216cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x140216d48
je 0x140216d3f
mov eax, 0xc433
cmp ecx, eax
ja 0x140216d23
je 0x140216d3f
mov eax, ecx
sub eax, 0x2a
je 0x140216d3f
sub eax, 0xc402
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
cmp eax, 3
jmp 0x140216d3d
mov eax, ecx
sub eax, 0xc435
je 0x140216d3f
sub eax, 0x1263
je 0x140216d7b
sub eax, 0x812
je 0x140216d3f
cmp eax, 1
jne 0x140216d41
xor edx, edx
call 0x14088f7d6
int3
mov eax, ecx
sub eax, 0xdead
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 1
je 0x140216d3f
sub eax, 0x1f35
je 0x140216d3f
cmp eax, 1
jne 0x140216d41
and edx, 8
jmp 0x140216d41
Function at 0x1402293b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402293d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402293d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x415920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415aab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415985
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415994
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4159b3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4159c3
cmp rbx, 0x1000
jae 0x41598b
jmp 0x415a2d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4159d5
xor edx, edx
jmp 0x415a24
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4159b9
jmp 0x4159a8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00517d7d]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005183b5]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051af9a]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x415ae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415d06
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415b53
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415b62
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415b85
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415b95
cmp rbx, 0x1000
jae 0x415b59
nop
jmp 0x415c18
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415bad
xor esi, esi
jmp 0x415c0a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415b8b
jmp 0x415b76
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0064c938]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415ca0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x005183ce]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x005183b5]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00513f1f]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415c40
call sym.runtime.printlock
lea rax, [0x005183ce]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x005183b5]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051a7ec]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS