joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054270
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
mov dword [rsp - 0x2c], esp
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x1400894c8
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a6084]
cmp qword [0x1404a60e0], 0
mov dword [rsp - 0x24], 0x4dc3682b
jne 0x140088c10
syscall
ret

Function at 0x140054290
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088dd3
xchg rcx, rdi
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1404a5fdc]
cmp qword [0x1404a60e0], 0
mov dword [rsp - 0x14], esi
jne 0x140088c10
syscall
ret

Function at 0x1400542a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088dfd
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a5fe0]
mov r10, r10
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
ret

Function at 0x1400542b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e26
xchg r11, rcx
mov r10, r11
xchg rcx, r11
mov eax, dword [0x1404a5fe4]
mov r11, r11
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
mov r14, r14
ret

Function at 0x1400542c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e52
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a5fe8]
cmp qword [0x1404a60e0], 0
mov dword [rsp - 0x10], 0x3274590d
jne 0x140088c10
syscall
ret

Function at 0x1400542d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088daa
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a5fd8]
mov rdi, rdi
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
ret

Function at 0x1400542e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089332
mov r10, rcx
mov eax, dword [0x1404a605c]
mov dword [rsp - 0x28], 0x1978ffbf
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
ret

Function at 0x1400542f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e80
xchg rsi, r10
mov rsi, rcx
xchg rsi, r10
mov eax, dword [0x1404a5fec]
cmp qword [0x1404a60e0], 0
xchg r10, r10
jne 0x140088c10
syscall
ret

Function at 0x140054300
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d1d
xchg r15, r10
mov r15, rcx
xchg r10, r15
mov eax, dword [0x1404a5fcc]
mov dword [rsp - 0x3c], 0x37282e53
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
mov dword [rsp - 0x18], 0x1696e64d
ret

Function at 0x140054310
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088efc
xchg rsi, r10
mov rsi, rcx
xchg rsi, r10
mov eax, dword [0x1404a5ff8]
cmp qword [0x1404a60e0], 0
jne 0x140088c10
mov dword [rsp - 0x2c], 0x3632ec79
syscall
ret
Function at 0x140054340
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089521
add rsp, 0xfffffffffffffee0
lea rcx, [0x140088c7f]
nop
sub rsp, 8
mov qword [rsp], rcx
push rbp
mov rcx, rcx
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push qword [0x1404a60e8]
lea rsi, [rsp + 0x170]
mov dword [rsp - 0x30], 0x57d2b1c0
lea rdi, [rsp + 0x28]
mov ecx, 0x71e769c3
sub ecx, 0x20bde8a4
sub ecx, 0x36403172
add ecx, 0x368dbff7
sub ecx, 0x51770f94
rep movsq qword [rdi], qword [rsi]
mov dword [rsp - 0x18], 0xff18aa9
jmp qword [0x1404a60e0]
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a608c]
mov dword [rsp - 0x28], edi
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
mov dword [rsp - 0xc], 0x1bdd008f
ret

Function at 0x140054350
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d81
xchg rcx, r15
mov r10, r15
xchg r15, rcx
mov eax, dword [0x1404a5fd4]
xchg rbx, rbx
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
ret

Function at 0x140054360
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008949f
xchg rcx, r14
mov r10, r14
xchg rcx, r14
mov eax, dword [0x1404a6080]
cmp qword [0x1404a60e0], 0
jne 0x140088c10
xchg r9, r9
syscall
ret

Function at 0x140054370
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008944d
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a6078]
cmp qword [0x1404a60e0], 0
jne 0x140088c10
mov r10, r10
syscall
ret

Function at 0x140054380
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089476
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a607c]
cmp qword [0x1404a60e0], 0
jne 0x140088c10
mov rsi, rsi
syscall
ret

Function at 0x140054390
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d53
xchg r8, r10
mov r8, rcx
xchg r10, r8
mov eax, dword [0x1404a5fd0]
cmp qword [0x1404a60e0], 0
mov dword [rsp - 0x30], 0x22a5a289
jne 0x140088c10
syscall
ret

Function at 0x1400543a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088f2a
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a5ffc]
cmp qword [0x1404a60e0], 0
mov rsi, rsi
jne 0x140088c10
syscall
ret
Function at 0x1400579d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
xchg r11, rbx
mov qword [rax + 0x10], r11
xchg rbx, r11
push rdi
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x38], 0x2ac00f06
movabs rbx, 0x751530337bd79db4
sub rbx, 0x322bd918
add rbx, 0x2a36c548
xor rbx, 0x70f9affc
mov rdi, rcx
cmp qword [rcx + 0x30], rbx
jne 0x140057c2c
mov dword [rsp - 0x28], 0x2c1dd8e2
mov dword [rax - 0x48], 0xbb96df2
xor dword [rax - 0x48], 0x5c4391d2
xor dword [rax - 0x48], 0x7230f85a
add dword [rax - 0x48], 0x4aab79b5
sub dword [rax - 0x48], 0x70417e2c
xor r8d, r8d
mov dword [rsp - 0x34], 0x42d26507
mov dword [rax - 0x44], 0x2c4fde6a
add dword [rax - 0x44], 0x3e104b6a
xor dword [rax - 0x44], 0x410c4c4b
add dword [rax - 0x44], 0x214e638f
sub dword [rax - 0x44], 0x4c7dc864
mov dword [rax - 0x40], 0x5d18139d
add dword [rax - 0x40], 0x1bc99397
sub dword [rax - 0x40], 0x5eb0f52f
sub dword [rax - 0x40], 0x19f7b1d3
mov dword [rax - 0x3c], 0x6aa4f24
xor dword [rax - 0x3c], 0x2848b6c1
add dword [rax - 0x3c], 0x107f7b4a
sub dword [rax - 0x3c], 0x3ef474a0
mov dword [rax - 0x38], 0x79d2b76e
sub dword [rax - 0x38], 0x674c806c
sub dword [rax - 0x38], 0x970e1a2
xor dword [rax - 0x38], 0x57a1e406
xor dword [rax - 0x38], 0x5e80b10a
mov dword [rax - 0x34], 0x7cffb173
xor dword [rax - 0x34], 0x4eec5603
sub dword [rax - 0x34], 0x143066bc
xor dword [rax - 0x34], 0x4d88b8a1
xor dword [rax - 0x34], 0x505b38c5
mov qword [rsp + 0x70], r8
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x3c], 0x3b8e69e3
nop word [rax + rax]
xchg rcx, r14
mov r14, qword [rsp + 0x70]
xchg rcx, r14
mov rax, qword [rsp + 0x70]
and cl, 3
mov dword [rsp - 0x1c], edi
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x8e757eb
xor eax, 0x1ed8cc06
xor eax, 0xed9b570
add eax, 0x43d621a5
shr eax, cl
movzx ecx, al
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x2c], 0x59b459fa
xor cx, dx
mov word [rsp + rax*2 + 0x38], cx
xchg r13, rax
mov r13, qword [rsp + 0x70]
xchg r13, rax
inc rax
mov r8, r8
xchg r10, rax
mov qword [rsp + 0x70], r10
xchg r10, rax
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0xc], 0x52afa20
cmp rax, 0xc
jb 0x140057b05
xor edx, edx
mov word [rsp + 0x50], r8w
mov r13, r13
lea rcx, [rsp + 0x38]
call fcn.14007b690
xchg rdi, rdx
mov rdi, rax
xchg rdi, rdx
mov r8, rax
mov r10, r10
xor rdx, rbx
xor eax, eax
xchg rdx, rbx
mov qword [rdi + 0x30], rbx
xchg rbx, rdx
lea rdi, [rsp + 0x38]
mov ecx, 0x5cd0525a
sub ecx, 0x254b48e2
sub ecx, 0x98ab538
sub ecx, 0x2dfa5434
rep stosb byte [rdi], al
xchg rbx, rbx
cmp rdx, rbx
je 0x140057c34
lea rdx, [0x1404a5420]
mov dword [rsp - 0x28], 0x5ebbdf37
xchg rcx, r13
mov r13, r8
xchg rcx, r13
call fcn.14005f780
mov dword [rsp - 0x30], 0x48d9e0df
test al, al
setne al
xchg rbx, rdx
mov rdx, qword [rsp + 0x78]
xchg rdx, rbx
sub rsp, 0xffffffffffffffa0
mov dword [rsp - 0x30], 0x76608aa4
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x6c
sub al, 0x1e
sub al, 0x32
sub al, 0x1b
xchg r10, rbx
mov r10, qword [rsp + 0x78]
xchg rbx, r10
nop
sub rsp, 0x4bc768fe
add rsp, 0x4bc7695e
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140057c60
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffb0
movabs rbx, 0x7515303326e5cd96
xor rbx, 0x19d4847c
add rbx, 0x148e938d
xor rbx, 0x2edb5d20
xor rbx, 0x7e7fa64f
xchg rdi, r12
mov r12, rcx
xchg r12, rdi
cmp qword [rcx + 0x28], rbx
xchg rbx, rbx
jne 0x140057ea9
mov eax, 0xfde9273
xor eax, 0x58f8188c
add eax, 0x6dad1e8
sub eax, 0x4dc2d48f
xor eax, 0x103e8876
mov dword [rsp + 0x20], 0x19a5fb27
add dword [rsp + 0x20], 0x190b5c5
add dword [rsp + 0x20], 0x139aa28f
sub dword [rsp + 0x20], 0x2e95536e
mov word [rsp + 0x30], ax
xor r8d, r8d
mov dword [rsp - 0x44], esi
mov dword [rsp + 0x24], 0x45588537
xor dword [rsp + 0x24], 0x384fce41
sub dword [rsp + 0x24], 0x1cbfd62c
sub dword [rsp + 0x24], 0x1512fe5c
xor dword [rsp + 0x24], 0x4b2b7637
mov dword [rsp + 0x28], 0x39de62c2
sub dword [rsp + 0x28], 0xa5c8cce
sub dword [rsp + 0x28], 0x2827b2ca
xor dword [rsp + 0x28], 0x724235a
mov dword [rsp + 0x2c], 0x49fe44de
add dword [rsp + 0x2c], 0x31b3e503
xor dword [rsp + 0x2c], 0x3bfd8443
sub dword [rsp + 0x2c], 0x401facca
xchg r8, r9
mov qword [rsp + 0x60], r9
xchg r9, r8
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
xchg rcx, rsi
mov rsi, qword [rsp + 0x60]
xchg rcx, rsi
xchg rcx, rax
mov rcx, qword [rsp + 0x60]
xchg rcx, rax
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov dword [rsp - 0x3c], 0x6bf6a86a
mov eax, 0x5cb18d1
xor eax, 0x30952058
add eax, 0x38dfd7ff
xor eax, 0x675f11df
add eax, 0x535b4eeb
shr eax, cl
movzx ecx, al
xchg r14, r14
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
inc rax
xchg r11, r11
mov qword [rsp + 0x60], rax
xchg rcx, rax
mov rcx, qword [rsp + 0x60]
xchg rcx, rax
cmp rax, 9
jb 0x140057d79
mov r9, r9
xor edx, edx
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
call fcn.14007b690
mov dword [rsp - 0x34], 0x4fc8241e
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r13, r8
mov r13, rax
xchg r8, r13
xor rdx, rbx
mov dword [rsp - 0x28], esp
xor eax, eax
xchg r9, rdx
mov qword [rdi + 0x28], r9
xchg rdx, r9
lea rdi, [rsp + 0x32]
mov dword [rsp - 0x18], 0x28a15363
mov ecx, 0x69c01e3f
sub ecx, 0x1d502d77
add ecx, 0xb727d68
sub ecx, 0x3fe7acf3
xor ecx, 0x17fac134
rep stosb byte [rdi], al
mov r10, r10
cmp rdx, rbx
je 0x140057eb1
lea rdx, [0x1404a55a0]
mov dword [rsp - 0x44], esi
xchg rcx, rsi
mov rsi, r8
xchg rsi, rcx
call fcn.14006a720
mov dword [rsp - 0x10], 0x679b10e8
test al, al
setne al
xchg rbx, r14
mov r14, qword [rsp + 0x68]
xchg rbx, r14
add rsp, 0x50
xchg rsi, rsi
pop rdi
ret
mov al, 0x1e
sub al, 0xa
xor al, 0x3d
sub al, 0x28
mov rbx, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffb0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140057ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x7515303375bebaa4
sub rbx, 0x323baa74
xor rbx, 0x3d8f4fba
sub rbx, 0xacf772b
sub rbx, 0x7021c247
xchg r13, rdi
mov r13, rcx
xchg r13, rdi
cmp qword [rcx + 0x38], rbx
mov dword [rsp - 0x24], esi
jne 0x140058119
xor r8d, r8d
mov dword [rsp + 0x20], 0x79275ec1
sub dword [rsp + 0x20], 0x27b77f5e
xor dword [rsp + 0x20], 0x6d48a95b
sub dword [rsp + 0x20], 0x3823d62f
xor dword [rsp + 0x20], 0x423a019
mov dword [rsp + 0x24], 0x3d63a8e6
sub dword [rsp + 0x24], 0x287f9721
add dword [rsp + 0x24], 0x508374b6
xor dword [rsp + 0x24], 0x654986a4
mov dword [rsp + 0x28], 0xd70dae4
add dword [rsp + 0x28], 0x5c3b0d07
xor dword [rsp + 0x28], 0x4c8afbbb
sub dword [rsp + 0x28], 0x24bd1c1a
mov dword [rsp + 0x2c], 0x3b097f56
xor dword [rsp + 0x2c], 0x658b309a
xor dword [rsp + 0x2c], 0x11eb060a
sub dword [rsp + 0x2c], 0x4f314934
mov dword [rsp + 0x30], 0x2e344ef3
sub dword [rsp + 0x30], 0x916cd91
add dword [rsp + 0x30], 0x1f124ee7
xor dword [rsp + 0x30], 0x4413d067
xchg r8, r13
mov qword [rsp + 0x60], r13
xchg r8, r13
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
nop word [rax + rax]
xchg rcx, r9
mov r9, qword [rsp + 0x60]
xchg r9, rcx
mov rax, qword [rsp + 0x60]
mov rbx, rbx
and cl, 3
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x15c1fd27
xor eax, 0x676d1ba7
sub eax, 0x6a0ec08e
xor eax, 0x44416fd5
xor eax, 0x10631a65
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x10], 0x5970fea1
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
xor cx, dx
mov dword [rsp - 0x24], ebx
mov word [rsp + rax*2 + 0x34], cx
xchg r12, rax
mov r12, qword [rsp + 0x60]
xchg r12, rax
inc rax
xchg r9, r9
xchg r10, rax
mov qword [rsp + 0x60], r10
xchg r10, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x60]
xchg rbx, rax
cmp rax, 0xa
jb 0x140057fee
mov rsi, rsi
xor edx, edx
mov word [rsp + 0x48], r8w
lea rcx, [rsp + 0x34]
mov dword [rsp - 0x14], ebx
call fcn.14007b690
xchg r8, rax
mov rdx, r8
xchg r8, rax
xchg r14, r8
mov r14, rax
xchg r8, r14
xor rdx, rbx
xor eax, eax
mov qword [rdi + 0x38], rdx
mov dword [rsp - 0x1c], 0x7bccf47c
lea rdi, [rsp + 0x34]
mov ecx, 0x4710077
add ecx, 0x682cab3a
sub ecx, 0x12f6f7ea
xor ecx, 0x608c9526
xor ecx, 0x392a26eb
rep stosb byte [rdi], al
cmp rdx, rbx
je 0x140058121
mov dword [rsp - 0x10], esp
lea rdx, [0x1404a55d0]
xchg rsi, r8
mov rcx, rsi
xchg r8, rsi
call fcn.14006ace0
xchg r13, r13
test al, al
setne al
xchg rbx, rcx
mov rcx, qword [rsp + 0x68]
xchg rcx, rbx
nop
sub rsp, 0x197c47ec
add rsp, 0x197c483c
pop rdi
xchg r15, r15
ret
mov al, 0x61
add al, 0x13
xor al, 0x62
xor al, 0x17
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg rbx, r13
nop
sub rsp, 0x76146db8
add rsp, 0x76146e08
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140058150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x50
movabs rbx, 0x7515303337fdd184
sub rbx, 0xb461551
xor rbx, 0x6222140
sub rbx, 0x277a775b
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
cmp qword [rcx + 0x20], rbx
jne 0x14005839e
mov eax, 0x7bdc747f
sub eax, 0x67d1d7bd
xor eax, 0x3fae6c74
add eax, 0x1d472cda
sub eax, 0x48ec1cc0
mov dword [rsp + 0x20], 0x6d184e7b
sub dword [rsp + 0x20], 0x1b2c3c68
xor dword [rsp + 0x20], 0x22608414
xor dword [rsp + 0x20], 0x6d0eaa59
xor dword [rsp + 0x20], 0x1eba3c4f
mov word [rsp + 0x34], ax
mov r8, r8
xor r8d, r8d
mov dword [rsp + 0x24], 0xe55dae2
add dword [rsp + 0x24], 0x1d05726e
add dword [rsp + 0x24], 0x43a5967b
sub dword [rsp + 0x24], 0x6ed0e2f2
mov dword [rsp + 0x28], 0x40ad3a94
add dword [rsp + 0x28], 0x1ffc4f3b
sub dword [rsp + 0x28], 0x1e651c6a
sub dword [rsp + 0x28], 0x41e16d37
mov dword [rsp + 0x2c], 0x35c4c239
xor dword [rsp + 0x2c], 0x150e1d8d
sub dword [rsp + 0x2c], 0x2f49874
sub dword [rsp + 0x2c], 0x1d6446b2
mov dword [rsp + 0x30], 0x732b3835
sub dword [rsp + 0x30], 0x19e61bc8
xor dword [rsp + 0x30], 0x13a09f65
sub dword [rsp + 0x30], 0xe34651b
xor dword [rsp + 0x30], 0x3c8d1dcb
xchg r9, r8
mov qword [rsp + 0x60], r9
xchg r9, r8
mov rax, qword [rsp + 0x60]
mov r15, r15
xchg rcx, rbx
mov rbx, qword [rsp + 0x60]
xchg rcx, rbx
mov rax, qword [rsp + 0x60]
mov rbp, rbp
and cl, 3
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x20]
xchg rsi, rsi
mov eax, 0x3194e34e
add eax, 0x48755cd9
sub eax, 0x222fccff
xor eax, 0x129bbefc
xor eax, 0x19fd9d96
shr eax, cl
mov r14, r14
movzx ecx, al
mov rax, qword [rsp + 0x60]
xor cx, dx
mov dword [rsp - 0x34], ecx
mov word [rsp + rax*2 + 0x36], cx
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
mov dword [rsp - 0x34], esi
mov rax, qword [rsp + 0x60]
cmp rax, 0xb
jb 0x14005827b
xor edx, edx
mov dword [rsp - 0x3c], 0x5f4d1c35
mov word [rsp + 0x4c], r8w
lea rcx, [rsp + 0x36]
call fcn.14007b690
mov dword [rsp - 0x3c], 0x4a51a0d0
xchg rdx, rbp
mov rbp, rax
xchg rbp, rdx
xchg rdx, rax
mov r8, rdx
xchg rdx, rax
xor rdx, rbx
mov r11, r11
xor eax, eax
xchg rdx, r14
mov qword [rdi + 0x20], r14
xchg rdx, r14
lea rdi, [rsp + 0x36]
mov ecx, 0x42a6ddc5
add ecx, 0x369a55d7
sub ecx, 0x2e199f51
xor ecx, 0x4b279440
rep stosb byte [rdi], al
mov rdi, rdi
cmp rdx, rbx
je 0x1400583a8
lea rdx, [0x1404a5890]
xchg rsp, r8
mov rcx, rsp
xchg r8, rsp
call fcn.14006b150
test al, al
mov dword [rsp - 0x2c], edx
setne al
xchg r12, rbx
mov r12, qword [rsp + 0x68]
xchg rbx, r12
nop
add rsp, 0xd24e7b5
sub rsp, 0xd24e765
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x19
xor al, 0x2f
sub al, 5
add al, 0x19
xor al, 0x4b
xchg rbx, r8
mov r8, qword [rsp + 0x68]
xchg r8, rbx
neg rsp
add rsp, 0xffffffffffffffb0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140073560
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
add rsp, 0x6edf8417
sub rsp, 0x6edf8427
mov dword [rsp + 0x20], 0x133133fb
xor dword [rsp + 0x20], 0x1194d6a
add dword [rsp + 0x20], 0x4388dbd1
mov r8, rcx
mov byte [rsp + 0x24], 0x17
add byte [rsp + 0x24], 0x67
sub byte [rsp + 0x24], 0x51
add byte [rsp + 0x24], 0x21
mov qword [rsp + 0x28], 0x744804c5
sub qword [rsp + 0x28], 0x5b8ee484
xor qword [rsp + 0x28], 0x18b92041
mov rax, qword [rsp + 0x28]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0x24a3690
xor edx, 0x921145e
add edx, 0x2b3b2598
xor edx, 0x6a1a1824
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 5
jb 0x1400735cc
cmp byte [r8], 0
pushf
mov byte [rsp + 7], 0x35
xor byte [rsp + 7], 0x58
xor byte [rsp + 7], 0x6d
popf
je 0x140073682
movzx edi, byte [rsp]
nop word [rax + rax]
lea rcx, [rsp]
test dil, dil
je 0x140073685
movzx edx, byte [r8]
movzx eax, dil
lea rcx, [rcx + 1]
cmp dl, al
je 0x140073675
movzx eax, byte [rcx]
test al, al
jne 0x140073659
jmp 0x140073685
inc r8
cmp byte [r8], 0
jne 0x140073644
xor r8d, r8d
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x70c3b5bf
sub ecx, 0x3cd045b0
sub ecx, 0x33f3700a
rep stosb byte [rdi], al
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x1400736b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
nop
sub rsp, 0x57708dc7
add rsp, 0x57708db7
xor r8d, r8d
movzx edi, cl
mov dword [rsp + 0x20], r8d
cmp cl, 0x2c
je 0x14007387b
mov dword [rsp + 0x28], 0x7d784169
sub dword [rsp + 0x28], 0x3eb5401f
add dword [rsp + 0x28], 0x16ee5918
mov byte [rsp + 0x2c], 0x6d
sub byte [rsp + 0x2c], 0x15
sub byte [rsp + 0x2c], 0x38
xor byte [rsp + 0x2c], 0x6e
mov qword [rsp + 0x30], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov edx, 0x59dbb571
xor edx, 0x65b45100
sub edx, 0x1cfb4e25
xor edx, 0x43c8c60e
mov rax, qword [rsp + 0x30]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x28]
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 3], dl
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, 5
jb 0x14007370b
movzx eax, byte [rsp + 3]
lea rcx, [rsp + 3]
mov byte [rsp + 8], r8b
test al, al
je 0x14007378c
lea rcx, [rcx + 1]
cmp dil, al
je 0x140073860
movzx eax, byte [rcx]
test al, al
jne 0x140073774
mov word [rsp + 0x20], 0x38d
add word [rsp + 0x20], 0x5082
sub word [rsp + 0x20], 0x4679
sub word [rsp + 0x20], 0x57
mov qword [rsp + 0x28], r8
mov rax, qword [rsp + 0x28]
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
mov edx, 0xf126c38
xor edx, 0x4cfbe354
add edx, 0x5b76040
xor edx, 0x151cbfee
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x1400737bc
movzx eax, byte [rsp]
lea rcx, [rsp]
mov byte [rsp + 2], r8b
test al, al
je 0x14007383e
nop dword [rax]
lea rcx, [rcx + 1]
cmp dil, al
je 0x1400738ee
movzx eax, byte [rcx]
test al, al
jne 0x140073826
xor dl, dl
mov r8d, 0x58bcc113
add r8d, 0xfa1be12
sub r8d, 0x36f1be81
sub r8d, 0x316cc0a1
jmp 0x140073883
mov r8d, 0x5a7d7b25
add r8d, 0x1984ba00
sub r8d, 0x350d9e03
xor r8d, 0x3ef49723
mov dl, 0x30
add dl, 0x3b
sub dl, 0x6a
test r8b, 2
je 0x1400738b0
and r8d, 0xfffffffd
lea rdi, [rsp]
xor eax, eax
mov ecx, 0x79ebd32b
xor ecx, 0x1a352df6
sub ecx, 0x459a4ea5
xor ecx, 0x1e44b03a
rep stosb byte [rdi], al
test r8b, 1
je 0x1400738da
lea rdi, [rsp + 3]
xor eax, eax
mov ecx, 0x6e50083d
sub ecx, 0x27374505
add ecx, 0x4788c15
xor ecx, 0x4b914f48
rep stosb byte [rdi], al
movzx eax, dl
nop
sub rsp, 0x43145272
add rsp, 0x43145282
pop rdi
ret
mov r8d, 0x1c620a57
xor r8d, 0x24b6e5a4
sub r8d, 0x38d4eff0
jmp 0x14007387b
Function at 0x1400744b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x10
mov word [rsp + 0x20], 0x6be3
sub word [rsp + 0x20], 0xf8b
add word [rsp + 0x20], 0x16d9
xor word [rsp + 0x20], 0x7e0e
mov r8, rcx
mov qword [rsp + 0x28], 0x4a4a5cde
sub qword [rsp + 0x28], 0x44d92157
sub qword [rsp + 0x28], 0x5713b87
mov rax, qword [rsp + 0x28]
nop
mov rcx, qword [rsp + 0x28]
mov edx, 0x51819f1c
add edx, 0x17783036
add edx, 0x31fb40f
xor edx, 0x30a5d323
mov rax, qword [rsp + 0x28]
and cl, 3
shl cl, 3
shr edx, cl
xor dl, byte [rsp + rax + 0x20]
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax], dl
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, 2
jb 0x1400744f7
movzx eax, byte [rsp]
lea rcx, [rsp]
movzx edx, byte [r8]
mov byte [rsp + 2], 0x76
sub byte [rsp + 2], 0xd
xor byte [rsp + 2], 0x69
test al, al
je 0x140074582
lea rcx, [rcx + 1]
cmp dl, al
je 0x1400745be
movzx eax, byte [rcx]
test al, al
jne 0x14007456b
xor dl, dl
xor eax, eax
lea rdi, [rsp]
mov ecx, 0x44cf5271
sub ecx, 0x13930661
add ecx, 0x29c18876
xor ecx, 0x5afdd484
rep stosb byte [rdi], al
test dl, dl
jne 0x1400745ce
mov byte [r8], al
lea rax, [r8 + 1]
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
mov dl, 0x3c
add dl, 5
add dl, 0x22
sub dl, 0x62
jmp 0x140074584
mov rax, r8
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
pop rdi
ret
Function at 0x1400746d0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbp
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg rsi, r13
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x10], 0x6a241810
nop
sub rsp, 8
mov qword [rsp], r14
nop
add rsp, 0x110975ee
sub rsp, 0x1109760e
movsxd rbx, dword [rcx + 0x3c]
mov rbx, rbx
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg rcx, r11
mov rsi, r11
xchg rcx, r11
mov edx, dword [rbx + rcx + 0xb0]
mov r14, r14
call fcn.140076770
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov dword [rsp - 0x24], 0xfa0eb72
mov ebp, dword [rbx + rsi + 0xb4]
xchg r10, rax
mov r11, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x24], 0x6e6a8dbf
je 0x1400748d4
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
xchg r14, r14
mov r9d, dword [r11]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x44], 0x75f91bac
movzx eax, word [rcx + rsi + 0x14]
movzx r10d, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, r10w
mov dword [rsp - 0x40], 0x21af49b9
jae 0x1400747f5
mov eax, dword [rdx + 8]
test eax, eax
mov rdx, rdx
jne 0x1400747b7
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
mov dword [rsp - 0x44], ebx
cmp r9d, ecx
jb 0x1400747d5
add eax, ecx
xchg rdi, rdi
cmp r9d, eax
jb 0x140074865
inc r8w
neg rdx
add rdx, 0xffffffffffffffd8
neg rdx
cmp r8w, r10w
mov dword [rsp - 0x28], 0x36e2d458
jb 0x1400747a6
xchg r14, r8
mov r14, r8
xchg r14, r8
mov eax, dword [r11 + 4]
lea rdx, [r11 + 8]
xchg r12, r12
nop
sub rax, 0x166a4933
add rax, 0x166a492b
shr rax, 1
test eax, eax
xchg rdi, rdi
je 0x1400748bb
mov r9d, eax
nop word [rax + rax]
movzx eax, word [rdx]
mov rbp, rbp
mov ecx, eax
shr ecx, 9
shr ecx, 3
cmp ecx, 3
mov r9, r9
je 0x14007488e
cmp ecx, 0xa
jne 0x14007489f
xchg r15, r15
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x14007489f
test rdx, rdx
je 0x1400747f5
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0xc], 0x554f8444
mov eax, dword [rdx + 0xc]
sub r8, rax
add r8, rsi
add r8, r9
mov r8, r8
jmp 0x1400747fe
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0x28], 0x3ed3ba83
nop
sub rdx, 0x3386d932
add rdx, 0x3386d934
sub r9, 1
mov r8, r8
jne 0x140074831
add ebx, dword [r11 + 4]
xchg r9, rdx
mov r11, r9
xchg rdx, r9
cmp ebx, ebp
jb 0x140074769
mov dword [rsp - 0x14], esi
mov rbx, qword [rsp + 0x30]
xchg rbp, r11
mov r11, qword [rsp + 0x38]
xchg r11, rbp
xchg rsi, rdi
mov rdi, qword [rsp + 0x40]
xchg rdi, rsi
xchg rdi, r12
mov r12, qword [rsp + 0x48]
xchg r12, rdi
add rsp, 0x20
mov dword [rsp - 0x10], ebx
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret