joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61cc8380
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
lea rcx, [0x61cd7260]
mov rdi, rdx
mov rsi, r8
mov r12, r9
call sym.libintl_8.dll_libintl_lock_lock_func
test eax, eax
jne 0x61cc8599
mov rbx, qword [0x61ce0320]
test rbx, rbx
je 0x61cc83f4
mov rdx, rbx
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x61cc8570
mov rcx, qword [0x61ce0328]
test rcx, rcx
je 0x61cc83ec
call sub.msvcrt.dll_fclose
mov rbx, qword [0x61ce0320]
mov qword [0x61ce0328], 0
mov rcx, rbx
call fcn.61cd60f0
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sub.msvcrt.dll_malloc
test rax, rax
mov qword [0x61ce0320], rax
je 0x61cc854f
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [0x61cdb677]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
mov qword [0x61ce0328], rax
je 0x61cc854f
lea rcx, str.domain
mov r9, rbx
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r8, [rdi + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.61cc82a0
mov edx, 4
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
mov rdi, rax
je 0x61cc84ba
lea rcx, str._nmsgctxt
mov r9, rbx
mov r8d, 9
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rsi
lea rsi, [rdi + 1]
mov r8, rdi
mov rcx, rbx
call fcn.61cc82a0
lea rcx, str._nmsgid
mov r9, rbx
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea r8, [rsi + rax]
mov rdx, rsi
mov rcx, rbx
call fcn.61cc82a0
mov eax, dword [rsp + 0x70]
mov r9, rbx
test eax, eax
je 0x61cc8580
lea rcx, str._nmsgid_plural
mov r8d, 0xe
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_strlen
lea r8, [r12 + rax]
mov rdx, r12
mov rcx, rbx
call fcn.61cc82a0
lea rcx, str._nmsgstr_0_____n
mov r9, rbx
mov r8d, 0xe
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rbx
mov ecx, 0xa
call sub.msvcrt.dll_putc
lea rcx, [0x61cd7260]
call sym.libintl_8.dll_libintl_lock_unlock_func
test eax, eax
jne 0x61cc8599
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbx, qword [0x61ce0328]
jmp 0x61cc8448
lea rcx, str._nmsgstr____n
mov r8d, 0xb
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x61cc8542
call sub.msvcrt.dll_abort
nop
nop

Function at 0x61ccadb0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov edx, 0x24
mov rcx, rbx
mov rsi, r8
call sub.msvcrt.dll_strchr
test rax, rax
je 0x61ccae40
lea rdx, [rsp + 0x28]
mov r8, rbx
xor ecx, ecx
mov r9, rsi
call sym.libintl_8.dll_libintl_vasnprintf
test rax, rax
mov rbx, rax
je 0x61ccae13
mov r8, qword [rsp + 0x28]
mov r9, rdi
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
mov rsi, rax
call fcn.61cd60f0
cmp rsi, qword [rsp + 0x28]
je 0x61ccae20
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
cmp rsi, 0x7fffffff
mov eax, esi
jbe 0x61ccae18
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x84
jmp 0x61ccae13
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_vfprintf
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x61ccae90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
mov r8, rsi
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.libintl_8.dll_libintl_vfprintf

Function at 0x61ccf070
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.mlang.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x61ccf10b
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertINetString
mov rcx, rbx
call rsi
lea rdx, str.ConvertINetMultiByteToUnicode
mov rcx, rbx
mov qword [0x61ce0348], rax
call rsi
lea rdx, str.ConvertINetUnicodeToMultiByte
mov rcx, rbx
mov qword [0x61ce0340], rax
call rsi
lea rdx, str.IsConvertINetStringAvailable
mov rcx, rbx
mov qword [0x61ce0338], rax
call rsi
lea rdx, str.LcidToRfc1766A
mov rcx, rbx
mov qword [0x61ce0350], rax
call rsi
lea rdx, str.Rfc1766ToLcidA
mov qword [0x61ce0358], rax
mov rcx, rbx
call rsi
mov qword [0x61ce0360], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x61cd0250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x61ce03a0]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x61cd0430
mov rax, qword [0x61ce0398]
xor ebx, ebx
nop
mov r9, qword [rax + 8]
cmp rsi, r9
jb 0x61cd029c
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 8]
add r9, rdx
cmp rsi, r9
jb 0x61cd0370
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x61cd0280
mov rcx, rsi
call fcn.61cd11c0
test rax, rax
mov r12, rax
je 0x61cd0454
movsxd rbx, ebx
lea r13, [rsp + 0x30]
lea r14, [rbx + rbx*2]
mov rbx, qword [0x61ce0398]
shl r14, 3
add rbx, r14
mov qword [rbx + 0x10], rax
mov dword [rbx], 0
call fcn.61cd12a0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r13
mov qword [rbx + 8], rax
mov rax, qword [0x61ce0398]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r14 + 8]
call rbx
test rax, rax
je 0x61cd0437
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x61cd03e5
add dword [0x61ce03a0], 1
mov r8d, 0x30
mov rdx, r13
mov rcx, rsi
call rbx
test rax, rax
je 0x61cd0463
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x61cd0380
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r13, [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x61cd032b
cmp eax, 0x40
je 0x61cd034b
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x61cd03d6
cmp eax, 4
je 0x61cd03d6
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbx
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0x40
je 0x61cd0324
mov r9, qword [0x61ce0398]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add r9, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x61cd0324
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.61cd01f0
nop word [rax + rax]
xor ebx, ebx
jmp 0x61cd02a7
mov rax, qword [0x61ce0398]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r14 + 8]
call fcn.61cd01f0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.61cd01f0
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.61cd01f0
nop
nop dword [rax + rax]
Function at 0x61cd0e80
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x61ce0c00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x61ce0c28]
test rbx, rbx
je 0x61cd0ed4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x61cd0ecb
test rsi, rsi
je 0x61cd0ecb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x61cd0eb0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x61ce0c00]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x61cd10b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x61cd10c0
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x61cd10b9
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x61cd10e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x61cd1120
lea ecx, [rcx - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x61cd1117
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x61cd1122
add rax, 0x28
cmp rax, r9
jne 0x61cd1104
xor eax, eax
repz ret

Function at 0x61cd11c0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x61cc0000]
call fcn.61cd10b0
test eax, eax
je 0x61cd11f0
lea rcx, [0x61cc0000]
mov rdx, rbx
sub rdx, rcx
add rsp, 0x20
pop rbx
jmp fcn.61cd10e0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001f6d4
Capabilities:
Encode data using xor

Disassembly:
add bh, al
and al, 0xd0
movabs eax, dword [0x378e92a94a7]
dec ecx
lea r9d, [rcx + 0x3214]
jo 0x14001ecd1
sub edx, 0x7a435de0
lea r11d, [rdx - 0x23f9]
rcr r9d, 0x56
lea r8d, [rdi + 0xc8b8]
cmp rdi, rcx
movabs rdx, 0x77a4c5ffffff31e9
test r15, rdi
jmp rcx

Function at 0x140023cdf
Capabilities:
Encode data using xor

Disassembly:
and al, 0xc8
invalid
jne 0x140023a41
movabs rdi, 0x6d9276fffff280e9
lea r12d, [rbp + 0xb6d6]
pushfq
jne 0x140022a4c
call fcn.14002349c
invalid
jne 0x140023d64
je 0x140023d64
call fcn.140023acc
add rsp, 0x48
pop rcx
ret
pop rcx
jmp 0x1400241fc
mov rcx, r14
mov rcx, rcx
mov dword [rsp - 0x24], 0x36ff9d2a
mov dword [rsp - 0x28], 0x604b59a6
mov dword [rbp + 0x20], ebx
call fcn.1400f06a0
mov rsi, rax
jmp 0x140023d75
pop r10
mov rdi, qword [rcx + 0x60]
mov rcx, r14
call fcn.1400f7340
je 0x140023ce2
jne 0x140023ce2
test r14, rbp
ror esi, 0x91
call rax
pop r8
mov edi, 0x7140c8f8
movabs rbx, 0x5ed47200000777e9
jae 0x140022efe
jmp 0x14002445e
dec r11
call fcn.140024379
lea rdx, [rbp + 0x28]
mov dword [rsp - 0x2c], 0x31931ee1
mov dword [rsp - 0xc], ebx
push rcx
movabs rcx, 0x1c4a0efffffdb8e9
jmp 0x140023b0a
jmp 0x140023b21
mov rcx, qword [rax]
mov rdi, rdi
push r10
movabs r10, 0x74b738ffffff3be9
je 0x140023da1
jmp 0x140023cbf
jne 0x140023da1
sub r13d, 0x84e3e154
bswap r15
cmp rdx, rcx
test r10d, 0xb5b2750e
movabs r10, 0x4e17490000078ee9
rcr edi, 0x4e
ret 0x28
jmp 0x140024534
call fcn.1400f0f70
xchg rdi, rdi
mov dword [rsp - 0x30], 0x6967c3a8
mov ecx, dword [rax + 4]
mov dword [rbp + 0x24], ecx
jmp 0x140023c17
mov dword [rsp - 0x20], 0x10fba339
lea rdx, [rbp + 0x30]
mov rcx, r14
mov ebx, dword [rax + 4]
jmp 0x140023de6
mov dword [rsp - 0x34], 0x3314b1ad
xchg r13, r13
call fcn.1400f0f70
xor r15d, r15d
jmp 0x140023d51
xor ebx, 0x74376334
mov dword [rsp - 0x2c], 0x135f6a9f
mov dword [rsp - 0x3c], ebp
xchg rdi, rdi
jmp 0x1400240bd
mov r9d, ebx
mov qword [rsp + 0x40], rsi
mov rcx, r14
mov dword [rsp - 0x1c], 0xaee44d8
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
call fcn.1400f0f70
jmp 0x140024036
mov rdx, rdx
mov qword [rsp + 0x60], rbx
lea rdx, [rbp + 0x28]
jmp 0x140024340
invalid
lea rdx, [rbp + 0x30]
invalid
invalid

Function at 0x140026e2f
Capabilities:
Encode data using xor

Disassembly:
xchg esp, esp
add byte [rax], al
add byte [rcx - 0x3f], al
int 0x81
movabs r10, 0x30b598fffffbbde9
rcl edx, 0xd1
pause
jnp 0x14002604c
lea esi, [rdi + 0x1259]
call 0x14002746c
Function at 0x14002c5de
Capabilities:
Encode data using xor

Disassembly:
mov r12, r12
mov dword [rsp - 0x20], 0x546d4710
test rax, rax
je 0x14002bd84
mov rcx, qword [rdi + 0x10f0]
jmp 0x14002ba7c
cmp rax, rcx
mov r8, r8
jb 0x14002bd78
jmp 0x14002bca1
add rcx, qword [rdi + 0x10f8]
mov qword [rdi + 0x10f0], rcx
imul rcx, rcx, 0x2a0
mov dword [rsp - 0x10], 0x335ea245
call fcn.140099d10
mov r14, rax
jmp fcn.14002b9c8
fcomp dword [rax + 0x4863dca5]
mov ecx, ecx
mov dword [rsp - 0x38], ebp
cmp rsi, qword [rbp + 0x440]
jb 0x14002b973
mov rax, qword [rdi + 0x10e8]
mov dword [rsp - 0x10], 0x5c89f2c0
jmp 0x14002ba21
mov r14, qword [rdi + 0x10e0]
jmp fcn.14002bedf
mov r14, qword [rdi + 0x10e0]
test r14, r14
jne fcn.14002bedf
jmp 0x14002c052
mov dword [rsp - 0x3c], 0x59700d2b
mov rdx, rdx
mov rbx, rbx
mov dword [rsp - 0x24], 0x4f5662d1
mov r14, rax
mov qword [rdi + 0x10e0], rax
jmp fcn.14002bedf
mov dword [rsp - 0x18], 0x2976dd99
mov dword [rsp - 0x38], 0x466484df
mov dword [rsp - 0x2c], 0x7a3d1f59
mov rax, qword [rdi + 0x10f8]
imul rcx, rax, 0x2a0
jmp 0x14002c0c0
mov qword [rdi + 0x10f0], rax
call fcn.140099d10
mov dword [rsp - 0x3c], 0x7b7ce114
jmp 0x14002bdba
out 0x48, al
bswap ebx
popfq
rcr r13d, 0x97
cmp esi, 0x9c23f666
pushfq
call rax
cmp esi, 0x8f1100a6
rcr ebx, 0xb7
jnp 0x14002bd4b
cmp edi, 0x54c89ea0
movabs rdi, 0x2cd0eb3a4a0a23eb
lea esi, [rbx + 0x9651]
popf
rcl ecx, 0x4b
test r14d, 0x6b54aa72
lea edi, [rdi + 0xfcef]
call rcx
ret 0x28
jmp 0x14002c54e
jns 0x14002c57c
call fcn.14002bdf3

Function at 0x14002cff3
Capabilities:
Execute syscall

Disassembly:
and al, 0xdc
popfq
lea ebp, [rdx - 0x9842]
ja 0x14002c0eb
mul rdx
lea r9d, [rcx - 0x41e0]
movabs r10, 0x5608d7fffffdc3e9
jb 0x14002dcb7
syscall
mul r13
ret 0x30

Function at 0x14002e6e0
Capabilities:
Execute syscall

Disassembly:
lea edi, [rcx + 0xe259]
or r12d, 0x637945d0
syscall
ret 0x30
Function at 0x140030c6f
Capabilities:
Execute syscall

Disassembly:
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x28], ecx
mov dword [rsp - 0x44], 0x585e59cc
mov dword [rsp - 0xc], 0xd970d5a
mov dword [rsp - 0x2c], 0x1076fda7
mov dword [rsp - 0x34], 0x618f660a
mov rbp, rbp
je 0x140030a0f
jne 0x140030a0f
jge 0x14003162c
call rcx
call rcx
rcr r15d, 0x3c
lea r15d, [rbx - 0x2d08]
lea r10d, [rbx - 0xb6e5]
jmp rcx
jmp 0x140030b77
xchg rdx, rdx
mov dword [rsp - 0x1c], 0x17e83fc8
mov dword [rsp - 0x14], 0x22db0b71
xchg r8, r8
mov dword [rsp - 0x1c], 0x211b91df
jmp 0x140030c83
ret
pop rsi
xor cx, dx
mov word [r8 + rax*2], cx
mov rax, qword [rbp + 0x10]
mov rcx, rcx
jmp 0x140030c5d
call 0x140030c6f
add rsp, 0x50
pop rsi
jmp 0x140030a90
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
jmp 0x140030c06
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x40], 0x499c017e
cmp rax, 0x24
jb 0x140030cea
mov rbx, qword [rsp + 0x68]
mov rax, r8
mov dword [rsp - 0x44], 0x4e59b69a
jmp 0x140030c97
mov r11, r11
mov eax, 0x2eaf52b3
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
jne 0x140030c1f
je 0x140030c1f
jmp rcx
jmp 0x140030a6d
mov dword [rsp - 0x28], ecx
mov r14, r14
mov dword [rsp - 0x1c], 0x4624bd00
mov rsi, rsi
jmp 0x140030c74
mov r13, r13
inc rax
mov qword [rbp + 0x10], rax
jmp 0x140030b87
push rsi
movabs rsi, 0x67b90ffffffe06e9
jne 0x140030c86
jmp 0x140030a91
je 0x140030c86
jmp 0x140030b12
mov dword [rsp - 0x38], 0x2dc3eca4
mov word [r8 + 0x48], r9w
add rsp, 0x50
pop rbp
mov rdi, rdi
mov dword [rsp - 0x1c], 0x1c9436e2
ret
mov rcx, qword [rbp + 0x10]
jmp 0x1400309b1
sti
adc dword [rsi - 0x64], esp
movabs r10, 0x21800dffffff74e9
inc r10
call rax
ror ebx, 0x76
jg 0x140031d05
rcl r8d, 0x62
call rcx
syscall
bswap r15
test edi, 0x92c7920d
ret
invalid
add eax, dword [rax]
add bh, al
and al, 0xec
jg 0x140031cc7
cdq
je 0x140031cd8
and al, 0xc0
xor ecx, ecx
Function at 0x140045a9a
Capabilities:
Execute syscall

Disassembly:
movabs r13, 0x217bbafffffddce9
syscall
popf
neg rdi
and r10d, 0xa23b76e6
popf
ret 0x30

Function at 0x140048fe2
Capabilities:
Execute syscall

Disassembly:
mov r8, r8
mov dword [rsp - 0x18], 0x13d6ae90
mov dword [rsp - 0x20], 0x761206cf
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
jmp 0x14004945e
add dword [rax], eax
add bl, bl
add byte [rdi], al
je 0x14004902c
jne 0x14004902c
lea edx, [rbp - 0x80f5]
rol r8d, 0x63
add r14d, 0xf5ccf3e1
dec rbp
lea ecx, [rdx - 0x3ceb]
test r14d, 0xb7317c20
div rcx
jmp 0x1400491c4
mov dword [rbp + 0x1fc], 0x3c00dc
mov qword [rsp + 0x40], rbx
xchg rcx, rcx
jmp 0x140048f82

Function at 0x140051f7f
Capabilities:
Execute syscall

Disassembly:
shr eax, 1
cmp dword [rdi], ecx
add byte [rax], al
bswap r12
jmp fcn.140050664
mov qword [rsp + 8], rbx
push rdi
xchg r11, r11
mov dword [rsp - 0x3c], ebp
sub rsp, 0x20
push r10
movabs r10, 0x14fbc61263ac22eb
je 0x140051e84
jmp 0x140051e99
adc al, 0x74
add eax, 0x48cc0375
mov ebx, 0x6ebc62eb
and eax, 0x8d122062
lodsd eax, dword [rsi]
invalid
jne 0x140051e84
int3
jmp 0x140051ee8
pop r10
mov rbx, rcx
mov rcx, qword [rcx + 0x50]
jmp 0x140051f9d
add byte [rax], al
invalid
mov ecx, 0x30
rep stosb byte [rdi], al
jne 0x140051e75
je 0x140051e75
call 0x140051f32
add rsp, 0x20
pop r10
ret
jg 0x140051f73
xchg rsi, rsi
mov dword [rsp - 0x24], 0x1aae8a63
mov dword [rsp - 0x1c], edi
je 0x140051f1a
jne 0x140051f1a
pop r13
movabs rsi, 0x1e48ed844ee41eb
jnp 0x140051958
jmp 0x140051f5d
jnp 0x140052c09
bswap rbp
lea ebp, [rbp - 0x1767]
lea r11d, [rdx + 0x4b3c]
jmp fcn.1400523d3
call 0x140051f7f
add rsp, 0x20
pop r10
ret
pop r10
dec dword [rcx + 8]
cmp dword [rcx + 8], 0
jmp 0x140051efd
mov dword [rsp - 0xc], ebx
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov dword [rsp - 0x3c], 0x682259b6
mov qword [rbx + 0x50], 0
mov rcx, qword [rbx + 8]
jmp 0x14005200a
test rcx, rcx
mov dword [rsp - 0xc], 0x4e0c5dd5
mov dword [rsp - 0x28], 0x35edba53
je 0x140051ff4
jne 0x140051ff4
cmp edx, 0x5b684194
add ebp, 0x4cb21fec
jnp 0x1400519ab
inc rcx
and ecx, 0xc9105e97
call rax
syscall
jg 0x140051e7c
call rcx
push rbx
jge 0x140052d74
jle 0x1400510d7
bswap rbx
xor r10d, 0xfc80586f
movabs rdx, 0x3a1994562fab6deb
xor r11d, 0x678c832f
or ebp, 0x951f0e54
ret
jmp 0x140052063
lea rdi, [rbx + 0x10]
cmp rcx, rdi
xchg rdx, rdx
xchg r12, r12
mov dword [rsp - 0x34], 0x2f9e69ac
jne 0x140052086
xor eax, eax
jne 0x140052053
je 0x140052053
lea r11d, [rdx - 0xc297]
mov r12d, 0x5372205c
int3
jmp 0x140051ea7
mov dword [rsp - 0x38], 0x6f91ae69
je 0x140051f7b
push r10
movabs r10, 0x69ec7dfffffed5e9
jne 0x140052075
jmp 0x140051f4f
je 0x140052075
jmp 0x140051f43
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jne 0x1400520af
je 0x1400520af
popfq
mov r9d, 0x3785e7bd
test r10, rcx
lea edx, [rbp - 0x9314]
jno 0x1400523e1
popfq
call rcx
movabs r10, 0x6bcee31e738a14eb
jmp rax
jmp 0x1400520c5
jmp fcn.1400999d0
scasd eax, dword [rdi]
ret
and al, 0xf0
iretd

Function at 0x140052fd4
Capabilities:
Execute syscall

Disassembly:
adc ax, di
and al, 0xe4
mov dl, 0x45
invalid
Function at 0x140054ca0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
xchg rsi, r11
mov qword [rsp + 0x18], r11
xchg r11, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop word [rax + rax]
mov rcx, qword [r15]
movzx edx, ax
mov dword [rsp - 0x20], ebx
and dx, r10w
ror eax, 5
ror eax, 3
xor dx, word [rcx + r8*2]
mov r15, r15
mov word [rsi + r8*2], dx
inc r8
cmp r8, qword [r15 + 0x38]
jb 0x140054ddb
xchg r13, r13
mov r8d, ebx
xchg rbp, r9
mov rbp, r9
xchg r9, rbp
cmp qword [r12 + 0x38], rbp
jbe 0x140054e7b
nop dword [rax]
mov dword [rsp - 0x14], 0x17df0aa5
xchg r13, rax
mov r13, qword [r12]
xchg r13, rax
movzx edx, r8w
mov dword [rsp - 0x18], 0x20f1fdcc
mov rcx, qword [r15 + 0x38]
and dx, r10w
add rcx, r9
ror r8d, 5
ror r8d, 2
ror r8d, 1
xor dx, word [rax + r9*2]
mov dword [rsp - 0x2c], 0x4709111a
inc r9
mov word [rsi + rcx*2], dx
cmp r9, qword [r12 + 0x38]
mov dword [rsp - 0x24], edi
jb 0x140054e2e
lea rax, [r14 + 8]
mov word [rsi + r13*2], bp
xorps xmm0, xmm0
xchg rdx, rdx
xchg rdi, rax
mov qword [r14], rdi
xchg rdi, rax
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
movups xmmword [rax + 0x10], xmm0
xchg r8, r8
movups xmmword [rax + 0x20], xmm0
inc rdi
cmp word [rsi + rdi*2], bp
xchg rsi, rsi
jne 0x140054ea4
xchg rdi, r8
mov rdx, r8
xchg r8, rdi
mov qword [r14 + 0x38], rdi
xchg rbx, rcx
mov rbx, r14
xchg rbx, rcx
call fcn.140017924
mov rdi, rdi
cmp qword [r14 + 0x38], rbp
jbe 0x140054f40
xchg rsi, rcx
mov rdx, rcx
xchg rcx, rsi
mov r8d, 0x74a94204
sub r8d, 0x1af8d08
xor r8d, 0x1e7018a6
sub r8d, 0x6055bb5a
sub r8d, 0xc33f001
sub rdx, rax
mov dword [rsp - 0x38], 0x629281ed
nop
movzx ecx, bx
lea rax, [rax + 2]
and cx, r8w
mov rdx, rdx
ror ebx, 7
ror ebx, 1
xor cx, word [rdx + rax - 2]
inc rbp
mov r12, r12
mov word [rax - 2], cx
cmp rbp, qword [r14 + 0x38]
jb 0x140054f14
mov rcx, rsi
xchg r8, r8
call fcn.140099890
xchg rbx, rdi
mov rdi, qword [rsp + 0x50]
xchg rdi, rbx
mov rax, r14
mov dword [rsp - 0x20], 0x61d65a48
mov rbp, qword [rsp + 0x58]
xchg rsi, r13
mov r13, qword [rsp + 0x60]
xchg rsi, r13
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
pop r15
pop r14
mov dword [rsp - 0x1c], 0x152e692c
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140055320
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rsi, r9
mov qword [rsp + 0x10], r9
xchg r9, rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x18], edi
mov rbx, rdx
xchg r13, r8
mov r13, qword [rdx + 0x38]
xchg r13, r8
xchg rdi, r10
mov r10, rcx
xchg r10, rdi
add r8, rsi
xchg rsp, rdx
mov rsp, rsi
xchg rdx, rsp
mov qword [rcx + 0x38], r8
call fcn.140055fe0
mov dword [rsp - 0x38], 0x5fa8ed19
mov r9, qword [rbx]
mov ecx, esi
and ecx, 3
mov r8d, 0x7f5af824
sub r8d, 0x17517203
add r8d, 0xadd0519
sub r8d, 0x69856315
add r8d, 0x254e2a8e
shl ecx, 1
shl ecx, 2
mov edx, r8d
mov dword [rsp - 0x18], 0x61ed006f
ror edx, cl
mov r10, rax
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov dword [rsp - 0x34], 0x252816c6
jbe 0x14005543a
lea rax, [rsi + rsi]
mov r11d, 0x51c63f18
xor r11d, 0x5e9a97ae
xor r11d, 0x1cd12b97
add r11d, 0x24aeaeea
sub r11d, 0x383c310c
sub rax, r9
xchg r12, r12
add r10, rax
nop dword [rax]
movzx eax, dx
mov rbx, rbx
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 6
ror edx, 2
and ax, r11w
ror r8d, 7
ror r8d, 1
xor ax, word [r9 - 2]
inc rcx
mov dword [rsp - 0x2c], 0x7845d600
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x1400553fb
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
xchg rdi, r13
mov rax, r13
xchg rdi, r13
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140055470
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rsi, r10
mov qword [rsp + 0x10], r10
xchg r10, rsi
xchg r9, rdi
mov qword [rsp + 0x18], r9
xchg rdi, r9
nop
push 0x3e49af88
mov qword [rsp], r14
sub rsp, 0x20
mov dword [rsp - 0x18], 0x144f96df
xchg r14, rbx
mov rbx, qword [rcx + 0x38]
xchg rbx, r14
xchg rcx, rdi
mov rcx, rdx
xchg rdi, rcx
xchg rcx, rdi
mov rsi, rdi
xchg rcx, rdi
nop
movabs rbx, 0xffffffff5aef1681
add rbx, 0x18af05aa
xor rbx, 0x49287da0
add rbx, 0x7fffffff
add rbx, 0x45499e75
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400554ea
xchg r8, r8
lea r8, [r14 + rbx]
xchg r14, rbx
mov rdx, rbx
xchg r14, rbx
mov qword [rcx + 0x38], r8
call fcn.140055fe0
mov ecx, r14d
mov dword [rsp - 0x18], ebp
mov edx, 0x6847e7d4
sub edx, 0x5de9cdb4
add edx, 0x5b120af7
sub edx, 0x36c0d264
and ecx, 3
xchg rdx, rdx
shl ecx, 2
shl ecx, 1
ror edx, cl
test rbx, rbx
xchg r9, r9
je 0x1400555a3
lea r8, [r14 + r14]
mov ecx, 0x687777e2
xor ecx, 0x7c8a6f6a
xor ecx, 0x232e9248
xor ecx, 0x37d38a3f
sub r8, rdi
add r8, rax
xchg rsp, rsp
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
xchg r14, r14
lea rdi, [rdi + 2]
and ax, cx
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov word [r8 + rdi - 2], ax
xchg r9, r9
sub rbx, 1
jne 0x140055578
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x40], ebp
xchg rdi, rsi
mov rsi, qword [rsp + 0x40]
xchg rsi, rdi
add rsp, 0x20
xchg rsi, rsi
pop r14
ret