joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a596
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg r11, rsp
xchg rbx, rsi
mov qword [r11 + 0x20], rsi
xchg rbx, rsi
push rdi
xchg rbp, rbp
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
xchg r14, rbx
mov r14, qword [rcx]
xchg rbx, r14
lea rax, [r11 - 0x40]
mov dword [rsp - 0xc], 0x7cf41b61
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov dword [rsp - 0x44], esp
mov ebp, r8d
mov qword [r11 + 0x10], rsi
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0x40], 0x2e55d26e
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
xchg r14, rdx
mov rdx, r14
xchg rdx, r14
xchg r13, rsp
movups xmmword [r13 + 0x28], xmm0
xchg rsp, r13
lea rdx, [rsi + 1]
mov dword [rsp - 0x10], 0x628a317b
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg rsp, r14
xchg rdi, rsp
movups xmmword [rdi + 0x48], xmm0
xchg rdi, rsp
call fcn.140017a38
mov dword [rsp - 0x28], 0x5457260b
mov edx, 0x168f920f
add edx, 0x19c2fb3d
sub edx, 0x1297a40a
xor edx, 0x4564a220
test rsi, rsi
mov dword [rsp - 0x40], 0x34f32c5e
je 0x14008a607
xchg r11, rax
mov rdi, r11
xchg r11, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0x30], edx
mov r9d, 0x811bf7b
xor r9d, 0x3253331e
xor r9d, 0x755fc64a
sub r9d, 0x2a5c79db
sub r9d, 0x24c0cf55
nop word [rax + rax]
movzx ecx, dx
mov r8, r8
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x10], ebx
mov word [rdi - 2], cx
sub r8, 1
jne 0x14008a5d8
xchg rsi, rsi
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov r14, r14
mov rdx, r14
mov rcx, qword [rsp + 0x20]
call fcn.14008a6e0
mov r14, r14
xchg r9, rcx
mov r9, qword [rsp + 0x20]
xchg r9, rcx
mov ebx, eax
xchg rsp, rsp
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
xchg rsi, r14
mov r14, qword [rsp + 0x78]
xchg r14, rsi
xchg rbp, rdi
mov rdi, qword [rsp + 0x70]
xchg rdi, rbp
cmp rcx, rax
mov dword [rsp - 0x44], ebx
jne 0x14008a6b3
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, r9
mov ecx, 0x7e27cb76
sub ecx, 0x72fc9ff4
xor ecx, 0x224f4771
sub ecx, 0x29646cc3
rep stosb byte [rdi], al
mov dword [rsp - 0x18], ebp
mov eax, ebx
xchg rbx, r13
mov r13, qword [rsp + 0x88]
xchg rbx, r13
nop
add rsp, 0x7f3c80ae
sub rsp, 0x7f3c804e
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400984b0
mov eax, ebx
mov r15, r15
mov rbx, qword [rsp + 0x88]
nop
add rsp, 0x38322b32
sub rsp, 0x38322ad2
pop rdi
ret
Function at 0x14008a6e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov dword [rsp + 0x18], r8d
mov r8, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xfffffffffffffdc0
mov dword [rsp - 0x10], 0x1de6606a
xchg rdx, rbp
mov rbx, rbp
xchg rbp, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
mov dword [rsp - 0x24], 0x24b66e3d
lea rcx, [rsp + 0x30]
mov r8d, 0x4ebcfe12
sub r8d, 0x11b6c9a1
sub r8d, 0x3a0be2da
sub r8d, 0x2fa4f8f
call fcn.140098ae0
mov rax, qword gs:[0x60]
mov dword [rsp - 0xc], esi
xchg r8, r9
mov r9, qword [rax + 0x18]
xchg r8, r9
mov rax, qword [r8 + 0x10]
mov dword [rsp - 0xc], ebp
mov r8, qword [rax]
test r8, r8
je 0x14008a9a2
xchg r9, r9
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14008a9a2
mov edx, 0x331f2130
add edx, 0xffbbfda
sub edx, 0x4bf67e3
sub edx, 0x3e5b7823
lea rcx, [rsp + 0x30]
mov r12, r12
lea r9d, [rdx - 1]
call fcn.1400996a0
mov edx, 0x43a2bcf6
xor edx, 0x47159efe
xor edx, 0x3517b48e
xor edx, 0x4c97a855
xor edx, 0x7d373e8f
lea rcx, [rsp + 0x30]
xchg rcx, rcx
call fcn.1400997b0
test rax, rax
je 0x14008a96c
xor ecx, ecx
xchg rsi, rsi
xchg rdi, r10
mov rdx, r10
xchg r10, rdi
mov word [rax], cx
xchg r8, r8
movabs rcx, 0xebd120da0cff05dd
add rcx, 0x5f0963ed
xor rcx, 0x1ca24e8a
xor rcx, 0x75856c64
add rcx, 0x94aacb8
mov rax, qword [0x140142690]
mov dword [rsp - 0x1c], edi
ror rax, 0xd
ror rax, 5
ror rax, 3
xor rax, rcx
movabs rcx, 0x1beb49e35ccdeae1
sub rcx, 0xba026a5
sub rcx, 0x4fcc886a
add rcx, 0x2f3d2af1
add rax, rcx
mov r14, r14
movabs rcx, 0xd506a20f27e31ca3
add rcx, 0xd98467d
add rcx, 0x14ea60ff
add rcx, 0x270c6c83
rol rax, 1
rol rax, 4
add rax, rcx
mov dword [rsp - 0x3c], esp
lea rcx, [rsp + 0x20]
call rax
mov r10, qword [0x140142680]
xchg r15, r15
lea r8, [rsp + 0x20]
movabs rcx, 0x1d1e8412c22442b
add rcx, 0x433af1cc
sub rcx, 0x2ba77f17
add rcx, 0x7451a7e
add rcx, 0x5430a776
lea rdx, [rsp + 0x260]
add r10, rcx
xchg rdx, rdx
movabs rax, 0x70e5db2c1c41e0a5
add rax, 0x64fc2f7
xor rax, 0x73a622a
sub rax, 0x20eec28b
add rax, 0x7fffffff
add rax, 0x1a888e32
rol r10, 1
rol r10, 4
lea rcx, [rsp + 0x30]
mov r12, r12
xor r10, rax
mov r9, rbx
rol r10, 3
movabs rax, 0x5428e4819cbab9d
add rax, 0x2a6f2d79
sub rax, 0x3248b600
sub rax, 0xc08c03e
add r10, rax
mov dword [rsp - 0x2c], esi
ror r10, 3
ror r10, 7
not r10
xchg rcx, rcx
call r10
xchg r8, rbx
mov r8, qword [rsp + 0x250]
xchg r8, rbx
add rsp, 0x240
mov dword [rsp - 0x14], ebp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x43abbc9e
add eax, 0x1badd47f
sub eax, 0x4096a91b
add eax, 0x1a6e7762
add eax, 0x86cea09d
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x20], esi
add rsp, 0x240
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x3d08202
xor eax, 0x545b669f
xor eax, 0x7da01c30
sub eax, 0x18855e3b
add eax, 0xae5966c3
add rsp, 0x240
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14008df60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140143084], 0
mov dword [rsp - 0xc], 0x2ecace13
jne 0x14008e06f
xor edx, edx
lea r8, [0x140143080]
nop word [rax + rax]
mov dword [rsp - 0x10], 0x5a84593d
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov rsp, rsp
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x18], 0x3391e195
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x34], 0x5a4495b0
shr ecx, 1
and eax, 1
neg eax
mov r10, r10
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x20], 0x307fa714
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg rbp, rbp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xchg rbx, rbx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rdx, rdx
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x18], 0x49ef62c7
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg r15, r15
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov rcx, rcx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x10], edx
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov rsi, rsi
mov eax, ecx
shr ecx, 1
and eax, 1
mov r12, r12
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x24], ebp
cmp edx, 0x100
jb 0x14008df90
ret
Function at 0x140093208
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r9
mov qword [rsp + 0x10], r9
xchg rbp, r9
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
push rdi
mov dword [rsp - 0x38], 0x21c0184b
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x3357e44e
sub rsp, 0x3357e46e
movzx eax, byte [rdx + 1]
xchg r8, r8
xchg r13, r8
mov r15, r13
xchg r13, r8
movzx ebx, byte [rdx]
mov dword [rsp - 0x38], esi
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 4
shl ebx, 1
shl ebx, 3
dec r8d
or ebx, eax
mov dword [rsp - 0xc], 0x6d2740e2
shl edi, 1
shl edi, 5
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x28], edx
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
xchg rbp, rbp
movzx eax, byte [rdx + 3]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x20], ecx
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 8
xchg r8, r8
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 3
shl edi, 1
or edi, eax
test r8d, r8d
mov dword [rsp - 0x28], 0x247df5ee
jle 0x14009336c
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
xchg r12, r12
movsxd rax, r8d
shr r14d, 1
inc r14d
mov r9, r9
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
mov dword [rsp - 0x30], edi
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov dword [rsp - 0x18], 0x685d1883
xchg r11, rsi
mov rdx, r11
xchg r11, rsi
mov ecx, edi
mov r8, r8
call fcn.140093a9c
xor ebx, eax
xchg r15, rdx
mov r15, rbp
xchg rdx, r15
mov ecx, ebx
mov dword [rsp - 0x28], edx
call fcn.140093a9c
xor edi, eax
nop
sub rsi, 0x521bf6ad
add rsi, 0x521bf695
add rbp, 0xffffffffffffffe8
sub r14, 1
jne 0x14009331c
mov dword [rsp - 0x28], 0x10e6b017
lea rax, [r15 + 7]
mov ecx, 0x7bae61fe
sub ecx, 0x6bbeb02
sub ecx, 0x193c9033
sub ecx, 0x5bb5e6c5
mov byte [rax - 4], dil
mov byte [rax], bl
xchg rsp, rsp
dec rax
shr ebx, 5
shr ebx, 2
shr ebx, 1
shr edi, 5
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x34], 0x5736a73d
jne 0x140093387
xchg r13, rbx
mov r13, qword [rsp + 0x40]
xchg rbx, r13
mov rbp, qword [rsp + 0x48]
mov dword [rsp - 0x2c], esi
xchg rsi, r10
mov r10, qword [rsp + 0x50]
xchg r10, rsi
nop
add rsp, 0x3b8bd0e9
sub rsp, 0x3b8bd0c9
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140093404
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg rsi, rbx
mov qword [rax + 8], rsi
xchg rsi, rbx
mov qword [rax + 0x10], rbp
mov dword [rsp - 0x18], edi
xchg rbp, rsi
mov qword [rax + 0x18], rbp
xchg rsi, rbp
mov qword [rax + 0x20], rdi
push r14
xchg rdx, rdx
nop
add rsp, 0x4dedda29
sub rsp, 0x4dedda49
movzx eax, byte [rdx + 1]
mov r10, r10
xchg r8, r14
mov r8, r14
xchg r8, r14
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
shl ebx, 3
shl ebx, 1
shl ebx, 1
shl ebx, 2
shl ebx, 1
or ebx, eax
xchg r8, r8
shl edi, 3
shl edi, 1
shl edi, 2
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 8
mov dword [rsp - 0x44], 0x39faadad
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov rbx, rbx
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 4
shl edi, 1
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 1
shl edi, 1
shl edi, 2
or edi, eax
mov dword [rsp - 0x30], esi
mov eax, dword [rcx + 4]
test eax, eax
jle 0x14009351d
mov rsi, qword [rcx + 8]
mov r10, r10
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov ecx, edi
call fcn.140093a9c
mov dword [rsp - 0x30], ebp
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
call fcn.140093a9c
mov dword [rsp - 0x10], ebp
xor edi, eax
nop
add rsi, 0x1db183f0
sub rsi, 0x1db183d8
sub rbp, 1
jne 0x1400934da
mov rdi, rdi
lea rax, [r14 + 7]
mov ecx, 0x46a4f458
xor ecx, 0x76de12c8
add ecx, 0x14502fe7
sub ecx, 0x12c54e8c
xor ecx, 0x3205c7ef
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x18], 0x1951c08f
shr ebx, 7
shr ebx, 1
shr edi, 7
shr edi, 1
sub rcx, 1
jne 0x14009353e
xchg r11, r11
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
mov rbp, qword [rsp + 0x38]
xchg rsi, rdi
mov rdi, qword [rsp + 0x40]
xchg rsi, rdi
xchg rdi, r9
mov r9, qword [rsp + 0x48]
xchg rdi, r9
nop
sub rsp, 0x424b9b3c
add rsp, 0x424b9b5c
pop r14
mov dword [rsp - 0xc], esi
ret
Function at 0x140093760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
mov dword [rsp - 0x40], 0x4d555030
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
lea rbp, [rsp - 0x47]
neg rsp
sub rsp, 0xffffffffffffff60
neg rsp
movdqa xmm0, xmmword [0x140001e00]
mov dword [rsp - 0x24], ebp
xor edi, edi
movdqa xmm1, xmmword [0x140001db0]
xchg r9, rdx
mov rbx, r9
xchg rdx, r9
xchg rcx, rbp
movdqu xmmword [rcx - 0x39], xmm0
xchg rcx, rbp
xchg r11, rcx
mov rsi, r11
xchg r11, rcx
mov edx, edi
mov r11, r11
movdqa xmm0, xmmword [0x140001dd0]
mov r8d, edi
movdqu xmmword [rbp - 0x29], xmm1
mov rbp, rbp
movdqa xmm1, xmmword [0x140001dc0]
xchg r10, rbp
movdqu xmmword [r10 - 0x19], xmm0
xchg r10, rbp
xchg rbp, rdi
movdqu xmmword [rdi - 9], xmm1
xchg rbp, rdi
mov ecx, edx
mov dword [rsp - 0x1c], 0x613b1e8c
lea r8, [r8 + 4]
mov eax, 0x658f5dcc
add eax, 0x15e99f09
sub eax, 0x2dd08d5a
add eax, 0x28bffa59
inc rdx
rol eax, cl
mov dword [rsp - 0x44], edi
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov r9, r9
jb 0x140093803
cmp dword [rsi + 4], 8
jne 0x1400938ab
lea rdx, [rbp + 0x6d]
xchg r11, r11
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
mov dword [rsp - 0x38], 0x36150132
shl cx, 2
shl cx, 5
shl cx, 1
or cx, ax
mov rsi, rsi
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140093856
mov rbx, rbx
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov rcx, rsi
mov dword [rsp - 0x18], edx
call fcn.1400935a4
jmp 0x140093974
cmp dword [rsi], edi
jle 0x140093974
mov r14d, edi
xchg rdi, rdi
lea rdx, [rbp + 0x6d]
mov r8d, 0x3ddf9609
xor r8d, 0x1ced4db
add r8d, 0x357152e5
add r8d, 0x99e5111
sub r8d, 0x7b20e6c4
movzx eax, byte [rbx]
mov dword [rsp - 0x28], 0x1e7a0d1
movzx ecx, byte [rbx + 1]
neg rbx
add rbx, 0xfffffffffffffffe
neg rbx
shl ax, 8
or cx, ax
xchg r13, r13
mov word [rdx], cx
lea rdx, [rdx - 2]
sub r8, 1
jne 0x1400938df
mov r15, r15
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rbp, rbp
xchg rcx, r15
mov r15, rsi
xchg r15, rcx
call fcn.1400935a4
mov r8d, dword [rsi + 4]
mov dword [rsp - 0x2c], edx
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
add r8d, 0xfffffff8
mov rbx, rbx
xchg rcx, rdx
mov rdx, rsi
xchg rdx, rcx
call fcn.1400935a4
mov rbp, rbp
inc edi
neg r14d
add r14d, 0xfffffff8
neg r14d
cmp edi, dword [rsi]
xchg r10, r10
jl 0x1400938b9
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
xchg r11, r11
lea rdi, [rbp + 7]
xchg rsi, rdx
mov rdx, qword [r11 + 0x30]
xchg rsi, rdx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
mov dword [rsp - 0x3c], 0x335fd6da
mov rsp, r11
pop r14
pop rdi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret

Function at 0x140093a50
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov dword [rsp - 0x14], 0x360fe45
test edx, edx
je 0x140093a94
lea ecx, [r11 + r11]
mov r9d, r10d
mov dword [rsp - 0x14], ecx
xor r9d, r11d
mov r11d, ecx
test dl, 1
cmove r9d, r10d
xchg rsp, rsp
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
xchg rdx, rdx
cmovb r11d, ecx
shr edx, 1
jne 0x140093a62
mov eax, r10d
mov r14, r14
ret
Function at 0x14009ef68
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xchg rbp, rbp
xor r8d, r8d
mov r9, rdx
test rax, rax
je 0x14009efcc
mov rsi, rsi
mov ecx, r8d
mov edx, 0x670d706a
sub edx, 0x10336cb3
xor edx, 0x3822e165
xor edx, 0x5623bdca
add edx, 0x3d8d0abc
rol edx, cl
mov dword [rsp - 0xc], esi
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
inc r8
mov rsi, rsi
cmp r8, 0x20
jb 0x14009ef84
mov al, 0x5d
add al, 0x10
sub al, 0x2d
sub al, 0x3f
ret
mov rax, qword [rcx + 0x100]
mov r8, r8
test rax, rax
je 0x14009f000
movups xmm0, xmmword [rax]
mov rsp, rsp
xchg r13, rdx
movups xmmword [r13], xmm0
xchg r13, rdx
movups xmm1, xmmword [rax + 0x10]
mov rdi, rdi
movups xmmword [rdx + 0x10], xmm1
jmp 0x14009efc3
xorps xmm0, xmm0
xchg r12, r12
xor al, al
xchg r10, rdx
movups xmmword [r10], xmm0
xchg r10, rdx
xchg rdx, r12
movups xmmword [r12 + 0x10], xmm0
xchg rdx, r12
ret
Function at 0x1400b5a34
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r10
mov r10, rsp
xchg r11, r10
xchg r14, rbx
mov qword [r11 + 8], r14
xchg r14, rbx
mov qword [r11 + 0x18], rsi
mov dword [rsp - 0x28], 0x6e6eed55
mov qword [r11 + 0x20], rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffc0
neg rsp
mov rax, qword [0x1401424c8]
lea rdx, [r11 + 0x10]
mov r8, r8
mov rbx, rcx
ror rax, 0x1e
movabs rcx, 0x1522c2b31a59e4e3
add rcx, 0x576a6fd
sub rcx, 0x47a4097
xor rcx, 0x4b162027
xor rcx, 0x61b94c78
mov dword [rsp + 0x58], 0x44012996
add dword [rsp + 0x58], 0x2b4a4700
sub dword [rsp + 0x58], 0x5d15de6f
sub dword [rsp + 0x58], 0x12359217
sub rax, rcx
xchg r15, r15
movabs rcx, 0x59fbccab08e79cc5
add rcx, 0x39c01177
sub rcx, 0x3b8fde56
add rcx, 0x790a9277
ror rax, 5
add rax, rcx
mov rsi, rsi
movabs rcx, 0x2fbc5f7362cd42c2
xor rcx, 0x63f619e2
xor rcx, 0x5d8fa7bf
add rcx, 0x213f42f1
xor rax, rcx
lea rcx, [r11 - 0x28]
call rax
mov dword [rsp - 0x38], 0xdd7ad7b
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg r15, rdi
mov qword [rbx], r15
xchg r15, rdi
xor esi, esi
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov dword [rsp - 0x40], 0x3c73099
movups xmmword [rdi + 0x20], xmm0
test eax, eax
jne 0x1400b5b59
xchg rsi, rdi
mov qword [rbx + 0x38], rdi
xchg rdi, rsi
jmp 0x1400b5c89
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
mov dword [rsp - 0x30], ecx
inc r14
cmp word [rax + r14*2], si
jne 0x1400b5b66
mov qword [rbx + 0x38], r14
mov dword [rsp - 0x44], edx
cmp qword [rbx], rdi
je 0x1400b5b93
xchg r15, rcx
mov r15, qword [rbx]
xchg rcx, r15
call fcn.1400984b0
cmp r14, 0x18
mov dword [rsp - 0x30], 0x1e0b1e76
jbe 0x1400b5bd6
lea rcx, [r14 + r14]
call fcn.140098780
xchg r11, r11
xchg r12, rax
mov qword [rbx], r12
xchg r12, rax
test rax, rax
mov dword [rsp - 0x14], edx
jne 0x1400b5be6
xchg r14, rdi
mov qword [rbx], r14
xchg r14, rdi
mov rcx, rsi
jmp 0x1400b5c05
xchg rsp, rdi
mov qword [rbx], rsp
xchg rdi, rsp
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xorps xmm0, xmm0
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
xchg r12, rax
movups xmmword [r12 + 0x10], xmm0
xchg r12, rax
movups xmmword [rax + 0x20], xmm0
mov dword [rsp - 0x10], ebp
mov rcx, qword [rbx]
mov edx, 0x773f9678
sub edx, 0x58a0e0ea
sub edx, 0xc4f9814
xor edx, 0x4a915618
cmp qword [rbx + 0x38], rsi
mov r10, r10
jbe 0x1400b5c89
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0x1c], 0x264746a6
mov r9d, 0x42385cfa
xor r9d, 0x72b4fafa
xor r9d, 0x77c0912a
xor r9d, 0x489151f1
xor r9d, 0xfdd6624
and ax, r9w
xchg rbp, rbp
ror edx, 3
ror edx, 4
ror edx, 1
xor ax, word [r8 + rcx]
inc rsi
mov word [rcx], ax
mov r8, r8
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400b5c31
xchg rdx, rsi
mov rdx, qword [rsp + 0x60]
xchg rsi, rdx
xchg rdi, rax
mov rdi, rbx
xchg rdi, rax
mov rbx, qword [rsp + 0x50]
mov dword [rsp - 0x34], ebp
mov rdi, qword [rsp + 0x68]
nop
add rsp, 0x78704631
sub rsp, 0x787045f1
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400d6c2c
Capabilities:
Execute syscall

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rsp, rsp
xchg rsp, rcx
mov rbx, rsp
xchg rcx, rsp
mov rcx, qword [rcx + 0x1a8]
cmp rcx, 0xffffffffffffffff
je 0x1400d6d3e
mov rbp, rbp
xchg r9, rax
mov r9, qword [rbx + 0x258]
xchg r9, rax
movabs rdx, 0x5f80ab98204c6071
add rdx, 0x4fbb9dfb
sub rdx, 0x5692382e
add rdx, 0x7fffffff
add rdx, 0x333ecbba
sub rax, rdx
movabs rdx, 0x6fe6f8ab0c3ff381
add rdx, 0x8414dac
add rdx, 0x353d9cdd
add rdx, 0x3b160
sub rdx, 0x22bfa554
rol rax, 5
rol rax, 0xa
rol rax, 1
rol rax, 1
rol rax, 1
xor rax, rdx
mov dword [rsp - 0x1c], 0x9063ca6
movabs rdx, 0x3be11aba2a2718be
add rdx, 0x3e39e19e
sub rdx, 0x53e80cf2
add rdx, 0x24f34316
sub rax, rdx
movabs rdx, 0xd61d39724b4751bb
sub rdx, 0x129f619d
xor rdx, 0x5e1d0b2e
add rdx, 0x7fffffff
xor rdx, 0xc7f8b84
xor rax, rdx
mov dword [rsp - 0x14], edx
movabs rdx, 0x6a36cc9a09ab22bc
add rdx, 0x35487ff4
sub rdx, 0x20a0fd15
sub rdx, 0x399e948
sub rax, rdx
call rax
xchg r8, r8
xchg rcx, r15
mov r15, qword [rbx + 0x198]
xchg r15, rcx
test rcx, rcx
mov dword [rsp - 0x38], 0x5b0013dc
je 0x1400d6d8c
cmp qword [rbx + 0x1a0], 0
jne 0x1400d6d8c
mov rcx, qword [rcx + 0x20]
xchg r15, r15
call fcn.1400984b0
xchg r9, rcx
mov r9, qword [rbx + 0x198]
xchg rcx, r9
call fcn.1400984b0
mov dword [rsp - 0x24], ebp
xchg r9, rcx
mov r9, qword [rbx + 0x1a0]
xchg rcx, r9
test rcx, rcx
mov dword [rsp - 0x38], 0x5feb2372
je 0x1400d6e76
xchg rcx, rax
mov rcx, qword [rbx + 0x248]
xchg rcx, rax
movabs rdx, 0xea7bd3652652dcc7
xor rdx, 0x766e369
xor rdx, 0x500fa5c9
xor rdx, 0x112d0028
add rdx, 0x7fffffff
sub rdx, 0x32e251e9
xor rax, rdx
movabs rdx, 0xed2357662891b132
sub rdx, 0x10fbac98
sub rdx, 0x65b2c0a
xor rdx, 0x3bedaa1c
add rdx, 0x7fffffff
add rdx, 0x1408ddd
rol rax, 2
rol rax, 0xa
rol rax, 1
rol rax, 3
rol rax, 1
add rdx, rax
movabs rax, 0x4696f703024319e0
add rax, 0x605ae073
xor rax, 0x6180216e
add rax, 0x5b21281
xor rdx, rax
movabs rax, 0x513c42e85af0e454
sub rax, 0x2f46c3ce
add rax, 0x368a9f6
sub rax, 0xda14cdb
add rax, 0x7fffffff
add rax, 0xc107da1
add rdx, rax
call rdx
xchg r11, r11
cmp qword [rbx + 0x200], 0
je 0x1400d6f39
xchg r9, rax
mov r9, qword [rbx + 0x210]
xchg r9, rax
movabs rcx, 0x5f4bd1a1558e813
add rcx, 0x515759da
sub rcx, 0x5eed4039
xor rcx, 0x401aa0c8
sub rcx, 0x3ce86b16
rol rax, 0xa
rol rax, 0x16
rol rax, 2
rol rax, 1
xor rax, rcx
movabs rcx, 0x6cb5cd713fa671bd
add rcx, 0x1c7704bc
xor rcx, 0x262a2b4b
add rcx, 0x7fffffff
sub rcx, 0xdfa9aa5
add rax, rcx
movabs rcx, 0x4212e61d728d777d
sub rcx, 0x140c511
xor rcx, 0x7e642853
add rcx, 0x6eaf761b
ror rax, 0x27
ror rax, 1
ror rax, 3
ror rax, 1
add rax, rcx
call rax
mov rcx, qword [rbx + 0x200]
xchg r9, r9
call fcn.14008cf50
and qword [rbx + 0x200], 0
xchg rcx, r15
mov r15, qword [rbx + 0x1f0]
xchg rcx, r15
nop
sub rsp, 0x3a88cd35
add rsp, 0x3a88cd55
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140054ed0
Function at 0x1400d7178
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rsi
xchg rcx, rcx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
mov dword [rsp - 0x20], ebx
lea rbp, [rsp - 0x47]
sub rsp, 0x6b13e988
add rsp, 0x6b13e8a8
xor ebx, ebx
mov dword [rbp - 0x79], 0x149cf1a0
xor dword [rbp - 0x79], 0x40f2392f
sub dword [rbp - 0x79], 0x30faf023
sub dword [rbp - 0x79], 0x234ed866
mov dword [rbp - 0x75], 0x2fbdbb81
add dword [rbp - 0x75], 0x4b5df6b3
sub dword [rbp - 0x75], 0x5ed92bfe
add dword [rbp - 0x75], 0x22b288bb
xor dword [rbp - 0x75], 0x3ecc0e5c
xchg r14, rsp
mov rsp, rdx
xchg rsp, r14
mov dword [rbp - 0x71], 0x59b393ab
xor dword [rbp - 0x71], 0x2383c6c
sub dword [rbp - 0x71], 0x3ee6495a
sub dword [rbp - 0x71], 0x1c83665b
mov dword [rbp - 0x6d], 0x1d0e32ae
xor dword [rbp - 0x6d], 0x575419a3
xor dword [rbp - 0x6d], 0x4b6354f1
sub dword [rbp - 0x6d], 0xfd7f0c
mov dword [rbp - 0x69], 0x66dddeac
xor dword [rbp - 0x69], 0x516afd98
sub dword [rbp - 0x69], 0x241af38f
xor dword [rbp - 0x69], 0x13bb2fab
xchg rbx, rsp
mov qword [rbp + 0x77], rsp
xchg rbx, rsp
xchg rdx, rax
mov rdx, qword [rbp + 0x77]
xchg rdx, rax
mov rcx, qword [rbp + 0x77]
mov r15, r15
mov rax, qword [rbp + 0x77]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x79]
mov eax, 0x6a31a3b6
sub eax, 0x4e780c92
add eax, 0x1507f003
add eax, 0x281cc43b
shr eax, cl
mov rsp, rsp
movzx ecx, al
xchg rcx, rax
mov rcx, qword [rbp + 0x77]
xchg rcx, rax
xor cx, dx
mov word [rbp + rax*2 - 0x65], cx
mov rax, qword [rbp + 0x77]
mov r8, r8
inc rax
xchg rsp, rax
mov qword [rbp + 0x77], rsp
xchg rsp, rax
xchg rsi, rax
mov rsi, qword [rbp + 0x77]
xchg rsi, rax
cmp rax, 0xa
jb 0x1400d7267
xor edx, edx
mov dword [rsp - 0x2c], esp
mov word [rbp - 0x51], bx
lea rcx, [rbp - 0x65]
call fcn.14008a9e0
mov dword [rsp - 0x44], ebp
mov rsi, rax
lea rdi, [rbp - 0x65]
xor eax, eax
lea ecx, [rax + 0xa]
mov r13, r13
rep stosb byte [rdi], al
test rsi, rsi
je 0x1400d73c9
xchg rdi, rdi
mov edx, 0x624dc8ff
add edx, 0xbacfce5
xor edx, 0x333646ba
xor edx, 0x7bcf82ed
xor edx, 0xae9a3412
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140082d10
mov rdi, rax
mov r10, r10
test rax, rax
je 0x1400d73b7
xchg r14, rdi
mov rdx, rdi
xchg rdi, r14
lea rcx, [rbp - 0x49]
mov dword [rsp - 0xc], ebp
call fcn.140073a40
xchg rdx, rcx
mov rdx, qword [rbp - 0x49]
xchg rdx, rcx
call rdi
mov dword [rsp - 0x18], 0x29dbdfc6
mov rcx, qword [rbp - 0x49]
cmp eax, 1
lea rax, [rbp - 0x41]
sete bl
xchg rbp, rbp
cmp rcx, rax
jne 0x1400d73b2
lea rdi, [rbp - 0x41]
xor eax, eax
mov dword [rsp - 0x3c], edi
mov ecx, 0x748c4ade
xor ecx, 0x5a97ede3
add ecx, 0x3df67ebd
sub ecx, 0x18df26cf
sub ecx, 0x5332feab
rep stosb byte [rdi], al
mov r15, r15
jmp 0x1400d73b7
call fcn.1400984b0
xchg r9, rsi
mov rcx, r9
xchg r9, rsi
call fcn.14008cf50
mov dword [rsp - 0x24], esi
lea r11, [rsp + 0xe0]
mov al, bl
xchg rbx, rsp
mov rsp, qword [r11 + 0x20]
xchg rbx, rsp
xchg rbx, rsi
mov rbx, qword [r11 + 0x28]
xchg rsi, rbx
mov rsp, r11
pop r14
xchg r10, r10
pop rdi
nop
mov rbp, qword [rsp]
add rsp, 8
ret