joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e7a0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x1404469b0]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x14004e7de
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004e7d5
test r13, r13
je 0x14004e7ea
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x14004e9b3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x14004e9f7
cmp al, 0xd
je 0x14004e9f7
mov rbx, rcx
cmp rcx, r12
jae 0x14004e863
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x14004e863
cmp al, 0xd
je 0x14004e863
inc rbx
cmp rbx, r12
jb 0x14004e850
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x14004e997
cmp al, 0x5b
jne 0x14004e97e
cmp rbx, rcx
jbe 0x14004e97e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x14004e97e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call fcn.14007a3ad
mov r15, rax
test rax, rax
je 0x14004e997
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call fcn.14007a3ad
mov r11, rax
test rax, rax
je 0x14004e997
mov r10, qword [0x1404469b0]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x14004e92a
cmp r9b, 0x23
jne 0x14004e907
cmp byte [r8], r9b
jne 0x14004e907
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x1400b4a40]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x14004e8f5
mov r8d, dword [r10 + 0x2fe8]
xor eax, eax
not ecx
test r8d, r8d
jle 0x14004e954
mov r9, qword [r10 + 0x2ff0]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x14004e95a
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x14004e945
xor edi, edi
xor ebp, ebp
jmp 0x14004e997
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x14004e956
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x14004e997
test rdi, rdi
je 0x14004e997
test rbp, rbp
je 0x14004e997
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x14004e830
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x14004e9de
mov rax, qword [0x1404469b0]
test rax, rax
je 0x14004e9de
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2fcc], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x14004e830
Function at 0x140059cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140059e41
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140059d20
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1400596d0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140058d30
mov dword [rbx + 0x80], 0
jmp 0x140059e2d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.140057bf0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140067820
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400c9438]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov byte [rsp + 0x30], sil
mov qword [r11 - 0x44], rsi
mov dword [rsp + 0x7c], 0x67452301
mov dword [r11 - 0x38], 0xefcdab89
mov dword [r11 - 0x34], 0x98badcfe
mov dword [r11 - 0x30], 0x10325476
cmp qword [rdx + 0x18], 0x10
jb 0x14006788a
mov rdx, qword [rdx]
mov r8d, dword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400673e0
lea rcx, [rsp + 0x30]
call fcn.1400674b0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140067720
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400678e6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400678e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006791d
mov rcx, r8
call fcn.140079384
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], select
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400790d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14006f540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x14006f574
cmp ecx, r10d
jge 0x14006f562
mov rcx, rbx
call fcn.14006ed40
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14006f5ae
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x14006f590
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14006f5d6
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14006f605
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14006f5ef
xor dl, dl
jmp 0x14006f5f8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14006f5e6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14006f5b2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14006f66f
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14006f689
mov rcx, rbx
call fcn.14006ee90
test eax, eax
je 0x14006f662
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140079f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140079fb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140079fb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140079fb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140079fb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140079fb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140079fb8
xor al, al
add rsp, 0x28
ret

Function at 0x140455540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14045556d
xor al, al
jmp 0x1404556cf
mov rax, qword [0x1404756c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1404756c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1404756d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1404756d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1404756e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1404756e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1404756f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1404756f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140475700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1404556c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140455619
mov r11d, 2
jmp 0x14045563d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140455633
mov r11d, 1
jmp 0x14045563d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1404556e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140455682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14045569a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1404556aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1404556b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140455600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1404556ca
Function at 0x1400189e5
Capabilities:
Encode data using xor

Disassembly:
add rsp, 0x2e0
pop r13
ret
dec dword [rax - 0x41]
jmp 0x140017ce8
in al, dx
wait
xor al, 0xe9
loopne 0x140018098
invalid
hlt
mov rcx, qword [rbp + 0xb58]
jne 0x1400187ca
je 0x1400187ca
movabs r12, 0x71717d0000071fe9
lea r8d, [rdx + 0xdc49]
lea ebp, [rcx + 0x371e]
ret
jmp 0x140018eee
jne 0x140018e3c
je 0x140018e3c
call fcn.14001896a
add rsp, 0x3d
jmp 0x140018c0b
mov rax, qword [rbp + 0xb58]
mov dword [rsp - 0x28], 0x5f087958
mov r11, r11
xchg r9, r9
je 0x1400189f1
jne 0x1400189f1
jge 0x140018098
movabs r14, 0x1ba0a000003c8e9
popf
or ebx, 0x89b8f8dd
pop r9
jge 0x140017eb5
jmp 0x140018dbe
jmp fcn.140018d88
pop rsi
ret
pop rsi
xchg rsi, rsi
inc rax
mov qword [rbp + 0xb58], rax
jmp 0x1400189d0
mov dword [rsp - 0x24], 0x3b5e04bb
xchg rbp, rbp
cmp rax, rbx
jmp 0x140018f4d
xor cx, dx
mov word [rbp + rax*2 + 0x660], cx
mov rax, qword [rbp + 0xb58]
mov dword [rsp - 0x34], 0x5512032e
xchg rsi, rsi
push rsi
movabs rsi, 0x23eb2efffffdcce9
jne 0x140018e78
jmp 0x140018c0d
je 0x140018e78
rcl edi, 0x93
lea r10d, [rdi - 0xd1d]
call rax
jg 0x140019de9
lea ebp, [rcx + 0x37ad]
jne 0x1400184b1
lea ebp, [rbp + 0xfd78]
test r9, rcx
sub r14d, 0xaf51a535
movabs r12, 0x73bc18fffffb39e9
lea r10d, [rcx + 0xabb1]
lea edi, [rdi + 0xb67]
cmp rcx, rcx
bswap r14
cmp r14d, 0xcea0af2f
ret 0x30
jmp 0x1400189b6
mov rax, qword [rbp + 0xb58]
and cl, sil
shl cl, 3
mov rdx, rdx
mov dword [rsp - 0x3c], 0x2df2746d
mov dword [rsp - 0x44], ebx
jmp 0x140018f0f
movzx edx, word [rbp + rax*2 - 0x80]
mov eax, r15d
shr eax, cl
movzx ecx, al
xchg r9, r9
mov rax, qword [rbp + 0xb58]
jmp 0x140018e1c
jb 0x1400187bd
mov rax, qword [0x140141070]
lea r8, [rbp + 0x72a]
mov dword [rsp - 0x14], esp
mov dword [rsp - 0x3c], 0x108a35c4
movabs rcx, 0x744c20e3546dcf0c
mov word [rbp + 0x68a], r10w
mov esi, 0xfffd7de9
jmp qword [rdx + 0x49]
Function at 0x14001dc7d
Capabilities:
Execute syscall

Disassembly:
popf
div rcx
syscall
call rax
movabs rcx, 0xd47acffffff27e9
jnp 0x14001ea7e
syscall
ret 0x28
dec dword [rax - 0x7d]
invalid

Function at 0x1400218a9
Capabilities:
Encode data using xor

Disassembly:
cvttss2si ebx, xmm8
lea ecx, [rbx + rbx]
mov dword [rsp - 0x3c], 0x637b123
xchg r14, r14
mov dword [rsp - 0x10], 0x65fc0759
mov dword [rsp - 0x44], 0x2d9a48cd
push r12
jmp 0x1400221bd
Function at 0x140027e44
Capabilities:
Execute syscall

Disassembly:
mov edx, 0xfff44de9
push qword [rsi + rbx - 0x26c6b6c0]
ja 0x1400287a8
lea ecx, [rcx - 0x5a8b]
and ebp, 0xdaabec91
cmp r15d, 0x13233872
xor edi, 0xdd952b5d
jne 0x140028837
xor edi, 0xd7bef639
cmp rdi, rbx
call fcn.140027a1a
xor r8d, 0x776c8d37
rcl r11d, 0xcd
cmp r11d, 0xa89fac64
test ebx, 0x924f18
dec r15
rcl edx, 0x8a
lea r9d, [rcx + 0x6186]
jns 0x1400279d6
rol r11d, 0xcf
mov r8d, 0x46a6d625
movabs rdi, 0xff8f9fffffefee9
lea edx, [rdx + 0x5e85]
lea r14d, [rcx + 0x4fa6]
div rbp
rcl r15d, 0xb4
ror r12d, 0x69
ret
push rax
add dword [rax], eax
add byte [rax - 0x75], cl
retf
add bl, al

Function at 0x140028897
Capabilities:
Execute syscall

Disassembly:
ret
pop r14
mov rdx, rax
mov rcx, r15
iretd
call fcn.1400f32b0
mov r14d, 4
mov dword [rsp - 0x2c], 0x5f631cf7
je 0x140028883
jne 0x140028883
int3
jmp 0x140028af2
cmp eax, ecx
xchg r8, r8
mov r9, r9
jmp 0x140028901
jne 0x140028939
je 0x140028939
call 0x140028929
add rsp, 0x7a
pop r14
jmp 0x140028838
xchg rsp, rsp
xchg r10, r10
mov rcx, rbx
jge 0x140028b12
lea rdx, [rbp + 0x110]
call fcn.1400f8270
mov dword [rsp - 0x38], 0x402a95f9
jmp 0x140028929
mov dword [rsp - 0x20], 0x3c085edf
mov dword [rsp - 0xc], ebp
push r14
movabs r14, 0x2f3c5ffffffefbe9
jmp 0x1400288c6
jmp 0x140028839
mov dword [rsp - 0x14], 0x19e75a47
mov dword [rsp - 0xc], 0x3e52fc4b
mov dword [rsp - 0x30], 0x12cb393a
xchg r11, r11
jmp 0x140028b61
lea rdx, [rsp + 0x30]
Function at 0x140037911
Capabilities:
Execute syscall

Disassembly:
xor eax, eax
mov dword [rsp - 0x40], ecx
lea rdi, [rbp + 0xaba]
lea ecx, [rax + 0x41]
rep stosb byte [rdi], al
mov dword [rsp - 0x20], 0x637f2872
jmp 0x140037862
mov dword [rsp - 0x1c], 0x17cad9ca
mov dword [rsp - 0x20], 0xd28a246
lea rdi, [rbp + 0x7c0]
jmp fcn.14003a632
jmp 0x1400374fa

Function at 0x140037f8c
Capabilities:
Encode data using xor

Disassembly:
test dword [rbx + rax], ebx
add byte [rax], al
mov dword [rax], 0x85c7006e
and byte [rbx], al
add byte [rax], al
add eax, dword [rax]
adc byte [rax], al
Function at 0x14004ac29
Capabilities:
Execute syscall

Disassembly:
mov dword [rbp + 0x426], 0x1e0015
mov dword [rsp - 0x2c], 0x2a90c788
mov r12, r12
mov dword [rsp - 0x2c], esp
mov dword [rbp + 0x42a], 0x7300d6
push r10
jmp 0x14004aec9
or eax, 0xc700000b
and al, 0xd0
mov edi, 0xc7351b6c
and al, 0xe0
jge 0x14004a119
or edi, eax
and al, 0xdc
adc edx, ebx
pop rdi
or al, 0xc7
and al, 0xc8
test dword [rbx], ebx
jmp 0x14004a0c8
add bh, al
test esi, ebx
add al, 0
add byte [rax + rax], dl
add byte [r13 + 0x17], r14b
invalid
mov dword [rbp + 0x416], 0x5b001f
mov dword [rbp + 0x41a], 0x7100cb
mov dword [rsp - 0x3c], 0x5c69e022
mov dword [rbp + 0x41e], 0x5d0014
mov dword [rbp + 0x422], 0x6400c7
jmp 0x140049dc0
pop rsi
inc rsi
rcr ebp, 0x8a
jo 0x140049e71
jp 0x14004a09b
rcl ecx, 0x8b
call rcx
jg 0x14004aca0
rcl r14d, 0xb
call rcx
lea r15d, [rdi - 0xc72a]
mov edx, 0xb32599e3
movabs r14, 0x366ee3000002e0e9
cmp r10d, 0x1723a654
push rdx
syscall
ret
xchg esp, esp
mov dword [rsp - 0x30], 0x6a7ddc94
mov dword [rsp - 0x10], 0x247c2d2b
mov dword [rsp - 0x2c], ebx
jmp 0x14004aedc
mov dword [rsp - 0x18], 0x714f486
mov rdi, rdi
mov dword [rbp + 0x40e], 0x500030
mov dword [rbp + 0x412], 0x740093
jmp 0x14004a83a
call fcn.14004af3e
add rsp, 0x22
pop r10
ret
movabs r10, 0xa37b7ffffff73e9
jne 0x14004aecb
je 0x14004aecb
jmp 0x14004ae37
cmp rax, 0x20
jb fcn.140049abd
mov word [rbp + 0xb20], bx
mov r11d, 0x10
jmp 0x14004adb3
Function at 0x1400515b2
Capabilities:
Execute syscall

Disassembly:
lea edi, [rdi - 0x7e42]
lea edx, [rdi - 0xe522]
jae 0x140051b54
syscall
xor edi, 0x55bed79b
rcr r8d, 0xbc
call rax
lea edx, [rdx + 0x697b]
movabs rsi, 0x783655fffffea4e9
test r15d, 0xa23d4b
test r12d, 0x8d73062d
ret 0x18

Function at 0x140054d80
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
push rdi
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rbx, rdx
xchg rcx, r13
mov rdi, r13
xchg rcx, r13
nop
Function at 0x140054ec0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg rbp, r12
xchg r10, rsi
mov qword [rsp + 0x18], r10
xchg rsi, r10
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x765dc7c7
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov r13, qword [r8 + 0x38]
xchg rdx, r15
mov rdx, r15
xchg r15, rdx
add r13, qword [rdx + 0x38]
xchg rbx, rbx
xchg r14, rcx
mov rcx, r14
xchg r14, rcx
mov eax, 0x1fcfcecd
sub eax, 0xf036f21
add eax, 0x100c99db
xor eax, 0x1f99ecc5
xor eax, 0x3f411540
nop
movabs rdi, 0xffffffff0d23fe12
add rdi, 0x45072623
sub rdi, 0x2dfc102
add rdi, 0x7fffffff
xor rdi, 0x30b49ccd
xchg r12, rdx
mov rdx, r8
xchg r12, rdx
lea r9, [r13 + 1]
mul r9
cmovo rax, rdi
mov dword [rsp - 0x38], 0x2dbfd22c
mov rcx, rax
call fcn.1400993a0
xor ebp, ebp
mov dword [rsp - 0x2c], 0x6d760ebd
mov ebx, 0xeb11b8f
xor ebx, 0x2f9ffabb
xor ebx, 0x3ce424dd
sub ebx, 0x1c178778
xchg rdx, rax
mov rsi, rdx
xchg rdx, rax
mov eax, ebx
mov r8d, ebp
xchg rbp, rbp
mov r10d, 0x1720b430
add r10d, 0x1724d8a6
xor r10d, 0x7ed802ec
add r10d, 0x23b541b8
sub r10d, 0x7452cef3
cmp qword [r15 + 0x38], rbp
jbe 0x14005502c
nop word [rax + rax]
mov rdi, rdi
xchg rcx, r10
mov r10, qword [r15]
xchg r10, rcx
movzx edx, ax
and dx, r10w
mov dword [rsp - 0x38], ecx
ror eax, 6
ror eax, 2
xor dx, word [rcx + r8*2]
mov word [rsi + r8*2], dx
mov rdx, rdx
inc r8
cmp r8, qword [r15 + 0x38]
jb 0x140054ff5
mov rbp, rbp
mov r8d, ebx
xchg r9, rcx
mov rcx, rbp
xchg rcx, r9
cmp qword [r12 + 0x38], rbp
jbe 0x14005508f
xchg r10, r10
nop dword [rax]
mov rax, qword [r12]
movzx edx, r8w
xchg rsi, rcx
mov rsi, qword [r15 + 0x38]
xchg rsi, rcx
and dx, r10w
add rcx, r9
mov dword [rsp - 0x24], esi
ror r8d, 4
ror r8d, 2
ror r8d, 2
xor dx, word [rax + r9*2]
xchg rdi, rdi
inc r9
mov word [rsi + rcx*2], dx
cmp r9, qword [r12 + 0x38]
jb 0x140055049
xchg rsp, rsp
lea rax, [r14 + 8]
mov word [rsi + r13*2], bp
xorps xmm0, xmm0
mov dword [rsp - 0x3c], ebp
xchg rbx, rax
mov qword [r14], rbx
xchg rbx, rax
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
movups xmmword [rax + 0x10], xmm0
xchg rcx, rcx
xchg rcx, rax
movups xmmword [rcx + 0x20], xmm0
xchg rcx, rax
inc rdi
xchg r9, r9
cmp word [rsi + rdi*2], bp
jne 0x1400550bd
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
mov qword [r14 + 0x38], rdi
mov dword [rsp - 0x20], ebx
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
call fcn.14001781c
cmp qword [r14 + 0x38], rbp
mov dword [rsp - 0x1c], 0x609ec458
jbe 0x140055159
mov rdx, rsi
mov r8d, 0x36ba87c9
sub r8d, 0x1b1b9ae6
xor r8d, 0x7663cb23
xor r8d, 0x6dfd273f
sub rdx, rax
mov dword [rsp - 0x28], edx

Function at 0x1400552e9
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], ch
adc dl, byte [rbx - 0x7f]
ret
Function at 0x140055540
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x30], esi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x70fd1ee8
sub rsp, 0x70fd1f08
xchg r12, rsi
mov r12, qword [rcx + 0x38]
xchg r12, rsi
xchg rsp, rdx
mov rbx, rsp
xchg rsp, rdx
mov r8, qword [rdx + 0x38]
mov dword [rsp - 0x18], 0x17fda986
mov rdi, rcx
add r8, rsi
xchg r10, rsi
mov rdx, r10
xchg r10, rsi
xchg rdx, r8
mov qword [rcx + 0x38], rdx
xchg r8, rdx
call fcn.140056250
mov r9, qword [rbx]
mov r12, r12
mov ecx, esi
and ecx, 3
mov r8d, 0x6cc6c4c2
sub r8d, 0x36766d5c
xor r8d, 0x5d7c0941
sub r8d, 0x38e5183
sub r8d, 0x65eace33
shl ecx, 3
mov edx, r8d
ror edx, cl
xchg r8, r8
xchg r10, rax
mov rax, r10
xchg r10, rax
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov dword [rsp - 0x28], esp
jbe 0x140055676
lea rax, [rsi + rsi]
mov r11d, 0x41cf055b
add r11d, 0xb0fb3c3
sub r11d, 0x4180d316
add r11d, 0x5ad0df2f
sub r11d, 0x662ec438
sub rax, r9
add r10, rax
mov dword [rsp - 0x40], 0x226c7437
nop dword [rax]
movzx eax, dx
lea r9, [r9 + 2]
xchg rdi, rdi
xor ax, r8w
ror edx, 2
ror edx, 6
and ax, r11w
ror r8d, 5
ror r8d, 2
ror r8d, 1
xor ax, word [r9 - 2]
mov dword [rsp - 0x3c], 0x3717099b
inc rcx
mov word [r10 + r9 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x14005562f
mov dword [rsp - 0xc], ebp
mov rbx, qword [rsp + 0x30]
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rsi, rbx
mov rbx, qword [rsp + 0x38]
xchg rsi, rbx
nop
sub rsp, 0x232147e6
add rsp, 0x23214806
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x1400556b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x20], ebp
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg r15, rsi
xchg r10, rdi
mov qword [rsp + 0x18], r10
xchg rdi, r10
push rdx
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r14, qword [rcx + 0x38]
mov dword [rsp - 0x20], 0x23cd0f53
xchg r14, rdi
mov r14, rdx
xchg rdi, r14
xchg rdi, rsi
mov rdi, rcx
xchg rdi, rsi
nop
movabs rbx, 0xffffffff5a5cca0c
sub rbx, 0x531d3139
xor rbx, 0x57fe493d
add rbx, 0x7fffffff
add rbx, 0x2f3e2e12
inc rbx
cmp word [rdx + rbx*2], 0
mov dword [rsp - 0x38], ecx
jne 0x140055723
lea r8, [r14 + rbx]
xchg rdx, rdi
mov rdi, r14
xchg rdx, rdi
mov qword [rcx + 0x38], r8
mov r15, r15
call fcn.140056250
mov ecx, r14d
mov edx, 0x5bc843c
add edx, 0x5dfa1651
xor edx, 0x148c83ba
xor edx, 0x76892746
and ecx, 3
shl ecx, 2
shl ecx, 1
ror edx, cl
test rbx, rbx
je 0x1400557db
xchg rcx, rcx
lea r8, [r14 + r14]
mov ecx, 0x6b8878f0
xor ecx, 0x1b569663
xor ecx, 0x42b7b92d
xor ecx, 0x32695741
sub r8, rdi
add r8, rax
mov dword [rsp - 0x38], ebx
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov rsp, rsp
lea rdi, [rdi + 2]
and ax, cx
ror edx, 3
ror edx, 4
ror edx, 1
xor ax, word [rdi - 2]
mov r8, r8
mov word [r8 + rdi - 2], ax
sub rbx, 1
jne 0x1400557af
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0xc], 0x490a9aa6
xchg rsi, rdi
mov rax, rdi
xchg rdi, rsi
mov rsi, qword [rsp + 0x38]
mov r8, r8
xchg r13, rdi
mov r13, qword [rsp + 0x40]
xchg r13, rdi
nop
sub rsp, 0x56f56254
add rsp, 0x56f56274
nop
mov r14, qword [rsp]
add rsp, 8
ret