joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4543
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov dword [rsp - 0x3c], ebp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x1f7f402e
mov qword [rsp], r15
sub rsp, 0x28
xchg r14, r15
mov r15, rdx
xchg r15, r14
mov r13d, r8d
mov edx, 0x6455fb63
xor edx, 0x2332664c
sub edx, 0x9ad0120
sub edx, 0x3db69c0f
cmp r8d, edx
mov rcx, rcx
jae 0x1400a4551
mov edx, r13d
nop
movabs rcx, 0xffffffff5deb06b1
sub rcx, 0xf1449b6
add rcx, 0x30976020
add rcx, 0x7fffffff
add rcx, 0x91e2e5
mov eax, 0x2112a4da
xor eax, 0x2136d8f2
xor eax, 0x523af0f9
add eax, 0x208564e7
sub eax, 0x72a3f1b4
mul rdx
mov rbp, rbp
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400b6e40
mov r15, rax
mov byte [rsp + 0x70], 0x5c
sub byte [rsp + 0x70], 0x10
sub byte [rsp + 0x70], 0x16
add byte [rsp + 0x70], 0x47
sub byte [rsp + 0x70], 0x7c
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
lea r12d, [r13 + 0xfffff]
xor esi, esi
shr r12d, 0x10
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
je 0x1400a4712
mov dword [rsp - 0x28], 0x2fb0c4c4
xchg r13, rbx
mov qword [rsp + 0x68], r13
xchg rbx, r13
mov ecx, 0x791a2e8e
xor ecx, 0x2139777f
sub ecx, 0x2dd321f2
add ecx, 0x3bb94cca
xor ecx, 0x661984c9
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
mov edi, esi
mov r10, r10
mov ebx, r13d
shl edi, 0x11
shl edi, 1
shl edi, 1
shl edi, 1
mov rdx, r15
sub ebx, edi
cmp ebx, ecx
mov dword [rsp - 0x40], edi
cmova ebx, ecx
xchg rcx, r11
mov r11, rax
xchg rcx, r11
mov r8d, ebx
call fcn.1400a0dc0
mov dword [rsp - 0x28], ebx
test al, al
je 0x1400a46eb
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
mov rsp, rsp
test ebx, ebx
je 0x1400a46b2
xchg r9, rcx
mov rcx, r15
xchg rcx, r9
lea ecx, [rdi + rax]
mov dword [rsp - 0x2c], ebx
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
mov dword [rsp - 0x1c], esp
xor r8d, 0x643e38cc
inc eax
mov dword [r14 + rcx*4], r8d
mov dword [rsp - 0x28], 0x3c7543f1
cmp eax, ebx
jb 0x1400a4680
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0xc], esp
inc esi
mov ecx, 0x77d28940
xor ecx, 0xfea707a
sub ecx, 0x73503b3c
xor ecx, 0x64db70e7
sub ecx, 0x6023cd19
cmp esi, r12d
xchg r8, r8
jb 0x1400a4627
jmp 0x1400a46ff
mov byte [rsp + 0x70], 0x71
xor byte [rsp + 0x70], 3
xor byte [rsp + 0x70], 0x44
sub byte [rsp + 0x70], 0x36
mov rbx, qword [rsp + 0x68]
mov r14, r14
xchg rdi, r12
mov r12, qword [rsp + 0x20]
xchg r12, rdi
xchg r15, rcx
mov r15, rcx
xchg r15, rcx
call fcn.1400b6e50
mov dword [rsp - 0x18], 0x2482470a
movzx eax, byte [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x20], 0x50b868e8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
mov dword [rsp - 0x1c], 0xa4447a6
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400a45c2
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov dword [rsp - 0x3c], ebp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x1f7f402e
mov qword [rsp], r15
sub rsp, 0x28
xchg r14, r15
mov r15, rdx
xchg r15, r14
mov r13d, r8d
mov edx, 0x6455fb63
xor edx, 0x2332664c
sub edx, 0x9ad0120
sub edx, 0x3db69c0f
cmp r8d, edx
mov rcx, rcx
jae 0x1400a4551
mov edx, r13d
nop
movabs rcx, 0xffffffff5deb06b1
sub rcx, 0xf1449b6
add rcx, 0x30976020
add rcx, 0x7fffffff
add rcx, 0x91e2e5
mov eax, 0x2112a4da
xor eax, 0x2136d8f2
xor eax, 0x523af0f9
add eax, 0x208564e7
sub eax, 0x72a3f1b4
mul rdx
mov rbp, rbp
cmovo rax, rcx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400b6e40
mov r15, rax
mov byte [rsp + 0x70], 0x5c
sub byte [rsp + 0x70], 0x10
sub byte [rsp + 0x70], 0x16
add byte [rsp + 0x70], 0x47
sub byte [rsp + 0x70], 0x7c
xchg rdi, rax
mov rdi, qword [rsp + 0x60]
xchg rdi, rax
lea r12d, [r13 + 0xfffff]
xor esi, esi
shr r12d, 0x10
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
je 0x1400a4712
mov dword [rsp - 0x28], 0x2fb0c4c4
xchg r13, rbx
mov qword [rsp + 0x68], r13
xchg rbx, r13
mov ecx, 0x791a2e8e
xor ecx, 0x2139777f
sub ecx, 0x2dd321f2
add ecx, 0x3bb94cca
xor ecx, 0x661984c9
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
mov edi, esi
mov r10, r10
mov ebx, r13d
shl edi, 0x11
shl edi, 1
shl edi, 1
shl edi, 1
mov rdx, r15
sub ebx, edi
cmp ebx, ecx
mov dword [rsp - 0x40], edi
cmova ebx, ecx
xchg rcx, r11
mov r11, rax
xchg rcx, r11
mov r8d, ebx
call fcn.1400a0dc0
mov dword [rsp - 0x28], ebx
test al, al
je 0x1400a46eb
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
mov rsp, rsp
test ebx, ebx
je 0x1400a46b2
xchg r9, rcx
mov rcx, r15
xchg rcx, r9
lea ecx, [rdi + rax]
mov dword [rsp - 0x2c], ebx
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
mov dword [rsp - 0x1c], esp
xor r8d, 0x643e38cc
inc eax
mov dword [r14 + rcx*4], r8d
mov dword [rsp - 0x28], 0x3c7543f1
cmp eax, ebx
jb 0x1400a4680
mov rax, qword [rsp + 0x60]
mov dword [rsp - 0xc], esp
inc esi
mov ecx, 0x77d28940
xor ecx, 0xfea707a
sub ecx, 0x73503b3c
xor ecx, 0x64db70e7
sub ecx, 0x6023cd19
cmp esi, r12d
xchg r8, r8
jb 0x1400a4627
jmp 0x1400a46ff
mov byte [rsp + 0x70], 0x71
xor byte [rsp + 0x70], 3
xor byte [rsp + 0x70], 0x44
sub byte [rsp + 0x70], 0x36
mov rbx, qword [rsp + 0x68]
mov r14, r14
xchg rdi, r12
mov r12, qword [rsp + 0x20]
xchg r12, rdi
xchg r15, rcx
mov r15, rcx
xchg r15, rcx
call fcn.1400b6e50
mov dword [rsp - 0x18], 0x2482470a
movzx eax, byte [rsp + 0x70]
neg rsp
add rsp, 0xffffffffffffffd8
neg rsp
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x20], 0x50b868e8
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
mov dword [rsp - 0x1c], 0xa4447a6
pop rsi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400a4780
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x2c], 0x28a07693
mov qword [rsp + 0x20], rsi
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0xf5179c8
sub rsp, 0xf5179e8
mov r14d, r8d
xchg rdx, rdx
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
mov r9d, r14d
xchg r11, r11
xchg r13, rcx
mov rcx, r13
xchg r13, rcx
cmp r8d, 0x40000
xchg rsp, rsp
jb 0x1400a4814
mov r9d, 0x66086820
xor r9d, 0x3e113291
sub r9d, 0x9ed455c
xor r9d, 0x4e281555
nop
movabs rcx, 0xffffffff1d0a17b6
add rcx, 0x11fae1db
xor rcx, 0x5e25e8da
sub rcx, 0x3f5666d0
add rcx, 0x7fffffff
xor rcx, 0x4e355585
mov eax, 0x5335c14d
sub eax, 0x2a95f70f
xor eax, 0x2e9cf116
add eax, 0x465143a7
sub eax, 0x4c547ecb
mul r9
mov dword [rsp - 0x14], edi
cmovo rax, rcx
xchg rcx, rbp
mov rbp, rax
xchg rbp, rcx
call fcn.1400b6e40
mov dword [rsp - 0x1c], esi
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 0x13
shr r15d, 1
xor ebx, ebx
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov r12b, 0x57
sub r12b, 0xd
add r12b, 0x18
sub r12b, 0x19
xor r12b, 0x48
test r15d, r15d
je 0x1400a49b2
mov dword [rsp - 0x24], 0x8c660a4
nop
mov r8d, ebx
mov r10d, r14d
shl r8d, 0x11
shl r8d, 1
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
shr r8d, 2
xchg rdx, rdx
cmp r10d, 0x100000
jbe 0x1400a4927
mov r10d, 0x20a3c694
add r10d, 0x2b4966d
xor r10d, 0x67a7064e
sub r10d, 0x9e25c3
sub r10d, 0x4451358c
mov r11d, 0xae9e561
add r11d, 0x667e0e2b
xor r11d, 0x5aa3a92d
sub r11d, 0x2bc05aa1
jmp 0x1400a4940
mov r11d, r10d
mov rbx, rbx
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x1400a4976
mov dword [rsp - 0xc], ebp
mov r9, rbp
nop dword [rax]
lea edx, [r8 + rax]
xchg rbp, rbp
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xor ecx, 0x643e38cc
mov dword [rsp - 0x20], ecx
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
mov r8, r8
jb 0x1400a494a
mov r8d, r10d
xchg rdx, rbp
mov rbp, rdx
xchg rbp, rdx
xchg r8, rcx
mov r8, r13
xchg rcx, r8
call fcn.1400a13e0
mov dword [rsp - 0x1c], esp
test al, al
je 0x1400a49af
inc ebx
cmp ebx, r15d
xchg r9, r9
jb 0x1400a48b9
jmp 0x1400a49b2
xor r12b, r12b
xchg rcx, r12
mov r12, rbp
xchg r12, rcx
call fcn.1400b6e50
xchg r14, rbx
mov r14, qword [rsp + 0x50]
xchg rbx, r14
movzx eax, r12b
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov dword [rsp - 0x28], 0x53b27dce
nop
add rsp, 0x748f4e97
sub rsp, 0x748f4e77
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rdi
mov dword [rsp - 0x44], 0x133667fc
ret
Function at 0x1400a4a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, rsi
mov qword [rsp + 0x18], rsi
xchg rbp, rsi
nop
push r8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
push 0x70b39168
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov eax, 0x96f152a
add eax, 0x3d74f9f0
add eax, 0x3ee5a1f
xor eax, 0x6f419edd
sub eax, 0x2593e7c4
call fcn.1400b76f0
xchg r8, r8
sub rsp, rax
xchg r13, r15
mov r13, rcx
xchg r15, r13
call fcn.1400b8b60
mov ebp, eax
and ebp, 0x3fc
mov dword [rsp - 0x30], ebp
jbe 0x1400a4ae7
lea rdi, [rsp + 0x20]
mov esi, ebp
call fcn.1400b8b60
mov rcx, rcx
movzx ebx, ax
shl ebx, 6
shl ebx, 6
shl ebx, 2
shl ebx, 1
shl ebx, 1
call fcn.1400b8b60
mov dword [rsp - 0x44], 0xc3fc0ae
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
mov dword [rsp - 0x14], edx
sub rsi, 1
jne 0x1400a4aa8
lea r14d, [rbp*4]
xchg r15, r15
mov eax, 0x45bc6169
xor eax, 0xa210899
xor eax, 0x957917c
sub eax, 0x46caf888
mov ecx, r14d
mov r13, r13
mul rcx
pushf
movabs rcx, 0xffffffff38d7a050
add rcx, 0x44dc41ef
xor rcx, 0x124df9cf
xor rcx, 0x499336a6
add rcx, 0x7fffffff
xor rcx, 0x5992d2aa
popf
cmovo rax, rcx
xchg rsi, rcx
mov rsi, rax
xchg rsi, rcx
call fcn.1400b6e40
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
mov rsi, rsi
shr ebp, 5
shr ebp, 0xf
xor ebx, ebx
xchg rbx, rax
mov rsi, rbx
xchg rbx, rax
mov r12b, 0x52
sub r12b, 0x28
add r12b, 0x2b
xor r12b, 9
sub r12b, 0x5b
test ebp, ebp
mov dword [rsp - 0x44], 0x61cf0d50
je 0x1400a4c9e
nop
mov r8d, ebx
mov r13, r13
mov r10d, r14d
shl r8d, 4
shl r8d, 0xf
shl r8d, 1
xor eax, eax
xchg r15, r15
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov r14, r14
jbe 0x1400a4c08
mov r10d, 0x56e0aa8
add r10d, 0x5178ea3f
add r10d, 0x147a16c8
sub r10d, 0x33eca0b5
xor r10d, 0x37646afa
mov r11d, 0x6b8650c2
sub r11d, 0x2a1500d4
sub r11d, 0x1655e188
sub r11d, 0x2b176e66
jmp 0x1400a4c20
mov r11d, r10d
shr r11d, 2
mov dword [rsp - 0x40], 0x2374c4e9
test r11d, r11d
je 0x1400a4c66
xchg r14, rsi
mov r9, r14
xchg r14, rsi
nop dword [rax]
mov dword [rsp - 0x3c], 0x422d0d87
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
mov rcx, rcx
xor ecx, 0x643e38cc
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0xc], 0x513823e4
cmp eax, r11d
jb 0x1400a4c38
mov r8d, r10d
mov dword [rsp - 0x44], edi
xchg rsi, r9
mov rdx, r9
xchg r9, rsi
mov rcx, r15
xchg rsp, rsp
call fcn.1400a13e0
test al, al
je 0x1400a4c9b
inc ebx
xchg rsp, rsp
cmp ebx, ebp
jb 0x1400a4b94
jmp 0x1400a4c9e
xor r12b, r12b
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.1400b6e50
xchg r8, r8
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov rbx, qword [r11 + 0x38]
mov dword [rsp - 0x2c], 0xa66cce7
mov rbp, qword [r11 + 0x40]
xchg r14, rsp
mov r14, r11
xchg rsp, r14
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x1400a7310
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400a960a
xchg rcx, rbx
mov r10, rbx
xchg rcx, rbx
mov eax, dword [0x1404dc094]
cmp qword [0x1404dc0a8], 0
mov dword [rsp - 0x14], 0xb6b8001
jne 0x1400a8ad0
syscall
ret
Function at 0x1400aa550
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
mov ebx, edx
mov r8d, ecx
test ecx, ecx
xchg r12, r12
jne 0x1400aa579
xor eax, eax
xchg rbx, r9
mov r9, qword [rsp + 8]
xchg rbx, r9
ret
xor r10d, r10d
mov dword [rsp - 0x18], ebx
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
nop dword [rax]
mov dword [rsp - 0x3c], 0x1a0b363b
nop word [rax + rax]
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
xchg r15, r15
mov r9d, eax
test r11b, 1
cmove ecx, edx
xchg rdi, rdi
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
mov dword [rsp - 0x40], ebx
cmovb r9d, eax
shr r11d, 1
jne 0x1400aa59f
mov r11d, r8d
xchg rsp, rsp
mov r9d, r10d
test ecx, ecx
je 0x1400aa626
mov dword [rsp - 0x40], ecx
lea eax, [r11 + r11]
mov ecx, r9d
xor ecx, r11d
xchg rdi, rdi
mov r11d, eax
test dl, 1
cmove ecx, r9d
mov dword [rsp - 0x2c], 0x95d1175
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
mov dword [rsp - 0x3c], 0x191bd5ef
cmovb r11d, eax
shr edx, 1
jne 0x1400aa5e8
mov r11d, r9d
mov r10, r10
mov edx, r10d
test r9d, r9d
je 0x1400aa681
mov dword [rsp - 0x30], ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov dword [rsp - 0x38], esp
mov ecx, edx
xor ecx, r11d
mov r11d, eax
xchg rbp, rbp
test r9b, 1
cmove ecx, edx
xor r11d, ebx
mov r12, r12
cmp eax, 0x100
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
xchg r10, r10
jne 0x1400aa64a
test edx, edx
je 0x1400aa6cd
nop word [rax + rax]
mov rsp, rsp
mov ecx, r10d
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov dword [rsp - 0x14], ebp
mov r10d, ecx
lea ecx, [r8 + r8]
mov r8d, ecx
mov r15, r15
xor r8d, ebx
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
mov dword [rsp - 0x34], 0x413c57a1
jne 0x1400aa692
xchg rbx, rbp
mov rbp, qword [rsp + 8]
xchg rbx, rbp
mov eax, r10d
mov dword [rsp - 0x18], esi
ret
Function at 0x1400b76f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
xchg r12, r10
mov qword [rsp], r12
xchg r12, r10
xchg r11, r15
mov qword [rsp + 8], r15
xchg r11, r15
xor r11, r11
lea r10, [rsp + 0x18]
xchg r15, r15
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
mov rdi, rdi
bnd jae 0x1400b7757
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov dword [rsp - 0x30], edx
mov byte [r11], 0x55
sub byte [r11], 0x43
xor byte [r11], 0x3f
sub byte [r11], 0x2d
cmp r10, r11
mov rbp, rbp
bnd jne 0x1400b7733
mov r10, qword [rsp]
xchg rdi, r11
mov rdi, qword [rsp + 8]
xchg rdi, r11
sub rsp, 0xfffffffffffffff0
bnd ret
Function at 0x1404bd660
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov rdi, rdi
xchg rbx, r10
mov qword [r11 + 8], r10
xchg r10, rbx
xchg r12, rbp
mov qword [r11 + 0x10], r12
xchg r12, rbp
mov qword [r11 + 0x18], rsi
mov dword [rsp - 0x2c], 0x6dc64a8c
mov qword [r11 + 0x20], rdi
push r14
nop
add rsp, 0xf294c97
sub rsp, 0xf294cf7
xchg rbp, r14
mov r14, qword [rcx + 0xb8]
xchg rbp, r14
lea rax, [r11 - 0x40]
mov rsi, qword [rcx + 0x80]
mov dword [rsp - 0x14], 0x544af81f
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
lea rcx, [r11 - 0x48]
mov rsp, rsp
mov rbx, rdx
lea rdx, [rbp + 1]
xchg rsp, rdi
movups xmmword [rdi + 0x28], xmm0
xchg rdi, rsp
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp - 0x1c], 0x51f9446f
call fcn.140010f10
mov edi, 0x2c4ac051
xor edi, 0x1c369cb9
add edi, 0x103e405e
sub edi, 0xf8a6fbf
mov r9, rax
mov dword [rsp - 0xc], ecx
mov ecx, edi
mov r14d, 0x6b2d42d
sub r14d, 0x50ee8f3
add r14d, 0x228a7866
xor r14d, 0x242e635f
test rbp, rbp
mov dword [rsp - 0x30], edx
je 0x1404bd779
xchg r11, rdx
mov r11, rax
xchg rdx, r11
sub rsi, rax
xchg r8, rbp
mov rbp, r8
xchg r8, rbp
nop
movzx eax, cx
xchg r13, r13
lea rdx, [rdx + 2]
and ax, r14w
ror ecx, 7
ror ecx, 1
xor ax, word [rsi + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
mov dword [rsp - 0x20], edi
jne 0x1404bd74f
xor esi, esi
mov word [r9 + rbp*2], si
mov r12, r12
xchg rcx, r15
mov r15, qword [rsp + 0x20]
xchg r15, rcx
lea edx, [rsi + 0x5c]
call fcn.1400b8290
lea rcx, [rbx + 8]
mov dword [rsp - 0x18], edx
xorps xmm0, xmm0
xchg rcx, r8
mov qword [rbx], r8
xchg rcx, r8
xchg rcx, rbp
movups xmmword [rbp], xmm0
xchg rbp, rcx
movups xmmword [rcx + 0x10], xmm0
xchg rdi, rdi
xchg rcx, rbx
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rcx
test rax, rax
je 0x1404bd8bd
lea rbp, [rax + 2]
mov dword [rsp - 0x28], edx
nop
movabs rdx, 0xffffffff758d151d
sub rdx, 0x1f0a1e5a
xor rdx, 0x16f8fe90
add rdx, 0x7fffffff
xor rdx, 0x3f85f7ad
inc rdx
xchg r15, r15
cmp word [rbp + rdx*2], si
jne 0x1404bd7fd
xchg r13, rcx
mov r13, rbx
xchg r13, rcx
mov qword [rbx + 0x38], rdx
call fcn.140010f10
mov dword [rsp - 0x38], 0x6267fd3d
cmp qword [rbx + 0x38], rsi
jbe 0x1404bd876
sub rbp, rax
nop word [rax + rax]
mov dword [rsp - 0x1c], esp
movzx ecx, di
lea rax, [rax + 2]
and cx, r14w
ror edi, 3
ror edi, 2
ror edi, 3
xor cx, word [rax + rbp - 2]
inc rsi
mov dword [rsp - 0x20], 0x73840d58
mov word [rax - 2], cx
cmp rsi, qword [rbx + 0x38]
jb 0x1404bd844
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0x44], 0x1510eb71
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1404bd8cc
mov dword [rsp - 0x38], edx
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x12e4ca06
add ecx, 0x553a2a2e
xor ecx, 0xbf28842
sub ecx, 0x63ec7c46
rep stosb byte [rdi], al
mov r14, r14
jmp 0x1404bd8d1
xchg r11, rsi
mov qword [rbx + 0x38], r11
xchg r11, rsi
jmp 0x1404bd876
call fcn.1400b6f90
lea r11, [rsp + 0x60]
mov dword [rsp - 0x40], edx
mov rax, rbx
xchg rbx, r10
mov r10, qword [r11 + 0x10]
xchg rbx, r10
mov rbp, qword [r11 + 0x18]
xchg r9, rsi
mov r9, qword [r11 + 0x20]
xchg r9, rsi
mov rdi, qword [r11 + 0x28]
xchg rdx, rsp
mov rdx, r11
xchg rsp, rdx
pop r14
ret
Function at 0x1400056a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000579b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x1400057a3
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400057da
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x1400057b0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140005805
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000582b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140005810
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000b0b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140030008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000b0f5
xor al, al
jmp 0x14000b142
cmp word [rbx], 0
je 0x14000b10d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000b100
cmp word [rsp + 0x30], 0
je 0x14000b13b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000b163
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000b120
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c8d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.140010b8c
int3
Function at 0x14000b220
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
movzx eax, cl
mov rcx, qword [0x140030ac0]
test rcx, rcx
je 0x14000b291
test al, al
je 0x14000b266
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x14000b25f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_send_CTRL_C_to_child_process.
call fcn.14000bd10
mov rcx, qword [0x140030ac0]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b284
mov rcx, qword [0x140030ac0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140030ac0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030acd], 0
je 0x14000b389
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140024c18]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14003d340]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b36a
test al, 0x10
je 0x14000b36a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b310
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000b4e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14000c870
sub rsp, rax
mov rax, qword [0x140030008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x140030ac8]
lea rsi, [0x14003f340]
mov rdi, rcx
test r11d, r11d
jne 0x14000b559
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000b650
test al, al
je 0x14000b639
lea rcx, [rsp + 0x20]
call fcn.140014fd0
movsxd r11, dword [0x140030ac8]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x140030ac8], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000b594
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000b584
add rax, 2
test ecx, ecx
jne 0x14000b570
test edx, edx
je 0x14000b5b7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000b564
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000b5a0
cmp rax, 2
jne 0x14000b5bb
cmp word [rdi + 2], 0x3a
jne 0x14000b5bb
mov al, 1
jmp 0x14000b618
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000b5e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b60d
mov bl, 1
cmp dword [0x140030ac8], 0x400
jge 0x14000b60d
mov rcx, rdi
call fcn.140014fd0
movsxd rdx, dword [0x140030ac8]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x140030ac8], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000c8d0
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000bb70
int3