joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rdi, rcx
call qword [rax + 0x78]
mov rdx, qword [rdi + 0x650]
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x30], rax
call fcn.140038be0
mov rcx, rdi
call fcn.1400382b0
mov rcx, qword [0x1404a2ba8]
mov rdx, qword [rax + 0x98]
call fcn.14002fc10
mov rcx, rax
call fcn.14003c090
lea rcx, [rdi + 0x648]
mov qword [rbx + 0x20], rax
lea rdx, [rsp + 0x30]
call fcn.14002d580
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
sub rsp, 0xffffffffffffffe0
pop rdi
jmp 0x140048dd0
push rbx
add rsp, 0xffffffffffffffe0
cmp qword [rcx + 0x650], 0
mov rbx, rcx
je 0x140048efb
lea rdx, [rsp + 0x30]
call fcn.140039290
mov r8, qword [rsp + 0x30]
mov r11d, 0x16cdd525
add r11d, 0x247b8969
xor r11d, 0x3b495e2e
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x650]
mov rdx, qword [rbx + 0x650]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140048eb1
mov rax, qword [rbx + 0x648]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140048eac
mov r8d, r11d
xor r8d, 0x35cb7a53
xor r9d, 0x35cb7a53
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x35cb7a53
add r10d, r11d
add rax, 8
mov dword [rdx + 0x38], ecx
mov dword [rdx + 0x3c], 0x4dfcf622
xor dword [rdx + 0x3c], 0x44d476e
sub dword [rdx + 0x3c], 0x13e636f9
mov dword [rdx + 0x40], r8d
mov dword [rdx + 0x44], r9d
cmp rax, rdi
jne 0x140048e66
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x668]
test rax, rax
je 0x140048ef3
sub r8d, r9d
mov dword [rax + 0x1c], 0x5dbc3ee8
add dword [rax + 0x1c], 0x1ca08d0f
sub dword [rax + 0x1c], 0x449151a4
xor r8d, 0x35cb7a53
xor r9d, 0x35cb7a53
mov dword [rax + 0x18], r8d
mov dword [rax + 0x20], r9d
mov dword [rax + 0x24], r9d
mov rcx, rbx
call fcn.140038340
sub rsp, 0xffffffffffffffe0
pop rbx
ret

Function at 0x140052a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x187fc2a6
sub rsp, 0x187fc2c6
mov rbx, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
nop
movabs rdx, 0xffffffff4d7d8d0d
sub rdx, 0x38d12d67
add rdx, 0x69c5acb4
add rdx, 0x7fffffff
xor rdx, 0x18df3a6
nop word [rax + rax]
inc rdx
xchg rbp, rbp
cmp word [rbx + rdx*2], 0
jne 0x140052a89
xchg rdx, r9
mov qword [rcx + 0x38], r9
xchg rdx, r9
call fcn.14000ed90
mov rcx, rcx
xor r8d, r8d
mov edx, 0x1f0bbf58
xor edx, 0xd3ac777
add edx, 0x6cbc1be1
sub edx, 0x6c2a7781
cmp qword [rdi + 0x38], r8
jbe 0x140052b32
xchg r10, r10
sub rbx, rax
mov r9d, 0x1e9062b6
sub r9d, 0x506b993
xor r9d, 0x11efb2ee
add r9d, 0x674c3c73
sub r9d, 0x6fb25741
nop word [rax + rax]
mov dword [rsp - 0xc], esp
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
mov dword [rsp - 0x10], ecx
ror edx, 8
xor cx, word [rax + rbx - 2]
inc r8
mov word [rax - 2], cx
mov dword [rsp - 0x14], 0x72210e7a
cmp r8, qword [rdi + 0x38]
jb 0x140052b02
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
xchg r14, rdi
mov rax, r14
xchg rdi, r14
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140053500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg rsp, rsp
nop
push 0x1e2b7d2a
mov qword [rsp], rdi
nop
add rsp, 0x51f4008e
sub rsp, 0x51f400ae
xchg rdi, rsi
mov rdi, qword [rcx + 0x38]
xchg rdi, rsi
mov rbx, rdx
xchg rbx, rbx
mov r8, qword [rdx + 0x38]
xchg rdi, rsp
mov rsp, rcx
xchg rdi, rsp
add r8, rsi
mov rbx, rbx
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r8, r10
mov qword [rcx + 0x38], r10
xchg r10, r8
call fcn.1400541f0
mov dword [rsp - 0x1c], 0x2c8155e8
xchg rsi, r9
mov rsi, qword [rbx]
xchg rsi, r9
mov ecx, esi
and ecx, 3
mov r8d, 0x217f0953
sub r8d, 0xadff4bd
add r8d, 0x68bb523d
sub r8d, 0x673791b1
sub r8d, 0x55fb893
shl ecx, 1
shl ecx, 2
mov edx, r8d
mov dword [rsp - 0x40], ebp
ror edx, cl
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
jbe 0x140053637
xchg rsi, rsi
lea r10, [rsi + rsi]
mov r11d, 0x6fe6acb7
xor r11d, 0xe4eeebd
sub r11d, 0x301c6661
xor r11d, 0x32c497ed
xor r11d, 0x34f4cbb
sub r10, r9
mov dword [rsp - 0x44], esp
add r10, rax
nop word [rax + rax]
movzx eax, dx
mov dword [rsp - 0x18], ebp
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 4
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 1
and ax, r11w
xchg r10, r10
ror r8d, 1
ror r8d, 7
xor ax, word [r9 - 2]
mov r9, r9
inc rcx
mov word [r9 + r10 - 2], ax
cmp rcx, qword [rbx + 0x38]
mov dword [rsp - 0x20], 0x3a818dbf
jb 0x1400535ec
mov rbx, qword [rsp + 0x30]
xchg r12, rdi
mov rax, r12
xchg r12, rdi
xchg rsi, rbx
mov rbx, qword [rsp + 0x38]
xchg rsi, rbx
nop
add rsp, 0x49b7b8c8
sub rsp, 0x49b7b8a8
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x140053670
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg r15, rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp - 0x3c], 0x5afd6878
nop
push 0x4ff031
mov qword [rsp], r14
nop
sub rsp, 0x57316bc2
add rsp, 0x57316ba2
mov r14, qword [rcx + 0x38]
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
xchg rsi, rdx
mov rdx, rcx
xchg rsi, rdx
nop
movabs rbx, 0xffffffff3cdb5636
xor rbx, 0x3c6200e
add rbx, 0x2968f920
xor rbx, 0x4546e29f
add rbx, 0x7fffffff
xor rbx, 0x523f7239
inc rbx
xchg rbx, rbx
cmp word [rdx + rbx*2], 0
jne 0x1400536f0
lea r8, [r14 + rbx]
xchg r14, rdx
mov r14, rdx
xchg r14, rdx
mov qword [rcx + 0x38], r8
call fcn.1400541f0
mov ecx, r14d
mov rcx, rcx
mov edx, 0x2a5e4170
sub edx, 0x244c9f04
add edx, 0x577493ed
sub edx, 0x4ac319ca
and ecx, 3
mov dword [rsp - 0x3c], esp
shl ecx, 2
shl ecx, 1
ror edx, cl
xchg rbx, rbx
test rbx, rbx
je 0x1400537af
lea rcx, [r14 + r14]
mov r8d, 0x69dd2c60
add r8d, 0x1ed3930
sub r8d, 0x4e1f9d5f
sub r8d, 0x1daac732
sub rcx, rdi
add rcx, rax
mov dword [rsp - 0x38], ebx
nop word [rax + rax]
movzx eax, dx
lea rdi, [rdi + 2]
xchg rbp, rbp
and ax, r8w
ror edx, 5
ror edx, 2
ror edx, 1
xor ax, word [rdi - 2]
mov word [rdi + rcx - 2], ax
mov dword [rsp - 0x2c], edx
sub rbx, 1
jne 0x140053782
mov rbx, qword [rsp + 0x30]
mov rcx, rcx
xchg rsi, r14
mov rax, r14
xchg rsi, r14
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0x30], 0x4613837b
mov rdi, qword [rsp + 0x40]
nop
add rsp, 0x10ee2cf0
sub rsp, 0x10ee2cd0
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140053f76
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg r10, rbx
xchg r8, rbp
mov qword [rsp + 0x18], r8
xchg r8, rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r11
mov qword [rsp], r14
nop
add rsp, 0x36973b8f
sub rsp, 0x36973baf
lea rsi, [rdx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x24], ecx
xchg rsi, r12
mov qword [rdx], r12
xchg rsi, r12
xor edi, edi
xchg rbx, rsi
movups xmmword [rbx], xmm0
xchg rsi, rbx
xchg r14, r10
mov r10, r9
xchg r10, r14
mov rbp, r8
xchg rsi, rcx
movups xmmword [rcx + 0x10], xmm0
xchg rsi, rcx
xchg rcx, rbx
mov rcx, rdx
xchg rbx, rcx
xchg rbp, rsi
movups xmmword [rbp + 0x20], xmm0
xchg rsi, rbp
xchg r12, rdi
mov qword [rdx + 0x38], r12
xchg r12, rdi
xchg rbx, rax
mov rbx, qword [rcx + 0x38]
xchg rbx, rax
cmp r8, rax
xchg r8, r8
jae 0x140054183
sub rax, r8
mov qword [rsp + 0x40], r15
cmp rax, r9
xchg r8, r8
cmovb r14, rax
mov qword [rdx + 0x38], r14
mov rax, qword [rcx]
mov dword [rsp - 0x1c], 0x7e2202e8
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14005400c
mov r9, r9
call fcn.140098620
cmp r14, 0x18
jbe 0x140054052
mov dword [rsp - 0x18], 0x7bec916d
lea rcx, [r14 + r14]
call fcn.140098900
mov qword [rbx], rax
mov dword [rsp - 0xc], 0x4945dcc4
test rax, rax
jne 0x140054064
xchg r10, rsi
mov qword [rbx], r10
xchg rsi, r10
xchg rdi, r10
mov r9, r10
xchg r10, rdi
jmp 0x140054087
xchg rsi, r8
mov qword [rbx], r8
xchg rsi, r8
xchg rdi, rsi
mov rax, rdi
xchg rsi, rdi
xorps xmm0, xmm0
mov r14, r14
movups xmmword [rax], xmm0
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
xchg r13, rax
movups xmmword [r13 + 0x20], xmm0
xchg r13, rax
xchg rdx, r9
mov rdx, qword [rbx]
xchg rdx, r9
and ebp, 3
xchg rbp, rbp
mov r8d, 0x3ba9fb40
add r8d, 0x10ed3cc9
add r8d, 0x1120a7d7
sub r8d, 0x174d5396
xor r8d, 0x54a990c5
shl ebp, 3
mov dword [rsp - 0x30], 0x22eeac7
mov edx, r8d
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
xchg r12, r12
jbe 0x14005413a
sub r15, r9
mov ecx, 0x28fa853c
add ecx, 0x2fd4ecae
xor ecx, 0x4b4eb5ff
add ecx, 0x3b9b8d96
sub ecx, 0x4f1d50ac
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
xchg r13, r13
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 8
mov dword [rsp - 0x44], edi
and ax, cx
ror r8d, 7
ror r8d, 1
xor ax, word [r9 + r15 - 2]
xchg r9, r9
inc rdi
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
xchg r10, r10
jb 0x1400540fd
mov r15, qword [rsp + 0x40]
mov rax, rbx
mov dword [rsp - 0x2c], 0x15fb347d
mov rbx, qword [rsp + 0x48]
xchg r13, rbp
mov r13, qword [rsp + 0x50]
xchg rbp, r13
nop
add rsp, 0x74387c5e
sub rsp, 0x74387c3e
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
mov dword [rsp - 0x2c], esp
ret
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x14005414a
Function at 0x140054830
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e15
mov r10, rcx
xchg r14, r14
mov eax, dword [0x1404a2fc0]
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov dword [rsp - 0x14], edi
ret

Function at 0x140054850
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov dword [rsp - 0x40], ebp
mov byte [rsp + 0x28], al
jmp 0x14008945e
xchg rcx, r12
mov r10, r12
xchg rcx, r12
mov eax, dword [0x1404a3058]
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
mov dword [rsp - 0x44], ecx
syscall
ret

Function at 0x140054870
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088c17
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a2f90]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x34], ecx
jne 0x140088ba0
syscall
ret

Function at 0x140054880
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008906c
xchg r10, r8
mov r8, rcx
xchg r8, r10
mov eax, dword [0x1404a2ff8]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x28], 0xb14c53f
jne 0x140088ba0
syscall
ret

Function at 0x140054890
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088c6d
xchg r13, rcx
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404a2f98]
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
mov rsi, rsi
syscall
ret

Function at 0x1400548a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089266
xchg r12, r10
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1404a3028]
xchg rdx, rdx
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
xchg r13, r13
ret

Function at 0x1400548b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e3c
xchg rcx, rbx
mov r10, rbx
xchg rbx, rcx
mov eax, dword [0x1404a2fc4]
mov dword [rsp - 0x18], edx
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov r15, r15
ret

Function at 0x1400548d0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088c45
mov r10, rcx
mov eax, dword [0x1404a2f94]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x28], edi
jne 0x140088ba0
syscall
ret

Function at 0x1400548e0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400891ec
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a301c]
mov r14, r14
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
ret

Function at 0x1400548f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089017
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a2ff0]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x20], 0x7fd604d
jne 0x140088ba0
syscall
ret

Function at 0x140054900
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089045
mov r10, rcx
mov eax, dword [0x1404a2ff4]
mov dword [rsp - 0x3c], ecx
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov r14, r14
ret

Function at 0x140054910
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088ebe
mov r10, rcx
mov dword [rsp - 0x3c], ecx
mov eax, dword [0x1404a2fd0]
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov rdx, rdx
ret
Function at 0x140054920
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x58], al
xchg r14, r14
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x140089434
xchg rcx, r13
mov r10, r13
xchg r13, rcx
mov eax, dword [0x1404a3054]
mov dword [rsp - 0x30], edx
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
ret

Function at 0x140054940
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d43
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404a2fac]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x44], ebp
jne 0x140088ba0
syscall
ret

Function at 0x140054950
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d6d
mov r10, rcx
mov eax, dword [0x1404a2fb0]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0xc], edx
jne 0x140088ba0
syscall
ret

Function at 0x140054960
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d91
xchg r14, r10
mov r14, rcx
xchg r14, r10
mov eax, dword [0x1404a2fb4]
mov dword [rsp - 0x28], esi
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
ret

Function at 0x140054970
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088dbb
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a2fb8]
mov dword [rsp - 0x44], esp
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
xchg r10, r10
ret

Function at 0x140054980
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088d1a
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a2fa8]
cmp qword [0x1404a30a8], 0
mov rbx, rbx
jne 0x140088ba0
syscall
ret

Function at 0x140054990
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089292
mov r10, rcx
mov eax, dword [0x1404a302c]
cmp qword [0x1404a30a8], 0
mov rbp, rbp
jne 0x140088ba0
syscall
ret

Function at 0x1400549a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088de8
xchg rcx, r8
mov r10, r8
xchg r8, rcx
mov eax, dword [0x1404a2fbc]
mov r14, r14
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov dword [rsp - 0x1c], ebx
ret

Function at 0x1400549b0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088c96
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404a2f9c]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x34], esp
jne 0x140088ba0
syscall
ret

Function at 0x1400549c0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e69
xchg rcx, r9
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1404a2fc8]
xchg r13, r13
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
ret

Function at 0x1400549f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x140089488
add rsp, 0xfffffffffffffee0
lea rcx, [0x140088c0a]
mov dword [rsp - 0x28], 0x51cccb72
nop
sub rsp, 8
mov qword [rsp], rcx
push rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push qword [0x1404a30b0]
lea rsi, [rsp + 0x170]
xchg r12, r12
lea rdi, [rsp + 0x28]
mov ecx, 0x55c01dbc
sub ecx, 0x2386e2bb
add ecx, 0x17e7367d
sub ecx, 0x4a20716e
rep movsq qword [rdi], qword [rsi]
jmp qword [0x1404a30a8]
xchg rbx, r10
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1404a305c]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x40], 0x4f122acd
jne 0x140088ba0
syscall
ret
Function at 0x140054a00
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088cee
xchg rbx, r10
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1404a2fa4]
xchg r10, r10
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov r13, r13
ret

Function at 0x140054a10
Capabilities:
Execute syscall

Disassembly:
jmp 0x14008940b
xchg rcx, r12
mov r10, r12
xchg r12, rcx
mov eax, dword [0x1404a3050]
cmp qword [0x1404a30a8], 0
mov r13, r13
jne 0x140088ba0
syscall
ret

Function at 0x140054a20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400893b4
xchg r13, rcx
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404a3048]
cmp qword [0x1404a30a8], 0
xchg rbp, rbp
jne 0x140088ba0
syscall
ret

Function at 0x140054a30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400893dd
xchg r12, r10
mov r12, rcx
xchg r10, r12
mov eax, dword [0x1404a304c]
cmp qword [0x1404a30a8], 0
mov dword [rsp - 0x38], 0x4e5d8578
jne 0x140088ba0
syscall
ret

Function at 0x140054a40
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088cc0
xchg rcx, r8
mov r10, r8
xchg r8, rcx
mov eax, dword [0x1404a2fa0]
mov dword [rsp - 0x20], esi
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
mov dword [rsp - 0x10], ebx
ret

Function at 0x140054a50
Capabilities:
Execute syscall

Disassembly:
jmp 0x140088e92
xchg rcx, r9
mov r10, r9
xchg rcx, r9
mov eax, dword [0x1404a2fcc]
xchg r10, r10
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
syscall
xchg rbp, rbp
ret
Function at 0x1400580d0
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
mov qword [rax + 0x10], rbx
mov dword [rsp - 0x24], edx
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffa0
mov rbx, rbx
movabs rbx, 0x7be217502771d95
add rbx, 0x86ef6d7
add rbx, 0x397f2698
xor rbx, 0x645d4ce4
xor rbx, 0x5330264e
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
cmp qword [rcx + 0x30], rbx
mov dword [rsp - 0x34], 0x73cf29cf
jne 0x140058316
mov dword [rax - 0x48], 0x627a9735
sub dword [rax - 0x48], 0x35c5008c
xor dword [rax - 0x48], 0x5d36704e
sub dword [rax - 0x48], 0x710be619
xor r8d, r8d
mov dword [rax - 0x44], 0x77fb1c1f
sub dword [rax - 0x44], 0x3a25300f
sub dword [rax - 0x44], 0x35d7333
add dword [rax - 0x44], 0x3abc1599
sub dword [rax - 0x44], 0x74c18dc1
mov dword [rax - 0x40], 0x7bcf2130
sub dword [rax - 0x40], 0x172cee55
add dword [rax - 0x40], 0x216dc9d
sub dword [rax - 0x40], 0x66440e79
mov dword [rax - 0x3c], 0x5a18de6e
sub dword [rax - 0x3c], 0x2775c675
sub dword [rax - 0x3c], 0x20b47221
sub dword [rax - 0x3c], 0x11cea4e8
mov dword [rax - 0x38], 0xb8475a6
add dword [rax - 0x38], 0x4f659b67
sub dword [rax - 0x38], 0x57517faa
xor dword [rax - 0x38], 0x27de8eab
sub dword [rax - 0x38], 0x23ce1f27
mov dword [rax - 0x34], 0x6f8986ff
xor dword [rax - 0x34], 0x7994bdeb
xor dword [rax - 0x34], 0x52bc0a90
sub dword [rax - 0x34], 0x442330d5
xchg r15, r8
mov qword [rsp + 0x70], r15
xchg r15, r8
xchg rdi, rax
mov rdi, qword [rsp + 0x70]
xchg rdi, rax
nop word [rax + rax]
mov rcx, qword [rsp + 0x70]
xchg rsi, rsi
xchg r14, rax
mov r14, qword [rsp + 0x70]
xchg r14, rax
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov dword [rsp - 0xc], 0x62652cef
mov eax, 0x719bfd13
xor eax, 0x7be76384
add eax, 0x4572a1d7
sub eax, 0x3d2c23df
shr eax, cl
xchg r14, r14
movzx ecx, al
xchg rcx, rax
mov rcx, qword [rsp + 0x70]
xchg rcx, rax
xor cx, dx
mov word [rsp + rax*2 + 0x38], cx
xchg r8, rax
mov r8, qword [rsp + 0x70]
xchg r8, rax
inc rax
xchg rsi, rax
mov qword [rsp + 0x70], rsi
xchg rsi, rax
xchg rcx, rax
mov rcx, qword [rsp + 0x70]
xchg rcx, rax
cmp rax, 0xc
mov dword [rsp - 0x28], 0x7dfa6e05
jb 0x140058203
xor edx, edx
mov word [rsp + 0x50], r8w
xchg rdi, rdi
lea rcx, [rsp + 0x38]
call fcn.14007be20
xchg rdx, r14
mov r14, rax
xchg rdx, r14
mov r8, rax
xor rdx, rbx
xor eax, eax
mov dword [rsp - 0x38], ecx
mov qword [rdi + 0x30], rdx
lea rdi, [rsp + 0x38]
mov ecx, 0x59f736ae
sub ecx, 0x1fa7bed2
add ecx, 0x3ce741c4
sub ecx, 0x39b8c218
sub ecx, 0x3d7df77c
rep stosb byte [rdi], al
cmp rdx, rbx
mov r15, r15
je 0x14005831e
lea rdx, [0x1404a2400]
mov rcx, r8
call fcn.140060190
mov dword [rsp - 0x38], edi
test al, al
setne al
mov rbx, qword [rsp + 0x78]
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
pop rdi
mov dword [rsp - 0x40], 0x56673aa5
ret
mov al, 0x69
add al, 0xf
sub al, 0x29
sub al, 0x4e
mov rbx, qword [rsp + 0x78]
mov dword [rsp - 0x20], 0x427288
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140058340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
movabs rbx, 0x7be21755c779c89
sub rbx, 0x40e0af0e
sub rbx, 0xa6bd985
xor rbx, 0x101f7507
add rbx, 0x71d3eabd
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
cmp qword [rcx + 0x28], rbx
xchg r10, r10
jne 0x14005858b
mov eax, 0x2d436063
sub eax, 0x1f2d998c
add eax, 0x6c06f044
sub eax, 0x7a1cb638
mov dword [rsp + 0x20], 0x651a0aaa
sub dword [rsp + 0x20], 0x25211a0c
sub dword [rsp + 0x20], 0x3473dd
xor dword [rsp + 0x20], 0x3d166ea6
sub dword [rsp + 0x20], 0x26211a7
mov word [rsp + 0x30], ax
xor r8d, r8d
mov dword [rsp + 0x24], 0x382ee6a8
sub dword [rsp + 0x24], 0x2a3a777f
add dword [rsp + 0x24], 0x33b7038c
sub dword [rsp + 0x24], 0x418a720f
mov dword [rsp + 0x28], 0x7dec1486
sub dword [rsp + 0x28], 0x6d3f8026
add dword [rsp + 0x28], 0x12316859
xor dword [rsp + 0x28], 0x17d69620
xor dword [rsp + 0x28], 0x35396a24
mov dword [rsp + 0x2c], 0x2c6722ab
add dword [rsp + 0x2c], 0x1e0b9f14
add dword [rsp + 0x2c], 0x282e413
xor dword [rsp + 0x2c], 0x7c464f0f
xor dword [rsp + 0x2c], 0x30cdea7a
mov qword [rsp + 0x60], r8
mov dword [rsp - 0x38], ecx
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
mov dword [rsp - 0x28], 0x45425a75
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
and cl, 3
mov dword [rsp - 0x2c], 0x3f2d83c2
shl cl, 2
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
xchg r8, r8
mov eax, 0x4c2e206b
add eax, 0x30028229
sub eax, 0x7c08d437
add eax, 0x48b146f3
sub eax, 0x3615f8c1
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x34], 0x21195969
mov rax, qword [rsp + 0x60]
xor cx, dx
mov word [rsp + rax*2 + 0x32], cx
mov dword [rsp - 0x3c], 0x7b47eb33
mov rax, qword [rsp + 0x60]
inc rax
xchg rbp, rax
mov qword [rsp + 0x60], rbp
xchg rbp, rax
xchg rcx, rax
mov rcx, qword [rsp + 0x60]
xchg rcx, rax
cmp rax, 9
jb 0x14005845e
xor edx, edx
mov dword [rsp - 0x14], ecx
mov word [rsp + 0x44], r8w
lea rcx, [rsp + 0x32]
call fcn.14007be20
mov dword [rsp - 0x20], 0x8b01a20
mov rdx, rax
xchg r8, rax
mov rax, r8
xchg r8, rax
xor rdx, rbx
xor eax, eax
xchg r15, r15
mov qword [rdi + 0x28], rdx
lea rdi, [rsp + 0x32]
mov ecx, 0xc78567
add ecx, 0x404278de
add ecx, 0x1d16b223
sub ecx, 0x5e20b05f
rep stosb byte [rdi], al
cmp rdx, rbx
mov dword [rsp - 0x28], ecx
je 0x140058595
lea rdx, [0x1404a20e0]
xchg rcx, r14
mov r14, r8
xchg rcx, r14
call fcn.14006b6b0
test al, al
xchg r9, r9
setne al
xchg rbx, r10
mov r10, qword [rsp + 0x68]
xchg r10, rbx
nop
add rsp, 0x128c5dc2
sub rsp, 0x128c5d72
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov al, 0x67
add al, 0x13
sub al, 0xa
sub al, 0x55
sub al, 0x1a
xchg rsi, rbx
mov rsi, qword [rsp + 0x68]
xchg rsi, rbx
add rsp, 0x50
mov rbp, rbp
pop rdi
ret