joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a78b6
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rdi
mov rdi, rsp
xchg rdi, r11
mov qword [r11 + 0x20], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 0x1e444d60
add rsp, 0x1e444d00
mov rbx, qword [rcx]
mov r13, r13
lea rax, [r11 - 0x40]
xchg rbp, r10
mov qword [r11 + 8], r10
xchg r10, rbp
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
xchg rdi, rdi
xchg rsi, r8
mov qword [r11 + 0x10], r8
xchg rsi, r8
mov rsi, qword [rcx + 0x38]
mov dword [rsp - 0xc], 0x37e8241b
lea rcx, [r11 - 0x48]
xchg r14, rsi
mov qword [r11 + 0x18], rsi
xchg rsi, r14
mov r14, rdx
xchg rsp, r8
movups xmmword [r8 + 0x28], xmm0
xchg r8, rsp
lea rdx, [rsi + 1]
mov r12, r12
xchg rcx, rsp
movups xmmword [rcx + 0x38], xmm0
xchg rcx, rsp
xchg rsi, rsp
movups xmmword [rsi + 0x48], xmm0
xchg rsp, rsi
call fcn.140016fb8
xchg r10, r10
mov edx, 0x4c0eaa04
xor edx, 0x26f5dce6
sub edx, 0x41fee761
sub edx, 0x171482ad
add edx, 0x317b546e
test rsi, rsi
mov rbx, rbx
je 0x1400a791e
xchg r10, rax
mov rdi, r10
xchg r10, rax
sub rbx, rax
mov r8, rsi
mov dword [rsp - 0xc], 0x569a3a8
mov r9d, 0x166c6313
add r9d, 0x1e6028a4
xor r9d, 0x61854be7
sub r9d, 0x5549bf51
nop word [rax + rax]
xchg rsp, rsp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
ror edx, 6
ror edx, 2
xor cx, word [rbx + rdi - 2]
mov dword [rsp - 0x1c], edi
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400a78f2
mov dword [rsp - 0x38], esp
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
xchg rdx, r14
mov r14, rdx
xchg rdx, r14
xchg r14, rcx
mov r14, qword [rsp + 0x20]
xchg r14, rcx
call fcn.1400a7a10
mov dword [rsp - 0x24], 0x6b4a319a
xchg r14, rcx
mov r14, qword [rsp + 0x20]
xchg rcx, r14
mov ebx, eax
xchg r9, r14
mov r9, qword [rsp + 0x80]
xchg r9, r14
lea rax, [rsp + 0x28]
mov dword [rsp - 0x2c], 0x66d76f6c
xchg rsi, r8
mov r8, qword [rsp + 0x78]
xchg rsi, r8
mov rbp, qword [rsp + 0x70]
mov rbx, rbx
cmp rcx, rax
jne 0x1400a79e0
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x40], 0x4bf3459d
mov ecx, 0xc5d31d1
add ecx, 0x3d0f6f7a
xor ecx, 0x1a51211a
xor ecx, 0x533d8061
rep stosb byte [rdi], al
mov eax, ebx
mov r9, r9
xchg rbx, r9
mov r9, qword [rsp + 0x88]
xchg r9, rbx
nop
add rsp, 0x4919281f
sub rsp, 0x491927bf
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400bb730
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov dword [rsp - 0x30], 0x667fbae2
add rsp, 0x60
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400a7a10
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0x2c], esi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x240
mov dword [rsp - 0x24], esi
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg r12, rdi
mov r12, rcx
xchg rdi, r12
xor edx, edx
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x40], edi
mov r8d, 0x4a5d66eb
xor r8d, 0x52a352c3
add r8d, 0x169398d7
sub r8d, 0x2a21afdd
xor r8d, 0x5701f2a
call fcn.1400bbd50
mov rax, qword gs:[0x60]
mov dword [rsp - 0x40], esp
mov r8, qword [rax + 0x18]
xchg rdi, rax
mov rdi, qword [r8 + 0x10]
xchg rdi, rax
mov r8, qword [rax]
test r8, r8
je 0x1400a7d1a
xchg r14, r14
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x1400a7d1a
mov rbp, rbp
mov edx, 0x28648e11
xor edx, 0x2d46b1e2
xor edx, 0x60381bb
xor edx, 0x3bef26b7
sub edx, 0x38ce97fb
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x2c], 0x2089d95
lea r9d, [rdx - 1]
call fcn.1400bc950
mov edx, 0x67ae90c8
sub edx, 0x3f155d23
sub edx, 0x1739b986
add edx, 0x268eb931
xor edx, 0x37ee330c
lea rcx, [rsp + 0x30]
call fcn.1400bca60
test rax, rax
xchg rsp, rsp
je 0x1400a7cee
xor ecx, ecx
xchg rdi, r12
mov rdx, r12
xchg r12, rdi
mov word [rax], cx
mov r14, r14
movabs rcx, 0x68021710d9854ce
xor rcx, 0x2f4bef1c
add rcx, 0x2433e8d0
xor rcx, 0x2eb72ced
add rcx, 0x7fffffff
xor rcx, 0x4ea798c6
mov rax, qword [0x1404896b0]
xor rax, rcx
mov dword [rsp - 0x24], 0x5f61ab54
movabs rcx, 0x3c314ebd55a6c7ed
sub rcx, 0x106ba0f5
add rcx, 0x277742d7
add rcx, 0x65d4e315
ror rax, 0x2d
ror rax, 8
ror rax, 1
ror rax, 3
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
mov rsp, rsp
movabs rcx, 0x448ec9a931227c5c
add rcx, 0x79d1dee
add rcx, 0x18d89eb8
add rcx, 0x7fffffff
add rcx, 0x28c694ba
sub rax, rcx
mov dword [rsp - 0x34], ebp
movabs rcx, 0xbff92314e7afa4c
sub rcx, 0x322e2805
xor rcx, 0xc1f2d17
add rcx, 0x7fffffff
add rcx, 0x3223e5d7
rol rax, 0xc
rol rax, 1
rol rax, 1
xor rax, rcx
mov r12, r12
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1404896a0]
mov dword [rsp - 0x3c], edx
lea r8, [rsp + 0x20]
movabs rcx, 0xe37b28c65843cdc4
sub rcx, 0x19a3d9dc
add rcx, 0x3aa0e448
sub rcx, 0x320ac906
add rcx, 0x2fcba5f9
lea rdx, [rsp + 0x260]
xor rax, rcx
mov r9, rbx
mov dword [rsp - 0xc], 0x1d4a6976
ror rax, 0x18
ror rax, 0x11
ror rax, 0xb
ror rax, 1
ror rax, 1
ror rax, 1
movabs rcx, 0xfaa8d977290055
xor rcx, 0x601b28bd
sub rcx, 0x116354f7
sub rcx, 0x1e7e10f
xor rax, rcx
movabs rcx, 0xae2e96b65e07190
sub rcx, 0x5cd9fc70
xor rcx, 0x546cdd2a
sub rcx, 0x1fd38cfb
add rcx, 0x7fffffff
xor rcx, 0x4be2bdf4
sub rax, rcx
mov dword [rsp - 0x1c], 0x7ea882c8
lea rcx, [rsp + 0x30]
call rax
mov rbx, qword [rsp + 0x250]
xchg rsp, rsp
add rsp, 0x25f2516c
sub rsp, 0x25f24f2c
pop rdi
mov rsi, rsi
ret
mov eax, 0xf4106e
add eax, 0x50d1d6f4
sub eax, 0x1789d788
add eax, 0x85c3f027
mov rbx, qword [rsp + 0x250]
add rsp, 0x1371371
sub rsp, 0x1371131
pop rdi
ret
mov rbx, qword [rsp + 0x250]
mov rdi, rdi
mov eax, 0x6b615387
sub eax, 0x8b19031
sub eax, 0x5213e2b6
add eax, 0x32a29a1
add eax, 0xac39f6f4
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400ac3a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae5e6
mov r10, rcx
mov eax, dword [0x14048a034]
cmp qword [0x14048a048], 0
xchg rsp, rsp
jne 0x1400adab0
syscall
ret
Function at 0x1400ae854
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg r14, r14
push rdi
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov rcx, rcx
add rsp, 0xffffffffffffffe0
movzx eax, byte [rdx + 1]
mov r15, r8
mov dword [rsp - 0x14], esp
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 4
shl ebx, 3
shl ebx, 1
dec r8d
mov dword [rsp - 0x34], ebx
or ebx, eax
shl edi, 7
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x34], 0x322f48b1
shl ebx, 5
shl ebx, 1
shl ebx, 2
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 2
shl ebx, 5
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
mov dword [rsp - 0x44], 0x1a2650a4
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 1
shl edi, 3
shl edi, 1
shl edi, 3
or edi, eax
movzx eax, byte [rdx + 7]
xchg r10, r10
shl edi, 7
shl edi, 1
or edi, eax
test r8d, r8d
mov dword [rsp - 0x40], ebx
jle 0x1400ae97f
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
movsxd rax, r8d
mov dword [rsp - 0x24], 0x64ab7a24
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov r10, r10
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
mov dword [rsp - 0x20], ebx
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov rdx, rsi
mov ecx, edi
mov dword [rsp - 0x1c], esp
call fcn.1400af06c
xor ebx, eax
xchg rsp, rdx
mov rsp, rbp
xchg rsp, rdx
mov ecx, ebx
call fcn.1400af06c
mov rsi, rsi
xor edi, eax
sub rsi, 0x18
nop
sub rbp, 0x55e69844
add rbp, 0x55e6982c
sub r14, 1
mov dword [rsp - 0x28], esi
jne 0x1400ae939
lea rax, [r15 + 7]
mov ecx, 0x1435e743
sub ecx, 0x1703923
sub ecx, 0x12aa3c1c
sub ecx, 0x1b7200
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x14], 0x8136c9e
shr ebx, 1
shr ebx, 4
shr ebx, 2
shr ebx, 1
shr edi, 1
shr edi, 3
shr edi, 4
sub rcx, 1
xchg r15, r15
jne 0x1400ae99a
xchg rbx, rdx
mov rdx, qword [rsp + 0x40]
xchg rdx, rbx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov dword [rsp - 0x34], 0x3757ae49
nop
add rsp, 0x4b5ff038
sub rsp, 0x4b5ff018
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop rdi
ret
Function at 0x1400aed50
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg r13, rbx
xchg rsi, r15
mov qword [rsp + 0x18], r15
xchg r15, rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r14
mov dword [rsp - 0x24], ebx
lea rbp, [rsp - 0x47]
sub rsp, 0x365128ab
add rsp, 0x3651280b
movdqa xmm0, xmmword [0x14000be80]
xchg r12, r12
xor edi, edi
movdqa xmm1, xmmword [0x14000be50]
xchg rdx, rbp
mov rbx, rbp
xchg rbp, rdx
xchg rbx, rbp
movdqu xmmword [rbx - 0x39], xmm0
xchg rbx, rbp
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov edx, edi
mov dword [rsp - 0x1c], ebp
movdqa xmm0, xmmword [0x14000bf00]
mov r8d, edi
xchg r15, rbp
movdqu xmmword [r15 - 0x29], xmm1
xchg r15, rbp
movdqa xmm1, xmmword [0x14000bef0]
xchg r11, r11
movdqu xmmword [rbp - 0x19], xmm0
xchg r10, rbp
movdqu xmmword [r10 - 9], xmm1
xchg r10, rbp
mov ecx, edx
lea r8, [r8 + 4]
mov dword [rsp - 0x18], edx
mov eax, 0x69dc832a
xor eax, 0x372a3c7b
sub eax, 0x58bf760c
add eax, 0x6e262853
inc rdx
mov dword [rsp - 0x10], ebx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
mov r13, r13
cmp rdx, 0x10
jb 0x1400aedfe
cmp dword [rsi + 4], 8
jne 0x1400aeea3
xchg r14, r14
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
xchg rdx, rdx
shl cx, 5
shl cx, 1
shl cx, 1
shl cx, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov r13, r13
cmp rdi, 4
jl 0x1400aee4d
lea r9, [rbp + 7]
mov dword [rsp - 0x1c], 0x20e51889
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov rcx, rsi
xchg r12, r12
call fcn.1400aeb9c
jmp 0x1400aef5c
cmp dword [rsi], edi
mov rbx, rbx
jle 0x1400aef5c
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x438b7e74
sub r8d, 0x5c98929
add r8d, 0x4cd338c
sub r8d, 0x428f28d3
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
sub rbx, 0xfffffffffffffffe
mov dword [rsp - 0x34], ecx
shl ax, 4
shl ax, 1
shl ax, 1
shl ax, 1
shl ax, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
xchg rbx, rbx
sub r8, 1
jne 0x1400aeed0
lea r9, [rbp + 7]
mov dword [rsp - 0x40], 0x3eda7ec2
mov r8d, r14d
lea rdx, [rbp + 0x67]
mov rcx, rsi
call fcn.1400aeb9c
xchg rsi, rsi
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
xchg r12, r12
lea rdx, [rbp + 0x67]
neg r8d
sub r8d, 0xfffffff8
neg r8d
mov rcx, rsi
call fcn.1400aeb9c
inc edi
xchg r10, r10
sub r14d, 0xfffffff8
cmp edi, dword [rsi]
jl 0x1400aeeb1
mov r11, r11
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rdi, rbx
mov rdi, qword [r11 + 0x28]
xchg rbx, rdi
lea rdi, [rbp + 7]
mov dword [rsp - 0x20], esp
xchg rsi, rdx
mov rdx, qword [r11 + 0x30]
xchg rdx, rsi
lea ecx, [rax + 0x40]
mov r11, r11
rep stosb byte [rdi], al
xchg rsp, rcx
mov rcx, r11
xchg rsp, rcx
pop r14
pop rdi
mov dword [rsp - 0x14], ebp
pop rbp
ret

Function at 0x1400af020
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov rdx, rdx
je 0x1400af063
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
mov r9, r9
mov r11d, ecx
test dl, 1
cmove r9d, r10d
mov dword [rsp - 0x10], 0x3226c66f
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
xchg rcx, rcx
cmovb r11d, ecx
shr edx, 1
jne 0x1400af02d
mov eax, r10d
xchg r8, r8
ret
Function at 0x1400bbee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
xchg rsi, rsi
mov qword [rsp], r10
xchg rdi, r11
mov qword [rsp + 8], rdi
xchg rdi, r11
xor r11, r11
lea r10, [rsp + 0x18]
mov r13, r13
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
mov dword [rsp - 0x38], 0x2c9bf43b
cmp r10, r11
bnd jae 0x1400bbf4e
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov dword [rsp - 0x40], 0x4f501c3f
mov byte [r11], 0x44
sub byte [r11], 0x2c
add byte [r11], 0x13
xor byte [r11], 0x6e
xor byte [r11], 0x45
cmp r10, r11
bnd jne 0x1400bbf25
mov r10, qword [rsp]
xchg r14, r14
xchg r11, r14
mov r14, qword [rsp + 8]
xchg r14, r11
nop
sub rsp, 0x2e55c5fa
add rsp, 0x2e55c60a
bnd ret
Function at 0x140442300
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
xchg rsp, rbx
mov qword [r11 + 8], rsp
xchg rbx, rsp
xchg rsi, rsp
mov qword [r11 + 0x18], rsp
xchg rsi, rsp
mov qword [r11 + 0x20], rdi
mov dword [rsp - 0x30], 0x3eddb04d
push r14
add rsp, 0xffffffffffffffc0
mov rdx, qword [0x1404894e8]
xchg rcx, r13
mov rbx, r13
xchg rcx, r13
movabs rcx, 0x609ab8b06dee1ec4
xor rcx, 0x44eac306
xor rcx, 0x3476c02a
add rcx, 0x2ac06ce3
xor rcx, 0x3b663fa2
mov dword [rsp + 0x58], 0x5d5a5112
xor dword [rsp + 0x58], 0x4576d334
xor dword [rsp + 0x58], 0x384a2d88
xor dword [rsp + 0x58], 0x2066afbe
add rdx, rcx
movabs rax, 0x1b220d415a4c2185
xor rax, 0x524e3776
add rax, 0x61ed3cca
xor rax, 0x32a559ab
add rax, 0x7fffffff
sub rax, 0x2c72b476
xor rdx, rax
xchg rdx, rdx
lea rcx, [r11 - 0x28]
ror rdx, 8
ror rdx, 0xb
ror rdx, 9
ror rdx, 1
movabs rax, 0x3d378eaf4b890f37
sub rax, 0x2a283279
add rax, 0x35730c42
sub rax, 0x1d802c8a
add rax, rdx
lea rdx, [r11 + 0x10]
mov r14, r14
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rdi
xchg rbx, rbx
xor esi, esi
movups xmmword [rdi], xmm0
xchg rdi, rsp
movups xmmword [rsp + 0x10], xmm0
xchg rdi, rsp
xchg rcx, rdi
movups xmmword [rcx + 0x20], xmm0
xchg rdi, rcx
test eax, eax
jne 0x140442426
xchg rbp, rbp
mov qword [rbx + 0x38], rsi
jmp 0x140442568
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
inc r14
xchg rdx, rdx
cmp word [rax + r14*2], si
jne 0x14044242f
xchg r9, r14
mov qword [rbx + 0x38], r9
xchg r9, r14
cmp qword [rbx], rdi
mov dword [rsp - 0x44], 0x10ae4c71
je 0x140442469
xchg r14, rcx
mov r14, qword [rbx]
xchg r14, rcx
call fcn.1400bb730
cmp r14, 0x18
mov dword [rsp - 0x1c], 0x47a6a50b
jbe 0x1404424af
lea rcx, [r14 + r14]
call fcn.1400bba10
mov qword [rbx], rax
mov dword [rsp - 0x2c], 0x389d693
test rax, rax
jne 0x1404424bb
xchg r15, rdi
mov qword [rbx], r15
xchg rdi, r15
xchg r12, rsi
mov rcx, r12
xchg r12, rsi
jmp 0x1404424e0
mov qword [rbx], rdi
xchg rdi, r14
mov rax, r14
xchg r14, rdi
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rsp - 0x18], 0x17310b0b
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rax
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
mov rcx, qword [rbx]
mov rdi, rdi
mov edx, 0x49aa336f
xor edx, 0x4327b88e
add edx, 0x737431a3
xor edx, 0x3d62dcc6
cmp qword [rbx + 0x38], rsi
mov r12, r12
jbe 0x140442568
lea r8, [rsp + 0x20]
sub r8, rcx
mov dword [rsp - 0x2c], edi
movzx eax, dx
mov r9d, 0x7f5f3ff
add r9d, 0x2446d983
xor r9d, 0x690a89dc
add r9d, 0x1991d293
xor r9d, 0x5ec8160e
and ax, r9w
mov dword [rsp - 0x38], 0x1c3e20c9
ror edx, 8
xor ax, word [r8 + rcx]
inc rsi
mov word [rcx], ax
mov dword [rsp - 0x38], 0x2db4a610
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x140442510
mov rbx, rbx
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
mov rsi, rbx
xchg rsi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x50]
xchg rcx, rbx
mov rdi, qword [rsp + 0x68]
mov dword [rsp - 0x44], 0x4cbb63c6
add rsp, 0x40
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x14045dd04
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x2c], 0xc6f348
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x2ad5bab1
sub rsp, 0x2ad5bae1
xchg rdx, rsi
mov rdx, r8
xchg rdx, rsi
mov bl, dl
xor edx, edx
mov r8d, 0x793efbb
add r8d, 0x157e3342
add r8d, 0x248cd600
sub r8d, 0x419ef765
xchg rcx, r12
mov rdi, r12
xchg rcx, r12
call fcn.1400bbd50
and qword [rdi + 0x198], 0
or r8, 0xffffffffffffffff
xchg rbx, rbx
and qword [rdi + 0x1a0], 0
mov qword [rdi + 0x1a8], r8
xor edx, edx
mov dword [rsp - 0x44], esp
mov byte [rdi + 0x1b0], bl
mov ecx, edx
mov eax, 0x18f67aa2
add eax, 0x3fe6881b
sub eax, 0x26e91d82
xor eax, 0x45ae94a3
rol eax, cl
mov dword [rsp - 0x2c], ecx
mov byte [rdx + rdi + 0x1b1], al
inc rdx
cmp rdx, 0x20
jb 0x14045dd8e
xchg r13, r13
xchg rdi, rsi
movups xmm0, xmmword [rdi]
xchg rsi, rdi
lea rcx, [rdi + 0x200]
mov dword [rsp - 0x34], esp
mov byte [rsp + 0x20], 0x4f
sub byte [rsp + 0x20], 0x44
add byte [rsp + 0x20], 0x6b
xor byte [rsp + 0x20], 0x76
mov r9d, 0x6d790741
xor r9d, 0x5463491c
add r9d, 0x4163a169
sub r9d, 0x7a7defc5
mov edx, 0x7f5e7af7
xor edx, 0x145b2ca8
sub edx, 0x3a121339
xor edx, 0x157644aa
sub edx, 0x25660789
xchg rdi, rcx
movups xmmword [rcx + 0x1d1], xmm0
xchg rdi, rcx
xchg rsi, r11
movups xmm1, xmmword [r11 + 0x10]
xchg rsi, r11
xchg r12, rdi
movups xmmword [r12 + 0x1e1], xmm1
xchg rdi, r12
and qword [rdi + 0x1f8], 0
and qword [rcx], 0
and dword [rdi + 0x20c], 0
mov dword [rsp - 0x3c], ebp
mov dword [rdi + 0x208], r8d
xor r8d, r8d
call fcn.140095700
and qword [rdi + 0x210], 0
mov r12, r12
lea rcx, [rdi + 0x218]
call fcn.14045dfe0
xchg rbx, rbp
mov rbp, qword [rsp + 0x40]
xchg rbx, rbp
xchg r9, rdi
mov rax, r9
xchg r9, rdi
xchg r10, rsi
mov r10, qword [rsp + 0x48]
xchg rsi, r10
sub rsp, 0xffffffffffffffd0
pop rdi
mov rdi, rdi
ret
Function at 0x14047d598
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg r14, rsi
mov qword [rsp + 0x10], r14
xchg r14, rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp - 0x10], 0x73ccedc7
push rbp
push r12
nop
push 0x68204830
mov qword [rsp], r14
xchg rbp, r12
mov r12, rsp
xchg r12, rbp
sub rsp, 0x70
xchg r12, r12
mov rdi, r8
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
xchg rdx, rcx
mov rsi, rdx
xchg rcx, rdx
movabs r12, 0x4ef446ac53b97085
xor r12, 0x3173c04d
sub r12, 0x1cbcd6a
add r12, 0xbf48d37
xor r12, 0x32c00fb8
cmp r9d, 0x60001
mov dword [rsp - 0xc], ebp
jne 0x14047d7bd
mov dword [rbp - 0x40], 0x28d0f360
xor dword [rbp - 0x40], 0x7223d212
xor dword [rbp - 0x40], 0x3eb04648
sub dword [rbp - 0x40], 0x14fcae7b
add dword [rbp - 0x40], 0x73dad01a
xor edx, edx
xchg r11, r11
mov dword [rbp - 0x3c], 0x21db20dd
add dword [rbp - 0x3c], 0xd375421
sub dword [rbp - 0x3c], 0xf965522
xor dword [rbp - 0x3c], 0xae29115b
mov dword [rbp - 0x38], 0x63f2a6bb
xor dword [rbp - 0x38], 0x179355ba
sub dword [rbp - 0x38], 0x6c572d08
add dword [rbp - 0x38], 0x49256c0e
xor dword [rbp - 0x38], 0x3b6a92a6
mov ecx, edx
mov eax, 0x5559768
xor eax, 0x55bdd646
sub eax, 0xd72d3c4
add eax, 0x952dae1
add eax, 0x2795294d
rol eax, cl
mov dword [rsp - 0x20], ebx
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov rdi, rdi
jb 0x14047d68b
mov r9d, 0x22d900dd
xor r9d, 0x2eb78ef9
sub r9d, 0x40185e3
add r9d, 0x1f0ab7c
sub r9d, 0xa5da3be
mov qword [rsp + 0x20], 0x343d50a9
xor qword [rsp + 0x20], 0x6f8015a
add qword [rsp + 0x20], 0x3849df2b
add qword [rsp + 0x20], 0xd824c75
sub qword [rsp + 0x20], 0x78917d87
lea r8, [rbp - 0x34]
mov dword [rsp - 0xc], ebx
xchg rcx, rdx
mov rcx, rdi
xchg rdx, rcx
xchg rbx, rcx
mov rbx, r14
xchg rbx, rcx
call fcn.14047b730
xchg r9, r9
mov rbx, rax
lea rdi, [rbp - 0x34]
xor eax, eax
mov r10, r10
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
je 0x14047d7fe
xchg rsi, rsi
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.1400ab6b4
test dword [rbp - 7], 0x1000
mov dword [rsp - 0x24], 0x13a40593
jne 0x14047d7fe
cmp byte [rbp - 0x1d], 0xe8
jne 0x14047d7fe
lea rdx, [rbx + 0xc]
mov dword [rsp - 0x2c], 0x6dcc8a8b
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
call fcn.1400a1fa0
mov dword [rsp - 0x38], ecx
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
mov rbp, rbp
xor rax, r12
add rdx, rax
xor rdx, r12
mov dword [rsp - 0x3c], esi
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
setne al
xchg r8, r8
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
xchg r10, rsi
mov r10, qword [r11 + 0x28]
xchg r10, rsi
xchg rdx, rdi
mov rdx, qword [r11 + 0x30]
xchg rdi, rdx
mov rsp, r11
pop r14
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
xor al, al
jmp 0x14047d7c7
Function at 0x10000b668
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x100011cc5], 0
mov esi, r8d
mov rbp, rcx
je 0x10000b695
mov eax, 0x3eb
jmp 0x10000b76c
cmp r8d, 0x240
ja 0x10000b6c2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x10000b6ee
and dword [rax], 0
jmp 0x10000b6ee
lea eax, [r8 + 0x78]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x10000b6ee
mov dword [rax], 1
mov dword [rax + 0x68], esi
test rdi, rdi
jne 0x10000b6f8
lea eax, [rdi + 8]
jmp 0x10000b76c
xor edx, edx
lea rbx, [rdi + 0x30]
lea r8d, [rdx + 0x20]
mov rcx, rbx
call sub.msvcrt.dll_memset
and dword [rdi + 0x50], 0
lea rax, [0x10000a594]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x68]
lea rdx, [rdi + 0x78]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x70]
lea r9, [0x100011cc0]
mov r8d, esi
mov rcx, rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10000b768
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x10000b768
mov rcx, rdi
call fcn.10000958c
jmp 0x10000b76a
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x10000b788
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x100011cc5], 0
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
je 0x10000b7b5
mov eax, 0x3eb
jmp 0x10000b817
lea rbx, [rdx + 0x30]
xor edx, edx
lea r8d, [rdx + 0x20]
mov rcx, rbx
call sub.msvcrt.dll_memset
lea rax, [0x10000a5f0]
lea rdx, [rdi + 0x78]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x68]
lea r9, [0x100011cc0]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x70]
mov r8d, ebp
mov rcx, rsi
mov qword [rdi + 0x10], rsi
mov qword [rsp + 0x20], rbx
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10000b815
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10000b817
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x10000bdfc
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
invalid
invalid
Function at 0x10000c138
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000c185
cmp rcx, 0xffffffffffffffff
je 0x10000c185
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000c17d
cmp dword [rcx + 0x3c], edx
jl 0x10000c17d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000c17d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000c185
mov rax, rdx
add rsp, 0x18
ret