joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454919
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00454960]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c360
xorps xmm15, xmm15
mov r14, qword [0x005cc388]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c4a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454860
Function at 0x45e540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4028cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408f60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c4a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4028a0
cmp byte [0x005cc190], 0
je 0x45e555
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b5a0
jmp 0x4028a0

Function at 0x45e560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005cc460]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005cc190], 0
je 0x45e595
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005cc7a0]
aesenc xmm0, xmmword [0x005cc7b0]
aesenc xmm0, xmmword [0x005cc7c0]
movq rax, xmm0
ret
jmp 0x409160

Function at 0x45e5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005cc460]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005cc190], 0
je 0x45e5d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005cc7a0]
aesenc xmm0, xmmword [0x005cc7b0]
aesenc xmm0, xmmword [0x005cc7c0]
movq rax, xmm0
ret
jmp 0x4091c0

Function at 0x45ffc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005cc720]
mov qword [rsp + 8], rdx
lea r8d, [0x005cc1a8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e480
add rsp, 0x30
ret

Function at 0x460500
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46052c
call fcn.0045e480
shl rcx, 3
add rcx, 0x1480
mov qword [0x005cc388], rcx
ret
Function at 0x148af2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x148af21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x148af2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x148af206f
add dl, dl
jne 0x148af2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x148af20f6
xor eax, eax
add dl, dl
jne 0x148af20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x148af21ad
add dl, dl
jne 0x148af20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x148af20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x148af20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x148af20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x148af20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x148af207e
mov eax, 1
add dl, dl
jne 0x148af2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x148af2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x148af20fb
sub eax, ebx
mov ebx, 1
jne 0x148af214c
mov ecx, 1
add dl, dl
jne 0x148af212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x148af213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x148af2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x148af207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x148af2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x148af2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x148af215d
cmp eax, 0x7d00
jae 0x148af219b
cmp eax, 0x500
jb 0x148af2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x148af207e
cmp eax, 0x7f
ja 0x148af219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x148af207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x148af21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x148af207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140016b01
Capabilities:
Execute syscall

Disassembly:
loope 0x140016a53
mov dword [rsp - 0xc], 0x443d64f1
jne 0x1400169a9
cmp byte [rax], al
add byte [rcx - 0x45], cl
mov edx, 0x2444c745
loopne 0x140016abb
invalid
mov dword [rsp - 0x44], ecx
mov dword [rsp - 0xc], 0xe7ca942
mov dword [rsp - 0x44], 0x59485e0
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
jmp 0x140016b83
pop rbx
ret
mov r9, rbx
mov dword [rsp - 0x14], ebp
and qword [rsp + 0x20], 0
mov r8d, 0x40
mov rdx, rdi
mov rcx, qword [rax]
jmp 0x140016bd9
mov dword [rsp - 0x1c], 0x47542440
cmovs eax, ecx
and al, 0x54
cmovs r8d, r9d
add rsp, 0x30
pop rdi
xchg r14, r14
mov rdx, rdx
push rbp
je 0x140016b2e
jne 0x140016b2e
cmp r15d, 0x5e026048
call rcx
rcl r13d, 0x8b
mov ecx, dword [rdi]
add dword [rdx], 0xffffffff
invalid
invalid
syscall
movabs r13, 0x4f07c000000c1e9
ror r9d, 0x8e
add r15d, 0x3abc0873
call rcx
ror ecx, 0x11
lea r11d, [rcx - 0x13fe]
cpuid
call fcn.140016ccd
jmp 0x140016bf4
pop rbp
ret
pop rbp
xchg rbp, rbp
pop rsi
jne 0x140016b71
je 0x140016b71
rcl r9d, 0xd3
jmp 0x1400169d8
jmp 0x140016adc
push rbx
push rsi
mov dword [rsp - 0x14], 0x4e63b715
mov dword [rsp - 0x34], 0x3b21ef01
jmp 0x140016c10
push r9
movabs r9, 0x188d6e0b0e534aeb
jne 0x140016b9e
jmp 0x140016bea
je 0x140016b9e
call fcn.140016d83
add rsp, 0x30
pop r9
jmp 0x140016be9
test eax, eax
mov dword [rsp - 0xc], 0x48d9b5d3
mov dword [rsp - 0x28], 0x19027f08
mov dword [rsp - 0xc], 0x38935e23
jmp 0x140016afc
mov r9, r9
call fcn.1400991b0
or ecx, 0xffffffff
jmp 0x140016bba
ret
pop r9
mov r13, r13
jmp 0x140016c2d
movabs rbp, 0x7a3f99ffffff5be9
jne 0x140016bf6
jmp 0x140016b56
je 0x140016bf6
call fcn.140016c43
add rsp, 0x30
jmp 0x140016b54
push rdi
sub rsp, 0x30
mov rbx, rdx
lea rsi, [rax + 0x18]
mov dword [rsp - 0x10], 0x162a28c1
mov dword [rsp - 0x38], ecx
jmp 0x140016b9a
mov rdi, rcx
call fcn.1400182a0
mov qword [rsp + 0x28], rsi
jmp 0x140016ade
Function at 0x14001c94a
Capabilities:
Encode data using xor

Disassembly:
jne 0x14001c93c
mov dword [rsp - 0x44], esi
mov dword [rsp - 0x40], 0x511c151f
mov dword [rsp - 0x14], 0x53c68481
jmp 0x14001c5f7
mov dword [rsp - 0x34], 0x766a63c6
push rsi
movabs rsi, 0x55c6ee00000273e9
jne 0x14001c207
jmp 0x14001c47f
je 0x14001c207
call fcn.14001c3f0
jmp 0x14001c479
jmp 0x14001c975
add rsp, 0x1d
pop rsi
ret
pop rsi
rep stosb byte [rdi], al
jmp 0x14001c2c3
jne 0x14001c5ee
mov r15, r15
lea rdi, [rbp + 0x7f0]
xor eax, eax
mov rcx, r15
mov dword [rsp - 0x10], ebx
mov rbp, rbp
jmp 0x14001c1fc
call fcn.140098930
mov dword [rsp - 0xc], 0x6888ebdd
mov dword [rsp - 0x3c], 0x4bb59f46
and al, 0xc4
lahf
mov ch, 0x4b
jmp 0x14001c972
mov rdx, r15
mov dword [rsp - 0x34], 0x6e7f632b
mov dword [rsp - 0x3c], ebx
mov dword [rsp - 0x28], 0x76ccf6c2
jmp 0x14001c9af
xchg r12, r12
mov rcx, qword [rbp + 0x430]
lea rax, [rbp + 0x438]
jmp 0x14001c956
lea rdi, [rbp + 0x438]
xor eax, eax
xchg r9, r9
mov dword [rsp - 0x28], 0x6652090d
mov dword [rsp - 0xc], 0x597ae624
xchg rdi, rdi
mov r12, r12
jmp 0x14001ca00
mov r9, r9
cmp rcx, rax
jne 0x14001ca12
je 0x14001c9e1
jne 0x14001c9e1
jp 0x14001c5bf
lea edx, [rdx + 0x8711]
cmp esi, 0x2a26ff68
add r14d, 0x9ea49d29
pushf
rcr ebp, 0xf8
call rcx
movabs r13, 0x676ddee759b7a5eb
jmp rax
jmp 0x14001c988
mov dword [rsp - 0x24], 0xa948f00
mov rcx, rdx
rep stosb byte [rdi], al
jmp 0x14001ca8a
call fcn.140098930
mov dword [rsp - 0x24], edx
mov dword [rsp - 0x34], ebx
je 0x14001ca25
jne 0x14001ca25
movabs rcx, 0xf7c6942716555eb
jne 0x14001c2ed
jmp 0x14001ca7c
cmp r12d, 0x6c243526
call fcn.14001c2a0
mov r11, r11
mov dword [rsp - 0x44], 0x36b13bb4
mov rdx, r15
mov rcx, qword [rbp + 0x2b0]
lea rax, [rbp + 0x2b8]
mov dword [rsp - 0x28], ebx
Function at 0x1400206c9
Capabilities:
Execute syscall

Disassembly:
add rsp, 0x52
pop r9
ret
pop r9
xor eax, eax
lea rdi, [rbp + 0x56]
jne 0x14001fe46
je 0x14001fe46
call rcx
pause
test r10d, 0xa0e75d83
lea r10d, [rbp + 0x83de]
rol edi, 0xd
sub r15d, 0x204112a6
lea ecx, [rbx - 0x2675]
test esi, 0xd7a75743
syscall
or r11d, 0xea458e72
je 0x14002088a
movabs rdi, 0x40fb7a000007a8e9
rcl edi, 0x1b
cmp r8, rdi
int3
jmp 0x1400205f3
invalid
lea rdi, [rbp + 0x20]
lea ecx, [rax + 0x1a]
rep stosb byte [rdi], al
mov r10, r10
mov dword [rsp - 0x18], 0x72f2a1ba
jne 0x1400205ad
je 0x1400205ad
movabs r11, 0x784a8b0000016fe9
ret 0x38
jmp 0x140020721
lea ecx, [rax + 0x32]
xchg r8, r8
mov dword [rsp - 0x28], 0x5e528ac5
mov dword [rsp - 0x20], 0x3b1cb6f2
rep stosb byte [rdi], al
jmp 0x140020593
movabs r9, 0x20ccdfffff731e9
jne 0x1400206cb
jmp 0x14001fe01
je 0x1400206cb
call fcn.140020851
je 0x140020711
jne 0x140020711
pop r11
rcl edi, 0x23
jb 0x14002014e
invalid

Function at 0x14002425c
Capabilities:
Execute syscall

Disassembly:
test rsi, rsi
je 0x140024714
xchg r8, r8
jmp 0x14002441c
mov dword [rsp - 0x18], esp
mov dword [rsp - 0x24], 0x76961984
mov dword [rsp - 0x28], edx
mov r9d, 1
jmp 0x14002423c
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0x28]
mov rdx, rax
jmp 0x140024326
mov ebx, dword [rax + 0xe0]
xor ebx, 0x6a9d6a96
mov qword [rbp + 0x28], 0x20
and byte [rax], al
add byte [rax], al
call fcn.14009ff10
jmp 0x14002419e
add eax, dword [rax]
add byte [rdx], ch
sbb al, byte [rcx - 0x7f]
leave
xor al, 0x50
ret
mov dword [rsp - 0x28], 0x77ddf53
mov dword [rsp - 0x44], ebp
cmp byte [rsi + 0x310], r15b
je 0x140024714
mov rax, qword [rsi]
je 0x14002446c
jne 0x14002446c
jp 0x14002437d
lea ebp, [rbx - 0xabf9]
int3
jmp 0x140024522
test rcx, rcx
je 0x1400240eb
jmp 0x140023eb3
mov rsi, rsi
mov dword [rsp - 0x20], esi
mov dword [rsp - 0x20], esi
mov dword [rsp - 0x38], 0x3bc9c986
jmp 0x14002424c
mov rcx, r14
mov dword [rsp - 0x30], edi
mov dword [rsp - 0x28], 0x4292a858
mov r12, r12
mov rdi, qword [rax + 0x28]
call fcn.1400f5130
mov rcx, r14
jmp 0x1400244ad
Function at 0x140031f42
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [rsi], dword [rdi]
add byte [rbx], dl
add cl, ch
add dword [rax], 0
add byte [rdi], cl
jne 0x140031984
je 0x140031984
call 0x140031a1f
add rsp, 0x60
add byte [rax], al
je 0x14003213d
call fcn.140031f68
add rsp, 0xb80
pop r9
ret
pop r9
jmp 0x140032227
call fcn.14003203a
add rsp, 0xb80
pop rdx
je 0x14003211a
jne 0x14003211a
and r12d, 0x3fe443ae
movabs rbp, 0x57f82e000000a3e9
test rcx, rbx
call rax
popfq
ret 0x20
jmp 0x1400321c2
jmp 0x140031f59
ret
pop rdx
mov rcx, rax
xchg r10, r10
xchg r15, r15
mov dword [rsp - 0x44], 0x7fd9a3e6
jne 0x1400321ed
je 0x1400321ed
and esi, 0x76476c6d
jmp rax
jmp 0x14003226c
mov rcx, qword [rcx + 8]
call fcn.1400ff3d0
push rdx
movabs rdx, 0x1b759c5436818eeb
jne 0x140032233
jmp 0x1400321c3
je 0x140032233
je 0x140032254
jne 0x140032254
cpuid
syscall
cmp rsi, rdx
pushf
add ebp, 0x73f3d4f1
movabs r14, 0x61506dfffffea7e9
call rcx
or esi, 0xfecc06a7
rcr ecx, 0xd1
jmp 0x1400318e0
jmp 0x140032100
mov dword [rsp - 0x10], 0x11a3d7d4
mov r8, r8
invalid
invalid
Function at 0x140037bb8
Capabilities:
Encode data using xor

Disassembly:
je 0x140037283
mov esi, 0xfffda9e9
push qword [rbx - 0x2e00933c]
jp 0x140037bb8
push r11
mov r8d, 0xf73d72ed
call rcx
neg rdi
popf
neg r10
ret
mov eax, dword [rbp + 0x1090]
enter 0x6d08, 0xffffffffffffffee
add al, bh

Function at 0x14003d79e
Capabilities:
Encode data using xor

Disassembly:
invalid
add rsp, 0x72
pop rcx
ret
pop rcx
movzx eax, byte [rbp + rdx + 0x80]
jmp 0x14003d832
mov dword [rsp - 0x10], ebx
mov rcx, rcx
mov dword [rsp - 0x14], 0x34fe2bec
push rcx
jmp 0x14003d7e1
movabs rcx, 0x3f3490ffffff77e9
jne 0x14003d7e3
jmp 0x14003d75f
je 0x14003d7e3
call 0x14003d79e
je 0x14003d7fd
jne 0x14003d7fd
cmp rbp, rcx
movabs r14, 0x700512ffffff57e9
adc al, byte [0x151f55978]
int1
jb 0x14003d7fe
jmp 0x14003d759
div rsi
cmp edi, 0xd42a3557
jmp 0x14003c7f4
mov word [r8 + rdx*2], ax
inc rdx
mov dword [rsp - 0x1c], 0xe0a4f87
jne 0x14003d85b
je 0x14003d85b
mov esi, 0x22ed96a6
cmp r11d, 0x658cade
cmp r9d, 0x4d9cd66b
movabs rcx, 0x374a8fe6113f16eb
ror r13d, 0x3a
div r10
sub r9d, 0xabe8c3e4
push rdi
ret
jmp 0x14003d873
mov rbx, rbx
mov rsi, rsi
xchg rdx, rdx
cmp rdx, qword [rbp - 0x28]
jb 0x14003d760
Function at 0x14004b831
Capabilities:
Encode data using xor

Disassembly:
movabs eax, dword [0xe8d3c48b4162d638]

Function at 0x14004cb64
Capabilities:
Execute syscall

Disassembly:
movabs r11, 0x7dce54fffffee9e9
ror esi, 0xe6
syscall
cmp r12, rbx
syscall
ret
Function at 0x14004fc33
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp - 0x24], 0x130c6f1e
mov dword [rsp - 0x24], 0xf55516f
mov dword [rsp - 0x24], 0x27b7de70
movups xmmword [rbp + 0x718], xmm0
movups xmmword [rbp + 0x728], xmm0
movups xmmword [rbp + 0x738], xmm0
jmp 0x14004fd2a
lea rax, [rbp + 0x718]
mov dword [rsp - 0xc], 0x29eb6d46
mov dword [rsp - 0x28], 0x36ca7d2
cmp rcx, rax
jne 0x14004ff1d
jmp 0x14004fb1d
call 0x14004fc33
add rsp, 0x3f
pop r11
ret
pop r11
call fcn.140057780
mov rcx, qword [rbp + 0x710]
jne 0x14004faf9
je 0x14004faf9
call rcx
syscall
jbe 0x140050a0a
jmp rcx
jmp 0x14004fa7d
lea rdi, [rbp + 0x718]
mov dword [rsp - 0x2c], 0x130d587b
mov dword [rsp - 0x14], 0x2718af20
scasd eax, dword [rdi]
sbb byte [rdi], ah
xor eax, eax
mov rcx, r13
rep stosb byte [rdi], al
mov dword [rsp - 0x40], 0x14909492
jmp 0x14004fdba
jbe 0x14004fe45
movzx ecx, byte [rsp + rbx + 0x50]
mov dword [rsp - 0x10], 0x769a438f
mov r12, r12
mov dword [rsp - 0x1c], edi
mov word [rax + rbx*2], cx
add rbx, rsi
jmp 0x14004fc66
je 0x14004fd4a
call 0x14004fc20
add rsp, 0x3f
pop r13
ret
jne 0x14004fca5
je 0x14004fca5
call fcn.14004fe27
add rsp, 0x3f
pop rdx
ret
cmp rbx, qword [rbp + 0x748]
mov dword [rsp - 0x20], 0x6a8ce8c8
mov dword [rsp - 0x3c], 0x44cf1b84
mov dword [rsp - 0x30], 0x34a932f
jmp 0x14004fe3f
mov dword [rsp + 0x50], 0x9a25cf5
lea rax, [rbp + 0x718]
mov byte [rsp + 0x54], 0xd7
mov dword [rsp - 0x34], ecx
push rdx
movabs rdx, 0x40d737000000d2e9
jne 0x14004fcb3
jmp 0x14004fd7c
je 0x14004fcb3
movabs rdi, 0x114c086a71799deb
jmp rcx
jmp 0x14004fc52
mov dword [rsp - 0x10], 0x1d01a804
mov dword [rsp - 0x28], ecx
mov dword [rsp - 0x24], 0x2835c8c0
mov dword [rsp - 0x14], 0x78a6d2bb
push r13
movabs r13, 0x684ae6ef4ae154eb
jne 0x14004fd4a
jmp 0x14004fda0
jmp 0x14004fc3b
sbb dword [rdx + 0x4d], ebx
xchg esi, esi
mov r11, r11
mov dword [rsp - 0x10], ebp
jmp 0x14004fc8a
pop rdx
mov r13, r13
mov rdx, r12
mov qword [rbp + 0x710], rax
lea rcx, [rbp + 0x710]
mov qword [rbp + 0x748], r12
xchg rsi, rsi
jmp 0x14004fa4b
pop r13
call fcn.14001791c
cmp qword [rbp + 0x748], rbx
jmp 0x14004fc15
ret
pop rbp
jmp 0x14004ff2c
mov dword [rsp - 0x34], 0x7a898dfb
mov dword [rsp - 0x40], 0x5028619a
xchg r12, r12
push rbp
movabs rbp, 0x60ac479d6745e2eb
jne 0x14004fdd0
jmp 0x14004fdb4
jne 0x14004fe21
je 0x14004fe21
lea esi, [rdi - 0xd7c]
rcl r15d, 0xb0
jmp rax
jmp 0x14004feab
jb 0x14004fc1b
mov r9b, byte [rbp + 0x1130]
lea r8, [rbp + 0x750]
lea rdx, [rbp + 0x710]
xchg r8, r8
mov dword [rsp - 0x1c], edx
lea rcx, [rbp + 0x980]
jne 0x14004fe7f
je 0x14004fe7f
pop rcx
bswap r8
jno 0x14004fb31
lea r13d, [rcx - 0x6038]
movabs r9, 0x7ba66f8e5daf15eb
lea ebp, [rdi + 0x5670]
rol r13d, 3
call 0x14004f0f2
jmp 0x14004fe96
push r11
movabs r11, 0x248435fffffc0fe9
jne 0x14004fe9a
jmp 0x14004faae
je 0x14004fe9a
jmp 0x14004faa2
je 0x14004fdd0
call 0x14004fe24
add rsp, 0x3f
pop rbp
je 0x14004fece
jne 0x14004fece
bswap r14
js 0x140050cb3
ror r8d, 0xa9
movabs r9, 0x1a4b04fffffee0e9
jmp rax
jmp 0x14004fdb3
call fcn.140098930
mov r9, r9
mov r11, r11
mov dword [rbp + rcx*4 - 0x45], 0xdf66
and al, 0xe8
invalid
Function at 0x140054950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r12, r12
push rdi
nop
sub rsp, 0x6c4db6e7
add rsp, 0x6c4db6c7
xchg r14, rbx
Function at 0x140054d80
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
xchg rbp, r10
mov qword [rsp + 0x10], r10
xchg rbp, r10
xchg rsi, r12
mov qword [rsp + 0x20], r12
xchg rsi, r12
mov word [rsp + 0x18], r8w
mov dword [rsp - 0x38], 0x273e98f1
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x6b730da0
mov qword [rsp], r15
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x24], esi
mov r12, qword [rdx + 0x38]
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
xchg rcx, rsp
mov r15, rsp
xchg rcx, rsp
sub r12, 0xfffffffffffffffe
mov eax, 0x1f7d79ef
add eax, 0x26bb29b0
xor eax, 0x42ce3167
sub eax, 0x4f692f6
nop
movabs rsi, 0xffffffff04c62024
add rsi, 0x38c9edb1
Function at 0x1400550f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov rbp, rbp
push rdi
add rsp, 0xffffffffffffffe0
xchg rsi, r13
mov r13, qword [rcx + 0x38]
xchg r13, rsi
xchg r8, rbx
mov r8, rdx
xchg rbx, r8
mov r8, qword [rdx + 0x38]
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
add r8, rsi
xchg r10, rdx
mov r10, rsi
xchg r10, rdx
mov qword [rcx + 0x38], r8
xchg rbp, rbp
call fcn.140055dc0
mov r9, qword [rbx]
mov ecx, esi
and ecx, 3
mov dword [rsp - 0x10], ebx
mov r8d, 0x1e40a76f
add r8d, 0x269eaf71
xor r8d, 0x4aec88d2
add r8d, 0x3ac77f55
add r8d, 0x17c9d632
shl ecx, 1
shl ecx, 2
mov edx, r8d
mov dword [rsp - 0x14], ebx
ror edx, cl
xchg r15, r10
mov r15, rax
xchg r10, r15
xor ecx, ecx
cmp qword [rbx + 0x38], rcx
mov dword [rsp - 0x24], 0x69be1085
jbe 0x1400551fa
lea rax, [rsi + rsi]
mov r11d, 0x366b20f1
xor r11d, 0x1d64d323
sub r11d, 0x231970ec
sub r11d, 0x7f681e7
sub rax, r9
add r10, rax
nop dword [rax]
xchg r11, r11
movzx eax, dx
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 7
ror edx, 1
and ax, r11w
mov dword [rsp - 0x44], 0x66f555ec
ror r8d, 8
xor ax, word [r9 - 2]
inc rcx
mov word [r10 + r9 - 2], ax
mov dword [rsp - 0x20], edx
cmp rcx, qword [rbx + 0x38]
jb 0x1400551be
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rbx, rsi
mov rbx, qword [rsp + 0x38]
xchg rsi, rbx
sub rsp, 0xffffffffffffffe0
mov dword [rsp - 0xc], ebx
pop rdi
ret

Function at 0x140055230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rsi
mov qword [rsp + 0x10], rbp
xchg rsi, rbp
xchg rdi, r9
mov qword [rsp + 0x18], r9
xchg r9, rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
add rsp, 0xffffffffffffffe0
xchg r8, r14
mov r8, qword [rcx + 0x38]
xchg r14, r8
xchg rdi, rbx
mov rbx, rdx
xchg rbx, rdi
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
nop
movabs rbx, 0xffffffff01707a10
add rbx, 0x72935bd9
sub rbx, 0x4fb40dfd
sub rbx, 0x1121300
add rbx, 0x7fffffff
xor rbx, 0x5cc24b14
inc rbx
mov r12, r12
cmp word [rdx + rbx*2], 0
jne 0x1400552a3
lea r8, [r14 + rbx]
mov dword [rsp - 0x34], ecx
xchg rdx, r14
mov r14, rdx
xchg r14, rdx
mov qword [rcx + 0x38], r8
mov r10, r10
call fcn.140055dc0
mov ecx, r14d
mov edx, 0x4e1dcbb5
xor edx, 0x743f1aec
add edx, 0x29957832
sub edx, 0x2f5abcba
add edx, 0x2c67a6e8
and ecx, 3
shl ecx, 3
mov dword [rsp - 0x38], ecx
ror edx, cl
test rbx, rbx
je 0x14005536f
lea r8, [r14 + r14]
mov dword [rsp - 0x10], 0x48dea65
mov ecx, 0x7b8f8e29
sub ecx, 0x63919611
add ecx, 0x534b652a
sub ecx, 0x6b495c43
sub r8, rdi
mov dword [rsp - 0x14], ebp
add r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
mov dword [rsp - 0x28], ecx
lea rdi, [rdi + 2]
and ax, cx
ror edx, 6
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
mov dword [rsp - 0x34], edi
mov word [r8 + rdi - 2], ax
sub rbx, 1
jne 0x14005533f
xchg rdi, rdi
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
xchg r9, rax
mov r9, rsi
xchg r9, rax
mov rsi, qword [rsp + 0x38]
xchg rsp, rsp
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret