joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016b2a
Capabilities:
Execute syscall

Disassembly:
adc eax, dword [rax]
fcmovnbe st(0), st(7)
adc eax, dword [rax]
invalid
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
jmp 0x1400169d5
push r10
movabs r10, 0x1192b6000002ace9
jne 0x1400168bc
jmp 0x140016b6d
jmp 0x1400169ed
mov r8, qword [rbx + 8]
mov rdi, rax
test r8, r8
mov dword [rsp - 0x24], 0x1716e2fe
mov dword [rsp - 0x44], 0x78fafe96
jmp 0x14001699d
lea rax, [rax + 8]
sub r8, 1
mov dword [rsp - 0x24], 0x31164ba4
jmp 0x1400168b8
mov rcx, qword [rcx + 0x10]
cmp qword [rbx + 8], rcx
jb 0x140016b80
xchg rcx, rcx
mov dword [rsp - 0x3c], 0x3e0f0138
mov dword [rsp - 0xc], 0x1a97eed6
xchg r13, r13
jne 0x14001695b
je 0x14001695b
rcr r11d, 0x4b
add r9d, 0xae4b1273
call rcx
lea r14d, [rdx - 0xec27]
cmp r9d, 0x5b2aa4ea
rcl r13d, 0x8f
jp 0x140015fd6
cmp r9, rbx
rcl r15d, 0x4c
mov r14d, 0xc38f9ef0
movabs r12, 0x7c2d4800000115e9
or ecx, 0xe7b3bb4d
div rcx
cpuid
div rsi
call rax
lea r14d, [rbx + 0x73be]
int3
jmp 0x140016a75
pop rcx
mov r15, r15
mov r14, r14
mov dword [rsp - 0x2c], esp
mov rcx, qword [rdx + rax]
mov qword [rax], rcx
jmp 0x1400168ea
mov rsi, rsi
je 0x140016a15
mov rdx, qword [rbx]
jmp 0x140016b0a
mov r14, r14
mov dword [rsp - 0x34], 0x5a00412
call fcn.140099bc0
jne 0x1400169c4
je 0x1400169c4
movabs r11, 0x461cbeffffff02e9
jmp rcx
jmp 0x1400168cb
mov dword [rsp - 0x20], edx
xchg r9, r9
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rsi, rdx
jmp 0x140016ae9
je 0x1400168bc
call 0x140016b2a
add rsp, 0x20
jmp 0x140016b6a
push rdi
movabs rdi, 0x48c9716b699a66eb
jne 0x140016a04
jmp 0x140016a6c
je 0x140016a04
jmp 0x140016a61
mov rcx, qword [rbx]
test rcx, rcx
xchg rbx, rbx
je 0x140016a29
call fcn.1400999a0
mov qword [rbx], rdi
mov dword [rsp - 0x2c], 0x7b1869db
je 0x140016a44
jne 0x140016a44
lea r15d, [rbx + 0x8a3f]
mul r14
movabs r10, 0xea6f0e072a2bbeb
lea edi, [rbx + 0xe65]
ret
jmp 0x140016a01
call fcn.140016c2d
add rsp, 0x20
pop rdi
ret
pop rdi
xchg r8, r8
jmp fcn.140016bb6
add rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rcx
shl rcx, 3
mov rbp, rbp
xchg r12, r12
je 0x140016ac5
jne 0x140016ac5
mul r14
ror r15d, 0xa7
mov r12d, 0x19e4349
div rbx
cmp r8, rdi
sub ebp, 0x5476e3c1
lea r12d, [rbp + 0xaaf4]
jnp 0x14001794a
lea r12d, [rbx - 0xb27a]
ror esi, 0x79
div rbp
mov edi, 0x3643be40
movabs r9, 0x4f3f9dfffffee4e9
pushfq
pushfq
jp 0x1400173ca
jmp 0x1400169ae
cmp r9d, 0xa64b3cb8
mov edi, 0xb405e15a
mov esi, 0xa9ff165f
ret 0x28
mov rbx, rcx
mov dword [rsp - 0x10], 0x699302c3
xchg rsp, rsp
mov dword [rsp - 0x3c], 0x7b19ca08
je 0x140016b88
jmp 0x1400168ff
sub rdx, rax
mov dword [rsp - 0x1c], 0x6bde8a16
mov dword [rsp - 0x3c], 0x34d70f15
mov dword [rsp - 0x18], ecx
push rcx
movabs rcx, 0x1e7c6ffffffe5de9
jne 0x140016b24
jmp 0x140016986
jmp 0x140016b33
je 0x140016b24
call fcn.140016d1f
add rsp, 0x20
pop rcx
ret
pop r10
ret
pop r10
xchg rdx, rdx
xchg rbx, rbx
jne 0x140016991
jmp 0x140016a15
mov rdi, qword [rbx]
jmp fcn.140016bb6
mov rdi, qword [rcx]
test rdi, rdi
jne fcn.140016bb6
mov dword [rsp - 0x14], 0x34371fd8
mov dword [rsp - 0x1c], 0x20b776e5
ret
Function at 0x140016c88
Capabilities:
Execute syscall

Disassembly:
mov rax, rsp
mov dword [rsp - 0x34], 0x48803dea
mov r10, r10
mov dword [rsp - 0x3c], 0x1f131e1a
jmp 0x140016e7e
fild dword [rcx]
add byte [rax], al
push rsi
push rdi
sub rsp, 0x30
mov dword [rsp - 0x34], 0x428f4283
push rdi
movabs rdi, 0x76c09000000199e9
jmp 0x140016ec3
jmp 0x140016eda
xchg r8, r8
mov dword [rsp - 0xc], 0x45fe677a
mov dword [rsp - 0x34], 0x702b1131
mov dword [rsp - 0x18], 0x32c6a9df
jmp 0x140016d2b
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
xchg r13, r13
jne 0x140016ea9
je 0x140016ea9
pushf
call rax
pushfq
rcr edx, 0x2a
cmp rcx, rbx
cmp r8, rcx
or r12d, 0x64a4a591
movabs r10, 0x44f61fffffedde9
lea r14d, [rbp - 0xeed2]
rcl ebx, 0x25
ret
jmp 0x140016d8b
jne 0x140016d3c
je 0x140016d3c
call fcn.140016e23
add rsp, 0x30
pop rdi
ret
pop rdi
jmp fcn.140016e5f
Function at 0x14001f694
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rsp - 0x34], 0x126dcc92
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
jmp 0x14001f7a0
mov r11, r11
mov dword [rsp - 0x38], 0x65bf8cf3
mov rcx, rcx
call 0x140079d80
xor ebx, ebx
test al, al
movabs rbx, 0x5c5ca9f035561deb
jne 0x14001f6d8
jmp 0x14001f6f7
je 0x14001f6d8
call 0x14001f690
add rsp, 0x1c0
jmp 0x14001f6f5
pop rbx
ret
pop rbx
mov rsi, rcx
jmp 0x14001f6b4
lea rbp, [rax - 0xd8]
sub rsp, 0x1c0
push rbx
jmp 0x14001f6d6
mov dword [rsp - 0x34], 0x383fbe1a
xchg r9, r9
push r15
je 0x14001f782
jne 0x14001f782
jmp rax
jmp 0x14001f729
push rbp
push r13
mov dword [rsp - 0xc], 0x44b292ec
mov dword [rsp - 0x3c], 0x47786bb9
jmp 0x14001f73d

Function at 0x140020fe3
Capabilities:
Execute syscall

Disassembly:
call fcn.1400997f0
mov rax, rbx
mov dword [rsp - 0x14], 0x9086b87
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
ret
pop rbx
xchg r15, r15
mov rbx, rcx
jne 0x140020b66
je 0x140020b66
call rax
jae 0x140020fcc
rol edx, 3
movabs rcx, 0x482d6601137841eb
inc rdx
add r12d, 0x26b72fff
div r12
and edi, 0x77abf890
pause
call fcn.140020432
mov dword [rsp - 0x38], 0x69f9beb5
push rbx
movabs rbx, 0x3d1bfb7d1029b9eb
jne 0x140020b93
jmp 0x140020ba9
jmp 0x140020b4e
je 0x140020b93
call fcn.140020b52
jmp 0x140020b48
mov qword [rcx], rax
test dl, 1
mov rdx, rdx
je 0x140020b37
mov edx, 0x10
jne 0x140020bfd
je 0x140020bfd
jmp rcx
jmp 0x140020b32
and eax, 0xff6894d
lea ecx, [rcx]
add eax, dword [rax]
add byte [rax - 0x73], cl
fadd st(6)
sub eax, 8
add byte [rax], al
add ecx, ebp
lock add byte [rax], al
add byte [rdi], cl
invalid

Function at 0x140022910
Capabilities:
Execute syscall

Disassembly:
add byte [rax], al
cmp r9d, 0xb68d55c
lea ebp, [rdx + 0xf4cf]
pop r10
test r13d, 0xb9d5ec17
jns 0x140022b9a
ret 0x30
add byte [rcx - 0x48], cl

Function at 0x140024630
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x34], esp
mov dword [rsp - 0x38], edx
mov dword [rsp - 0x44], ebx
sub rsp, 0x20
mov rbx, rcx
jmp 0x14002476e
call fcn.1400f7b70
mov dword [rsp - 0x2c], 0x1057ca05
mov dword [rsp - 0x30], 0x1481380
mov dword [rsp - 0xc], 0x1d7dd5a0
mov dword [rsp - 0x38], 0x5976e344
push r15
jmp 0x1400247cd
movabs r15, 0x4d27ebce32f3ebeb
jne 0x1400247cf
je 0x1400247cf

Function at 0x1400287cc
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x38], 0x635a9c6b
mov dword [rsp - 0x20], 0x428e8c0a
xchg r14, r14
mov dword [rsp - 0x14], 0x7f7600a5
jbe 0x140028866
jmp loc.1400287f1
Function at 0x1400297bd
Capabilities:
Execute syscall

Disassembly:
add rsp, 0x20
pop rbp
ret
pop rbp
mov rcx, qword [rbx]
call fcn.1400999a0
je 0x140028e33
jne 0x140028e33
add r13d, 0x30b2e3f7
pop rcx
add r13d, 0x42ed2a76
pause
rcl r15d, 0x12
int3
jmp 0x140028eca
jmp 0x1400290a1
mov rax, qword [rbx + 0x78]
cmp rax, 0x78
jbe 0x140028fc2
mov dword [rsp - 0x30], 0x6c805f62
mov rcx, qword [rbx]
jmp 0x140028f74
mov rsp, rsp
push rbp
movabs rbp, 0x2bd071fffffea1e9
jne 0x140028f49
jmp 0x140028def
je 0x140028f49
call fcn.1400290d7
jmp 0x140028de9
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
xchg r13, r13
mov dword [rsp - 0x38], 0x669978d7
mov dword [rsp - 0x2c], 0x78b0aa70
jmp 0x140028f43
test rax, rax
je 0x1400290a1
mov rax, qword [rbx]
mov dword [rsp - 0x30], 0x26e2f95e
xchg rbx, rbx
xor edx, edx
jmp 0x140029103
add rsp, 0x20
pop rdi
xchg rsi, rsi
mov dword [rsp - 0x18], 0x37e66506
mov dword [rsp - 0x40], 0x4444effc
jne 0x14002900e
je 0x14002900e
jb 0x1400297bb
dec rbp
rol r8d, 0x8f
div r12
movabs rdi, 0x5835608200e818eb
rol ebp, 0x79
xor edi, 0x300c38bd
rol r11d, 7
call fcn.140028619
jmp 0x140029028
ret
mov dword [rsp - 0x20], 0x1ad26607
mov dword [rsp - 0x38], 0x1700fec2
jb 0x140028eda
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, rdi
mov rsi, qword [rsp + 0x40]
je 0x140029095
jne 0x140029095
lea r10d, [rdx + 0xf90f]
jmp rax
jmp 0x140028fe0
and byte [rax + 0x4cc7c164], ch
ret
mov qword [rbx + 0x78], rbp
inc rdi
sub rbx, 0xffffffffffffff80
cmp rdi, qword [rsi]
xchg r8, r8
jne 0x1400290ec
je 0x1400290ec
ror ebx, 0x75
ret
jmp 0x140029029
mov rcx, rbx
call qword [rax]
mov dword [rsp - 0x18], 0x70c33477
mov dword [rsp - 0x20], ecx
jo 0x14002909a
and al, 0xe0
mov dword [rsp - 0x3c], 0x29abc3ec
je 0x14002912d
jne 0x14002912d
and edi, 0x1fb443a7
rcr edi, 0x62
jmp rcx
jmp 0x1400290a1
mov rax, qword [rdi + 0x78]
cmp rax, 0x78
jbe 0x1400294c1
mov rcx, qword [rdi]
mov dword [rsp - 0x14], esi
jne 0x14002933c
je 0x14002933c
ja 0x14002910f
neg r15
sub ebp, 0xe0db0cd0
or r13d, 0x2eee58aa
movabs rcx, 0x382ba3000000b3e9
int3
jmp 0x1400293f4
add byte [rax], al
test dword [rsi], eax
jle fcn.1400287f8
mul rcx
call rcx
div r12
rcr r10d, 0xc3
test r11d, 0xf5c483ac
ret
Function at 0x14002a569
Capabilities:
Execute syscall

Disassembly:
and al, 0x18
out 0xff, al
lea r8, [rbp + 0x20]
jmp 0x14002966f
Function at 0x14002c7a6
Capabilities:
Execute syscall

Disassembly:
jne 0x14002c7a7
call rax
jns 0x14002d232
ror byte [rdi], 1
mov dword [rbx + 0x4900000a], eax
div esp
div r12
call rax
cmp r12, rbp
call rcx
rcl r10d, 0x8b
div r15
jae 0x14002d197
movabs rbx, 0x75314cffffff1fe9
xor ebx, 0xd5758ff0
syscall
ret
movabs r13, 0x14d06700000295e9
jne 0x14002d025
jmp 0x14002d2bf
je 0x14002d025
call fcn.14002d01b
add rsp, 0x20
pop r13
ret
mov dword [rsp - 0x24], 0x619e39b3
mov dword [rsp - 0x44], 0x71ccab58
push rdi
movabs rdi, 0x1774ac7d19a038eb
jne 0x14002d055
jmp 0x14002d08f
je 0x14002d055
call 0x14002d04a
jmp 0x14002d089
mov edx, 0x1100
mov rcx, rdi
mov dword [rsp - 0x10], 0x4072c9e0
mov dword [rsp - 0x20], esp
call fcn.1400997f0
jmp 0x14002d2a4
add rsp, 0x20
pop rdi
ret
pop rdi
mov rcx, qword [rsi + rax]
dec dword [rcx + 8]
cmp dword [rcx + 8], 0
jmp 0x14002d340
push rdx
movabs rdx, 0x2e4e0e00000195e9
jne 0x14002d0a3
jmp 0x14002d23d
je 0x14002d0a3
call fcn.14002cfcd
add rsp, 0x20
jmp 0x14002d23b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rdi, rdi
mov dword [rsp - 0x24], 0x4f14bc86
mov rdi, rdi
push r13
jmp 0x14002d023
xchg rdx, rdx
mov dword [rsp - 0x1c], edi
mov dword [rsp - 0x2c], 0x688bb277
jmp 0x14002d219
xchg rbx, rbx
ret
mov qword [rcx + 0x5a8], rax
cmp qword [rcx + 0x10e8], rbx
jbe 0x14002d37c
mov qword [rsp + 0x40], rsi
mov dword [rsp - 0x1c], 0x2762964b
jne 0x14002d1e8
je 0x14002d1e8
xor r12d, 0x91e6c340
syscall
ror ebx, 0xe8
cmp r12, rbp
ror r12d, 0xaf
sub edx, 0xd47ebf42
pause
cpuid
jns 0x14002d975
lea r8d, [rcx - 0x2b06]
movabs rbp, 0x30fee300000134e9
jmp 0x14002de79
jmp 0x14002d321
mov rsi, qword [rsp + 0x40]
push rsi
movabs rsi, 0x260e8900000155e9
jne 0x14002d221
jmp 0x14002d37b
je 0x14002d221
call fcn.14002d121
add rsp, 0x20
jmp 0x14002d379
pop rdx
ret
pop rdx
xchg r10, r10
test bpl, 1
jmp 0x14002d25f
cmp rbx, qword [rdi + 0x10e8]
jb 0x14002d331
xchg rsi, rsi
jmp 0x14002d129
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x18], 0x45efa8eb
mov dword [rsp - 0x3c], esi
mov dword [rsp - 0x30], 0x3e8006ea
mov dword [rsp - 0x30], 0x550121bc
je 0x14002d2a4
jmp 0x14002d06b
mov rax, rdi
add rsp, 0x20
pop rdi
xchg r13, r13
xchg r12, r12
mov dword [rsp - 0x30], 0x6e658539
jmp 0x14002d166
pop r13
mov r8, r8
mov rdi, rdi
inc rbx
add rsi, 0x2a0
jmp 0x14002d24a
mov dword [rsp - 0x30], 0x1a40fd97
mov dword [rsp - 0x24], 0x14aeba4d
mov rcx, rdi
call fcn.1400fdd90
mov r14, qword [rsp + 0x48]
mov dword [rsp - 0x28], edx
mov dword [rsp - 0x3c], 0x4cb797ed
je 0x14002d314
jne 0x14002d314
mul r9
or ebp, 0x13e7bb50
rcl r13d, 0xd6
call rcx
movabs r9, 0x66c9c3fffffd87e9
call fcn.14002c51b
jmp 0x14002d0a0
mov dword [rsp - 0x38], 0xa8b7018
mov r15, r15
mov esi, ebx
nop dword [rax]
mov rax, qword [rdi + 0x10e0]
xchg rdi, rdi
jmp 0x14002d042
xchg rbx, rbx
xchg r14, r14
mov dword [rsp - 0x10], 0x57185ea1
mov dword [rsp - 0x44], 0x76746f5e
jg 0x14002d2c7
jmp 0x14002d0e7
pop rsi
ret
pop rsi
lea rcx, [rdi + 0x10e0]
call fcn.14002e480
xchg rbp, rbp
mov dword [rsp - 0x24], ecx
jmp 0x14002d2d6
lea esi, [rsi + 0x280]
push rsi
or bh, al
and al, 0xf0
insd dword [rdi], dx
js 0x14002d9ce
jbe 0x14002d969
Function at 0x14002cf99
Capabilities:
Execute syscall

Disassembly:
test cl, al
ror ebx, 0x48
mul ecx
invalid
sar edi, 0xe1
lea r12d, [rdi + 0x77ad]
jg 0x14002d96c
syscall
test r9, rcx
invalid
invalid
invalid

Function at 0x14002ddaa
Capabilities:
Encode data using xor

Disassembly:
push rcx
add dword [rax], eax
add byte [rdi + rax*4 + 0x76], ch
mov ecx, 0x131d973d
div rbx
sub ecx, 0x23f19157
jmp rcx
push rsi
sub rsp, 0x20
mov dword [rsp - 0x24], ebx
mov dword [rsp - 0x30], 0x3afdc58
mov rsi, rcx
mov r8, rdx
jmp 0x14002daed
mov qword [rsp + 0x38], rdi
mov rdi, qword [rdx]
mov rax, qword [rdi]
jmp 0x14002dc80
mov rcx, qword [rdx + 0x78]
xchg r12, r12
mov dword [rsp - 0xc], esp
mov rbp, rbp
jne 0x14002db2a
je 0x14002db2a
lea esi, [rbx + 0xa550]
ror r8d, 0x92
rcr ebp, 0x3c
lea r11d, [rbp - 0xe44e]
inc r10
rcr ecx, 0x13
cmp r12, rbp
jmp 0x14002dbad
pop rbx
ret
mov dword [rsp - 0x28], 0x25d08e5a
mov dword [rsp - 0x24], 0x6f748630
mov dword [rsp - 0x18], ebx
push rbx
movabs rbx, 0x61643086b92e5eb
jne 0x14002db5f
jmp 0x14002db46
jmp 0x14002dc6a
pop rcx
xchg rbp, rbp
mov qword [rsi + 0x78], rcx
cmp rcx, 0x78
jmp 0x14002dbf2
je 0x14002dbb3
call fcn.14002dd5c
add rsp, 0x20
pop rcx
ret
mov dword [rsp - 0x30], 0x647c7aeb
mov qword [rsi], rax
add rsp, 0x20
pop rsi
mov dword [rsp - 0x24], edi
mov rsi, rsi
jmp 0x14002db48
xchg r14, r14
push rcx
movabs rcx, 0x6557dbe70bbab9eb
jne 0x14002dbb3
jmp 0x14002db6e
jmp 0x14002db7f
mov dword [rsp - 0x24], edx
xchg rsi, rsi
mov r9, r9
mov dword [rsp - 0x28], 0x36abf65a
jmp 0x14002db91
mov dword [rsp - 0x2c], 0x3b4a4e94
call rbx
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jmp 0x14002dbc2
jbe 0x14002dcca
mov qword [rsp + 0x30], rbx
mov dword [rsp - 0x2c], 0x57202da4
mov dword [rsp - 0x1c], esp
je 0x14002dc36
jne 0x14002dc36
pushfq
xor r12d, 0xe88c31f0
xor r15d, 0xfcd8d72a
rol r14d, 0xec
in al, dx
jle 0x14002dc1f
jge 0x14002dda9
bswap rcx
lea r13d, [rdi - 0x1961]
cpuid
movabs r12, 0x4c3374fffffea2e9
popf
lea edi, [rdx + 0x2678]
ror r10d, 0x91
jmp 0x14002cdef
jmp 0x14002dadd
mov dword [rsp - 0x18], 0x1684764f
mov r9, r9
mov dword [rsp - 0x30], 0x2272070d
mov r8, r8
jmp 0x14002dbd9
je 0x14002db5f
call 0x14002dc8d
add rsp, 0x20
pop rbx
ret
mov rbx, qword [rax + 0x10]
xchg r10, r10
mov r12, r12
call fcn.140099bc0
mov rdx, rax
mov rcx, rdi
je 0x14002dcb0
jne 0x14002dcb0
rcl r9d, 0x9f
jo 0x14002ea61
lea r14d, [rdi + 0xdf1]
rcr r9d, 0x25
movabs r11, 0x483e8fdc1d539deb
pause
xor ebx, 0x677d23e
cmp rdi, rcx
jmp rcx
jmp 0x14002dc4f
test rcx, rcx
je 0x14002dd29
mov rax, qword [rdx]
jmp 0x14002dd0b
add rsp, 0x20
mov dword [rsp - 0x24], ebp
mov dword [rsp - 0x30], 0x64025c5a
mov dword [rsp - 0x20], 0x194b1fc6
pop rsi
jne 0x14002dcfa
je 0x14002dcfa
movabs r13, 0x79badb336b460beb
ret
mov dword [rsp - 0x30], 0x7f8ba8db
xchg rbp, rbp
mov dword [rsp - 0xc], 0x762e7040
mov rcx, r8
mov rdx, rsi
jmp 0x14002dcdb
add rsp, 0x20
pop rsi
ret
mov esp, 0x21de9
add al, ch
invalid
add dl, dl
xor dword [rdx], ebp
Function at 0x14002e610
Capabilities:
Encode data using xor

Disassembly:
invalid
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x2c], 0x688491a6
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
jmp 0x14002e720
mov dword [rsp - 0xc], edi
mov r14, r14
mov dword [rsp - 0x40], 0x3f8cc257
and al, 0xc0
push rdi
ret 0x3f8c
xor edx, edx
mov rax, qword [rcx]
jmp 0x14002e734
call 0x14002e695
add rsp, 0x20
pop rbp
jne 0x14002e678
je 0x14002e678
push r14
mov r10d, 0x2302af3b
jmp rax
jmp 0x14002e6de
movabs rbp, 0x715a3403727b1aeb
jne 0x14002e68b
jmp 0x14002e6a7
je 0x14002e68b
call fcn.14002e79a
add rsp, 0x20
jmp 0x14002e6a5
pop rbp
ret
pop rbp
jmp 0x14002e823
mov edi, ebp
invalid
and al, 0xd8

Function at 0x14002e9fe
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x3c], 0x15f406eb
mov dword [rsp - 0x1c], 0x79d8ef4a
xchg rdx, rdx
mov qword [rsp + 0x18], rsi
jmp 0x14002ed14
call fcn.1400ee3a4
xchg rcx, rcx
mov dword [rsp - 0x1c], 0x7e65cf11
mov dword [rsp - 0x24], 0x5e1f5dd3
mov r9, qword [0x1401435e8]
movabs rcx, 0x803b9a82e9f5702
rol r9, 0x3a
jmp 0x14002eecf
push rdi
movabs rdi, 0x6f6df400000bfee9
jne 0x14002e9d8
jmp 0x14002f5db
je 0x14002e9d8
call 0x14002e9fe
je 0x14002ea05
jne 0x14002ea05
cmp rsi, rbp
lea r13d, [rdx + 0x7c48]
jne 0x14002ee8c
jno 0x14002f10e
movabs r8, 0x42b836000002b4e9
cmp rbx, rbp
or edx, 0x5ecaa269
js 0x14002f8a0
jmp 0x14002ecbe
ror r15d, 0x57
xor r8d, 0xe8585b94
and r13d, 0xfb13774c
sub ebx, 0xffb87931
inc r12
call fcn.14002f143
add rsp, 0x20
pop rdi
ret
movabs rcx, 0x2222b0b2ee2ca81d
sub r9, rcx
sub ecx, ecx
push rdi
sub rsp, 0x20
mov dword [rsp - 0x10], edx
mov r15, r15
xchg rsp, rsp
mov r15, r15
mov dword [rsp - 0x3c], 0x553de2a2
jmp 0x14002e9d5
xor cl, byte [rdi]
mov dh, 0x41
add ecx, dword [rax + 0x75332444]
adc byte [rsi + rcx + 0x48], dh
inc esi
mov dword [rsp - 0x24], 0x440a9b2c
xchg r13, r13
xchg r13, r13
mov r8d, 0xa
jmp 0x14002f3ef
push r13
movabs r13, 0x5eabd10a145e41eb
jne 0x14002f008
jmp 0x14002f04b
je 0x14002f008
call 0x14002f1d2
je 0x14002f02f
jne 0x14002f02f
mov esi, 0x14da9687
call rcx
test r11, rbx
ror r15d, 0x78
pause
movabs r8, 0x50ce8c0e629b13eb
popf
test r13, rdi
dec r9
pause
ret 0x20
jmp 0x14002f044
add rsp, 0x20
pop r13
ret
pop r13
rol r9, 0x31
jmp 0x14002ecc9
retf
sub r9, rcx
movzx edx, bx
mov dword [rsp - 0x24], ebx
mov dword [rsp - 0x10], 0x7b5c3a57
jne 0x14002f438
je 0x14002f438
div rdx
ror ebx, 0xdc
dec rcx
xor ecx, 0x5622bc8e
xor r11d, 0x15f00375
cpuid
cmp r12, rcx
rcl r9d, 0x8d
jmp rax
jmp 0x14002f004
pop rdi
mov ebx, ecx
mov rcx, qword [0x1401485f0]
jmp 0x14002e9a3
Function at 0x140034e1c
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x2c], 0x192e9cf0
xchg r10, r10
xor eax, eax
push rsi
movabs rsi, 0x227d1e000001d3e9
jne 0x1400339f3
jmp 0x140033bcb
jmp 0x1400344e5
mov dword [rsp - 0x38], 0x10860c3d
mov dword [rsp - 0x14], 0x5fb85b5f
mov dword [rsp - 0x34], 0x5d86fcec
mov dword [rbp + 0x582], 0x5200d0
push rsi
jmp 0x1400338bb
ret
pop rsi
mov dword [rbp + 0x556], 0x4c00ef
xor edi, edi
xchg rdx, rdx
xchg rdx, rdx
jmp 0x14003400c
mov rcx, qword [rbp + 0x10a8]
mov rax, qword [rbp + 0x10a8]
jmp 0x140034442
test al, al
jne 0x14003a91f
mov rax, qword [0x140143470]
mov dword [rsp - 0x2c], 0x26f1e71d
xchg r8, r8
mov dword [rsp - 0x2c], edi
jmp 0x1400336fb
movzx edx, word [rbp + rax*2 - 0x72]
xchg rbp, rbp
mov dword [rsp - 0xc], 0x7942307d
push r13
movabs r13, 0x44a0a2000010c4e9
jne 0x140033d49
jmp 0x140034e12
jmp 0x140034e00
xchg r15, r15
mov dword [rsp - 0x30], 0x14285892
mov dword [rbp + 0x55e], 0x7200f7
jmp 0x140034324
mov dword [rsp - 0x20], ecx
mov word [rbp + 0x8b8], ax
mov esi, 0x9a
mov dword [rbp + 0x55a], 0x1b00f5
mov word [rbp + 0x60a], si
jmp 0x140033e9e
mov dword [rbp + 0x566], 0x6d00cb
mov dword [rbp + 0x56a], 0x5500dd
mov dword [rbp + 0x56e], 0x3a00c3
mov dword [rsp - 0x24], 0x7194740c
xchg r11, r11
jmp 0x1400349ae
mov dword [rbp + 0x562], 0x5f00d5
lea esi, [rdi + 0x18]
mov dword [rsp - 0x20], 0x65296934
mov dword [rsp - 0x14], 0x31f24d80
mov dword [rsp - 0x1c], 0x56dd7afe
jmp 0x140034270
push r15
movabs r15, 0x6d98de000008c8e9
jne 0x140034446
jmp 0x140034d13
je 0x140034446
call fcn.1400343ab
add rsp, 0x6f
jmp 0x140034d10
je 0x1400339f3
call fcn.1400346b3
add rsp, 0x6f
pop rsi
jmp 0x140033bca
add al, ch
pop rbx
jg 0x1400346b8
add cl, ch
or rax, qword [rax]
add byte [rax - 0x79], cl
in al, 0x48
mov eax, dword [rbp + 0x10a8]
xchg rsp, rsp
mov rax, qword [rbp + 0x10a8]
xor cx, dx
mov word [rbp + rax*2 + 0x888], cx
jmp 0x140034967
mov dword [rsp - 0x34], 0x75c0665e
mov r15, r15
mov rax, qword [rbp + 0x10a8]
inc rax
mov qword [rbp + 0x10a8], rax
xchg rdx, rdx
mov rax, qword [rbp + 0x10a8]
jmp 0x140034fdc
xchg r8, r8
mov dword [rbp + 0x572], 0x4e00d9
mov dword [rbp + 0x576], 0x6e00d7
mov dword [rbp + 0x57a], 0x590094
mov dword [rbp + 0x57e], 0x3a00c1
jmp 0x140033a72
pop r15
ret
pop r15
xchg rbx, rbx
mov r14, r14
and cl, r14b
shl cl, 3
jmp 0x140033d35
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x14], edi
mov rbx, rbx
mov r11, r11
jmp 0x1400346be
je 0x140033d49
call fcn.140034fcf
add rsp, 0x6f
pop r13
ret
pop r13
mov eax, r15d
jne 0x140034e4f
je 0x140034e4f
test r13d, 0xabc6b94e
test rbx, rbx
call rcx
jg 0x1400353a4
dec r13
jmp rax
jmp 0x140034dd7
cmp rax, rsi
jb 0x140033c7b
mov dword [rsp - 0x40], 0x581325b6
jmp 0x1400339e3
Function at 0x1400350a0
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x20], edx
push r14
movabs r14, 0x25e0ed000002dee9
jne 0x140033e72
je 0x140033e72
ror r13d, 0x73
or r9d, 0x91efdb6f
jg 0x140033020
jmp fcn.140033465
popfq
ror r10d, 0x74
ret
add byte [rdx], bh
add byte [rbp - 0x77], cl
test byte [rax - 0x79], 0xf6
jne 0x1400350ce
je 0x1400350ce
add ebx, 0xad37bf85
or ebx, 0x214791ed
lea r12d, [rbx + 0x37c1]
lea r15d, [rcx + 0x7c43]
ror r8d, 0xa3
popfq
movabs r14, 0x15842cffffed6ce9
jb 0x1400348c3
jmp 0x140033e3f
ror r13d, 0x90
syscall
lea r11d, [rbx - 0xd315]
ret 0x10

Function at 0x140035592
Capabilities:
Execute syscall

Disassembly:
and eax, 0xa20f493b
jne 0x140034d1e
jb 0x14003648a
or edi, 0x69fcb565
pause
call rcx
ret 8

Function at 0x14003c614
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
je 0x14003c635
jne 0x14003c635
ret
jmp 0x14003c7ea
mov r8, r8
mov dword [rsp - 0x3c], 0x66032ce6
xchg r13, r13
push r14
jmp fcn.14003c740

Function at 0x14003d9d2
Capabilities:
Execute syscall

Disassembly:
adc dword [rcx - 0x42], eax
in al, 0x56
mov dl, 0x9f
lea r14d, [rdi + 0x5d52]
syscall
movabs rcx, 0x5010f000000132e9
sub r12d, 0x64312bf4
dec r9
rol r8d, 0xe5
div r13
ret
Function at 0x140046856
Capabilities:
Encode data using xor

Disassembly:
call fcn.1400460f7
add rsp, 0x13
pop r10
ret
pop r10
xchg rcx, rcx
mov rcx, qword [rbp + 0x450]
jmp 0x1400465ab
push r9
movabs r9, 0x5ddd06d157984aeb
jne 0x1400465af
jmp 0x1400465fb
je 0x1400465af
call fcn.140046552
add rsp, 0x13
jmp 0x1400465f8
pop r9
ret
pop r9
jmp 0x14004678e
lea rax, [rbp + 0x458]
cmp rcx, rax
jne 0x140046a28
jne 0x1400467e0
mov dword [rsp - 0x40], 0x2c3c0212
jmp 0x140046912
push r10
movabs r10, 0x787833fffff869e9
jne 0x140046916
jmp 0x140046184
je 0x140046916
jmp 0x140046178
call fcn.1400999a0
Function at 0x140049642
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
and al, 0xe8
xchg edi, eax
jnp 0x140049626
mov dword [ebp + 0x1c0], 0x550094