joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ae40
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
nop
push r9
mov qword [rsp], rdi
nop
add rsp, 0x73fdd88
sub rsp, 0x73fdda8
xchg rbx, r13
mov r13, rdx
xchg rbx, r13
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
nop
movabs rdx, 0xffffffff6e6f9518
sub rdx, 0x3a7debd9
add rdx, 0x11cbc73
add rdx, 0x21726367
add rdx, 0x7fffffff
xor rdx, 0x297f36e7
nop word [rax + rax]
mov dword [rsp - 0x14], 0x15bdc4ae
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x14006aeb2
mov dword [rsp - 0x20], 0x754a5b68
xchg rdx, r11
mov qword [rcx + 0x38], r11
xchg r11, rdx
call fcn.1400110e0
mov r13, r13
xor r8d, r8d
mov edx, 0x6d5c4ee2
xor edx, 0x61fa6b25
add edx, 0xe6def1f
xor edx, 0x1c61f246
add edx, 0x18e2b34
cmp qword [rdi + 0x38], r8
jbe 0x14006af68
sub rbx, rax
mov dword [rsp - 0x40], 0x644a687d
mov r9d, 0x772ee121
xor r9d, 0x4824cb77
xor r9d, 0xd2ac96f
sub r9d, 0x3220e23a
nop word [rax + rax]
mov r15, r15
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
mov dword [rsp - 0x40], ebx
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rax + rbx - 2]
inc r8
mov word [rax - 2], cx
mov dword [rsp - 0x20], 0x4d389b21
cmp r8, qword [rdi + 0x38]
jb 0x14006af33
mov rbx, qword [rsp + 0x30]
xchg rdi, rsp
mov rax, rsp
xchg rsp, rdi
sub rsp, 0xffffffffffffffe0
mov r12, r12
pop rdi
ret
Function at 0x14006b900
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rsi
push rdi
mov dword [rsp - 0x34], ebx
nop
sub rsp, 0x2e7c6c8b
add rsp, 0x2e7c6c6b
xchg rsp, rsi
mov rsp, qword [rcx + 0x38]
xchg rsp, rsi
xchg rbx, r15
mov r15, rdx
xchg r15, rbx
mov r8, qword [rdx + 0x38]
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
add r8, rsi
mov rdx, rdx
mov rdx, rsi
mov qword [rcx + 0x38], r8
call fcn.14006c570
mov dword [rsp - 0x38], esi
mov r9, qword [rbx]
mov ecx, esi
and ecx, 3
mov r12, r12
mov r8d, 0x473a8564
xor r8d, 0x70aa9f39
sub r8d, 0x1027e1e1
sub r8d, 0xd71131
sub r8d, 0x1d8d1577
shl ecx, 3
xchg r8, r8
mov edx, r8d
ror edx, cl
xor ecx, ecx
mov dword [rsp - 0x24], 0x692a0dc
cmp qword [rbx + 0x38], rcx
jbe 0x14006ba2f
lea r10, [rsi + rsi]
mov dword [rsp - 0x2c], ebx
mov r11d, 0x365bffe5
add r11d, 0x66e45d9
xor r11d, 0x52500e71
xor r11d, 0x65335dd0
sub r11d, 0xba91520
sub r10, r9
xchg r15, r15
add r10, rax
nop word [rax + rax]
movzx eax, dx
mov dword [rsp - 0x44], 0x63be218f
lea r9, [r9 + 2]
xor ax, r8w
ror edx, 8
and ax, r11w
xchg rdi, rdi
ror r8d, 5
ror r8d, 2
ror r8d, 1
xor ax, word [r9 - 2]
mov dword [rsp - 0x20], 0x658558e5
inc rcx
mov word [r9 + r10 - 2], ax
cmp rcx, qword [rbx + 0x38]
jb 0x14006b9df
mov dword [rsp - 0xc], 0x57edb43
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rsi, r8
mov r8, qword [rsp + 0x38]
xchg r8, rsi
nop
add rsp, 0x15524cad
sub rsp, 0x15524c8d
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14006ba70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rsi
xchg r13, rdi
mov qword [rsp + 0x18], r13
xchg rdi, r13
nop
sub rsp, 8
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov r14, qword [rcx + 0x38]
mov dword [rsp - 0x24], 0x6fa8635d
xchg rdx, rbx
mov rdi, rbx
xchg rbx, rdx
xchg rbx, rsi
mov rbx, rcx
xchg rsi, rbx
nop
movabs rbx, 0xffffffff4b885da3
sub rbx, 0x279400f2
xor rbx, 0x260d8f95
xor rbx, 0x340e1ba3
add rbx, 0x7fffffff
xor rbx, 0x4e083779
inc rbx
mov dword [rsp - 0x18], esi
cmp word [rdx + rbx*2], 0
jne 0x14006baea
lea r8, [r14 + rbx]
mov dword [rsp - 0x28], ebp
mov rdx, r14
mov qword [rcx + 0x38], r8
call fcn.14006c570
mov ecx, r14d
xchg rcx, rcx
mov edx, 0xf57b9d2
add edx, 0x2de2076f
add edx, 0x39186a89
xor edx, 0xd1c4568
sub edx, 0x724a5cce
and ecx, 3
shl ecx, 1
shl ecx, 2
ror edx, cl
mov dword [rsp - 0x18], 0x6d1bea97
test rbx, rbx
je 0x14006bbba
lea rcx, [r14 + r14]
mov r8d, 0x1841faf5
add r8d, 0x98641a2
add r8d, 0x771444d
sub r8d, 0x2728a3fe
xor r8d, 0x210dc19
sub rcx, rdi
add rcx, rax
xchg r15, r15
nop word [rax + rax]
movzx eax, dx
lea rdi, [rdi + 2]
and ax, r8w
mov dword [rsp - 0x28], ebx
ror edx, 1
ror edx, 1
ror edx, 1
ror edx, 3
ror edx, 1
ror edx, 1
xor ax, word [rdi - 2]
xchg r11, r11
mov word [rdi + rcx - 2], ax
sub rbx, 1
jne 0x14006bb88
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
mov rsi, qword [rsp + 0x38]
xchg rdi, r10
mov r10, qword [rsp + 0x40]
xchg r10, rdi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x14006c2c0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg rbx, r15
mov qword [rsp + 0x18], rbp
mov rsi, rsi
push rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x40], 0x44ca0984
lea rsi, [rdx + 8]
xorps xmm0, xmm0
xchg rsi, rdi
mov qword [rdx], rdi
xchg rsi, rdi
xor edi, edi
xchg rbx, rsi
movups xmmword [rbx], xmm0
xchg rbx, rsi
xchg r9, rbx
mov r14, rbx
xchg r9, rbx
xchg rbp, r10
mov r10, r8
xchg r10, rbp
xchg rcx, rsi
movups xmmword [rcx + 0x10], xmm0
xchg rsi, rcx
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
xchg rsi, r13
movups xmmword [r13 + 0x20], xmm0
xchg rsi, r13
mov qword [rdx + 0x38], rdi
mov rax, qword [rcx + 0x38]
cmp r8, rax
mov dword [rsp - 0x34], 0x42c8b845
jae 0x14006c502
sub rax, r8
mov qword [rsp + 0x40], r15
mov dword [rsp - 0x30], ecx
cmp rax, r9
cmovb r14, rax
xchg r12, r14
mov qword [rdx + 0x38], r12
xchg r12, r14
mov rax, qword [rcx]
mov dword [rsp - 0x18], 0x225954cb
mov rcx, qword [rdx]
lea r15, [rax + r8*2]
cmp rcx, rsi
je 0x14006c396
mov r8, r8
call fcn.1400bb8f0
cmp r14, 0x18
jbe 0x14006c3d1
lea rcx, [r14 + r14]
mov dword [rsp - 0x3c], edx
call fcn.1400bbbb0
xchg rdx, rax
mov qword [rbx], rdx
xchg rdx, rax
test rax, rax
mov rdi, rdi
jne 0x14006c3e3
mov qword [rbx], rsi
xchg rdi, r9
mov rdi, r9
xchg r9, rdi
jmp 0x14006c3ff
xchg rsp, rsi
mov qword [rbx], rsp
xchg rsi, rsp
xchg r13, rsi
mov rax, r13
xchg r13, rsi
xorps xmm0, xmm0
movups xmmword [rax], xmm0
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
xchg rbx, rax
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rax
mov r9, qword [rbx]
mov r11, r11
and ebp, 3
mov r8d, 0x32173e1a
sub r8d, 0x25f5f23
sub r8d, 0x902d4e8
add r8d, 0x7d508f7
xor r8d, 0x278e02d2
shl ebp, 3
mov edx, r8d
mov r9, r9
movzx ecx, bpl
ror edx, cl
cmp qword [rbx + 0x38], rdi
jbe 0x14006c4b4
xchg r13, r13
sub r15, r9
mov ecx, 0x78a158fe
xor ecx, 0x2f499c24
xor ecx, 0x3a2ec1c2
sub ecx, 0x2d0c7271
sub ecx, 0x40b991a8
nop dword [rax]
mov dword [rsp - 0x28], edx
nop word [rax + rax]
movzx eax, dx
lea r9, [r9 + 2]
mov r13, r13
xor ax, r8w
ror edx, 2
ror edx, 4
ror edx, 2
and ax, cx
xchg rdx, rdx
ror r8d, 3
ror r8d, 4
ror r8d, 1
xor ax, word [r9 + r15 - 2]
inc rdi
xchg rsi, rsi
mov word [r9 - 2], ax
cmp rdi, qword [rbx + 0x38]
jb 0x14006c471
mov r15, qword [rsp + 0x40]
xchg r9, r9
xchg rbx, rdx
mov rax, rdx
xchg rbx, rdx
mov rbx, qword [rsp + 0x48]
mov dword [rsp - 0x10], 0x71da7430
xchg rdi, rbp
mov rdi, qword [rsp + 0x50]
xchg rdi, rbp
add rsp, 0x20
mov dword [rsp - 0x40], 0x5bfb442c
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
xchg r15, r15
ret
xchg r11, rax
mov r11, rbx
xchg r11, rax
jmp 0x14006c4c5
Function at 0x14006fbb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
push 0x20575fbe
mov qword [rsp], r14
neg rsp
sub rsp, 0xffffffffffffff50
neg rsp
mov r14d, edx
xchg rsp, rsp
xchg rsi, r8
mov r8, rcx
xchg rsi, r8
xchg r14, r9
mov rdx, r14
xchg r14, r9
lea rcx, [rsp + 0x20]
mov ebp, r8d
call fcn.140030a20
xchg r12, r12
mov rax, qword [rsp + 0xa8]
mov edi, 0x24fb0c3a
sub edi, 0x16f255b0
xor edi, 0x692b7a02
sub edi, 0x14bd7b99
sub edi, 0x5265d0f0
cmp rax, rdi
jbe 0x14006fc62
mov dword [rsp - 0x38], 0x488d3d9a
mov ecx, edi
call fcn.1400bb700
xchg rdx, rax
mov rbx, rdx
xchg rdx, rax
xchg r10, rax
mov r8, r10
xchg r10, rax
xor eax, eax
mov dword [rsp - 0x44], ecx
jmp 0x14006fca6
xchg rbp, rax
mov rcx, rbp
xchg rbp, rax
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
call fcn.1400bb700
mov dword [rsp - 0x14], 0x44883a1
xchg r11, rbx
mov r11, rax
xchg r11, rbx
xchg r15, rax
mov r8, r15
xchg r15, rax
xor eax, eax
test rdi, rdi
je 0x14006fcd4
mov dword [rsp - 0x3c], ecx
nop word [rax + rax]
xchg r8, rcx
mov r8, qword [rsp + 0x20]
xchg rcx, r8
movzx edx, byte [rcx + rax]
mov dword [rsp - 0x44], 0xbc01036
xor dl, 0x37
mov byte [r8 + rax], dl
inc rax
cmp rax, rdi
mov dword [rsp - 0x38], edx
jb 0x14006fca6
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
mov dword [rsp - 0x18], ebp
call fcn.14006d5c0
xchg rbx, r15
mov qword [rax + 8], r15
xchg r15, rbx
mov byte [rax + 4], 6
add byte [rax + 4], 0x1b
add byte [rax + 4], 0x2f
add byte [rax + 4], 0xf
sub byte [rax + 4], 0x5b
mov word [rax + 5], di
mov dword [rsp - 0x1c], esp
lea rax, [rsp + 0x28]
xchg rbx, rcx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
mov byte [rsi + 8], 0x78
sub byte [rsi + 8], 0xd
sub byte [rsi + 8], 0x3e
sub byte [rsi + 8], 0x2c
cmp rcx, rax
mov rdx, rdx
jne 0x14006fd6b
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0xd85895c
add ecx, 0x35106a1c
add ecx, 0x30ae24f8
sub ecx, 0x13716842
sub ecx, 0x5fd2afae
rep stosb byte [rdi], al
mov dword [rsp - 0x38], 0x7dc3eb01
jmp 0x14006fd70
call fcn.1400bb8f0
lea r11, [rsp + 0xb0]
xchg r10, r10
mov rbx, qword [r11 + 0x28]
xchg rbp, r13
mov r13, qword [r11 + 0x30]
xchg r13, rbp
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
pop r14
mov dword [rsp - 0x1c], esi
pop rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x140090d20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad8dc
mov r10, rcx
mov eax, dword [0x1404e2fd0]
cmp qword [0x1404e30b8], 0
mov r10, r10
jne 0x1400ad660
syscall
ret

Function at 0x140090d40
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x28], al
jmp 0x1400adf14
xchg rcx, rdi
mov r10, rdi
xchg rdi, rcx
mov eax, dword [0x1404e3068]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov rbx, rbx
syscall
ret

Function at 0x140090d50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad6d4
mov r10, rcx
mov dword [rsp - 0x34], 0x2531da4d
mov eax, dword [0x1404e2fa0]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
xchg r12, r12
syscall
ret

Function at 0x140090d60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc7d
mov r10, rcx
mov eax, dword [0x1404e3028]
xchg r12, r12
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
xchg r13, r13
ret

Function at 0x140090d70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adb21
xchg rbx, rcx
mov r10, rbx
xchg rcx, rbx
mov eax, dword [0x1404e3008]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov rbp, rbp
syscall
ret

Function at 0x140090d80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad730
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e2fa8]
xchg r12, r12
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090d90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400addad
mov r10, rcx
mov dword [rsp - 0x44], 0x73f8e55f
mov eax, dword [0x1404e3044]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov r14, r14
syscall
ret

Function at 0x140090da0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400addd8
mov r10, rcx
mov eax, dword [0x1404e3048]
cmp qword [0x1404e30b8], 0
xchg r14, r14
jne 0x1400ad660
syscall
ret

Function at 0x140090db0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adcfe
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e3034]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov dword [rsp - 0x40], 0x776a95a5
syscall
ret

Function at 0x140090dc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add2c
xchg r10, rsi
mov rsi, rcx
xchg r10, rsi
mov eax, dword [0x1404e3038]
cmp qword [0x1404e30b8], 0
mov dword [rsp - 0x10], 0x20572378
jne 0x1400ad660
syscall
ret

Function at 0x140090dd0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad8ff
mov r10, rcx
xchg r15, r15
mov eax, dword [0x1404e2fd4]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
xchg r10, r10
syscall
ret

Function at 0x140090df0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc28
xchg rcx, r11
mov r10, r11
xchg r11, rcx
mov eax, dword [0x1404e3020]
xchg rbx, rbx
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090e00
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad703
xchg r8, r10
mov r8, rcx
xchg r8, r10
mov eax, dword [0x1404e2fa4]
mov r13, r13
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090e10
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adca3
xchg r10, rbx
mov rbx, rcx
xchg rbx, r10
mov eax, dword [0x1404e302c]
xchg r15, r15
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x40], ebp
ret
Function at 0x140090e20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adad0
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e3000]
cmp qword [0x1404e30b8], 0
xchg r10, r10
jne 0x1400ad660
syscall
ret

Function at 0x140090e30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adaf9
mov r10, rcx
mov dword [rsp - 0xc], ecx
mov eax, dword [0x1404e3004]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x1c], edi
ret

Function at 0x140090e40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad97c
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404e2fe0]
xchg rdi, rdi
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090e50
Capabilities:
Execute syscall

Disassembly:
movzx eax, byte [rsp + 0x58]
xchg r14, r14
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
jmp 0x1400adeea
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e3064]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov dword [rsp - 0x20], ebp
syscall
ret

Function at 0x140090e70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad7ff
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e2fbc]
mov dword [rsp - 0x3c], 0xcb01e47
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x40], 0x46a18f9d
ret

Function at 0x140090e80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad835
xchg rcx, r13
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404e2fc0]
mov dword [rsp - 0x24], 0x649c6748
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x1c], ebx
ret

Function at 0x140090e90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad867
mov r10, rcx
mov eax, dword [0x1404e2fc4]
cmp qword [0x1404e30b8], 0
mov dword [rsp - 0x20], 0x5fb71200
jne 0x1400ad660
syscall
ret

Function at 0x140090ea0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad88f
mov r10, rcx
mov eax, dword [0x1404e2fc8]
cmp qword [0x1404e30b8], 0
xchg r12, r12
jne 0x1400ad660
syscall
ret

Function at 0x140090eb0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad7d5
xchg rdi, r10
mov rdi, rcx
xchg rdi, r10
mov eax, dword [0x1404e2fb8]
mov dword [rsp - 0x14], esi
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090ec0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add5a
xchg rcx, rsi
mov r10, rsi
xchg rcx, rsi
mov eax, dword [0x1404e303c]
cmp qword [0x1404e30b8], 0
mov rcx, rcx
jne 0x1400ad660
syscall
ret

Function at 0x140090ed0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad8b2
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e2fcc]
mov dword [rsp - 0x14], ecx
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090ee0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad759
xchg rbp, rcx
mov r10, rbp
xchg rbp, rcx
mov eax, dword [0x1404e2fac]
mov dword [rsp - 0x34], 0x7a364f23
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090ef0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad925
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x1404e2fd8]
mov rsp, rsp
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret
Function at 0x140090f20
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adf3d
add rsp, 0x86ef538
sub rsp, 0x86ef658
lea rcx, [0x1400ad6c7]
push rax
mov qword [rsp], rcx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
xchg r8, r8
nop
push 0x396a938c
mov qword [rsp], rdi
push qword [0x1404e30c0]
mov rsp, rsp
lea rsi, [rsp + 0x170]
lea rdi, [rsp + 0x28]
mov ecx, 0xde4785e
add ecx, 0x3ca4b467
add ecx, 0x247365cd
sub ecx, 0x6efc9282
rep movsq qword [rdi], qword [rsi]
jmp qword [0x1404e30b8]
xchg rsi, rcx
mov r10, rsi
xchg rsi, rcx
mov eax, dword [0x1404e306c]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov dword [rsp - 0x38], 0xe036b9f
syscall
ret

Function at 0x140090f30
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad7b2
mov r10, rcx
mov eax, dword [0x1404e2fb4]
cmp qword [0x1404e30b8], 0
mov rsi, rsi
jne 0x1400ad660
syscall
ret

Function at 0x140090f40
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adec4
mov r10, rcx
mov r14, r14
mov eax, dword [0x1404e3060]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov r8, r8
syscall
ret

Function at 0x140090f50
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400add83
xchg rdi, r10
mov rdi, rcx
xchg rdi, r10
mov eax, dword [0x1404e3040]
mov dword [rsp - 0x38], edx
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
ret

Function at 0x140090f60
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ade76
mov r10, rcx
mov eax, dword [0x1404e3058]
cmp qword [0x1404e30b8], 0
mov dword [rsp - 0x18], 0x3d77dbca
jne 0x1400ad660
syscall
ret

Function at 0x140090f70
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc51
mov r10, rcx
mov eax, dword [0x1404e3024]
mov dword [rsp - 0x44], edx
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x40], 0x3f3da210
ret

Function at 0x140090f80
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ade9e
mov r10, rcx
xchg r15, r15
mov eax, dword [0x1404e305c]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov r14, r14
ret

Function at 0x140090f90
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad787
mov r10, rcx
mov r8, r8
mov eax, dword [0x1404e2fb0]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
syscall
mov dword [rsp - 0x3c], 0x201200bc
ret

Function at 0x140090fa0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad94e
xchg r15, rcx
mov r10, r15
xchg r15, rcx
mov eax, dword [0x1404e2fdc]
cmp qword [0x1404e30b8], 0
jne 0x1400ad660
mov dword [rsp - 0x18], 0x3cb05b02
syscall
ret
Function at 0x140096910
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r8, r8
nop
sub rsp, 8
mov qword [rsp], r14
add rsp, 0xffffffffffffffe0
xchg rsp, rsp
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
mov rsi, rcx
mov dword [rsp - 0x18], 0x65f7a852
mov edx, dword [rbx + rcx + 0xb0]
call fcn.140098e10
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
xchg rsi, rsi
mov ebp, dword [rbx + rsi + 0xb4]
mov r10, rax
mov ebx, r14d
test ebp, ebp
xchg r15, r15
je 0x140096adb
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov r13, r13
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov rdx, rdx
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
mov rbx, rbx
jae 0x140096a03
mov eax, dword [rdx + 8]
test eax, eax
jne 0x1400969cf
mov dword [rsp - 0xc], 0x3e0117c7
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
xchg rcx, rcx
jb 0x1400969ee
add eax, r9d
cmp r11d, eax
xchg r14, r14
jb 0x140096a87
inc r8w
add rdx, 0x28
cmp r8w, cx
mov r14, r14
jb 0x1400969b9
xchg r11, r14
mov r8, r11
xchg r11, r14
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
add rax, 0xfffffffffffffff8
mov dword [rsp - 0xc], 0x3ae62d8f
nop
add r10, 0x73dfc72c
sub r10, 0x73dfc724
shr rax, 1
xchg rdi, rdi
test eax, eax
je 0x140096ad0
mov edx, eax
mov r15, r15
nop word [rax + rax]
movzx eax, word [r10]
mov ecx, eax
mov dword [rsp - 0x38], 0x6e7299dd
shr ecx, 5
shr ecx, 2
shr ecx, 3
shr ecx, 1
shr ecx, 1
cmp ecx, 3
je 0x140096aa9
cmp ecx, 0xa
mov dword [rsp - 0x30], ecx
jne 0x140096aba
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x140096aba
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x2c], 0x3d41486f
sub r8, r9
add r8, rsi
add r8, r11
mov dword [rsp - 0x18], 0x3054bc9a
jmp 0x140096a0c
and eax, 0xfff
mov dword [rsp - 0x40], 0x66d5cbe2
add dword [rax + r8], edi
add r10, 2
sub rdx, 1
jne 0x140096a48
mov dword [rsp - 0xc], 0x40b5313e
add ebx, dword [r9]
cmp ebx, ebp
jb 0x140096987
mov rbx, qword [rsp + 0x30]
mov rdi, rdi
xchg r11, rbp
mov r11, qword [rsp + 0x38]
xchg r11, rbp
xchg rcx, rsi
mov rcx, qword [rsp + 0x40]
xchg rsi, rcx
mov rdi, qword [rsp + 0x48]
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140098e10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
mov dword [rsp - 0x10], 0x1819f372
xor r9d, r9d
add r8, rcx
mov r10d, edx
xchg rdi, rcx
mov rbx, rdi
xchg rdi, rcx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
mov dword [rsp - 0x24], ebp
add rax, 0x18
add rax, r8
cmp r9w, r11w
mov r12, r12
jae 0x140098ea6
nop dword [rax]
mov ecx, dword [rax + 8]
mov dword [rsp - 0x2c], 0x34b3daa1
test ecx, ecx
jne 0x140098e6f
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
mov dword [rsp - 0x34], 0xdc62d84
cmp r10d, edx
jb 0x140098e91
add ecx, edx
xchg rsp, rsp
cmp r10d, ecx
jb 0x140098ebc
inc r9w
xchg r12, r12
add rax, 0x28
cmp r9w, r11w
jb 0x140098e59
xor eax, eax
mov dword [rsp - 0x3c], 0x27be0bf7
xchg rbx, r15
mov r15, qword [rsp + 8]
xchg r15, rbx
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
mov dword [rsp - 0x10], 0x4e7936c4
mov rbx, qword [rsp + 8]
add rax, r10
ret
Function at 0x140098ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
push rbp
xchg rdx, rdx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0x39812618
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, word [rcx]
mov r15d, edx
xchg rsp, rsp
xor eax, 0x58fa27f9
mov rsi, rcx
cmp eax, 0x58fa7db4
jne 0x14009908f
mov r15, r15
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x58fa27f9
cmp eax, 0x58fa62a9
xchg r10, r10
jne 0x14009908f
mov edx, dword [rdx + rcx + 0x88]
call fcn.140098e10
xchg r15, r15
xchg r14, rsi
mov rcx, r14
xchg r14, rsi
xchg rdx, rax
mov r14, rdx
xchg rdx, rax
mov edx, dword [rax + 0x20]
mov r9, r9
call fcn.140098e10
mov edx, dword [r14 + 0x24]
xchg rsi, rbp
mov rcx, rbp
xchg rbp, rsi
xchg rsp, r12
mov rsp, rax
xchg rsp, r12
call fcn.140098e10
mov edx, dword [r14 + 0x1c]
mov dword [rsp - 0x3c], 0x155ce306
mov rcx, rsi
xchg r13, rax
mov rax, r13
xchg r13, rax
call fcn.140098e10
mov r13, r13
xor edi, edi
xchg rsi, rax
mov qword [rsp + 0x70], rsi
xchg rsi, rax
cmp dword [r14 + 0x18], edi
jbe 0x14009908f
xchg r12, r12
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rdi, rcx
mov rdi, rsi
xchg rcx, rdi
call fcn.140098e10
mov ecx, 0x234e66a1
xor ecx, 0x1da21524
xor ecx, 0x5c6eb370
sub ecx, 0x1cfc5f75
add ecx, 0xba799e7f
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rsp + 0x60], ecx
xchg rbp, rbp
cmp byte [rax], 0
je 0x140099074
nop dword [rax]
mov rdx, rbx
mov dword [rsp - 0x2c], ebx
lea rcx, [rsp + 0x60]
mov r8d, 0x2e8cf283
sub r8d, 0x2cf6dcac
add r8d, 0x71ddfc4a
sub r8d, 0x73741220
inc rbx
call fcn.1400a2bd0
mov dword [rsp - 0xc], 0x79f5631a
cmp byte [rbx], 0
jne 0x140099028
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x2c], 0x2aa93e4b
not ecx
cmp ecx, r15d
je 0x1400990e2
inc edi
mov dword [rsp - 0x2c], edx
cmp edi, dword [r14 + 0x18]
jb 0x140098fdf
xor eax, eax
mov dword [rsp - 0x14], ecx
xchg r13, rbx
mov r13, qword [rsp + 0x68]
xchg rbx, r13
nop
add rsp, 0x303d2c5a
sub rsp, 0x303d2c3a
pop r15
mov dword [rsp - 0x3c], edi
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
mov r8, r8
ret
movzx edx, word [r13 + rdi*2]
xchg rsi, r14
mov rcx, r14
xchg r14, rsi
mov rax, qword [rsp + 0x70]
mov dword [rsp - 0x44], ebp
mov edx, dword [rax + rdx*4]
call fcn.140098e10
jmp 0x140099095