joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400955f0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adc7c
xchg rcx, r15
mov r10, r15
xchg rcx, r15
mov eax, dword [0x1404d0fb4]
mov dword [rsp - 0x30], 0x2b6b6855
cmp qword [0x1404d1048], 0
jne 0x1400ad690
syscall
mov dword [rsp - 0x44], 0x1c3e1e0a
ret

Function at 0x140095600
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400adebd
mov r10, rcx
mov eax, dword [0x1404d0fec]
xchg r11, r11
cmp qword [0x1404d1048], 0
jne 0x1400ad690
syscall
ret

Function at 0x140095610
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad7ae
xchg rdi, r10
mov rdi, rcx
xchg r10, rdi
mov eax, dword [0x1404d0f40]
cmp qword [0x1404d1048], 0
xchg r9, r9
jne 0x1400ad690
syscall
ret

Function at 0x140095620
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ad96d
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x1404d0f6c]
cmp qword [0x1404d1048], 0
mov dword [rsp - 0x34], 0x2cf6be80
jne 0x1400ad690
syscall
ret
Function at 0x14009aff8
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 0x10], r15
xchg r15, rbx
mov qword [rsp + 8], rcx
xchg r15, r15
nop
sub rsp, 8
mov qword [rsp], rbp
push rax
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
mov r9, r9
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
mov rbx, rcx
mov rbp, rbp
mov r13d, r8d
mov r9d, 0x539d71cc
add r9d, 0x126be1b4
sub r9d, 0x33cb098c
add r9d, 0x3319509b
xor r9d, 0x65539a8f
xchg r12, rdx
mov rdx, r12
xchg r12, rdx
cmp r8d, r9d
mov dword [rsp - 0x24], esi
pushf
movabs rcx, 0xffffffff3590ce2e
add rcx, 0x1aa758e3
xor rcx, 0x14907f5f
add rcx, 0xa0a7ea4
add rcx, 0x7fffffff
add rcx, 0x314d290e
popf
pushf
mov eax, 0x4b4fc1b2
xor eax, 0xc4c78f3
sub eax, 0x3a4bb302
xor eax, 0xcb8063b
popf
cmovb r9d, r13d
mul r9
mov dword [rsp - 0x1c], 0x53653b25
cmovo rax, rcx
xchg r10, rax
mov rcx, r10
xchg r10, rax
call fcn.1400bb280
mov dword [rsp - 0x18], 0x253aaf2e
lea r15d, [r13 + 0xfffff]
xor esi, esi
shr r15d, 6
shr r15d, 4
shr r15d, 6
shr r15d, 3
shr r15d, 1
xchg rsi, rbp
mov rsi, rax
xchg rsi, rbp
mov eax, dword [rbx + 0x18]
mov ebx, 0x28931618
xor ebx, 0x561e2af4
sub ebx, 0x13837d91
sub ebx, 0x6b09bf5a
mov dword [rsp + 0x70], eax
mov dword [rsp - 0x18], edi
mov dword [rsp + 0x78], r15d
test r15d, r15d
je 0x14009b23d
mov dword [rsp - 0x10], edx
mov eax, 0x3663b3e2
add eax, 0x34d6dcd0
xor eax, 0x33a504e2
xor eax, 0x2a5a2ecc
xor eax, 0x72d5ba9c
xchg rdi, rcx
mov rdi, qword [rsp + 0x60]
xchg rdi, rcx
mov r14d, esi
mov dword [rsp - 0x30], ebx
shl r14d, 0xe
shl r14d, 2
shl r14d, 2
shl r14d, 1
shl r14d, 1
mov edi, r13d
sub edi, r14d
mov r8, r8
mov rdx, rbp
cmp edi, eax
cmova edi, eax
mov r8d, edi
xchg r10, r10
call fcn.140097e70
test al, al
je 0x14009b23b
shr edi, 2
mov dword [rsp - 0x30], esi
xor r8d, r8d
shr r14d, 2
test edi, edi
mov r13, r13
je 0x14009b20a
mov r15d, dword [rsp + 0x70]
xchg rsi, rbp
mov r9, rsi
xchg rbp, rsi
lea eax, [r14 + r8]
mov r10, r10
mov edx, r15d
xor edx, dword [r9]
add r8d, ebx
xor edx, 0x27310a4
xchg r9, r9
lea r9, [r9 + 4]
mov dword [r12 + rax*4], edx
cmp r8d, edi
mov dword [rsp - 0x30], 0x873d8b9
jb 0x14009b1d3
mov r15d, dword [rsp + 0x78]
add esi, ebx
mov eax, 0x72f4e969
sub eax, 0x31ef9952
add eax, 0x193181f1
sub eax, 0x4a75dcf2
sub eax, 0xfb0f516
cmp esi, r15d
jb 0x14009b164
mov dword [rsp - 0x44], 0x52671b0e
jmp 0x14009b23d
xor bl, bl
mov rcx, rbp
call fcn.1400bb290
xchg rsp, rsp
mov al, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
mov rdx, rdx
nop
add rsp, 8
mov r14, qword [rsp - 8]
pop r13
mov rdi, rdi
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
ret
Function at 0x14009b290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, r9
xchg rbp, r13
mov qword [rsp + 0x10], r13
xchg rbp, r13
mov qword [rsp + 0x18], rsi
xchg rbx, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x5fa4df2c
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r14
mov qword [rsp], r15
nop
add rsp, 0x8cde4e8
sub rsp, 0x8cde508
xchg rcx, rbp
mov r15, rbp
xchg rbp, rcx
mov r14d, r8d
xchg rsi, rsi
mov r9d, 0xb300b18
xor r9d, 0x7e3e1485
xor r9d, 0x2f309079
xor r9d, 0x5a3a8fe4
mov r12, rdx
cmp r8d, r9d
xchg r9, r9
pushf
movabs rcx, 0xffffffff0546b35d
add rcx, 0x1c430955
sub rcx, 0x10903fe5
add rcx, 0x7fffffff
add rcx, 0x6f068333
popf
pushf
mov eax, 0x5ab207f1
sub eax, 0x2e10097f
xor eax, 0x64958067
sub eax, 0x28456312
sub eax, 0x1fef1aff
popf
cmovb r9d, r14d
mov dword [rsp - 0x20], ebx
mul r9
cmovo rax, rcx
xchg r12, rax
mov rcx, r12
xchg r12, rax
call fcn.1400bb280
mov r13d, dword [r15 + 0x18]
mov dword [rsp - 0x18], edx
lea ebp, [r14 + 0xfffff]
shr ebp, 6
shr ebp, 3
shr ebp, 0xa
shr ebp, 1
xor edi, edi
mov dword [rsp - 0x20], edx
xchg rsi, r9
mov r9, rax
xchg r9, rsi
mov ebx, 0x3c464ee9
add ebx, 0x144c9668
sub ebx, 0x14abe589
sub ebx, 0x2df91745
sub ebx, 0xdede882
test ebp, ebp
je 0x14009b4c2
mov eax, 0x2c25e15b
add eax, 0x211e0441
sub eax, 0x27293e1e
add eax, 0x3a0da1fe
xor eax, 0x6038497c
mov r9d, edi
mov dword [rsp - 0x2c], esp
mov r8d, r14d
shl r9d, 9
shl r9d, 3
shl r9d, 7
shl r9d, 1
sub r8d, r9d
cmp r8d, eax
mov dword [rsp - 0x2c], 0x6ca3727e
cmova r8d, eax
shr r9d, 1
shr r9d, 1
mov r11d, r8d
mov dword [rsp - 0x2c], 0x36ee09ec
xor r10d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
xchg r8, r8
je 0x14009b470
mov rdx, rsi
lea ecx, [r9 + r10]
mov dword [rsp - 0x1c], 0x264939e
mov eax, r13d
xor eax, dword [r12 + rcx*4]
add r10d, ebx
mov dword [rsp - 0x44], 0x418fbaa
xor eax, 0x27310a4
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [rsp - 0x2c], 0x2a7cf927
cmp r10d, r11d
jb 0x14009b436
xchg rdx, r11
mov r11, rsi
xchg r11, rdx
mov rcx, r15
call fcn.140098400
mov dword [rsp - 0x14], 0x1d1b365c
test al, al
je 0x14009b4bc
add edi, ebx
mov eax, 0x2435bcc5
add eax, 0x2e145268
add eax, 0x20474097
xor eax, 0x186c7823
sub eax, 0x6aed37e7
cmp edi, ebp
xchg rsp, rsp
jb 0x14009b3e2
jmp 0x14009b4c2
xor bl, bl
mov dword [rsp - 0x44], edx
xchg rcx, rbx
mov rbx, rsi
xchg rcx, rbx
call fcn.1400bb290
xchg rbp, rbx
mov rbx, qword [rsp + 0x58]
xchg rbx, rbp
mov al, bl
mov rbx, qword [rsp + 0x50]
mov r12, r12
xchg rsi, r9
mov r9, qword [rsp + 0x60]
xchg rsi, r9
add rsp, 0x20
mov r9, r9
pop r15
pop r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14009fa80
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbp, rbp
mov qword [rsp + 0x10], rbp
xchg rsi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rsi
xchg r12, rdi
mov qword [rsp + 0x20], r12
xchg rdi, r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
mov dword [rsp - 0x18], esp
mov rdi, rdx
xchg r10, rsi
mov r10, rcx
xchg r10, rsi
mov edx, dword [rbx + rcx + 0xb0]
call fcn.1400a1820
mov dword [rsp - 0x38], ebx
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
mov rbp, rbp
xchg r10, rax
mov rax, r10
xchg r10, rax
mov ebx, r14d
test ebp, ebp
je 0x14009fc4c
xchg rbp, rbp
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov rbp, rbp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
movzx eax, word [rcx + rsi + 0x14]
mov dword [rsp - 0x28], edx
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
jae 0x14009fb85
mov dword [rsp - 0x34], edx
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14009fb45
mov eax, dword [rdx + 0x10]
mov dword [rsp - 0x24], ebx
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14009fb61
mov r15, r15
add eax, r9d
cmp r11d, eax
jb 0x14009fc08
inc r8w
mov dword [rsp - 0x2c], ebp
neg rdx
add rdx, 0xffffffffffffffd8
neg rdx
cmp r8w, cx
jb 0x14009fb33
mov dword [rsp - 0x3c], 0x4a5f2057
xchg r14, rsp
mov r8, rsp
xchg r14, rsp
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
mov r11, r11
nop
add rax, 0x4cf6cae8
sub rax, 0x4cf6caf0
nop
add r10, 0x3135900
sub r10, 0x31358f8
shr rax, 1
mov dword [rsp - 0x20], esp
test eax, eax
je 0x14009fc3d
mov edx, eax
nop word [rax + rax]
mov dword [rsp - 0x44], ebx
movzx eax, word [r10]
mov ecx, eax
shr ecx, 7
shr ecx, 2
shr ecx, 2
shr ecx, 1
cmp ecx, 3
je 0x14009fc1e
mov dword [rsp - 0x38], edx
cmp ecx, 0xa
jne 0x14009fc2f
and eax, 0xfff
add qword [rax + r8], rdi
mov rsp, rsp
jmp 0x14009fc2f
mov r8d, dword [rdx + 0x14]
mov dword [rsp - 0x34], ebp
sub r8, r9
add r8, rsi
add r8, r11
jmp 0x14009fb8e
and eax, 0xfff
add dword [rax + r8], edi
mov dword [rsp - 0xc], 0x6f082aa3
sub r10, 0xfffffffffffffffe
sub rdx, 1
jne 0x14009fbd0
add ebx, dword [r9]
mov dword [rsp - 0x3c], ebx
cmp ebx, ebp
jb 0x14009faff
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0xc], 0x1eb3694b
xchg rbp, r10
mov r10, qword [rsp + 0x38]
xchg r10, rbp
mov rsi, qword [rsp + 0x40]
mov r9, r9
xchg rdi, r10
mov r10, qword [rsp + 0x48]
xchg rdi, r10
nop
add rsp, 0xd38f330
sub rsp, 0xd38f310
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400a18f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
push rdi
push r12
mov dword [rsp - 0x1c], ebx
push r14
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
add rsp, 0x2c4ac14c
sub rsp, 0x2c4ac16c
movzx eax, word [rcx]
mov r15d, edx
mov dword [rsp - 0x10], 0x3908dcb
xor eax, 0x27310a4
xchg rcx, r8
mov rsi, r8
xchg r8, rcx
cmp eax, 0x2734ae9
jne 0x1400a1abc
xchg rdx, rdx
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x27310a4
cmp eax, 0x27355f4
mov dword [rsp - 0x40], 0x630674ea
jne 0x1400a1abc
mov edx, dword [rdx + rcx + 0x88]
call fcn.1400a1820
xchg rbx, rcx
mov rbx, rsi
xchg rbx, rcx
xchg rbx, r14
mov rbx, rax
xchg rbx, r14
mov edx, dword [rax + 0x20]
mov rcx, rcx
call fcn.1400a1820
mov edx, dword [r14 + 0x24]
xchg r15, rcx
mov r15, rsi
xchg r15, rcx
mov r12, rax
xchg rdx, rdx
call fcn.1400a1820
mov edx, dword [r14 + 0x1c]
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
xchg r13, rdx
mov rdx, rax
xchg rdx, r13
call fcn.1400a1820
xor edi, edi
mov dword [rsp - 0x3c], ecx
xchg r15, rax
mov qword [rsp + 0x70], r15
xchg r15, rax
cmp dword [r14 + 0x18], edi
jbe 0x1400a1abc
mov r11, r11
nop dword [rax]
mov edx, dword [r12 + rdi*4]
xchg rsi, r11
mov rcx, r11
xchg rsi, r11
call fcn.1400a1820
mov dword [rsp - 0x28], 0x723789d5
mov ecx, 0x43fb22d2
add ecx, 0x373282f9
sub ecx, 0x556d60ad
add ecx, 0xda3fbae1
xchg r8, rbx
mov r8, rax
xchg r8, rbx
mov dword [rsp + 0x60], ecx
mov dword [rsp - 0x34], 0x59bdfe93
cmp byte [rax], 0
je 0x1400a1a9e
nop dword [rax]
mov dword [rsp - 0x28], 0x1076d18e
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
lea rcx, [rsp + 0x60]
mov dword [rsp - 0x40], 0x4973db51
mov r8d, 0x7a01fa0c
xor r8d, 0xdba8791
sub r8d, 0x594bde81
xor r8d, 0x1e6f9f1d
inc rbx
call fcn.140094f30
cmp byte [rbx], 0
mov r13, r13
jne 0x1400a1a55
mov ecx, dword [rsp + 0x60]
not ecx
cmp ecx, r15d
mov r10, r10
je 0x1400a1b0f
inc edi
cmp edi, dword [r14 + 0x18]
mov dword [rsp - 0x40], edi
jb 0x1400a19fb
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
mov dword [rsp - 0x24], 0x1355027d
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
xchg r13, r13
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
movzx edx, word [r13 + rdi*2]
xchg rcx, rdx
mov rdx, rsi
xchg rcx, rdx
xchg r14, rax
mov r14, qword [rsp + 0x70]
xchg r14, rax
mov edx, dword [rax + rdx*4]
mov dword [rsp - 0x18], ebx
call fcn.1400a1820
jmp 0x1400a1abe
Function at 0x1400a5df5
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg rbx, r13
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
add rsp, 0x209926b4
sub rsp, 0x20992714
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
lea rax, [rsp + 0x28]
xchg rbp, rbp
xorps xmm0, xmm0
xchg rdi, rsi
mov qword [rsp + 0x70], rdi
xchg rsi, rdi
mov rsi, qword [rcx + 0x38]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x14], ebp
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
movups xmmword [rsp + 0x28], xmm0
lea rdx, [rsi + 1]
xchg r15, rsp
movups xmmword [r15 + 0x38], xmm0
xchg rsp, r15
movups xmmword [rsp + 0x48], xmm0
call fcn.140016fc0
mov edx, 0xd57c025
add edx, 0x60697714
add edx, 0x65ef589
xor edx, 0x7db166e3
sub edx, 0x5e9cd07
test rsi, rsi
mov r9, r9
je 0x1400a5eee
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
sub rbx, rax
xchg r15, r8
mov r15, rsi
xchg r15, r8
mov r9d, 0x164d7057
xor r9d, 0x123c7a91
xor r9d, 0x5286b154
add r9d, 0x27d52e2d
xor r9d, 0x7ecce940
nop dword [rax]
movzx ecx, dx
lea rdi, [rdi + 2]
xchg r11, r11
and cx, r9w
ror edx, 3
ror edx, 2
ror edx, 2
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r10, r10
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400a5ebc
mov r9, r9
xor ecx, ecx
mov word [rax + rsi*2], cx
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg r11, rcx
call fcn.1400a5f90
xchg r11, rcx
mov r11, qword [rsp + 0x20]
xchg r11, rcx
mov ebx, eax
mov dword [rsp - 0x44], edi
mov rsi, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400a5f70
mov rsi, rsi
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x5495a60c
xor ecx, 0x734b113e
xor ecx, 0x4d52bee5
sub ecx, 0x42637ffc
sub ecx, 0x282889ab
rep stosb byte [rdi], al
mov eax, ebx
xchg rbp, rbx
mov rbp, qword [rsp + 0x78]
xchg rbx, rbp
sub rsp, 0xffffffffffffffa0
mov r11, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call fcn.1400bb460
mov eax, ebx
mov r11, r11
mov rbx, qword [rsp + 0x78]
sub rsp, 0xffffffffffffffa0
pop rdi
xchg r15, r15
ret
Function at 0x1400a74c6
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rsp
mov rsp, r11
xchg r11, rsp
xchg rbx, r15
mov qword [r11 + 0x20], r15
xchg rbx, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x60
mov r12, r12
mov rbx, qword [rcx]
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
xorps xmm0, xmm0
mov dword [rsp - 0x10], 0x6bd10b44
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov qword [r11 + 0x10], rsi
mov dword [rsp - 0x40], 0x42db1227
mov rsi, qword [rcx + 0x38]
lea rcx, [r11 - 0x48]
mov qword [r11 + 0x18], r14
mov r14, rdx
mov dword [rsp - 0x40], ebp
xchg rsp, r13
movups xmmword [r13 + 0x28], xmm0
xchg rsp, r13
lea rdx, [rsi + 1]
mov dword [rsp - 0x24], esi
xchg r9, rsp
movups xmmword [r9 + 0x38], xmm0
xchg r9, rsp
xchg r13, rsp
movups xmmword [r13 + 0x48], xmm0
xchg rsp, r13
call fcn.140016fc0
mov edx, 0x668492b6
sub edx, 0x32e25dfa
add edx, 0x491d3720
xor edx, 0x7f1816c6
test rsi, rsi
je 0x1400a751f
mov dword [rsp - 0xc], edx
xchg r14, rdi
mov r14, rax
xchg r14, rdi
sub rbx, rax
mov dword [rsp - 0x2c], 0x6f2d4db1
mov r8, rsi
mov r9d, 0x21004144
add r9d, 0x33a24c36
sub r9d, 0x8fc6ae4
xor r9d, 0x4ba62269
nop word [rax + rax]
mov dword [rsp - 0x18], ebp
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x18], ebp
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
mov rsi, rsi
mov word [rdi - 2], cx
sub r8, 1
jne 0x1400a74f3
xor ecx, ecx
xchg r8, r8
mov r8d, ebp
mov word [rax + rsi*2], cx
mov rdx, r14
mov rcx, qword [rsp + 0x20]
mov r11, r11
call fcn.1400a75f0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov rdi, rdi
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov rsp, rsp
xchg r8, rbp
mov r8, qword [rsp + 0x70]
xchg rbp, r8
cmp rcx, rax
mov dword [rsp - 0x18], edx
jne 0x1400a75c7
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rsp - 0x18], 0x18ff4717
mov ecx, 0x56747546
xor ecx, 0x23bded39
sub ecx, 0x6f059f44
xor ecx, 0x79b3eca5
sub ecx, 0x7f70156e
rep stosb byte [rdi], al
mov eax, ebx
xchg r15, r15
xchg rbx, r14
mov r14, qword [rsp + 0x88]
xchg rbx, r14
neg rsp
add rsp, 0xffffffffffffffa0
neg rsp
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400bb460
xchg rdi, rdi
mov eax, ebx
xchg rbx, r15
mov r15, qword [rsp + 0x88]
xchg r15, rbx
nop
sub rsp, 0x60937475
add rsp, 0x609374d5
pop rdi
ret
Function at 0x1400a75f0
Capabilities:
Access peb ldr_data

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0x28], 0x5c3f4d12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x677f9bc0
add rsp, 0x677f9980
mov rbx, rdx
xchg rsp, rcx
mov rdi, rsp
xchg rsp, rcx
xor edx, edx
mov dword [rsp - 0x20], ebx
lea rcx, [rsp + 0x30]
mov r8d, 0x3dece55c
add r8d, 0x118b0e8d
xor r8d, 0x53036fe2
sub r8d, 0x1c749a03
call fcn.1400bb9f0
mov rbp, rbp
mov rax, qword gs:[0x60]
xchg rcx, r8
mov rcx, qword [rax + 0x18]
xchg r8, rcx
mov rax, qword [r8 + 0x10]
mov r8, qword [rax]
mov dword [rsp - 0x38], 0xe766911
test r8, r8
je 0x1400a7891
mov r8, qword [r8 + 0x50]
test r8, r8
xchg r9, r9
je 0x1400a7891
mov edx, 0x7dfeec1b
xor edx, 0x5039dd4f
sub edx, 0x25a3059b
xor edx, 0x1ebaa804
sub edx, 0x169e82b9
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x38], ebp
lea r9d, [rdx - 1]
call fcn.1400bc5e0
mov edx, 0x68cab9c2
xor edx, 0x7918ba54
xor edx, 0x4c6520dd
xor edx, 0x5db72317
lea rcx, [rsp + 0x30]
xchg rsp, rsp
call fcn.1400bc6f0
test rax, rax
je 0x1400a7865
xchg rbx, rbx
xor ecx, ecx
xchg rdi, r11
mov rdx, r11
xchg rdi, r11
mov word [rax], cx
movabs rcx, 0x9b7a73bd0d939dbb
add rcx, 0x11acb69d
xor rcx, 0x635b590
sub rcx, 0xaceb531
xor rcx, 0xd62244
mov r8, qword [0x1404d06b0]
movabs rax, 0x15126261df7db45
xor rax, 0x6a172786
sub rax, 0x85c4ee5
sub rax, 0x2705da5c
sub rax, 0x2250c8a
add r8, rcx
xchg rbp, rbp
lea rcx, [rsp + 0x20]
xor r8, rax
movabs rax, 0x1d7597bd581e639e
sub rax, 0x14349a74
sub rax, 0x42668ede
add rax, 0x1ccf70c8
add r8, rax
movabs rax, 0xec01a1734c2e12d7
sub rax, 0x6dd610e
xor rax, 0x7dc4adcc
sub rax, 0x48e9b99
xor r8, rax
mov dword [rsp - 0x28], ecx
call r8
mov r10, qword [0x1404d06a0]
lea r8, [rsp + 0x20]
mov dword [rsp - 0x1c], 0x604e2ce
movabs rcx, 0x7dd60b1620339399
xor rcx, 0x18433289
sub rcx, 0x25d0ba5e
xor rcx, 0x17f112ef
lea rdx, [rsp + 0x260]
add r10, rcx
xchg r10, r10
movabs rax, 0x22a3d38a0ecbd679
xor rax, 0x7d11fe29
xor rax, 0xc529a10
sub rax, 0x33992658
ror r10, 0x13
ror r10, 3
ror r10, 3
ror r10, 0x12
ror r10, 3
ror r10, 7
ror r10, 1
lea rcx, [rsp + 0x30]
add r10, rax
xchg rbx, r9
mov rbx, r9
xchg rbx, r9
rol r10, 0x14
rol r10, 4
rol r10, 1
call r10
mov dword [rsp - 0x10], ebp
xchg rdx, rbx
mov rdx, qword [rsp + 0x250]
xchg rbx, rdx
add rsp, 0x8d28c0c
sub rsp, 0x8d289cc
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x152816e7
add eax, 0x62574634
sub eax, 0x669dfdf4
add eax, 0xaf1ea0da
mov rbx, qword [rsp + 0x250]
add rsp, 0x13dc966f
sub rsp, 0x13dc942f
pop rdi
ret
xchg rbx, rbp
mov rbp, qword [rsp + 0x250]
xchg rbp, rbx
mov eax, 0x274887e7
xor eax, 0x20f732fa
add eax, 0x8139c0f
add eax, 0xb02cb009
add rsp, 0x1340df0c
sub rsp, 0x1340dccc
pop rdi
ret
Function at 0x1400abfc0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae198
xchg rcx, rdx
mov r10, rdx
xchg rdx, rcx
mov eax, dword [0x1404d1034]
xchg r8, r8
cmp qword [0x1404d1048], 0
jne 0x1400ad690
syscall
ret
Function at 0x1400ae404
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg r15, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r10
mov qword [rsp], r14
push r15
add rsp, 0xffffffffffffffe0
xchg r8, r8
movzx eax, byte [rdx + 1]
mov r15, r8
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8, r8
mov r8d, dword [rcx + 4]
shl ebx, 5
shl ebx, 2
shl ebx, 1
dec r8d
mov dword [rsp - 0x30], 0x152ae23d
or ebx, eax
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x38], ebx
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 4
shl edi, 2
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x34], 0x369990af
shl edi, 1
shl edi, 6
shl edi, 1
or edi, eax
test r8d, r8d
jle 0x1400ae537
mov rbx, rbx
xchg r8, rdx
mov r8, qword [rcx + 8]
xchg r8, rdx
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
mov dword [rsp - 0x34], edi
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
mov r14, r14
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov r11, r11
xchg rbx, rdx
mov rbx, rsi
xchg rdx, rbx
mov ecx, edi
mov dword [rsp - 0x10], ebp
call fcn.1400aec54
xor ebx, eax
mov rdx, rbp
mov ecx, ebx
mov dword [rsp - 0x10], ecx
call fcn.1400aec54
xor edi, eax
nop
sub rsi, 0x32e0ff62
add rsi, 0x32e0ff4a
add rbp, 0xffffffffffffffe8
mov dword [rsp - 0x38], edx
sub r14, 1
jne 0x1400ae4f0
lea rax, [r15 + 7]
xchg rbp, rbp
mov ecx, 0x5ff0f190
add ecx, 0x1f69b1da
sub ecx, 0x79833af1
xor ecx, 0x5d7687d
mov byte [rax - 4], dil
mov byte [rax], bl
xchg r9, r9
dec rax
shr ebx, 7
shr ebx, 1
shr edi, 1
shr edi, 3
shr edi, 1
shr edi, 2
shr edi, 1
sub rcx, 1
jne 0x1400ae555
mov rbx, qword [rsp + 0x40]
xchg r10, r10
xchg rbp, rbx
mov rbx, qword [rsp + 0x48]
xchg rbp, rbx
mov rsi, qword [rsp + 0x50]
mov dword [rsp - 0x34], ebp
nop
sub rsp, 0x489ad5c3
add rsp, 0x489ad5e3
pop r15
mov dword [rsp - 0x18], 0x797c6109
pop r14
pop rdi
ret
Function at 0x1400ae8f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r12, rsi
mov qword [rsp + 0x18], r12
xchg rsi, r12
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x1b42db49
mov qword [rsp], rdi
nop
push 0x3a9aabdf
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
xchg r8, r8
add rsp, 0xffffffffffffff60
movdqa xmm0, xmmword [0x14000bed0]
xor edi, edi
mov rsp, rsp
movdqa xmm1, xmmword [0x14000be60]
mov rbx, rdx
xchg rbp, rdi
movdqu xmmword [rdi - 0x39], xmm0
xchg rbp, rdi
xchg rsi, r9
mov r9, rcx
xchg rsi, r9
mov edx, edi
movdqa xmm0, xmmword [0x14000be70]
mov dword [rsp - 0x3c], esi
mov r8d, edi
xchg r9, rbp
movdqu xmmword [r9 - 0x29], xmm1
xchg rbp, r9
movdqa xmm1, xmmword [0x14000be50]
xchg rbp, rdi
movdqu xmmword [rdi - 0x19], xmm0
xchg rbp, rdi
xchg rbp, r8
movdqu xmmword [r8 - 9], xmm1
xchg r8, rbp
mov ecx, edx
mov dword [rsp - 0x30], 0x1761b9d9
lea r8, [r8 + 4]
mov eax, 0x60908e0f
xor eax, 0x3e8629aa
sub eax, 0x1bac1026
xor eax, 0x3d3a5f1f
sub eax, 0x4ce6bc2e
inc rdx
mov rcx, rcx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
mov dword [rsp - 0x38], ecx
jb 0x1400ae99d
cmp dword [rsi + 4], 8
jne 0x1400aea5f
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x20], 0x60dffa8e
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 1
shl cx, 2
shl cx, 1
shl cx, 1
shl cx, 2
shl cx, 1
or cx, ax
mov dword [rsp - 0xc], esi
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
mov dword [rsp - 0x24], ebx
jl 0x1400ae9fa
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
mov dword [rsp - 0x38], 0xc4cc01a
xchg rcx, rdx
mov rdx, rsi
xchg rdx, rcx
call fcn.1400ae748
mov r14, r14
jmp 0x1400aeb24
cmp dword [rsi], edi
jle 0x1400aeb24
mov r14d, edi
mov r14, r14
lea rdx, [rbp + 0x6d]
mov r8d, 0x5b843f65
add r8d, 0x1b5c4fcc
xor r8d, 0x76364460
sub r8d, 0xd6cb4d
movzx eax, byte [rbx]
mov dword [rsp - 0x28], 0x64afce97
movzx ecx, byte [rbx + 1]
add rbx, 2
shl ax, 7
shl ax, 1
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
xchg r9, r9
sub r8, 1
jne 0x1400aea8c
lea r9, [rbp + 7]
xchg r9, r9
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.1400ae748
mov dword [rsp - 0x2c], 0x653968de
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
mov dword [rsp - 0x38], 0x6d84ca11
lea rdx, [rbp + 0x67]
sub r8d, 8
mov rcx, rsi
call fcn.1400ae748
mov rbx, rbx
inc edi
nop
add r14d, 0xa2e18a4
sub r14d, 0xa2e189c
cmp edi, dword [rsi]
mov dword [rsp - 0x30], ebx
jl 0x1400aea6d
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbx, r13
mov r13, qword [r11 + 0x28]
xchg rbx, r13
lea rdi, [rbp + 7]
xchg rsi, rsi
xchg rsi, r14
mov r14, qword [r11 + 0x30]
xchg r14, rsi
lea ecx, [rax + 0x40]
mov dword [rsp - 0x2c], 0x2fc1863f
rep stosb byte [rdi], al
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400aec0c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov dword [rsp - 0x1c], ebx
mov r11d, ecx
test edx, edx
je 0x1400aec50
mov rdi, rdi
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
xchg r8, r8
mov r11d, ecx
test dl, 1
cmove r9d, r10d
xor r11d, r8d
mov dword [rsp - 0xc], esp
cmp ecx, 0x100
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
mov dword [rsp - 0xc], esp
jne 0x1400aec1d
mov eax, r10d
ret