joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400767b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
mov dword [rsp - 0x30], 0x5245a0a4
add rsp, 0xfffffffffffffdc0
mov rbx, rdx
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x26d10bef
sub r8d, 0x6c3335f
add r8d, 0xcfffd15
add r8d, 0x85be065
sub r8d, 0x3569b402
call fcn.1400844a0
mov rdx, rdx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov dword [rsp - 0x20], ebp
xchg r8, rbx
mov rbx, qword [rax]
xchg r8, rbx
test r8, r8
je 0x140076a33
mov r8, qword [r8 + 0x50]
mov dword [rsp - 0x28], ebp
test r8, r8
je 0x140076a33
mov edx, 0x396951a
add edx, 0x228a3fe7
add edx, 0x18d59b8e
sub edx, 0x3ef66f8b
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
mov dword [rsp - 0x44], 0x5e1a8473
call fcn.140084e70
mov edx, 0x4447e143
xor edx, 0x4b7d0c8e
xor edx, 0x1776338
add edx, 0x12b7067b
sub edx, 0x21049514
lea rcx, [rsp + 0x30]
call fcn.140084f40
xchg rsp, rsp
test rax, rax
je 0x1400769fe
xor ecx, ecx
xchg rdi, rsp
mov rdx, rsp
xchg rdi, rsp
mov word [rax], cx
mov r15, r15
movabs rcx, 0x22e96f0355d3f364
add rcx, 0x7844ad9
sub rcx, 0x31b04743
xor rcx, 0x1b97a096
xor rcx, 0x328d6aa2
mov r8, qword [0x1400dbe10]
movabs rax, 0x14ed767f6cfc21a4
sub rax, 0x3f01a29c
add rax, 0x3923a440
xor rax, 0x31bcf1ea
xor r8, rcx
mov dword [rsp - 0x38], ecx
movabs rcx, 0x2940b126751c2d06
xor rcx, 0x4835542d
sub rcx, 0x3c43cf9f
add rcx, 0x7fffffff
xor rcx, 0x2bea29a6
ror r8, 0x21
ror r8, 0xb
ror r8, 4
ror r8, 6
ror r8, 1
ror r8, 1
add r8, rcx
lea rcx, [rsp + 0x20]
mov r8, r8
xor r8, rax
not r8
call r8
mov r10, qword [0x1400dbe00]
xchg r12, r12
lea r8, [rsp + 0x20]
movabs rcx, 0xd47a71f43eddf7d7
xor rcx, 0x6e91164b
sub rcx, 0x43b8a176
add rcx, 0x5e4f9860
xor rcx, 0x30d9e584
lea rdx, [rsp + 0x260]
add r10, rcx
mov rdi, rdi
movabs rax, 0x6bcefa7621516d50
add rax, 0x1922f8d0
add rax, 0x154283c
sub rax, 0x39a2b043
add rax, 0x7fffffff
add rax, 0x5bc9b148
not r10
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x14], ebx
sub r10, rax
xchg rdx, r9
mov rdx, rbx
xchg rdx, r9
rol r10, 0x1d
rol r10, 2
rol r10, 1
rol r10, 1
call r10
xchg r15, r15
mov rbx, qword [rsp + 0x250]
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
ret
mov eax, 0x6712be82
sub eax, 0x5ab08ceb
add eax, 0x70308cee
add eax, 0x436d417c
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg r13, rbx
sub rsp, 0x4853006e
add rsp, 0x485302ae
pop rdi
xchg r11, r11
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x5fde0d21
sub eax, 0x4944506f
add eax, 0x4dd56051
sub eax, 0x4b244879
add eax, 0xa6b52cab
sub rsp, 0xfffffffffffffdc0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140079750
Capabilities:
Encode data using xor

Disassembly:
push rdx
mov qword [rsp], rbx
add rsp, 0xfffffffffffffdd0
mov dword [rsp - 0x1c], esi
mov rax, qword [0x1400db018]
lea rdx, [rsp + 0x20]
xchg rcx, r15
mov rbx, r15
xchg rcx, r15
not rax
mov rbx, rbx
movabs rcx, 0x740ef1e402648ebc
add rcx, 0x80568cd
add rcx, 0x3d6a6879
xor rcx, 0x68418fde
add rcx, 0x43ca8d2f
xor r9d, r9d
sub rax, rcx
movabs rcx, 0x33a30c7077eeaf53
sub rcx, 0x55cd77fa
add rcx, 0x144b6a5d
xor rcx, 0x3915605e
xor rcx, 0x51fe5611
xor rax, rcx
movabs rcx, 0x135a91703f51f582
add rcx, 0x1b8abfc7
add rcx, 0x8e7739a
sub rcx, 0x1dcc9849
add rcx, 0x7fffffff
add rcx, 0x39f27e20
sub rax, rcx
xor ecx, ecx
mov dword [rsp - 0x34], edi
lea r8d, [r9 + 8]
call rax
lea rcx, [rbx + 8]
mov dword [rsp - 0x2c], 0x2c2d3d1d
xorps xmm0, xmm0
mov qword [rbx], rcx
movups xmmword [rcx], xmm0
mov dword [rsp - 0x44], ebp
xchg rcx, rdx
movups xmmword [rdx + 0x10], xmm0
xchg rdx, rcx
xchg rbx, rcx
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rcx
test eax, eax
je 0x140079957
lea rax, [rsp + 0x20]
mov dword [rsp - 0x34], edi
nop
movabs rdx, 0xffffffff14d3a95f
xor rdx, 0x2d176193
sub rdx, 0x2c6fba89
add rdx, 0x694c7e0a
add rdx, 0x7fffffff
add rdx, 0x95e73b3
inc rdx
cmp word [rax + rdx*2], 0
xchg r12, r12
jne 0x140079878
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
xchg r12, rdx
mov qword [rbx + 0x38], r12
xchg rdx, r12
call fcn.1400166e8
xchg r10, r10
xor r8d, r8d
xchg rdx, rdi
mov rdi, rax
xchg rdx, rdi
mov ecx, 0x42d13905
xor ecx, 0x33ec2a31
sub ecx, 0x45b129d1
add ecx, 0x1e9d6579
cmp qword [rbx + 0x38], r8
jbe 0x140079961
mov dword [rsp - 0x20], 0x6aea6911
lea r9, [rsp + 0x20]
mov r10d, 0xa65134f
sub r10d, 0x1c6d6a4
add r10d, 0x2a95a3c0
xor r10d, 0x3333e094
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0x2c], 0x111e8a41
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg rdi, rdi
ror ecx, 7
ror ecx, 1
xor ax, word [r9 + rdx - 2]
xchg r10, r10
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
mov r10, r10
jb 0x14007990d
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0xa587a95
sub rsp, 0xa587865
pop rbx
mov r10, r10
ret
xor r8d, r8d
mov r10, r10
mov qword [rbx + 0x38], r8
xchg r12, rax
mov r12, rbx
xchg r12, rax
sub rsp, 0x2deb1382
add rsp, 0x2deb15b2
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14007a8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400dbfe4], 0
mov dword [rsp - 0x40], 0x656903bf
jne 0x14007a9b8
xor edx, edx
lea r8, [0x1400dbfe0]
xchg rsp, rsp
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov dword [rsp - 0xc], edi
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
xchg r8, r8
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x10], ebp
and eax, 1
neg eax
and eax, 0xedb88320
xchg r8, r8
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov r13, r13
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
xchg r13, r13
shr ecx, 1
and eax, 1
neg eax
mov rbp, rbp
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rbp, rbp
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov rcx, rcx
mov eax, ecx
shr ecx, 1
and eax, 1
mov r11, r11
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x44], ebx
mov ecx, eax
shr eax, 1
and ecx, 1
mov rbp, rbp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov rdi, rdi
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r12, r12
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x18], esp
cmp edx, 0x100
jb 0x14007a8eb
ret
Function at 0x140082830
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rdi, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
nop
sub rsp, 8
mov qword [rsp], r15
add rsp, 0xffffffffffffffe0
mov r9, r9
movzx eax, byte [rdx + 1]
xchg r9, r15
mov r9, r8
xchg r15, r9
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x1c], edx
mov r8d, dword [rcx + 4]
shl ebx, 1
shl ebx, 1
shl ebx, 6
dec r8d
or ebx, eax
mov dword [rsp - 0x10], 0x5d618868
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 4
shl ebx, 3
shl ebx, 1
or ebx, eax
mov dword [rsp - 0xc], esp
movzx eax, byte [rdx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 5]
xchg rsp, rsp
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0xc], 0x1df490cf
movzx eax, byte [rdx + 7]
shl edi, 1
shl edi, 2
shl edi, 3
shl edi, 1
shl edi, 1
or edi, eax
xchg rbp, rbp
test r8d, r8d
jle 0x140082984
mov rdx, qword [rcx + 8]
mov dword [rsp - 0x20], 0x3cc234f9
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
mov dword [rsp - 0x1c], esp
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
mov dword [rsp - 0x10], esi
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
xchg rbp, rbp
lea rbp, [rdx + rax*4]
mov rdx, rsi
mov ecx, edi
call fcn.1400830c8
xchg rdi, rdi
xor ebx, eax
xchg r14, rdx
mov r14, rbp
xchg r14, rdx
mov ecx, ebx
call fcn.1400830c8
mov dword [rsp - 0x40], 0xa2f2009
xor edi, eax
nop
add rsi, 0x5d757d63
sub rsi, 0x5d757d7b
nop
sub rbp, 0x52dd671b
add rbp, 0x52dd6703
sub r14, 1
xchg r12, r12
jne 0x140082930
lea rax, [r15 + 7]
mov ecx, 0x4941a1c9
sub ecx, 0x7c59e6f
xor ecx, 0xb19ff13
sub ecx, 0x4a65fc45
mov byte [rax - 4], dil
xchg rdi, rdi
mov byte [rax], bl
dec rax
shr ebx, 3
shr ebx, 2
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 1
shr edi, 4
shr edi, 3
sub rcx, 1
mov r8, r8
jne 0x14008299f
mov rbx, qword [rsp + 0x40]
xchg rbp, r13
mov r13, qword [rsp + 0x48]
xchg rbp, r13
mov rsi, qword [rsp + 0x50]
mov dword [rsp - 0x44], 0x237c208a
nop
add rsp, 0x482eb7ab
sub rsp, 0x482eb78b
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140082a18
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rdx
mov rax, rdx
xchg rsp, rdx
mov qword [rax + 8], rbx
mov dword [rsp - 0xc], 0x3c2d92e1
mov qword [rax + 0x10], rbp
xchg rsi, rcx
mov qword [rax + 0x18], rcx
xchg rcx, rsi
mov qword [rax + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x20
mov r8, r8
movzx eax, byte [rdx + 1]
xchg r8, r10
mov r14, r10
xchg r8, r10
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov dword [rsp - 0x20], edx
shl ebx, 2
shl ebx, 5
shl ebx, 1
or ebx, eax
shl edi, 8
movzx eax, byte [rdx + 2]
xchg rcx, rcx
shl ebx, 5
shl ebx, 2
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
xchg rcx, rcx
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
xchg rbp, rbp
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 5
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 8
xchg r15, r15
or edi, eax
mov eax, dword [rcx + 4]
test eax, eax
xchg rsp, rsp
jle 0x140082b1d
xchg r12, rsi
mov r12, qword [rcx + 8]
xchg rsi, r12
lea ebp, [rax - 1]
shr ebp, 1
mov dword [rsp - 0x34], ebx
inc ebp
xchg r13, rsi
mov rdx, r13
xchg rsi, r13
mov ecx, edi
xchg rcx, rcx
call fcn.1400830c8
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
mov r9, r9
call fcn.1400830c8
xor edi, eax
nop
add rsi, 0x5f461652
sub rsi, 0x5f46163a
sub rbp, 1
jne 0x140082ad7
mov dword [rsp - 0xc], 0x7c8cd2e1
lea rax, [r14 + 7]
mov ecx, 0x22b30451
xor ecx, 0x78f6beac
sub ecx, 0x41a04643
sub ecx, 0x18a574b6
mov byte [rax - 4], dil
xchg r11, r11
mov byte [rax], bl
dec rax
shr ebx, 5
shr ebx, 1
shr ebx, 1
shr ebx, 1
shr edi, 3
shr edi, 2
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
mov dword [rsp - 0xc], 0x69bf0a9e
jne 0x140082b38
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x2c], 0x56d989e0
xchg r13, rsi
mov r13, qword [rsp + 0x40]
xchg r13, rsi
mov rdi, qword [rsp + 0x48]
xchg r15, r15
nop
sub rsp, 0x79c91c59
add rsp, 0x79c91c79
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x140082d80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg rbx, r12
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x18], ebp
nop
push r9
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
lea rbp, [rsp - 0x47]
mov r12, r12
sub rsp, 0x57792c1
add rsp, 0x5779221
movdqa xmm0, xmmword [0x14000ba30]
mov rdi, rdi
xor edi, edi
movdqa xmm1, xmmword [0x14000b9c0]
xchg rbx, rsp
mov rsp, rdx
xchg rbx, rsp
xchg rdx, rbp
movdqu xmmword [rdx - 0x39], xmm0
xchg rbp, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov edx, edi
mov r12, r12
movdqa xmm0, xmmword [0x14000ba60]
mov r8d, edi
xchg rbp, r9
movdqu xmmword [r9 - 0x29], xmm1
xchg rbp, r9
movdqa xmm1, xmmword [0x14000b9b0]
xchg r9, r9
movdqu xmmword [rbp - 0x19], xmm0
xchg rdi, rbp
movdqu xmmword [rdi - 9], xmm1
xchg rbp, rdi
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0xf3ad3ea
add eax, 0x156457ef
sub eax, 0x248151e0
add eax, 0x3b81903c
inc rdx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rsp - 0x28], esp
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140082e2e
cmp dword [rsi + 4], 8
mov dword [rsp - 0x10], 0x6090f00b
jne 0x140082ed0
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
xchg rbx, rbx
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 2
shl cx, 5
shl cx, 1
or cx, ax
mov dword [rsp - 0x44], 0x672e7316
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
mov dword [rsp - 0x38], ecx
jl 0x140082e7b
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg r15, r15
mov rcx, rsi
call fcn.140082bb0
jmp 0x140082f9d
cmp dword [rsi], edi
mov dword [rsp - 0x1c], ebp
jle 0x140082f9d
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r12, r12
mov r8d, 0x4c1ae71
add r8d, 0x2d2bab12
add r8d, 0x4d43c265
sub r8d, 0x7f311be4
movzx eax, byte [rbx]
xchg r9, r9
movzx ecx, byte [rbx + 1]
neg rbx
add rbx, 0xfffffffffffffffe
neg rbx
shl ax, 2
shl ax, 2
shl ax, 2
shl ax, 2
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov dword [rsp - 0x38], 0x680ae9a2
sub r8, 1
jne 0x140082f01
lea r9, [rbp + 7]
mov r8d, r14d
mov r10, r10
lea rdx, [rbp + 0x67]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140082bb0
mov r8d, dword [rsi + 4]
xchg r10, r10
lea r9, [rbp + 0x27]
sub r8d, r14d
lea rdx, [rbp + 0x67]
nop
sub r8d, 0xca9fd87
add r8d, 0xca9fd7f
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140082bb0
inc edi
sub r14d, 0xfffffff8
xchg r10, r10
cmp edi, dword [rsi]
jl 0x140082edf
xor eax, eax
lea r11, [rsp + 0xa0]
mov dword [rsp - 0x40], 0xaaa5b8f
xchg rbx, r15
mov r15, qword [r11 + 0x28]
xchg r15, rbx
lea rdi, [rbp + 7]
mov rdi, rdi
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg r14, rsp
mov r14, r11
xchg rsp, r14
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
pop rbp
ret
Function at 0x140083080
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
xchg rdi, rdi
test edx, edx
je 0x1400830c3
lea ecx, [r11 + r11]
mov dword [rsp - 0x24], edx
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
test dl, 1
mov r12, r12
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
xchg r12, r12
cmovb r11d, ecx
shr edx, 1
jne 0x14008308d
mov dword [rsp - 0xc], ebx
mov eax, r10d
ret
Function at 0x140085160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
mov qword [rsp], r10
mov qword [rsp + 8], r11
mov dword [rsp - 0x44], 0x347c1153
xor r11, r11
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov r11, r11
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x1400851c8
mov dword [rsp - 0x10], 0xefbf055
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 0x3b
sub byte [r11], 0x34
xor byte [r11], 0x6d
add byte [r11], 0
sub byte [r11], 0x6a
cmp r10, r11
mov rdi, rdi
bnd jne 0x1400851a4
mov r10, qword [rsp]
xchg r11, rcx
mov rcx, qword [rsp + 8]
xchg r11, rcx
sub rsp, 0xfffffffffffffff0
mov dword [rsp - 0x1c], 0xb5f2174
bnd ret
Function at 0x14008a500
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xor r8d, r8d
mov dword [rsp - 0x44], ecx
xchg r9, rdx
mov rdx, r9
xchg r9, rdx
test rax, rax
mov dword [rsp - 0xc], 0x2db6b75e
je 0x14008a569
mov ecx, r8d
mov edx, 0x100f47f9
xor edx, 0x22478b6d
add edx, 0x2eb943b5
xor edx, 0x5a9d7a7c
rol edx, cl
mov r12, r12
xor dl, byte [rax]
inc rax
mov byte [r8 + r9], dl
inc r8
mov rdi, rdi
cmp r8, 0x20
jb 0x14008a528
mov al, 0x48
xor al, 0x32
sub al, 0x79
xor al, 0
ret
xchg r13, rax
mov r13, qword [rcx + 0x100]
xchg r13, rax
test rax, rax
je 0x14008a5a9
mov dword [rsp - 0x10], ebx
xchg rsp, rax
movups xmm0, xmmword [rsp]
xchg rsp, rax
movups xmmword [rdx], xmm0
mov dword [rsp - 0x18], esi
xchg rbp, rax
movups xmm1, xmmword [rbp + 0x10]
xchg rbp, rax
xchg rdx, r12
movups xmmword [r12 + 0x10], xmm1
xchg rdx, r12
jmp 0x14008a560
xorps xmm0, xmm0
xchg rdi, rdi
xor al, al
xchg r15, rdx
movups xmmword [r15], xmm0
xchg r15, rdx
xchg rdx, r13
movups xmmword [r13 + 0x10], xmm0
xchg r13, rdx
ret
Function at 0x14009af3c
Capabilities:
Encode data using xor

Disassembly:
xchg r12, r11
mov r12, rsp
xchg r12, r11
mov qword [r11 + 8], rbx
xchg rcx, rsi
mov qword [r11 + 0x18], rcx
xchg rsi, rcx
xchg rdi, r15
mov qword [r11 + 0x20], r15
xchg r15, rdi
push r14
add rsp, 0xffffffffffffffc0
xchg rsp, rsp
mov rax, qword [0x1400db9c8]
lea rdx, [r11 + 0x10]
ror rax, 0x28
ror rax, 2
ror rax, 2
ror rax, 3
ror rax, 1
ror rax, 1
xchg r12, rcx
mov rbx, r12
xchg r12, rcx
not rax
mov dword [rsp + 0x58], 0x5c900e20
add dword [rsp + 0x58], 0x116f6892
sub dword [rsp + 0x58], 0x3d42ee
sub dword [rsp + 0x58], 0x4802a6d5
sub dword [rsp + 0x58], 0x25bf8cdf
movabs rcx, 0xff291cb7e450f98
sub rcx, 0x3551447b
sub rcx, 0x18dcd562
xor rcx, 0x6f7df1ef
add rax, rcx
mov dword [rsp - 0x40], 0x5a69ef9
movabs rcx, 0x555ec8ed6e72bddf
xor rcx, 0x142863eb
sub rcx, 0x60276683
add rcx, 0x5a636a77
xor rcx, 0x32e925a8
xor rax, rcx
mov dword [rsp - 0x3c], 0x2c8b8d49
movabs rcx, 0x357ad12964655b9f
sub rcx, 0x51505bc7
add rcx, 0x3aa468eb
sub rcx, 0x17083ead
sub rax, rcx
mov dword [rsp - 0x20], 0x29abbc42
lea rcx, [r11 - 0x28]
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg rdx, rdx
xchg rdi, rbp
mov qword [rbx], rbp
xchg rbp, rdi
xor esi, esi
mov dword [rsp - 0x24], 0x5eacfaa
xchg r8, rdi
movups xmmword [r8], xmm0
xchg rdi, r8
xchg rdi, r10
movups xmmword [r10 + 0x10], xmm0
xchg rdi, r10
xchg r13, rdi
movups xmmword [r13 + 0x20], xmm0
xchg r13, rdi
test eax, eax
mov r8, r8
jne 0x14009b097
mov qword [rbx + 0x38], rsi
jmp 0x14009b1bb
lea rax, [rsp + 0x20]
mov r10, r10
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
xchg r8, r8
jne 0x14009b0a3
xchg r14, r13
mov qword [rbx + 0x38], r13
xchg r14, r13
cmp qword [rbx], rdi
je 0x14009b0d8
xchg r11, r11
xchg rcx, r14
mov r14, qword [rbx]
xchg r14, rcx
call fcn.140083f00
cmp r14, 0x18
mov r12, r12
jbe 0x14009b110
lea rcx, [r14 + r14]
call fcn.140084200
mov dword [rsp - 0x14], edx
xchg r12, rax
mov qword [rbx], r12
xchg r12, rax
test rax, rax
jne 0x14009b120
mov qword [rbx], rdi
mov r10, r10
mov rcx, rsi
jmp 0x14009b148
mov qword [rbx], rdi
mov dword [rsp - 0x3c], ecx
xchg rdx, rdi
mov rax, rdx
xchg rdi, rdx
xorps xmm0, xmm0
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r10, rax
movups xmmword [r10 + 0x10], xmm0
xchg r10, rax
xchg r13, rax
movups xmmword [r13 + 0x20], xmm0
xchg r13, rax
mov rcx, qword [rbx]
mov dword [rsp - 0x3c], 0x32973519
mov edx, 0x2b86cf79
xor edx, 0x141568b0
xor edx, 0x21f7b0be
add edx, 0x2bc53765
cmp qword [rbx + 0x38], rsi
jbe 0x14009b1bb
mov r12, r12
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov r9d, 0x5c42f00f
xor r9d, 0x5fff1972
xor r9d, 0xb1e070e
sub r9d, 0x8a3ed74
and ax, r9w
ror edx, 1
ror edx, 7
xor ax, word [r8 + rcx]
mov dword [rsp - 0x1c], edx
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
mov rsp, rsp
cmp rsi, qword [rbx + 0x38]
jb 0x14009b174
mov rsi, qword [rsp + 0x60]
mov dword [rsp - 0x1c], esi
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov dword [rsp - 0x34], esp
sub rsp, 0xffffffffffffffc0
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400adfbc
Capabilities:
Execute syscall

Disassembly:
push rbx
mov dword [rsp - 0x40], edx
add rsp, 0xffffffffffffffe0
mov rbx, rcx
mov rcx, qword [rcx + 0x1a8]
xchg rbx, rbx
cmp rcx, 0xffffffffffffffff
je 0x1400ae0b4
mov rax, qword [rbx + 0x258]
mov rdi, rdi
movabs rdx, 0x438283cf04179be9
add rdx, 0x4ff960ca
sub rdx, 0x2c88b627
xor rdx, 0x592e92d4
add rdx, 0x79141d7f
xor rax, rdx
movabs rdx, 0x39fc424213ce6483
add rdx, 0x5e9020a
xor rdx, 0x3abff46b
sub rdx, 0xf9e72f7
sub rax, rdx
movabs rdx, 0x4472aee913b07a42
xor rdx, 0x4c4dfbc1
xor rdx, 0x6e8febcc
add rdx, 0xbb6c375
sub rdx, 0x3cdc0407
ror rax, 0x1f
ror rax, 1
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rdx
mov dword [rsp - 0x1c], 0x665e2131
movabs rdx, 0x59f8e92e4537631c
sub rdx, 0xf126315
add rdx, 0x14eebed9
add rdx, 0x7fffffff
add rdx, 0x2275541e
rol rax, 0xb
rol rax, 0x28
rol rax, 6
rol rax, 4
rol rax, 1
add rax, rdx
call rax
xchg rbp, rbp
xchg rcx, r15
mov r15, qword [rbx + 0x198]
xchg rcx, r15
test rcx, rcx
mov dword [rsp - 0x14], 0x22015d64
je 0x1400ae0fe
cmp qword [rbx + 0x1a0], 0
jne 0x1400ae0fe
mov rcx, qword [rcx + 0x20]
mov r9, r9
call fcn.140083f00
xchg rsi, rcx
mov rsi, qword [rbx + 0x198]
xchg rsi, rcx
call fcn.140083f00
xchg rcx, r14
mov r14, qword [rbx + 0x1a0]
xchg r14, rcx
test rcx, rcx
je 0x1400ae19e
xchg rdx, rax
mov rdx, qword [rbx + 0x248]
xchg rdx, rax
movabs rdx, 0x682f45f1531e98b5
sub rdx, 0x73672e6
xor rdx, 0x5e00d6d1
sub rdx, 0x89acce0
sub rax, rdx
mov dword [rsp - 0x3c], 0x4fbfd477
movabs rdx, 0x40bdea8a68b938a8
sub rdx, 0x213035bf
sub rdx, 0x380ae92a
add rdx, 0x4122efb8
add rdx, 0x59907010
ror rax, 0xb
ror rax, 1
add rax, rdx
rol rax, 0x27
rol rax, 1
rol rax, 4
rol rax, 1
not rax
ror rax, 0x10
ror rax, 0x1e
ror rax, 8
ror rax, 1
ror rax, 1
call rax
cmp qword [rbx + 0x200], 0
mov dword [rsp - 0x18], 0x3b13c5ca
je 0x1400ae244
xchg r14, rax
mov r14, qword [rbx + 0x210]
xchg r14, rax
movabs rcx, 0x579855316a901092
xor rcx, 0x542bb179
xor rcx, 0x14a132af
sub rcx, 0x114b178f
rol rax, 0x1f
rol rax, 6
rol rax, 2
rol rax, 1
add rax, rcx
mov dword [rsp - 0x10], ebx
movabs rcx, 0xdc3d22652e8071d3
add rcx, 0x25eb8fed
sub rcx, 0xe8ed245
xor rcx, 0xea34ed
ror rax, 5
ror rax, 0xf
ror rax, 0xa
ror rax, 1
ror rax, 1
ror rax, 1
xor rax, rcx
call rax
mov rcx, qword [rbx + 0x200]
xchg r9, r9
call fcn.140078f00
and qword [rbx + 0x200], 0
xchg r8, rcx
mov r8, qword [rbx + 0x1f0]
xchg rcx, r8
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
mov rbx, qword [rsp]
add rsp, 8
jmp fcn.14004e750
Function at 0x1400ae47c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
xchg rdi, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
push 0x28411eba
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
mov dword [rsp - 0x2c], 0x35288d93
sub rsp, 0x10c03ef2
add rsp, 0x10c03e12
xor ebx, ebx
mov dword [rsp - 0x3c], 0x683d29d6
mov dword [rbp - 0x79], 0x7487c5d3
sub dword [rbp - 0x79], 0x5e7f328b
add dword [rbp - 0x79], 0x2d9b7e6d
xor dword [rbp - 0x79], 0x4384110d
mov dword [rbp - 0x75], 0xb0be7a
add dword [rbp - 0x75], 0x1d3f85c4
xor dword [rbp - 0x75], 0x6b887b4a
sub dword [rbp - 0x75], 0x3f14aa25
sub dword [rbp - 0x75], 0x373894f5
mov r14, rdx
mov dword [rbp - 0x71], 0x3eb57f35
add dword [rbp - 0x71], 0x271959d9
sub dword [rbp - 0x71], 0x36203c24
add dword [rbp - 0x71], 0x15428825
sub dword [rbp - 0x71], 0x44ca2463
mov dword [rbp - 0x6d], 0x3313167e
sub dword [rbp - 0x6d], 0x29f4068
xor dword [rbp - 0x6d], 0x4b214281
xor dword [rbp - 0x6d], 0x7b7c9490
mov dword [rbp - 0x69], 0x5156d25c
sub dword [rbp - 0x69], 0x4d066824
add dword [rbp - 0x69], 0x78d39771
xor dword [rbp - 0x69], 0x4e42f80
xor dword [rbp - 0x69], 0x79e22e99
mov qword [rbp + 0x77], rbx
mov r14, r14
mov rax, qword [rbp + 0x77]
xchg r10, rcx
mov r10, qword [rbp + 0x77]
xchg rcx, r10
mov edx, 0x7dbb1158
xor edx, 0x574a7479
xor edx, 0x6e284dc8
xor edx, 0xef06635
mov rax, qword [rbp + 0x77]
mov dword [rsp - 0x44], 0x29f2a938
and cl, 3
shl cl, 2
shl cl, 1
shr edx, cl
movzx ecx, dl
xor cx, word [rbp + rax*2 - 0x79]
xchg r15, r15
xchg rcx, rax
mov rcx, qword [rbp + 0x77]
xchg rcx, rax
mov word [rbp + rax*2 - 0x65], cx
mov dword [rsp - 0x2c], 0x287cb158
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
xchg r12, r12
xchg r15, rax
mov r15, qword [rbp + 0x77]
xchg r15, rax
cmp rax, 0xa
mov dword [rsp - 0x28], 0x2abc46fe
jb 0x1400ae572
xor edx, edx
mov word [rbp - 0x51], bx
lea rcx, [rbp - 0x65]
xchg r8, r8
call fcn.140076a70
xchg r13, rax
mov rsi, r13
xchg r13, rax
lea rdi, [rbp - 0x65]
xor eax, eax
xchg r13, r13
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
test rsi, rsi
je 0x1400ae6cf
mov rbp, rbp
mov edx, 0x6d07bf59
xor edx, 0x54e57d7d
sub edx, 0x2d6518b1
add edx, 0x5812e8ee
add edx, 0x2708a340
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.1400706c0
mov rdi, rax
xchg r10, r10
test rax, rax
je 0x1400ae6c3
mov rdx, r14
xchg rcx, rcx
lea rcx, [rbp - 0x49]
call fcn.1400344b0
mov rcx, qword [rbp - 0x49]
mov dword [rsp - 0x14], ecx
call rdi
xchg rcx, r12
mov r12, qword [rbp - 0x49]
xchg rcx, r12
cmp eax, 1
lea rax, [rbp - 0x41]
sete bl
xchg r11, r11
cmp rcx, rax
jne 0x1400ae6be
lea rdi, [rbp - 0x41]
xor eax, eax
mov rbx, rbx
mov ecx, 0x454b0f1b
sub ecx, 0x33041e97
add ecx, 0x50ef1841
xor ecx, 0x63360845
rep stosb byte [rdi], al
jmp 0x1400ae6c3
call fcn.140083f00
mov rcx, rsi
call fcn.140078f00
mov dword [rsp - 0x10], esi
lea r11, [rsp + 0xe0]
mov al, bl
xchg rbx, rcx
mov rcx, qword [r11 + 0x20]
xchg rcx, rbx
xchg rsi, r12
mov r12, qword [r11 + 0x28]
xchg rsi, r12
xchg rbp, r11
mov rsp, rbp
xchg r11, rbp
nop
mov r14, qword [rsp]
add rsp, 8
pop rdi
mov dword [rsp - 0x38], 0x2e179d12
pop rbp
ret