joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b08f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
mov dword [rsp - 0x3c], ebp
add rsp, 0xfffffffffffffdc0
xchg rdx, r11
mov rbx, r11
xchg rdx, r11
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xaba7e7
add r8d, 0x21869718
xor r8d, 0xa0a80aa
xor r8d, 0x56e5e277
sub r8d, 0x7edd5a1a
call fcn.1400b9e10
mov rsp, rsp
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xchg rcx, rax
mov rcx, qword [r8 + 0x10]
xchg rcx, rax
xchg r8, r13
mov r13, qword [rax]
xchg r8, r13
test r8, r8
mov r10, r10
je 0x1400b0b66
mov r8, qword [r8 + 0x50]
test r8, r8
mov dword [rsp - 0x18], 0x54d4c0c5
je 0x1400b0b66
mov edx, 0x271e3b1d
add edx, 0x46dd70ee
sub edx, 0x1ad4c29d
xor edx, 0x611ac8ef
sub edx, 0x323c207d
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.1400baa20
mov dword [rsp - 0x14], esi
mov edx, 0x9f5db4b
xor edx, 0x6c3ed776
sub edx, 0x4877ba74
sub edx, 0x1d53516d
lea rcx, [rsp + 0x30]
call fcn.1400bab40
mov r13, r13
test rax, rax
je 0x1400b0b30
xor ecx, ecx
mov r8, r8
mov rdx, rdi
mov word [rax], cx
movabs rcx, 0x5f1aae8a62550dcf
sub rcx, 0x34d1c534
xor rcx, 0x3c0bb7a5
add rcx, 0x31dbdc1c
add rcx, 0x7fffffff
xor rcx, 0x1c090cd3
mov r8, qword [0x14012f690]
mov r15, r15
movabs rax, 0x5fefe9f13e59b650
sub rax, 0x1736e260
sub rax, 0x8836205
add rax, 0x430c9e04
add rax, 0x7e935051
add r8, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x44], ebx
ror r8, 1
ror r8, 1
sub r8, rax
rol r8, 0x1f
rol r8, 3
rol r8, 0xc
rol r8, 1
call r8
mov r10, qword [0x14012f680]
mov dword [rsp - 0x30], ebx
lea r8, [rsp + 0x20]
movabs rcx, 0xeb75f20201847241
xor rcx, 0x43c591e
xor rcx, 0x7d32901e
add rcx, 0x72c6cea
sub rcx, 0x554f885
lea rdx, [rsp + 0x260]
add r10, rcx
xchg r15, r15
movabs rax, 0x199037dc0fc20e14
xor rax, 0x6e7c3dec
sub rax, 0x41d781e1
xor rax, 0x489613f1
add rax, 0x634d0f5a
rol r10, 0xb
rol r10, 1
rol r10, 0xf
rol r10, 1
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x10], esp
not r10
xchg rbx, r9
mov rbx, r9
xchg r9, rbx
sub r10, rax
not r10
mov dword [rsp - 0x34], 0x1cfa4a85
call r10
xchg rbx, r8
mov r8, qword [rsp + 0x250]
xchg r8, rbx
sub rsp, 0x427af668
add rsp, 0x427af8a8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x4ba9a1a
add eax, 0x618d73e7
sub eax, 0x5c10fda3
add eax, 0xb5c8efa3
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x3c], 0x19e5fbd8
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
pop rdi
mov rbp, rbp
ret
xchg rbp, rbx
mov rbp, qword [rsp + 0x250]
xchg rbx, rbp
mov eax, 0x14a6c41d
xor eax, 0x5b16be25
sub eax, 0x35cfbf9b
add eax, 0x38d50c8d
xor eax, 0x92b5c61f
sub rsp, 0x1c9490ec
add rsp, 0x1c94932c
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400b51a0
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400b8560
xchg rcx, rdi
mov r10, rdi
xchg rcx, rdi
mov eax, dword [0x140130024]
mov dword [rsp - 0x28], edx
cmp qword [0x140130038], 0
jne 0x1400b7a10
syscall
ret
Function at 0x1400b6a80
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x1c], 0x5309e3a1
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x2c], edx
xchg rdi, r8
mov r15, rdi
xchg rdi, r8
movzx ebx, byte [rdx]
xchg r15, r15
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
shl ebx, 1
shl ebx, 7
dec r8d
mov dword [rsp - 0x28], 0x1cfd8ff3
or ebx, eax
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 1
shl ebx, 5
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0xc], edi
movzx eax, byte [rdx + 3]
shl ebx, 5
shl ebx, 1
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
xchg r10, r10
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 3
shl edi, 3
shl edi, 1
shl edi, 1
or edi, eax
mov dword [rsp - 0x10], 0x5cfb32d
movzx eax, byte [rdx + 7]
shl edi, 1
shl edi, 2
shl edi, 2
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
xchg r11, r11
test r8d, r8d
jle 0x1400b6bee
xchg rsp, rdx
mov rsp, qword [rcx + 8]
xchg rsp, rdx
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
mov dword [rsp - 0x20], edi
inc r14d
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
mov dword [rsp - 0x34], 0x21fe2b67
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
mov dword [rsp - 0x10], edx
mov rdx, rsi
mov ecx, edi
call fcn.1400b733c
mov r14, r14
xor ebx, eax
xchg rbp, rdx
mov rbp, rdx
xchg rdx, rbp
mov ecx, ebx
mov dword [rsp - 0x38], esi
call fcn.1400b733c
xor edi, eax
nop
add rsi, 0x678d309
sub rsi, 0x678d321
nop
sub rbp, 0x3600da24
add rbp, 0x3600da0c
sub r14, 1
jne 0x1400b6b9e
mov r15, r15
lea rax, [r15 + 7]
mov ecx, 0x2b1720ae
xor ecx, 0x247be5d9
sub ecx, 0x1af8886
xor ecx, 0x5dab4a20
sub ecx, 0x501676cd
mov byte [rax - 4], dil
mov dword [rsp - 0xc], ecx
mov byte [rax], bl
dec rax
shr ebx, 5
shr ebx, 2
shr ebx, 1
shr edi, 6
shr edi, 1
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x20], esp
jne 0x1400b6c0f
xchg rbx, r14
mov r14, qword [rsp + 0x40]
xchg r14, rbx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
nop
sub rsp, 0x71d110c6
add rsp, 0x71d110e6
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400b6c7c
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rax
mov r12, rsp
xchg r12, rax
xchg r12, rbx
mov qword [rax + 8], r12
xchg r12, rbx
xchg r10, rbp
mov qword [rax + 0x10], r10
xchg r10, rbp
xchg rsi, rdi
mov qword [rax + 0x18], rdi
xchg rsi, rdi
xchg r9, rdi
mov qword [rax + 0x20], r9
xchg rdi, r9
push r14
xchg rsp, rsp
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
mov dword [rsp - 0x2c], esp
xchg r14, r13
mov r13, r8
xchg r13, r14
movzx ebx, byte [rdx]
mov rsi, rsi
movzx edi, byte [rdx + 4]
shl ebx, 1
shl ebx, 2
shl ebx, 5
or ebx, eax
mov dword [rsp - 0x10], ebp
shl edi, 7
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x40], esp
shl ebx, 3
shl ebx, 3
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x40], 0x62d014fa
movzx eax, byte [rdx + 3]
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 5]
or edi, eax
xchg r12, r12
movzx eax, byte [rdx + 6]
shl edi, 7
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
shl edi, 5
shl edi, 3
or edi, eax
mov dword [rsp - 0x38], 0x72f8947c
mov eax, dword [rcx + 4]
test eax, eax
jle 0x1400b6da4
mov rsi, qword [rcx + 8]
xchg r15, r15
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
xchg rdx, rbx
mov rbx, rsi
xchg rdx, rbx
mov ecx, edi
mov dword [rsp - 0x20], 0x65a35bee
call fcn.1400b733c
xor ebx, eax
lea rdx, [rsi + 0xc]
mov dword [rsp - 0x34], edx
mov ecx, ebx
call fcn.1400b733c
xor edi, eax
xchg r8, r8
nop
add rsi, 0x2a676207
sub rsi, 0x2a6761ef
sub rbp, 1
mov dword [rsp - 0x30], 0x53b03b13
jne 0x1400b6d55
lea rax, [r14 + 7]
mov ecx, 0x1601a3cc
add ecx, 0x46a070de
sub ecx, 0x40cfdf75
sub ecx, 0x1bd23531
mov byte [rax - 4], dil
mov dword [rsp - 0x30], edi
mov byte [rax], bl
dec rax
shr ebx, 2
shr ebx, 6
shr edi, 6
shr edi, 1
shr edi, 1
sub rcx, 1
jne 0x1400b6dbf
mov dword [rsp - 0x24], 0x1c4f40e3
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x20], esp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400b6fdc
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg r9, rbx
xchg rbp, rsi
mov qword [rsp + 0x18], rbp
xchg rsi, rbp
nop
push 0x1faa2c58
mov qword [rsp], rbp
nop
push r14
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r14
lea rbp, [rsp - 0x47]
mov dword [rsp - 0x3c], ebx
add rsp, 0xffffffffffffff60
movdqa xmm0, xmmword [0x14000beb0]
xor edi, edi
mov rsi, rsi
movdqa xmm1, xmmword [0x14000be50]
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg rbp, rcx
movdqu xmmword [rcx - 0x39], xmm0
xchg rbp, rcx
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
mov edx, edi
movdqa xmm0, xmmword [0x14000be30]
xchg rsp, rsp
mov r8d, edi
xchg r13, rbp
movdqu xmmword [r13 - 0x29], xmm1
xchg r13, rbp
movdqa xmm1, xmmword [0x14000be40]
xchg rbp, rbx
movdqu xmmword [rbx - 0x19], xmm0
xchg rbp, rbx
movdqu xmmword [rbp - 9], xmm1
mov dword [rsp - 0x20], edi
mov ecx, edx
lea r8, [r8 + 4]
mov eax, 0x634e59fd
sub eax, 0x12ec2486
add eax, 0x23c53263
sub eax, 0x1fa711b4
inc rdx
rol eax, cl
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rsp - 0x18], 0x777de3f8
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x1400b7086
cmp dword [rsi + 4], 8
mov dword [rsp - 0x18], edi
jne 0x1400b712a
lea rdx, [rbp + 0x6d]
movzx ecx, byte [rbx + rdi*2]
xchg r8, r8
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 3
shl cx, 2
shl cx, 3
or cx, ax
mov word [rdx], cx
mov dword [rsp - 0x14], esp
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x1400b70d3
xchg rbx, rbx
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg r12, r12
xchg rsi, rbp
mov rcx, rbp
xchg rsi, rbp
call fcn.1400b6e18
jmp 0x1400b7200
cmp dword [rsi], edi
xchg rsp, rsp
jle 0x1400b7200
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x63de86ef
xor r8d, 0x60960f09
add r8d, 0x58444f4e
xor r8d, 0x5b8cd930
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
xchg rsi, rsi
sub rbx, 0xfffffffffffffffe
shl ax, 2
shl ax, 3
shl ax, 1
shl ax, 1
shl ax, 1
or cx, ax
mov word [rdx], cx
mov r8, r8
lea rdx, [rdx - 2]
sub r8, 1
jne 0x1400b7157
mov dword [rsp - 0x34], ebx
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg rsi, r10
mov rcx, r10
xchg rsi, r10
call fcn.1400b6e18
mov dword [rsp - 0x10], 0x756763d9
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
xchg r15, r15
lea rdx, [rbp + 0x67]
nop
sub r8d, 0x73ef61eb
add r8d, 0x73ef61e3
xchg rcx, r10
mov r10, rsi
xchg r10, rcx
call fcn.1400b6e18
inc edi
xchg r8, r8
neg r14d
add r14d, 0xfffffff8
neg r14d
cmp edi, dword [rsi]
mov dword [rsp - 0x10], 0x22ae5280
jl 0x1400b7138
xor eax, eax
lea r11, [rsp + 0xa0]
mov rsi, rsi
mov rbx, qword [r11 + 0x28]
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
mov dword [rsp - 0x20], 0x54970f6f
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg r11, r14
mov rsp, r14
xchg r11, r14
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400b72e4
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
mov dword [rsp - 0x28], 0xb4d9186
test edx, edx
je 0x1400b7335
lea ecx, [r11 + r11]
mov r14, r14
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov dword [rsp - 0x34], 0x544a2da1
test dl, 1
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov dword [rsp - 0x14], ebx
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
mov dword [rsp - 0x2c], 0x246605aa
jne 0x1400b72f6
mov eax, r10d
ret
Function at 0x1400b9fc0
Capabilities:
Encode data using xor

Disassembly:
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xchg r10, r14
mov qword [rsp], r14
xchg r10, r14
xchg rbx, r11
mov qword [rsp + 8], rbx
xchg r11, rbx
xor r11, r11
lea r10, [rsp + 0x18]
mov dword [rsp - 0x28], ebp
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
xchg rcx, rcx
bnd jae 0x1400ba036
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov dword [rsp - 0x20], 0x46d5fed3
mov byte [r11], 0x25
xor byte [r11], 0x5c
sub byte [r11], 0x32
sub byte [r11], 0x31
sub byte [r11], 0x16
cmp r10, r11
bnd jne 0x1400ba00a
mov r14, r14
xchg r10, rcx
mov rcx, qword [rsp]
xchg rcx, r10
xchg r11, r15
mov r15, qword [rsp + 8]
xchg r11, r15
add rsp, 0x10
mov r11, r11
bnd ret
Function at 0x1400bfea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
xchg rdi, rdi
xor r8d, r8d
xchg rsp, rdx
mov r9, rsp
xchg rdx, rsp
test rax, rax
mov r12, r12
je 0x1400bff0b
mov ecx, r8d
mov edx, 0xf1f324c
add edx, 0x43070964
sub edx, 0x218d0e40
xor edx, 0x64197b56
rol edx, cl
xor dl, byte [rax]
inc rax
mov dword [rsp - 0x28], edi
mov byte [r8 + r9], dl
inc r8
cmp r8, 0x20
jb 0x1400bfec2
mov dword [rsp - 0x10], 0xd377d90
mov al, 0x3b
add al, 0x14
xor al, 0x50
add al, 0x20
xor al, 0x3e
ret
xchg rdi, rax
mov rdi, qword [rcx + 0x100]
xchg rdi, rax
test rax, rax
xchg rbp, rbp
je 0x1400bff4e
xchg r14, rax
movups xmm0, xmmword [r14]
xchg r14, rax
xchg rsp, rdx
movups xmmword [rsp], xmm0
xchg rdx, rsp
xchg r10, rax
movups xmm1, xmmword [r10 + 0x10]
xchg r10, rax
xchg r12, rdx
movups xmmword [r12 + 0x10], xmm1
xchg r12, rdx
jmp 0x1400bff00
xorps xmm0, xmm0
xor al, al
mov r12, r12
xchg rdx, r13
movups xmmword [r13], xmm0
xchg r13, rdx
xchg rdx, r9
movups xmmword [r9 + 0x10], xmm0
xchg rdx, r9
ret
Function at 0x1400d6f20
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg rsp, r11
mov qword [r11 + 8], rbx
xchg r11, r11
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x40
mov rax, qword [0x14012f4c8]
xchg r9, r9
lea rdx, [r11 + 0x10]
rol rax, 0xc
rol rax, 3
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
not rax
mov r13, r13
mov dword [rsp + 0x58], 0x7cc30f8d
sub dword [rsp + 0x58], 0x6692043
sub dword [rsp + 0x58], 0x5e647c99
sub dword [rsp + 0x58], 0x17f572a1
ror rax, 4
ror rax, 2
ror rax, 1
ror rax, 1
movabs rcx, 0x3d4d99b40347121c
add rcx, 0x180786c
xor rcx, 0xcd4de64
add rcx, 0x6f89fc2f
add rcx, 0x7fffffff
sub rcx, 0x18437a5f
add rax, rcx
lea rcx, [r11 - 0x28]
xchg rdi, rdi
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x2c], 0x54e4c32
xchg r13, rdi
mov qword [rbx], r13
xchg r13, rdi
xor esi, esi
mov dword [rsp - 0x30], esp
xchg rdi, r8
movups xmmword [r8], xmm0
xchg r8, rdi
xchg rsi, rdi
movups xmmword [rsi + 0x10], xmm0
xchg rdi, rsi
xchg rdi, rbp
movups xmmword [rbp + 0x20], xmm0
xchg rdi, rbp
test eax, eax
jne 0x1400d7025
xchg rsi, r11
mov qword [rbx + 0x38], r11
xchg r11, rsi
jmp 0x1400d7147
lea rax, [rsp + 0x20]
or r14, 0xffffffffffffffff
mov dword [rsp - 0x20], edi
inc r14
cmp word [rax + r14*2], si
jne 0x1400d7032
xchg r14, rbp
mov qword [rbx + 0x38], rbp
xchg r14, rbp
cmp qword [rbx], rdi
mov r13, r13
je 0x1400d7064
xchg rcx, r9
mov r9, qword [rbx]
xchg rcx, r9
call fcn.1400b9840
cmp r14, 0x18
mov dword [rsp - 0xc], 0x2b66adfb
jbe 0x1400d70a2
lea rcx, [r14 + r14]
call fcn.1400b9ad0
mov qword [rbx], rax
mov rcx, rcx
test rax, rax
jne 0x1400d70b2
mov qword [rbx], rdi
xchg rcx, rcx
xchg r8, rcx
mov r8, rsi
xchg rcx, r8
jmp 0x1400d70c9
xchg r14, rdi
mov qword [rbx], r14
xchg r14, rdi
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
xorps xmm0, xmm0
xchg r14, r14
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rbx]
mov r9, r9
mov edx, 0x42379c43
add edx, 0x363e509b
xor edx, 0x4c0911a5
sub edx, 0xd915c0a
add edx, 0xa4764c1
cmp qword [rbx + 0x38], rsi
jbe 0x1400d7147
mov dword [rsp - 0x2c], ecx
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
xchg rsi, rsi
mov r9d, 0x41dbefa2
add r9d, 0x2dbdd10f
xor r9d, 0x707a5cfd
xor r9d, 0x1fe39cb3
and ax, r9w
ror edx, 8
xchg rdx, rdx
xor ax, word [r8 + rcx]
inc rsi
mov word [rcx], ax
mov dword [rsp - 0x1c], edx
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
jb 0x1400d70fc
mov r15, r15
xchg rsi, rbp
mov rbp, qword [rsp + 0x60]
xchg rbp, rsi
xchg r12, rbx
mov rax, r12
xchg r12, rbx
xchg rbx, r10
mov r10, qword [rsp + 0x50]
xchg r10, rbx
mov rdi, qword [rsp + 0x68]
mov dword [rsp - 0x20], edi
nop
sub rsp, 0x8a6ec5a
add rsp, 0x8a6ec9a
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400f9918
Capabilities:
Execute syscall

Disassembly:
push rbx
mov dword [rsp - 0x18], 0x6598b99c
nop
add rsp, 0x378a85bd
sub rsp, 0x378a85dd
xchg rdi, rcx
mov rbx, rdi
xchg rdi, rcx
mov rcx, qword [rcx + 0x1a8]
cmp rcx, 0xffffffffffffffff
mov dword [rsp - 0x44], ecx
je 0x1400f99c3
xchg rsp, rax
mov rsp, qword [rbx + 0x258]
xchg rsp, rax
movabs rdx, 0x54dcb10e35ee4908
add rdx, 0x1a1ed39f
add rdx, 0x19de1c40
xor rdx, 0x7fe37cd6
xor rdx, 0x2c48dcaa
sub rax, rdx
movabs rdx, 0xc0a39a194251d1db
add rdx, 0x139a68c9
add rdx, 0x1d48829e
xor rdx, 0x61650795
add rdx, 0x976ca11
ror rax, 0x20
ror rax, 0xa
ror rax, 4
ror rax, 1
add rax, rdx
not rax
xchg rsp, rsp
call rax
mov rcx, qword [rbx + 0x198]
test rcx, rcx
je 0x1400f99fd
mov dword [rsp - 0x24], esi
cmp qword [rbx + 0x1a0], 0
jne 0x1400f99fd
mov rcx, qword [rcx + 0x20]
call fcn.1400b9840
xchg r11, r11
mov rcx, qword [rbx + 0x198]
call fcn.1400b9840
xchg rcx, r14
mov r14, qword [rbx + 0x1a0]
xchg r14, rcx
test rcx, rcx
mov dword [rsp - 0x30], ecx
je 0x1400f9ab3
mov rax, qword [rbx + 0x248]
movabs rdx, 0x7c3cba450a25744e
add rdx, 0x55660ad2
xor rdx, 0x359499db
add rdx, 0x2836d7f6
sub rax, rdx
movabs rdx, 0x630314e63cb76fd7
add rdx, 0x38737183
sub rdx, 0x3368c0a2
add rdx, 0x7fffffff
xor rdx, 0x6909dac1
not rax
sub rax, rdx
movabs rdx, 0xbed4a4c5f518761
xor rdx, 0x286987
sub rdx, 0xfd69b58
sub rdx, 0xceca68f
add rdx, 0x7fffffff
sub rdx, 0x10c7dc0f
not rax
mov dword [rsp - 0x44], 0x51b3177f
sub rax, rdx
rol rax, 1
rol rax, 6
rol rax, 1
call rax
cmp qword [rbx + 0x200], 0
je 0x1400f9b77
mov dword [rsp - 0xc], edi
mov rax, qword [rbx + 0x210]
movabs rcx, 0x26d2032a66693bf4
xor rcx, 0x41d9eb3d
add rcx, 0x583499cb
xor rcx, 0x2446c71b
xor rcx, 0x40f8ce02
sub rax, rcx
mov dword [rsp - 0x14], esp
movabs rcx, 0x5a901d303a4efa98
sub rcx, 0x2bb57d66
xor rcx, 0x3b2a217e
sub rcx, 0x22ce9f4
rol rax, 0x1c
rol rax, 7
add rax, rcx
movabs rcx, 0xc97d1c211cd4d221
xor rcx, 0x10e87977
add rcx, 0x441e0931
add rcx, 0x6e0fe62
add rcx, 0x7fffffff
xor rcx, 0x2ef2a856
ror rax, 9
ror rax, 2
xor rax, rcx
call rax
xchg r13, rcx
mov r13, qword [rbx + 0x200]
xchg r13, rcx
call fcn.1400b3120
and qword [rbx + 0x200], 0
xchg rcx, r14
mov r14, qword [rbx + 0x1f0]
xchg r14, rcx
nop
add rsp, 0x77c32559
sub rsp, 0x77c32539
pop rbx
jmp fcn.1400a19e0
Function at 0x1400fc124
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rcx, rsi
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
push rbp
push rdi
mov dword [rsp - 0x3c], 0x4f061f3
nop
push 0x1bcdec91
mov qword [rsp], r14
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
neg rsp
sub rsp, 0xffffffffffffffb0
neg rsp
xor esi, esi
mov dword [rbp - 0x30], 0x3fd86899
sub dword [rbp - 0x30], 0x1c4c7053
add dword [rbp - 0x30], 0x3fa9bf1e
add dword [rbp - 0x30], 0x16b672c1
xor dword [rbp - 0x30], 0x79992a40
mov dword [rbp - 0x2c], 0x1dc8871
add dword [rbp - 0x2c], 0x6dfa1b52
sub dword [rbp - 0x2c], 0x3118ead7
sub dword [rbp - 0x2c], 0x3e4fb8eb
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov dword [rbp - 0x28], 0x3dffbbab
add dword [rbp - 0x28], 0x219298c5
sub dword [rbp - 0x28], 0x1cee2d15
sub dword [rbp - 0x28], 0x4270275a
mov r14d, 0x7489c246
sub r14d, 0x2fbb2b30
xor r14d, 0x719301a3
add r14d, 0x18087d11
sub r14d, 0x4d6613c5
mov dword [rbp - 0x24], 0x784ea9f6
sub dword [rbp - 0x24], 0xfd35b14
sub dword [rbp - 0x24], 0xe94f37e
sub dword [rbp - 0x24], 0x59915b47
mov dword [rbp - 0x20], 0x73271b7c
xor dword [rbp - 0x20], 0x63ad7063
add dword [rbp - 0x20], 0x5d058d3e
sub dword [rbp - 0x20], 0x205a036b
sub dword [rbp - 0x20], 0x4ccbf494
xchg rsi, r14
mov qword [rbp + 0x20], r14
xchg r14, rsi
mov rax, qword [rbp + 0x20]
mov dword [rsp - 0x34], ebp
mov rcx, qword [rbp + 0x20]
xchg rcx, rax
mov rcx, qword [rbp + 0x20]
xchg rcx, rax
and cl, 3
mov dword [rsp - 0x38], ecx
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x30]
mov rbx, rbx
mov eax, 0x32a4b34
add eax, 0x7bfffda1
sub eax, 0x25e3805d
xor eax, 0x6875ce4a
shr eax, cl
xchg rdx, rdx
movzx ecx, al
xchg rsp, rax
mov rsp, qword [rbp + 0x20]
xchg rsp, rax
xor cx, dx
mov dword [rsp - 0x34], 0x2059fb68
mov word [rbp + rax*2 - 0x1c], cx
xchg r8, rax
mov r8, qword [rbp + 0x20]
xchg r8, rax
add rax, r14
xchg rcx, rcx
xchg rdx, rax
mov qword [rbp + 0x20], rdx
xchg rdx, rax
mov rax, qword [rbp + 0x20]
mov r13, r13
cmp rax, 0xa
jb 0x1400fc234
xor edx, edx
xchg rsi, rsi
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
call fcn.1400b0bb0
xchg r10, r10
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x200], rax
mov dword [rsp - 0x24], 0x14e83c11
xor eax, eax
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov dword [rsp - 0x34], ebx
rep stosb byte [rdi], al
test r8, r8
je 0x1400fc352
lea rdx, [rbx + 0x208]
mov dword [rsp - 0x24], 0x7ba78cf5
xchg rsi, rcx
mov rsi, r8
xchg rsi, rcx
call fcn.1400fc9cc
test al, al
jne 0x1400fc347
mov dword [rsp - 0x24], 0x73fa5cc3
xchg rsi, rcx
mov rsi, qword [rbx + 0x200]
xchg rsi, rcx
call fcn.1400b3120
mov dword [rsp - 0x44], 0xd91bf6d
xor al, al
mov qword [rbx + 0x200], rsi
jmp 0x1400fc352
mov al, r14b
mov dword [rsp - 0x14], 0x29551911
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
xchg rsi, rcx
mov rcx, qword [r11 + 0x30]
xchg rsi, rcx
mov rsp, r11
mov rdi, rdi
pop r14
nop
mov rdi, qword [rsp]
add rsp, 8
pop rbp
ret
Function at 0x1400fc7f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov qword [rsp], rdi
sub rsp, 0x140
xchg r11, r8
mov rdi, r11
xchg r11, r8
xchg r10, rcx
mov rbx, r10
xchg r10, rcx
mov r8d, 0x261439f0
xor r8d, 0x4938a2b0
sub r8d, 0x50c2bf27
sub r8d, 0x1e69db19
lea rcx, [rsp + 0x40]
xor edx, edx
xchg r11, r11
call fcn.1400b9e10
xchg r10, rsi
mov rsi, qword [rbx + 0x238]
xchg r10, rsi
lea r8, [rsp + 0x40]
xchg r12, r12
mov edx, dword [rdi + 0x10]
movabs rcx, 0xbe18b50c00e140f8
add rcx, 0x64e7cb9d
sub rcx, 0x3cd13323
add rcx, 0x7fffffff
xor rcx, 0x1c46caa4
rol r10, 3
rol r10, 4
rol r10, 1
movabs rax, 0x70e473ab503bb052
xor rax, 0x79c9be2b
add rax, 0x14da7532
sub rax, 0x2a6e282
add r10, rcx
mov dword [rsp + 0x30], 0xb9f5b79
xor dword [rsp + 0x30], 0x1bfc5b0b
xor dword [rsp + 0x30], 0x3b5515d4
xor dword [rsp + 0x30], 0x2b3615a4
and dword [rsp + 0x28], 0
not r10
mov dword [rsp - 0x10], 0x4bbed43c
mov rcx, qword [rdi + 0x20]
sub r10, rax
and qword [rsp + 0x20], 0
xchg rbx, rbx
mov r9d, 0x39399c4c
sub r9d, 0x57bc8e1
xor r9d, 0x52e22a71
sub r9d, 0xc452a47
xor r9d, 0x551acfd3
ror r10, 9
ror r10, 1
ror r10, 1
call r10
test eax, eax
mov r9, r9
jne 0x1400fc9b2
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
mov r10, r10
cmp byte [rsp + 0x40], 0
mov dword [rsp + 0x150], eax
je 0x1400fc988
xchg rdx, rdx
mov rdx, rbx
lea rcx, [rsp + 0x150]
mov r8d, 0x59ed22e5
xor r8d, 0x6173fa15
xor r8d, 0x4e58cfce
xor r8d, 0x76c6173f
inc rbx
mov r12, r12
call fcn.1400a1550
cmp byte [rbx], 0
jne 0x1400fc93f
mov dword [rsp - 0x10], 0x2d367f6a
mov eax, dword [rsp + 0x150]
not eax
cmp eax, 0xa2ca6717
je 0x1400fc9a5
mov r15, r15
cmp eax, 0xd7b7e7a8
sete al
jmp 0x1400fc9b4
mov al, 4
xor al, 0x2b
xor al, 1
sub al, 0x2d
jmp 0x1400fc9b4
xor al, al
mov rbx, qword [rsp + 0x158]
add rsp, 0x30111f07
sub rsp, 0x30111dc7
pop rdi
ret
Function at 0x140100f70
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x44], 0x545f418f
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffff40
neg rsp
mov rax, r8
mov rbx, rdx
xchg rsp, r8
mov rsp, rdx
xchg rsp, r8
xchg rbx, rcx
mov rdi, rbx
xchg rcx, rbx
mov edx, 0x5a15ce73
xor edx, 0x5fb6aef9
add edx, 0x427bd3f
sub edx, 0x9cb1da9
xchg rcx, rbx
mov rbx, rax
xchg rcx, rbx
call fcn.1401017d0
movzx eax, byte [rbx + 0x1f]
xchg rdx, rdx
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
and al, 0x3f
or al, 0x40
mov dword [rsp - 0x20], esi
xchg r10, rdx
mov r10, rbx
xchg rdx, r10
mov byte [rbx + 0x1f], al
xchg r8, r8
call fcn.140104db0
lea rdx, [rsp + 0x20]
xchg rcx, r8
mov r8, rdi
xchg r8, rcx
call fcn.140104ce0
mov dword [rsp - 0x40], 0x10bd6abb
mov rbx, qword [rsp + 0xd0]
sub rsp, 0xffffffffffffff40
pop rdi
mov rdi, rdi
ret