joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019330
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14002ad70]
call fcn.14001905c
mov rsi, rax
test rax, rax
je 0x14001937c
mov rcx, rax
call fcn.14001656c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140019387
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400283b0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov r11, rdx
mov rbx, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140028423
mov r9d, dword [r8 + 0xf0]
xor edx, edx
test r9d, r9d
je 0x140028423
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r10d, word [r8 + 6]
add rcx, rax
mov r9d, dword [r9 + rdi + 0xc]
test r10d, r10d
je 0x140028423
mov eax, dword [rcx + 0xc]
cmp r9d, eax
jb 0x140028418
mov r8d, dword [rcx + 8]
add eax, r8d
cmp r9d, eax
jb 0x140028430
inc edx
add rcx, 0x28
cmp edx, r10d
jb 0x140028404
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov dword [rbx], r8d
mov eax, dword [rcx + 0x24]
mov dword [r11], eax
mov eax, dword [rcx + 0xc]
add rax, rdi
jmp 0x140028425
Function at 0x1400154d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140020690], rbx
je 0x14001551c
cmp rax, rbx
jne 0x14001550f
mov ebx, 1
mov esi, ebx
jmp 0x140015521
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400154f4
mov ebx, 1
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x140015537
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14001559c
mov eax, dword [0x140020698]
test eax, eax
jne 0x140015596
mov dword [0x140020698], ebx
lea r15, [0x140017850]
lea rdi, [0x140017838]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140015588
test eax, eax
jne 0x14001558c
cmp qword [rdi], 0
je 0x14001557d
mov rax, qword [rdi]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001555e
test eax, eax
je 0x14001559c
mov eax, 0xff
jmp 0x140015678
mov dword [0x1400200a4], ebx
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x1400155c3
lea rdx, [0x140017830]
lea rcx, [0x140017820]
call sub.msvcrt.dll__initterm
mov dword [0x140020698], 2
test esi, esi
jne 0x1400155d0
xor eax, eax
xchg qword [0x140020690], rax
cmp qword [0x1400206a0], 0
je 0x140015604
lea rcx, [0x1400206a0]
call fcn.140015d50
test eax, eax
je 0x140015604
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400206a0]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov r8, qword [0x1400200b8]
mov rdx, qword [0x1400200b0]
mov ecx, dword [0x1400200a8]
call fcn.140001724
mov dword [0x1400200a0], eax
cmp dword [0x1400200c0], 0
jne 0x140015634
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400200a4], 0
jne 0x140015649
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400200a0]
jmp 0x140015678
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401a6000
add rsp, 0x28
jmp 0x1400154d0

Function at 0x140015c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015c88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015c80
cmp dword [rcx + 0x3c], edx
jl 0x140015c80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140015c80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140015c88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180005764
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18001bde0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800014b0
xor ebx, ebx
cmp qword [0x18001d0c8], rbx
mov rdi, rax
jne 0x180005877
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000594e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000594e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001d0c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001d0d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18001d0d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18001d0e8], rax
test rax, rax
je 0x18000586e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18001d0e0], rax
jmp 0x18000587e
mov rax, qword [0x18001d0e0]
jmp 0x180005885
mov rax, qword [0x18001d0e0]
mov r11, qword [0x18001d0e8]
cmp rax, rdi
je 0x1800058ec
cmp r11, rdi
je 0x1800058ec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18001d0e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1800058ec
test rax, rax
je 0x1800058ec
call rsi
test rax, rax
je 0x1800058e6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800058e6
test byte [rsp + 0x40], 1
jne 0x1800058ec
bts ebp, 0x15
jmp 0x18000592c
mov rcx, qword [0x18001d0d0]
cmp rcx, rdi
je 0x18000592c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000592c
call rax
mov rbx, rax
test rax, rax
je 0x18000592c
mov rcx, qword [0x18001d0d8]
cmp rcx, rdi
je 0x18000592c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000592c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001d0c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000594e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180005950
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180005370
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180005c97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18001bde0]
jne 0x18000538a
rol rcx, 0x10
test cx, 0xffff
jne 0x180005386
repz ret
ror rcx, 0x10
jmp 0x180005bf0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001d190]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001d288]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180005c75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001d190]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180005c97
mov rax, qword [rsp + 0x88]
mov qword [0x18001d288], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001d228], rax
mov rax, qword [0x18001d288]
mov qword [0x18001d100], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001d210], rax
mov dword [0x18001d0f0], 0xc0000409
mov dword [0x18001d0f4], 1
mov rax, qword [0x18001bde0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001bde8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001d188], eax
mov ecx, 1
call fcn.180005750
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180019a78]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001d188], 0
jne 0x180005d1e
mov ecx, 1
call fcn.180005750
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180005d69
Capabilities:
Packed with generic packer

Disassembly:
call fcn.180013155
xor bh, ch
sbb eax, dword [rcx]
call 0x1c7f5debf
xchg ecx, eax
in al, dx
jb 0x18000ecbf
Function at 0x180006926
Capabilities:
Packed with generic packer

Disassembly:
push r9
jo 0x180011775
mov rsp, rsp
jno 0x180011775
jmp fcn.18000d0e8
popfq
jp 0x18000e1da
mov ax, ax
jnp 0x18000e1da
call fcn.1800097ea
call fcn.180013155
invalid
mov eax, dword [0x18001c173]
call fcn.180008302
cli
invalid
pop rbp
jb 0x18001234a
mov cl, cl
jae 0x18001234a
jne 0x180012999
call fcn.180012c11
invalid
ret
pop r9
jb 0x18000bbfa
mov r11, r11
jae 0x18000bbfa
and qword [rbx + 0x10], 0
call fcn.18000bcb0
push rbx
or ebp, dword [rbp + 0x13]
call 0x180c4d946
add byte [rax], al
add al, ch
cld
movabs al, byte [0xfe8f0330395ffff]
mov gs, esp
popfq
invalid
add qword [rsp + 0x10], r9
jmp 0x18000839d
pushfq
jl 0x180013e87
mov bl, bl
jge 0x180013e87
js 0x1800084c7
call fcn.18000a201
sub bh, ah
imul edx, dword [rbx], 0x3e283e8
loop 0x18000f109
call fcn.18000df9d
in al, dx
or ebp, eax
pop rbp
call fcn.1800171b0
push rdi
je 0x18000f104
invalid
sbb al, ch
call fcn.18000e081
call fcn.18000e9e0
insd dword [rdi], dx
pop rbp
fchs
call 0x1a46cf276
adc byte [rdi], cl
mov byte [rax + 0x48000039], dh
mov esp, esp
jns 0x180012ae5
test rax, rax
call fcn.180006254
wait
invalid
and al, 0x28
add al, 0
add byte [rax], al
call fcn.180017690
jmp fcn.1800100ae
mov r9, qword [rsp + 8]
jb 0x180011961
mov rdi, rdi
jae 0x180011961
call fcn.18001746a
leave
wait
out dx, eax
call 0x168e4a2e0
invalid
movsxd r9, dword [r9]
jl 0x18000f0e4
mov di, di
jge 0x18000f0e4
jne 0x18001473f
call fcn.18000db2a
shr dword [rbx - 0x173c1708], 1
out dx, eax
jmp 0x13e82198a
ret
xor byte [rbx - 0x25170001], 0x2e
add byte [rax], al
shr dword [rsi + 0x60], 1
hlt
popfq
js 0x18000a30a
mov ch, ch
jns 0x18000a30a
jb 0x1800134ae
call fcn.18000fa44
cwde
and al, 0xe8
mov fs, ebx
movabs eax, dword [0xd5ffff47ece8ffff]
invalid
xor r9, 0x2bc30865
jmp 0x18000e70a
lea ecx, [0x18001bed0]
call fcn.180012501
mov word [rdi + rbx*2], fs
in al, dx
call 0x18877d097
call fcn.1800072d4
push rbx
stc
fld1
mov r8d, dword [rdx + 8]
call fcn.18000cdce
and al, 0xc4
and ebp, eax
jne 0x1800100e3
call fcn.18000c4fd
popfq
invalid

Function at 0x180006ddf
Capabilities:
Packed with generic packer

Disassembly:
push r15
jg 0x180007c5e
mov sp, sp
jle 0x180007c5e
mov r15, qword [rsp + 8]
jb 0x180008c60
mov r14, r14
jae 0x180008c60
sub qword [rsp + 0x10], rsi
js 0x180013472
mov dl, dl
jns 0x180013472
jmp fcn.18000d0e8
movsxd r15, dword [r15]
jo 0x1800138d6
mov di, di
jno 0x1800138d6
call fcn.18000cc98
call fcn.180016a51
cmp al, 0xd0
invalid

Function at 0x180007f31
Capabilities:
Packed with generic packer

Disassembly:
push rbx
jb 0x180006e14
mov al, al
jae 0x180006e14
jne 0x18000954e
call int.180017a08
stosb byte [rdi], al
sbb byte [rax - 0x3fcc1738], al
call fcn.180013059
rcr byte [rdi - 0x1717c226], 1
jle 0x180007f60
add al, ch
pop rax
movabs eax, dword [0xfe8143381b80000]
mov ecx, dword [rdx]
invalid
int 0x56
add byte [rax], al
Function at 0x180008455
Capabilities:
Packed with generic packer

Disassembly:
sub qword [rsp + 0x10], rax
je 0x180011b1b
mov dx, dx
jne 0x180011b1b
jb 0x1800103ac
call fcn.18001508b
pop rdi
invalid
push rax
jg 0x18000c84a
mov r11, r11
jle 0x18000c84a
call fcn.180005d69
call fcn.180007ca4
adc eax, 0xe827dd16
call fcn.18000cc98
call fcn.18000d4da
add ebp, ebx
invalid
popfq
jo 0x18000ceea
mov sp, sp
jno 0x18000ceea
call fcn.18000db2a
jg 0x1800094b3
lodsb al, byte [rsi]
clc
call 0x18054543d
add al, ch
adc al, 6
add byte [rax], al
invalid
sub byte [rdi], cl
call 0x13de96c45
fild word [rax]
add byte [rcx], bh
out dx, eax
invalid
add qword [rsp + 0x10], rdx
jp 0x180017037
nop
jnp 0x180017037
pop r8
je 0x18001507d
mov rcx, rcx
jne 0x18001507d
test rax, 0
call fcn.18000ac4c
invalid
add rax, 0x6765a8d
jg 0x180006cfe
mov bx, bx
jle 0x180006cfe
add rsi, 0x2b497f6d
jb 0x18000da9f
mov rbp, rbp
jae 0x18000da9f
mov eax, edx
call fcn.180008dca
hlt
ret
call fcn.180017664
wait
cmp dh, ch
invalid
mov rax, qword [rsp + 8]
jp 0x180011531
mov bx, bx
jnp 0x180011531
add rdx, 0xf05532f
jb 0x18000a212
nop
jae 0x18000a212
pop rsi
jp 0x1800113a8
mov r8, r8
jnp 0x1800113a8
call fcn.18000c4fd
mov dl, 0x61
in eax, dx
int3
sub qword [rsp + 0x10], rsi
jo 0x180009436
mov r12, r12
jno 0x180009436
jb 0x180011552
call fcn.180011c5b
and al, 3
call 0x17f98bdaf
call [rsi - 0x5e]
test al, 0xfe
call 0x1793a5fe0
invalid
pop rdx
jmp 0x18000b879
cmp ch, cl
invalid
ret
movsxd rax, dword [rax]
jl 0x1800173ef
mov rbx, rbx
jge 0x1800173ef
xor r9d, dword [rsi + 8]
call int.180017a08
mov byte [rax - 0x17173780], 0x4d
cmp edi, 0xee1de8ff
cmp r15, 0xffffffffee1de8ff
invalid
popfq
jp 0x1800155a8
mov ah, ah
jnp 0x1800155a8
mov r10d, edx
call fcn.1800087c2
outsd dx, dword [rsi]
not byte [rax - 0x7cb717f9]
invalid
pop rax
jo 0x18001329e
mov dl, dl
jno 0x18001329e
call fcn.18000fda2
call fcn.180016822
sbb eax, 0xe8e14b37
pushfq
js 0x18000cbed
mov r10, r10
jns 0x18000cbed
call fcn.18000a08b
call fcn.180008455
add byte [rcx], cl
mov bh, cl
call 0x1390ee331
outsd dx, dword [rsi]
add byte [rax], al
call fcn.1800141a5
invalid
popfq
jp 0x18000f185
mov r12, r12
jnp 0x18000f185
jge 0x18000c455
call fcn.18000e011
cmp byte [rsi + 0x49e82894], 0xf7
mov byte [rax], 0
add byte [rax], al
call fcn.180009417
pushfq
jb 0x18000a51c
mov rsi, rsi
jae 0x18000a51c

Function at 0x180008f3f
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 8]
ja 0x18000dcef
add byte [rax], al
mov r8, r8
jbe 0x18000dcef
mov r10d, eax
call fcn.18000e9e0
push rcx
fcmovu st(0), st(1)
loopne 0x180005dde
push rdi
jg 0x180005dd5
mov r15, r15
jle 0x180005dd5
Function at 0x18000a260
Capabilities:
Packed with generic packer

Disassembly:
push rbx
js 0x1800174df
mov r14, r14
jns 0x1800174df
mov ebx, dword [rdi]
call fcn.18001587c
invalid
movsxd rbx, dword [rbx]
jo 0x18000f9c4
mov ah, ah
jno 0x18000f9c4
mov qword [r11 + 0x10], rsi
call fcn.18000609e
fimul dword [0x18fe92298]
test dword [rdi + 0x27], esi
add byte [rax], al
call int.18001047e
invalid
add al, ch
rcr dword [rcx], 0
scasb al, byte [rdi]
adc dword [rbx], ebp
jmp 0x14af77b9f
pushfq
jb 0x1800074fb
mov r13, r13
jae 0x1800074fb
mov r8d, ebp
call fcn.18000a0d4
push rbx
jl 0x18000f9a9
invalid
mov rbx, qword [rsp + 8]
jmp 0x18000f8a7

Function at 0x18000a339
Capabilities:
Packed with generic packer

Disassembly:
push rbx
jmp 0x18000cdea
mov rbx, qword [rsp + 8]
jl 0x18000db76
mov rsi, rsi
jge 0x18000db76
mov rdi, qword [rsp + 0x48]
call fcn.18000d0d8
mov cl, 0xe3
sti
invalid
pushfq
je 0x1800144d7
mov bx, bx
jne 0x1800144d7
add byte [rax], al
mov rcx, rdi
call fcn.1800085ce
jrcxz 0x18000d3cd
shr eax, cl
mov r8d, 0x30
call fcn.180006446
xchg r15d, eax
invalid
movsxd rbx, dword [rbx]
jo 0x18000d3bf
mov r14, r14
jno 0x18000d3bf
js 0x18000fdad
call fcn.180012211
xor byte [rbx], bl
sub al, 0x3f
call 0x131c769ab
invalid
popfq
js 0x180014680
mov r10, r10
jns 0x180014680
je 0x18001727a
call fcn.180012501
invalid
test dword [rdx - 0x17ffffdb], ecx
sahf
xchg bh, bh
invalid
popfq
jmp fcn.180006df0
ret
jb 0x1800179b6
call fcn.180017690
clc
or dword [rsi], esi
sbb al, ch
add rbx, 0x3cfa18d1
ja 0x180014c97
mov r12, r12
jbe 0x180014c97
call rax
call fcn.180017514
jl 0x1800144c7
add al, 0xcf
call 0x168c1ca45
invalid
pop rbx
jl 0x180010b55
mov ch, ch
jge 0x180010b55
lea rcx, [rbp + 0x20]
call fcn.18000a201
enter 0x697f, 0x13
call 0x19ae9a2e2
invalid
ret 0x48e8
add qword [rsp + 0x10], rbx
jo 0x18000f339
mov rdx, rdx
jno 0x18000f339
sub qword [rsp + 0x10], rcx
jo 0x180010043
mov r12, r12
jno 0x180010043
mov word [r9 + r8*2], ax
call fcn.18000f786
ja 0x180014c6b
sti
shr al, 0x4d
test esp, esp
call fcn.180015370
xor eax, 0xe8e92a16
lea r8d, [r9 + 1]
call fcn.180007a04
sbb eax, 0xe8236e96
mov rcx, rax
call fcn.180006a13
jmp 0x1680311aa
lea ecx, [rsp + 0x48]
call fcn.180017664
add esi, dword [rcx - 0x13]
invalid
test edi, 0x83e80000
add dword [rax], eax
add al, cl
imul esp, dword [rbx], 0xfffffff4
call 0x168023cbe
mov dl, 0xf7
invalid

Function at 0x18000a394
Capabilities:
Packed with generic packer

Disassembly:
movsxd rcx, dword [rcx]
jb 0x18000947f
mov r14, r14
jae 0x18000947f
push rcx
call fcn.180013155
add eax, 0xe8011b77
movsxd r8, ebp
call int.180009a6e
and byte [rdi + rdi], cl
invalid
push rcx
jo 0x18000cc37
mov ah, ah
jno 0x18000cc37
pop r13
call fcn.180014058
int3
call fcn.1800087c2
invalid
mov rcx, qword [rsp + 8]
jl 0x18000742f
mov ah, ah
jge 0x18000742f
jne 0x18000c8d2
call fcn.180008455
invalid
Function at 0x18000b0d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add r12, 0x6c20256
js 0x1800090c0
mov r14, r14
jns 0x1800090c0
test bh, 0
call fcn.1800090e1
retf
movsxd r12, dword [r12]
ja 0x18000b2e3
mov r13, r13
jbe 0x18000b2e3
add qword [rsp + 0x10], rsi
jb 0x180008990
mov ax, ax
jae 0x180008990
popfq
jb 0x18000aa52
mov ch, ch
jae 0x18000aa52
test edi, 0
call int.180011824
adc dh, byte [rsp + riz*2]
cmp al, 0xe8
add qword [rsp + 0x10], r12
ja 0x180007e45
mov ax, ax
jbe 0x180007e45
test ah, 0
call fcn.180008b2b
cmc
insb byte [rdi], dx
pop rcx
invalid
invalid
pop r12
jp 0x18000cbc2
mov bl, bl
jnp 0x18000cbc2
jne 0x180011ddd
call fcn.180008f3f
jns 0x18000a9f1
adc ch, dh
call 0x16f503585
invalid
push r12
jb 0x180014d2c
mov rsp, rsp
jae 0x180014d2c
pushfq
je 0x180007713
mov bh, bh
jne 0x180007713
mov rdx, qword [rsp + 0x30]
call fcn.1800168b4
mov dword [rcx + 0x7a], esp
or al, ch
mov r13d, dword [rdi + rbp + 0x88]
call fcn.180016228
invalid
ret
mov r12, qword [rsp + 8]
js 0x180007bd8
mov al, al
jns 0x180007bd8
xor ecx, ecx
call fcn.180011e0b
mov al, 0xfa
invalid

Function at 0x18000b2c7
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1800125b2
clc
pop rdi
invalid

Function at 0x18000c2c7
Capabilities:
Packed with generic packer

Disassembly:
pop rdi
jp 0x1800146a9
mov r15, r15
jnp 0x1800146a9
sub rsp, 0x20
call fcn.18000b0d5
pop rdx
invalid
movsxd rdi, dword [rdi]
jb 0x18001029d
mov di, di
jae 0x18001029d
push rdi
jl 0x18000f2d2
mov rsi, rsi
jge 0x18000f2d2
jo 0x18000df69
call fcn.180016237
mul bl
xor al, 0xd0
call 0x1da5444fa
add byte [rax], al
call fcn.180009417
mov ch, 0xb
mov ebx, 0x8348e820
rol dword [rax + rbp*8], 4
mov bh, 0xff
jmp qword [rdi - 0x17236e03]
add qword [rsp + 0x10], rdi
jo 0x18000d962
mov cx, cx
jno 0x18000d962
jb 0x180013fda
call fcn.18000c9a1
movabs byte [0x1957e8e8c8a8d9], al
add al, ch
mov cl, 0x22
add byte [rax], al
int3
xor rdi, 0x3e33ad5c
jmp 0x18000c701
popfq
jg 0x180008757
mov r12, r12
jle 0x180008757
mov edx, esi
call fcn.1800103eb
xor bl, byte [rbx - 0x4e]
out dx, al
call 0x168cc64ca
leave
movabs byte [0xfe8f72d40c4ffff], al
pushfq
invalid
mov rdi, qword [rsp + 8]
jp 0x18000bd8b
mov r13, r13
jnp 0x18000bd8b
mov rbx, rcx
call fcn.1800163eb
invalid
pushfq
jmp 0x18000d4bd
test ebx, 0
call fcn.180012211
fisttp qword [rsp + rbp]
invalid
ret
Function at 0x18000e382
Capabilities:
Packed with generic packer

Disassembly:
push rdi
ja 0x180012c8b
mov dx, dx
jbe 0x180012c8b
mov rdi, qword [rsp + 0x18]
call fcn.18000c2c7
scasb al, byte [rdi]
lea esi, [rbx]
notrack call 0x103e9a5d0
cmpsd dword [rsi], dword [rdi]
invalid
mov rdi, qword [rsp + 8]
jg 0x180015688
mov r12, r12
jle 0x180015688
add rsp, 0x28
call fcn.1800090e1
cld
and al, 0x7d
sbb ebp, eax
call fcn.180006ddf
in al, dx
invalid

Function at 0x18000e7eb
Capabilities:
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + 8]
js 0x180009e4e
push rsi
jp 0x180006dcb
mov cl, cl
jnp 0x180006dcb
mov rcx, rdi
call fcn.18000df9d
test eax, edx
in al, dx
or ebp, eax
shr ecx, 2
call fcn.180010378
imul edi, dword [rbx - 0x1717e682], 0x65
sbb al, 0
add byte [rdi - 0x172377ea], dl

Function at 0x18000f3c1
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], r11
ja 0x18000bb85
mov dh, dh
jbe 0x18000bb85
test cl, 0
call fcn.180015a0b
invalid
popfq
jmp fcn.180010e19
movsxd r13, dword [r13]
ja 0x180016a62
mov dx, dx
jbe 0x180016a62
mov dword [rsi + 0x2c], ecx
call fcn.1800086b2
or dword [rdi + 0xfe83035], ebx
test dword [rdi - 0x57], edi
invalid
pushfq
ja 0x18000e691
mov r9, r9
jbe 0x18000e691
test edx, 0
call fcn.180013de8
mov cl, 0x2f
and dl, dh
call 0x168d069ad
mov bh, bh
call qword [rdx - 0x16]
insd dword [rdi], dx
cmp ebp, eax
test edx, 0
call fcn.180013039
invalid
xor r11, 0x262819e8
js 0x18000b3b4
mov r15, r15
jns 0x18000b3b4
push r13
jb 0x180013691
mov rcx, rcx
jae 0x180013691
mov r11, qword [rsp + 8]
jmp 0x1800146d2
mov r13, qword [rsp + 8]
jp 0x18000c961
mov bx, bx
jnp 0x18000c961
test bh, 0
call fcn.180009417
mov ah, 0x37
mov ebx, 0xf9de820
mov word [rdx], es
stosb byte [rdi], al
invalid
movsxd r11, dword [r11]
jb 0x18000de41
mov dx, dx
jae 0x18000de41
test eax, eax
call fcn.18000e9e0
enter 0xffffffffffffd935, 0xffffffffffffffe0
call 0x1a475d23c
call fcn.180016570
cmpsd dword [rsi], dword [rdi]
invalid

Function at 0x18000f786
Capabilities:
Packed with generic packer

Disassembly:
push r15
je 0x180016808
mov rbx, rbx
jne 0x180016808
Function at 0x180011824
Capabilities:
Packed with generic packer

Disassembly:
movsxd r14, dword [r14]
jb 0x1800159d3
mov ax, ax
jae 0x1800159d3
mov eax, 0xd
call int.180011824
push r14
jb 0x18001548e
mov ch, ch
jae 0x18001548e
push rcx
call fcn.180017b42
xor al, 0x28
and esi, esp
call 0x17fc8e62b
invalid
sub r14, 0x3c6440af
jl 0x180016439
mov rsp, rsp
jge 0x180016439
inc edi
call fcn.180014315
cmpsd dword [rsi], dword [rdi]
cld
sti
call 0x1e7549928
invalid
mov r14, qword [rsp + 8]
jo 0x180010817
mov dl, dl
jno 0x180010817
pushfq
jo 0x1800118f3
mov ah, ah
jno 0x1800118f3
cmp cl, 0xe9
call fcn.18000be03
retf 0x4233
add qword [rsp + 0x10], r14
jmp fcn.180013330

Function at 0x180011c0f
Capabilities:
Packed with generic packer

Disassembly:
push r13
jb 0x18000c66f
mov rbp, rbp
jae 0x18000c66f
jb 0x180014111
call fcn.180006254
invalid
shr al, 0x74
sldt word [rax]
invalid

Function at 0x180013039
Capabilities:
Packed with generic packer

Disassembly:
push r10
js 0x18000affa
nop
jns 0x18000affa

Function at 0x180015c8f
Capabilities:
Packed with generic packer

Disassembly:
movsxd r8, dword [r8]
ja 0x180006946
mov al, al
jbe 0x180006946
test dl, 0
call fcn.18000b2d1
cdq
sbb esi, dword [rsi + 0x15]
call 0x1a445d592
sbb al, ch
mov edi, 0x8500000d
movabs al, byte [0x75e8ff0348e8ed3e]
cmp edi, edi
jmp [rdi + 0x6a]
mov r8, qword [rsp + 8]
je 0x180014c24
mov bl, bl
jne 0x180014c24
lea rcx, [rsp + 0x50]
call fcn.1800075a0
xor dh, byte [rdx]
fcos
call 0x1990edfdd
outsb dx, byte [rsi]
add byte [rax], al
call fcn.180013059
sub ebp, dword [rdx + rbx*8]
cmp eax, 0xa9850fe8
and bh, bh
invalid
push r8
jg 0x18001526f
mov bx, bx
jle 0x18001526f

Function at 0x180016228
Capabilities:
Packed with generic packer

Disassembly:
push rbp
ja 0x180007e20
mov dl, dl
jbe 0x180007e20

Function at 0x180016cb3
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 8]
jp 0x180012754
mov ah, ah
jnp 0x180012754
jb 0x1800169b0
call fcn.18000db2a
fbld tbyte [rax + 0x48e8f8ac]
add esp, 0x20
call fcn.180016570
fcom qword [rbx - 5]
xor ebp, eax
mov edx, 0x148
call fcn.1800083e5
sbb byte [rax], al
mov cl, 0xc0
call 0x1a260732c
add byte [rax], al
call fcn.18000e060
nop
push rsp
xchg edx, esp
call 0x16801b223
xor dword [rbx], eax
add byte [rax], al
mov al, 0x91
fadd st(2)
call 0x18010e922
add al, ch
cmp al, byte [rbp + 0x51260000]
add dh, ah
call 0x1d5e9af7c
invalid
movsxd rdx, dword [rdx]
jb 0x1800155c6
mov r14, r14
jae 0x1800155c6
test rbx, 0
ret
mov dword [rax + 8], ebx
call fcn.180017514
adc al, 0xc9
sti
xor al, ch
pop rdi
js 0x180015f8f
mov rdx, rdx
jns 0x180015f8f
jle 0x18000c111
call fcn.180016a51
test byte [rbx], bl
invalid
push rdx
jl 0x18000eed9
mov sp, sp
jge 0x18000eed9
test r13, 0
call fcn.18000cdce
xor al, 0x61
and ebp, eax