joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400271f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rbx, r9
mov r9, rdx
xchg r9, rbx
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
test r8b, 0xf
je 0x14002723b
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xor edx, edx
test r8d, r8d
je 0x1400272c1
movdqa xmm2, xmmword [rsp]
nop
xchg rcx, rdx
movdqu xmm1, xmmword [rcx + rbx]
xchg rdx, rcx
test edx, edx
jne 0x140027268
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
xorps xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xd
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027286
aesdeclast xmm0, xmmword [r10 + 0x1e0]
xorps xmm0, xmm2
movdqa xmm2, xmm1
xchg r12, rdx
movups xmmword [r12 + r9], xmm0
xchg rdx, r12
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x14002724c
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x1400272e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rbx, r9
mov r9, rdx
xchg rbx, r9
xchg r12, r10
mov r12, rcx
xchg r10, r12
test r8b, 0xf
je 0x140027312
xor al, al
add rsp, 0x10
nop
xchg qword [rsp], rbx
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x1400273b5
movdqa xmm0, xmmword [rsp]
xchg rbp, rdi
mov qword [rsp + 0x20], rbp
xchg rbp, rdi
nop dword [rax + rax]
xchg rdx, r11
movdqu xmm1, xmmword [r11 + rbx]
xchg rdx, r11
test edx, edx
jne 0x140027354
xchg r10, rdx
movdqu xmm0, xmmword [rdx + 0x200]
xchg r10, rdx
xorps xmm0, xmm1
lea rax, [r10 + 0x10]
xorps xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0xd
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027372
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg rdx, rsi
movups xmmword [rsi + r9], xmm0
xchg rsi, rdx
nop
sub edx, 0x429dca00
add edx, 0x429dca10
cmp edx, r8d
jb 0x140027332
mov rdi, qword [rsp + 0x20]
mov al, 1
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x14002a750
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg r13, rsi
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg rdi, r9
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg r13, rsi
mov r13, rcx
xchg rsi, r13
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, rdi
mov qword [rsp + 0x40], rdi
xchg rbx, rdi
add rcx, 0x56e910a8
sub rcx, 0x56e90fe0
xchg r15, rbx
mov qword [rsp + 0x28], r15
xchg r15, rbx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.140029de0
test eax, eax
js 0x14002a7f7
cmp qword [rsp + 0x40], rbx
je 0x14002a7f7
lea eax, [rbx + 1]
jmp 0x14002a884
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002a818
mov eax, 2
jmp 0x14002a884
cmp dword [rcx + 0x74], ebx
jbe 0x14002a82b
mov eax, 3
jmp 0x14002a884
cmp byte [rdi + 2], bl
je 0x14002a83e
mov eax, 4
jmp 0x14002a884
cmp r14d, 0xa
jb 0x14002a867
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002a867
mov eax, 8
jmp 0x14002a884
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a220
jmp 0x14002a882
mov eax, ebx
xchg r9, rbx
mov r9, qword [rsp + 0x48]
xchg rbx, r9
xchg r12, rsi
mov r12, qword [rsp + 0x50]
xchg rsi, r12
xchg r13, rdi
mov r13, qword [rsp + 0x58]
xchg r13, rdi
add rsp, 0x30
push rax
push rcx
push rbx
push rcx
push rdx
push rax
push rax
push rcx
xchg qword [rsp + 0x40], r14
pop rcx
pop rax
pop rax
pop rdx
pop rcx
pop rbx
pop rcx
pop rax
add rsp, 8
ret
Function at 0x14002c3e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
xchg r12, rsi
mov r12, rcx
xchg r12, rsi
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14002c662
lea rax, [rdx - 1]
xchg r14, rdi
mov qword [rsp + 0x38], r14
xchg r14, rdi
xchg r13, rdi
mov r13, qword [rsi + 8]
xchg r13, rdi
or rax, rbx
bsr rcx, rax
xchg r14, r8
mov r14, rdi
xchg r14, r8
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14002bb20
xchg rbx, r12
mov qword [rsi + 0x38], r12
xchg rbx, r12
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
xchg rdi, rcx
mov rdi, qword [rsi + 8]
xchg rcx, rdi
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14002c5e8
mov qword [rsp + 0x30], rbp
xchg r13, rax
mov r13, rcx
xchg r13, rax
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
xchg r13, r11
mov r13, qword [rsi + 0x30]
xchg r13, r11
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 3
shl r11, 1
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x14002c4f6
xchg r15, rax
mov qword [r11], r15
xchg r15, rax
mov qword [r11 + 8], rax
jmp 0x14002c5cd
xchg r8, rdx
mov r8, qword [r11 + 8]
xchg r8, rdx
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x14002c568
xchg r14, r10
mov r14, qword [rdx]
xchg r14, r10
cmp r10, rax
je 0x14002c55f
mov r9, qword [rax + 8]
xchg rcx, r12
mov qword [r9], r12
xchg r12, rcx
xchg r8, r12
mov r12, qword [rcx + 8]
xchg r8, r12
xchg r10, rbp
mov qword [r8], rbp
xchg rbp, r10
mov rdx, qword [r10 + 8]
xchg rbp, rax
mov qword [rdx], rbp
xchg rbp, rax
mov qword [r10 + 8], r8
xchg rsi, r9
mov qword [rcx + 8], rsi
xchg r9, rsi
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002c5cd
cmp r8, rdx
je 0x14002c58b
nop
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x14002c611
cmp r8, rdx
jne 0x14002c573
xchg r10, rdx
mov rdx, qword [rax + 8]
xchg r10, rdx
xchg r8, rcx
mov qword [r10], r8
xchg r8, rcx
mov r9, qword [rcx + 8]
xchg r10, rdx
mov qword [r9], r10
xchg rdx, r10
mov r8, qword [rdx + 8]
mov qword [r8], rax
xchg r13, r9
mov qword [rdx + 8], r13
xchg r13, r9
xchg r10, r9
mov qword [rcx + 8], r9
xchg r10, r9
mov qword [rax + 8], r8
mov qword [r11], rax
xchg r8, rax
mov r8, rcx
xchg r8, rax
cmp rcx, rdi
jne 0x14002c4a8
xchg rbp, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbp
mov rdi, qword [rsp + 0x38]
xchg r10, r14
mov r10, qword [rsp + 0x40]
xchg r10, r14
xchg rsi, rbx
mov rsi, qword [rsp + 0x48]
xchg rsi, rbx
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret
xchg r12, r10
mov r12, qword [rdx]
xchg r10, r12
xchg r9, r12
mov r12, qword [rax + 8]
xchg r12, r9
mov qword [r9], rcx
xchg r14, r8
mov r14, qword [rcx + 8]
xchg r14, r8
mov qword [r8], r10
xchg rdx, r14
mov r14, qword [r10 + 8]
xchg r14, rdx
xchg rcx, rax
mov qword [rdx], rcx
xchg rcx, rax
xchg r8, rbx
mov qword [r10 + 8], rbx
xchg rbx, r8
xchg r9, r11
mov qword [rcx + 8], r11
xchg r9, r11
mov qword [rax + 8], rdx
jmp 0x14002c5cd
lea rcx, [0x140001530]
call fcn.14014f920
int3
Function at 0x14005c9c0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rcx
mov r9, r10
xchg rcx, r10
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005ca3e
cmp byte [rcx], 0
je 0x14005ca3e
test rdx, rdx
jne 0x14005c9f4
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005c9e6
test rdx, rdx
je 0x14005ca3b
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
xor rcx, rax
shr r8d, 6
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005ca06
not r8d
mov eax, r8d
ret

Function at 0x14005fe90
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, qword [rcx + 0x10]
xchg rbp, rax
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x14005fead
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14005fee2
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005fedf
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005febb
xchg r8, rax
mov r8, qword [rdx + 0x10]
xchg r8, rax
mov byte [rdx], 1
ret

Function at 0x14005fef0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r11, rcx
mov rdx, r11
xchg rcx, r11
test rax, rax
jne 0x14005ff09
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14005ff39
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005ff36
xchg r8, rcx
mov r8, qword [rdx + 0x10]
xchg r8, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005ff17
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret

Function at 0x14005ffd0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg rcx, r13
mov rdx, r13
xchg rcx, r13
test rax, rax
jne 0x14005ffe7
ret
cmp byte [rcx], 0
jne 0x14006001d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14006001a
nop dword [rax + rax]
xchg r14, rax
mov r14, qword [rdx + 0x10]
xchg r14, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005fffa
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret
Function at 0x1400d4e90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
push rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
push r9
mov qword [rsp], r15
sub rsp, 0x30
xchg r11, r14
mov r11, r8
xchg r11, r14
xchg r12, rdx
mov rdx, r12
xchg rdx, r12
test rdx, rdx
je 0x1400d50ab
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d50ab
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d50ab
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d50ab
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d50a0
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 1
shl rbx, 1
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d5092
mov ecx, 0x60
call fcn.14014ecd8
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d4fb9
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
mov qword [rsp + 0x88], rax
mov edx, dword [rax]
add rdx, r12
xchg r14, rcx
mov r14, rsi
xchg r14, rcx
call fcn.1400d9bb0
lea rax, [0x140003e48]
mov qword [rsi], rax
jmp 0x1400d4fd7
xchg r14, rsi
mov r14, r15
xchg rsi, r14
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
mov qword [rsp + 0x88], rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.14014ed1c
xchg r10, rax
mov rbx, r10
xchg r10, rax
test rax, rax
je 0x1400d5004
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.14014fd56
jmp 0x1400d5006
xor ebx, ebx
mov r8d, dword [r15]
mov rax, qword [rsp + 0x88]
mov edx, dword [rax]
mov r12, qword [rsp + 0x78]
add rdx, r12
xchg rbp, rcx
mov rbp, rbx
xchg rbp, rcx
call fcn.14014fd80
mov rax, qword [rsi]
xchg rbx, r15
mov rdx, r15
xchg rbx, r15
xchg rsi, r13
mov rcx, r13
xchg r13, rsi
call qword [rax + 0x10]
mov qword [rsp + 0x88], rsi
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x1400d5076
xchg r13, rsi
mov qword [rdx], r13
xchg rsi, r13
nop
sub qword [r14 + 8], 0x3babe9ca
add qword [r14 + 8], 0x3babe9d2
jmp 0x1400d508c
lea r8, [rsp + 0x88]
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
call fcn.1400d4250
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d4f37
test r13d, r13d
setne al
jmp 0x1400d50ad
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
push rax
xchg qword [rsp + 8], r15
pop rax
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
push rax
push rax
push rbx
push rcx
push rbx
push rcx
xchg qword [rsp + 0x30], r13
add rsp, 0x38
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret
Function at 0x1400d5400
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xchg rdi, r9
mov qword [rsp + 0x20], rdi
xchg r9, rdi
mov qword [rsp + 0x18], r8
xchg rcx, r10
mov qword [rsp + 8], r10
xchg rcx, r10
push rsi
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r13
mov qword [rsp], r15
sub rsp, 0x58
xchg r15, r9
mov rbx, r15
xchg r9, r15
xchg rsi, r14
mov r14, rdx
xchg rsi, r14
mov r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x1400d547a
mov eax, ebp
jmp 0x1400d54a5
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d5494
xchg rdi, rax
mov rdi, rbp
xchg rdi, rax
jmp 0x1400d54a5
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d55cb
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d55cb
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d55a1
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d5595
mov qword [rsp + 0xa8], rdx
xchg r9, rcx
mov qword [rsp + 0x30], r9
xchg r9, rcx
mov qword [rsp + 0x38], r8
xchg rsi, r9
mov qword [rsp + 0x40], rsi
xchg r9, rsi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d5642
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
lea rdx, [rsp + 0xa8]
xchg rcx, rdx
mov qword [rsp + 0x20], rcx
xchg rcx, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d55a1
xchg r8, r13
mov r13, qword [rsp + 0xb0]
xchg r13, r8
xchg rsi, r9
mov rsi, qword [rsp + 0xa0]
xchg rsi, r9
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d54f2
xchg r15, rcx
mov r15, qword [rbx + 0x38]
xchg r15, rcx
test rcx, rcx
je 0x1400d55c4
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 1
jmp 0x1400d55ea
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d55e8
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
push rbx
push rdx
push rdx
push rcx
push rdx
push rcx
xchg qword [rsp + 0x30], r15
add rsp, 0x38
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rcx
xchg qword [rsp + 8], r13
pop rcx
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
xchg qword [rsp + 8], rsi
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
mov rbx, qword [rsp]
add rsp, 8
ret
call fcn.14014fb0c
nop
int3
Function at 0x1400d9ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, r9
mov r9, rdx
xchg r9, r11
mov r10, rcx
test rdx, rdx
je 0x1400d9d1e
xchg r11, rbx
mov qword [rsp], r11
xchg r11, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400d9d11
movzx eax, byte [r10]
test bl, bl
je 0x1400d9cf3
lea rcx, [r9 - 1]
xchg r9, r15
mov rdx, r15
xchg r9, r15
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400d9ce2
jmp 0x1400d9d11
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400d9d02
inc r10
sub r11, 1
jne 0x1400d9cc4
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400dbd50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg rdi, r13
mov qword [rsp + 0x18], r13
xchg r13, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg r8, rbx
mov rdi, rbx
xchg rbx, r8
xchg r12, rbx
mov r12, rdx
xchg rbx, r12
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
test r8, r8
je 0x1400dbf03
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbe90
mov edx, 0x3e
xor ecx, ecx
call fcn.1400dc5e0
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbed4
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400dbda0
xchg r12, rbx
mov qword [rsi], r12
xchg rbx, r12
jmp 0x1400dbf06
mov qword [rcx], rdx
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
push rdx
push rcx
push rbx
push rbx
push rcx
push rax
push rax
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
ret
Function at 0x1400dc8a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg rbx, r9
mov rbx, qword [rcx]
xchg r9, rbx
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400dc90f
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400dc8ca
mov ecx, dword [r9]
jmp 0x1400dc9fe
cmp ecx, 0x4e0
jb 0x1400dc9fe
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc92e
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc982
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 9
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0xf
shr eax, 2
shr eax, 1
xor eax, edx
add rsp, 8
ret
Function at 0x1401d1b78
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x140cd9f30
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140bd828e
Function at 0x5dfd7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r8d, dword [rsp + 5]
jmp 0x5dfdab
mov esi, esp
neg rsi
js 0x5dfdf0
mov r9, 0xfffffffff848beb5
jmp 0x5dfdda
mov r13w, 0x8da7
mov esi, r15d
setns r13b
jmp 0x5dfe67
mov r9, 0xfffffffff848beb5
mov r13w, 0x8da7
mov esi, r15d
setns r13b
mov rdi, qword [rsp]
jmp 0x5dfe3b
mov dil, sil
lea rbx, [rcx*8]
setge cl
jmp 0x5dfe83
sub rsp, 0xc
mov word [rsp + 5], cx
lea rsp, [rsp + 4]
lea rsp, [rsp + 8]
add r15d, 0xf5fc321
jmp 0x5dfe25
mov rdi, qword [rsp]
jmp 0x5dfe3b
mov rcx, 0xffffffffbea786b8
cpuid
jmp 0x5dfe98
rcl r11b, 3
jne 0x5dfe6d
mov rcx, 0xffffffffbea786b8
cpuid
jmp 0x5dfe98
neg r15d
rdtsc
setne r11b
lea r14, [r14 + riz + 0x76f5da8a]
sete r8b
jmp 0x5dfee2
ror r15d, 0
mov edx, dword [rsp]
mov r13, rbx
rol r11w, 9
ja 0x5dff0e
jbe 0x5dfef8
movsd dword [rdi], dword [rsi]
and byte [rsi - 0x226cdf2f], dh
sub al, 0x3f
mov r9b, 0xef
bswap rbx
mov dl, spl
lea rsi, [rdx + riz - 0x1cde]
bswap r11
jmp 0x5dfec6
rdtsc
xchg r13b, r14b
mov r14b, r12b
jmp 0x5dffdb
rdtsc
xchg r13b, r14b
mov r14b, r12b
bsf rcx, rcx
neg esi
jmp 0x5dff86
mov edi, dword [rsp]
mov bl, byte [rsp]
mov r8w, word [rsp]
mov r8w, word [rsp]
jmp 0x5dffb0
xor r15d, 0x25b81549
lea rax, [rbp + riz]
btc r13d, esp
jbe 0x5dff59
ja 0x5dff3c
bsf rcx, rcx
neg esi
jmp 0x5dff86

Function at 0x70568b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [rsp + 0xd]
mov r9d, r12d
lea r9, [r15 + riz + 0xf6e5]
jmp 0x70564f
xchg byte [rsp + 4], cl
setp r12b
lea r14, [rax + r14]
xchg dword [rsp + 1], r12d
mov byte [rsp + 9], r14b
mov rsi, qword [rsp + 9]
jmp 0x7055f7
mov r11b, byte [rsp + 0xc]
xchg r14d, r12d
bswap r12d
mov word [rsp + 9], r12w
pop rsi
mov r13, rbp
jmp 0x705666
xchg dword [rsp + 0xc], r14d
mov rbp, rbx
bswap r11d
mov rcx, rbx
mov r12w, 0x533e
rdtsc
jmp 0x70562a
lea r11, [rsi + riz]
mov rcx, rsi
lea rsp, [rsp + 4]
bswap ecx
bswap eax
not r13
jmp 0x7056ba
mov ax, 0x9bce
mov r13w, word [rsp + 2]
mov byte [rsp + 0x12], r8b
mov qword [rsp + 8], rcx
jmp 0x70560d
mov r12b, r8b
mov di, r11w
mov r14d, 0x3ae1eae9
jmp 0x7056f6
xchg dx, si
bswap edx
mov sil, byte [rsp]
mov r13, qword [rsp + 8]
mov rdx, qword [rsp]
jmp 0x7056a4
mov r14w, 0x1b84
lea r14, [r8 + riz - 0xae]
mov r14, qword [rsp + 0x10]
mov edi, r12d
lea rcx, [rcx + riz + 0x64]
mov rdx, qword [rsp]
jmp 0x7056e0
Function at 0x707dea
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc r8d, esi
sbb r11b, r11b
dec r9w
jmp 0x707e36
xchg r10, r8
xchg r10b, dl
dec bp
std
mov r15w, cx
jmp 0x707f7f
mov sil, byte [rsp + 0x1d]
shl rbp, 9
push qword [rsp + 7]
lea rsp, [rsp + 0x25]
setl r15b
mov r11b, cl
jmp 0x707e20
lea rdx, [r14 + r14]
mov r9b, 0x6e
inc r9b
jmp 0x707ede
clc
mov r9, qword [rsp]
lea rsi, [rsi + rdi]
bsf bp, bx
neg r14
neg ax
jmp 0x707e7d
mov r10, r9
mov ebp, r15d
bsr r8d, r15d
lea r8, [r9 + r10]
jmp 0x707f53
bswap ebp
not rax
lea r15, [rdx + riz + 0x8ae2]
lea rbp, [r9 + riz - 0x3a]
bswap eax
mov r14w, word [rsp]
jmp 0x707ea8
lea r11, [rbp*8]
add rsp, 0
mov r14, qword [rsp]
shl bp, 0xb
inc r14
mov r8b, al
jmp 0x707ebe
neg r15
clc
mov r9d, esi
or r9, rax
cld
jmp 0x707f27
xchg esi, r15d
std
mov dx, 0x9220
rdtsc
mov r15, 0x6589025e
lea rsp, [rsp]
jmp 0x707efa
mov r8d, 0x21549670
setae r15b
shr r10d, 0
rdtsc
mov rdx, 0x4a4eb8db
xchg ebp, r15d
jmp 0x707fb2
and eax, r13d
mov byte [rsp], dl
add rsp, 0
mov r8w, word [rsp]
mov dx, 0x360a
bswap r10
jmp 0x707f10
mov byte [rsp], r15b
cmp dx, 0xfc3f
xchg byte [rsp], al
mov r8w, 0xbaa2
mov byte [rsp], bl
setge r15b
jmp 0x707e93
bsf r11w, r8w
bswap r10
xchg sil, r15b
mov r11d, dword [rsp + 6]
jmp 0x708aab
xchg byte [rsp], r10b
bswap r10
pushfq
rcl r8, cl
pop r14w
rcr si, 7
jmp 0x707f9c
add rsp, 0xd
neg bpl
pop r9w
call fcn.0070811c
shr al, 7
xchg byte [rsp + 6], al
mov r8, 0x58ad18b6
mov r15, qword [rsp + 8]
lea r10, [rsi + r14]
not sil
jmp 0x70814d
lea rsp, [rsp + 2]
setge dl
mov byte [rsp + 1], r9b
sub rsp, 9
adc r11w, 0xc14c
sub rsp, 7
jmp 0x708308