joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r10d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov ebx, r8d
mov r12, rdx
mov r11, rcx
test r10d, r10d
je 0x1400239c7
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov ebp, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r13, eax
mov eax, esi
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg ebp
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x1400239ac
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 4]
xor byte [rdx], al
add rdx, rsi
dec rdi
jne 0x140023988
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x1400239c0
add ecx, ebp
jmp 0x1400239c2
add ecx, ebx
test r10d, r10d
jne 0x14002395c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140024768
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r11d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov edi, r8d
mov r12, rdx
mov rbx, rcx
test r11d, r11d
je 0x140024831
mov eax, dword [rsp + 0x50]
mov ecx, r8d
mov ebp, r8d
lea r10d, [rax + rax*2]
mov eax, esi
imul ecx, dword [rsp + 0x58]
movsxd r13, r10d
imul eax, r9d
mov r9d, dword [rsp + 0x48]
movsxd r10, eax
mov qword [rsp + 0x28], r10
neg ebp
mov eax, dword [rbx + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [rbx + 0x150]
add rdx, r10
cmp dword [rsp + 0x60], 0
jle 0x140024817
mov r10d, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 3]
xor byte [rdx], al
add rdx, rsi
dec r10
jne 0x1400247f3
mov r10, qword [rsp + 0x28]
dec r11d
inc r9d
cmp dword [rbx + 0x174], 0
jne 0x14002482a
add ecx, ebp
jmp 0x14002482c
add ecx, edi
test r11d, r11d
jne 0x1400247c7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002d90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140009760
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140009760
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f0a4]
mov rbx, rcx
test esi, esi
jle 0x140002f30
mov rax, qword [0x14000f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002ed5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002e30
mov rcx, rbx
call fcn.140003850
mov rdi, rax
test rax, rax
je 0x140002f52
mov rax, qword [0x14000f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003990
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002f37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002ece
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002ee0
add dword [0x14000f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002d90
nop dword [rax]
xor esi, esi
jmp 0x140002e58
mov rax, qword [0x14000f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002d90
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002d90
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400034c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f0e0]
test rbx, rbx
je 0x14000351c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003513
test rsi, rsi
je 0x140003513
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400034f8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003850
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000be20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003870
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003878
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003870
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400038cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400038c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003870
add rax, 0x28
cmp rax, r9
jne 0x1400038b0
xor eax, eax
ret

Function at 0x1400038d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000be20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400038ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400038f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400038ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003990
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000be20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400039af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400039b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002db0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004ad0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004ad0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000a0a4]
mov rbx, rcx
test esi, esi
jle 0x140002f50
mov rax, qword [0x14000a0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002e6b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002ef5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002e50
mov rcx, rbx
call fcn.140003870
mov rdi, rax
test rax, rax
je 0x140002f72
mov rax, qword [0x14000a0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400039b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000a0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002f57
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002eee
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002f00
add dword [0x14000a0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000a0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002eee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002db0
nop dword [rax]
xor esi, esi
jmp 0x140002e78
mov rax, qword [0x14000a0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002db0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002db0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400034e0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000a0e0]
test rbx, rbx
je 0x14000353c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003533
test rsi, rsi
je 0x140003533
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003518
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003870
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006b30]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003890
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003898
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003890
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400038ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400038e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003890
add rax, 0x28
cmp rax, r9
jne 0x1400038d0
xor eax, eax
ret

Function at 0x1400038f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b30]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000390f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003918
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000390f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400039b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006b30]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400039cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400039d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400113de
Capabilities:
Terminate process

Disassembly:
jmp 0x14001af60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114d8
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ba90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001bab0
xor al, al
jmp 0x14001bb31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001bac3
xor al, al
jmp 0x14001bb31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001baed
xor al, al
jmp 0x14001bb31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001bb01
xor al, al
jmp 0x14001bb31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001bb13
xor al, al
jmp 0x14001bb31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001bb2f
xor al, al
jmp 0x14001bb31
mov al, 1
add rsp, 0x38
ret
Function at 0x140001022
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x5f379977
xor rax, rsp
mov qword [rbp + 0x70], rax
xchg rsp, rax
test dword [rax + 1], ebx
add byte [rax], al
xor esi, esi
mov qword [rbp + 0x60], rax
mov rbx, rdx
mov rax, qword [rbp + 0x150]
mov r11, rcx
push r8
or rcx, 0xffffffffffffffff
mov rsp, qword [rax]
add qword [rax], rax
add byte [rbp + rcx*4 - 0x39], al
add cl, byte [rcx + 0x11]
clc
invalid

Function at 0x140004fc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [0xc948bd89], rdi
insb byte [rdi], dx
and al, 0x10
mov qword [rbx + rdi*2 + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, qword [0x14037c660]
invalid

Function at 0x1400103e0
Capabilities:
Encode data using xor

Disassembly:
mov cl, reloc.SHELL32.dll_DAD_ShowDragImage
cmp dword [rcx], 0x48
je 0x14001040d
pop rsp
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push rsi
push r15
movabs rcx, 0x9f8a4560ec8348ec
mov r9d, dword [rbp - 0x3d]
mov ebp, dword [rbx]
xor r9d, r9d
xor r15d, dword [r14 + 0x3d4ede8]
mov esi, 0x3d4ede8
wait
jp 0x1400103f5
xor esp, esp
test eax, eax
invalid

Function at 0x1400287c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10, qword [rcx + 8]
out dx, eax
ror byte [rbp + rdi*4 + 0x44], 0x24
invalid

Function at 0x14003ba9c
Capabilities:
Encode data using xor

Disassembly:
int3
push rbx
or qword [rsi + 0x1bb20], 0
movsd dword [rdi], dword [rsi]
mov dword [rsp + 0x30], ebx
test rcx, rcx
xor byte [rax - 0x7b], cl
leave
je 0x14003baaa
lea rdx, [rbp + rcx - 0x4d]
call qword [0xc22f9da8]
nop dword [rbx + riz*8]
pushfq
pop rsp
and al, 0x30
invalid
je 0x14003ba9a
mov al, bl
movabs rsp, 0xebdb32ccc35b20c4
int3

Function at 0x140045618
Capabilities:
Encode data using xor

Disassembly:
mov qword [rbp + rsi + 0x6c], rbx
mov qword [rbx + rdx*2 + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x67
leave
movzx ebp, r8b
lea rax, [0x14037d0a0]
movabs eax, dword [0x3379c83d8d4816]
mov r14d, edx
divps xmm7, xmm0
mov r15, rcx
mov r10d, dword [rdi]
mov eax, dword [r15 + 0x24]
lahf
cmp al, 1
call 0x188c4887d
mov ecx, dword [rdx - 0x2ab7afdc]
insb byte [rdi], dx
and al, 0x72
mov rsi, qword [rsp - 0x53]
add rsp, 0x30
out 0x5f, al
pop r14
pop rdi
or eax, 0xdaf641cc
add dword [rdi], ecx
test dword [rdx - 0x74ffee39], ebp
sbb eax, 0x1d7802
invalid

Function at 0x140053014
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x18806281b], esi
mov esi, eax
pop rax
add dword [rax], eax
add byte [rax - 0x75], cl
xchg rdi, rax
mov r12, qword [rcx + r15*8]
test byte [rbp - 0x7d7bf01c], 0
movabs byte [0x48b49f075f8ee00], al
ror byte [rax + 0x33], 1
invalid

Function at 0x14008db74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
pop rsp
and al, 8
mov esp, 0x18246e89
push rdi
cqo
in al, dx
xor byte [rbx - 2], bh
mov r8, rdx
mov rdi, rcx
mov eax, 0xb07827a
cmp rsp, qword [rdi + rcx - 0x79]
xchg edi, eax
add byte [rax], al
scasb al, byte [rdi]
mov rcx, qword [rdi + 0x484833be]
jbe 0x14008db76
jbe 0x140c4dbbe
mov eax, 2
mov r10d, 0x80070216
add rax, 0xffffffffc88b4ce1
test qword [rbp + 0xf], rsi
test ebp, ecx
invalid
Function at 0x140092484
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp - 0x4d], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx - 0x24fffee6]
invalid

Function at 0x1400a2a0c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, dword [rdx + 0x56]
push rdi
pop rsp
sub esp, 0x40
mov rsi, rsi
xchg esi, eax
nop
stosd dword [rdi], eax
or al, 0
mov rsi, qword [rbx + 0xf8]
xor ebp, ebp
rol dl, 0x8d
push rsp
je 0x1400a2a8e
mov rbx, rbp
add al, 0x15
cmp dword [rcx + 0x25], esi
fisttp qword [rax - 0x7b]
sal byte [rcx + rdi + 0x48], 0x83
jrcxz 0x1400a2a64
cmp byte [rax], al
sar rcx, 0x8d
push 0x24541148
invalid
enter 0xffffffffffff8948, 0x4c
and al, 0x30
xor byte [rbx + rcx*4 - 0x3a], cl
lea rcx, [rsp + 0x70]
mov qword [rbp + riz*2 + 0x28], rcx
xor edi, esp
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x20], ebx
sub edx, dword [sym.imp.ntdll.dll_RtlVirtualUnwind]
inc edi
jo 0x1400a2a4e
invalid
sbb byte [rdi + 0x53109a89], dh
rcl byte [rdi - 0x4f]
push rsi
add rax, 0x38
mov r14, r9
mov rbx, r10
fiadd dword [rdi]
mov byte [rax + 0x51], Ordinal_174
mov rdi, rdx
xor ch, byte [rsi + 0x348029f]
stc
ror byte [rcx - 0x7462f788], 1
ret

Function at 0x1400a43c1
Capabilities:
Encode data using xor

Disassembly:
mov dword [rdi], ecx
xchg dword [rbx + rdx*8 + 0x32], eax
invalid
add byte [rbx], al
mov qword [rsp + riz*8 - 0x6e], rcx
loope 0x1400a4351
xchg ebx, eax
mov cl, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x18], r8
invalid

Function at 0x1400afba8
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [rax + 0x48018b48]
mov eax, dword [rax + 0x10]
call qword [0x1402f9ba7]
cmp al, 0x8b
pop rsp
and al, 0x30
movabs eax, dword [0xccc35f20c48348c7]
invalid
xor al, 0x9c
lodsb al, byte [rsi]
pop rsp
and al, 8
mov qword [rsp + 0x10], rbp
je 0x1400afba6
sbb byte [rdi + 0x48], dl
sub esp, 0x20
loopne 0x1400afb84
and cl, byte [rax - 0x75]
invalid

Function at 0x1400b04f4
Capabilities:
Encode data using xor

Disassembly:
adc rbx, qword [rsp + 0x18]
test dword [rcx + 0x5cdb243b], ecx
and qword [rax + riz + 0x2a], 0xfffffffffffffffe
mov rbx, rdx
mov dword [rdx], eax
mov rsi, rcx
and eax, 0xfffffff4
cmp al, 3
punpckhbw mm4, qword [rax - 0xaff8500]
cmp eax, 0x2ccab1
test eax, esp
jne 0x1400b0530
add al, 0xd5
or eax, 0x2cca17
call 0xcf0245fc
mov edi, eax
lea r8, [rbp + rcx*2 + 0x30]
jg 0x1400b058c
and al, 0x8a
call 0x14b0b092e
mov eax, dword [rbx]
cmp dword [rsp + 0x30], 0
mov r9d, eax
mov dword [rbx], eax
mov edx, eax
je 0x1400b057d
test al, 1
jne 0x1400b059b
xor ecx, dword [rdi]
and al, 0x38
and edx, 0x940278
push rbp
invalid
add cl, byte [rcx - 0x3e74beed]
invalid
out dx, al
sbb byte [rbx + rcx*4 - 0x31], al
invalid
add byte [rax], al
add byte [rax - 0x75], cl
adc ebp, dword [rbx - 0x4eeb2]
sbb al, byte [rbx]
invalid
Function at 0x1401b7590
Capabilities:
Encode data using xor

Disassembly:
mov dword [rax + 0x20], edi
push rbp
push r12
and byte [r9 - 0x28], al
push r15
push rsi
fisubr dword [rax - 0x208]
outsb dx, byte [rsi]
xor al, 0x49
loopne 0x1401b7546
add byte [rax], al
mov rax, qword [0x14037a9d8]
push rcx
invalid
add byte [rdx - 0x3f7a4c75], dh
jg 0x1401b759f
jp 0x1401b754f
add dword [rax], eax
add bl, ch
invalid
jno 0x1401b752c
mov gs, word [rax + 0x48000007]
mov ebx, 0x45f8201
jo 0x1401b75ae
add byte [rax - 0x73], cl
and al, al
mov rax, qword [rax + 0x28]
call qword [0x140959988]
mov ebx, eax
test edx, ebx
jns 0x1401b75ca
mov edx, 0x15a
jmp 0x1401b760f
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x13]
lea r12, [r14 + 0x3d53073d]
mov rcx, r12
call fcn.14000b654
outsd dx, dword [rsi]
in eax, 0xff
lea edx, ds:[rbp - 0x40]
nop
in al, dx
add ebp, eax
xor esp, ebp
sar bh, 1
mov r8d, r12d
push rdi
mov edx, dword [rsp + 0x60]
cmp cl, bl
mov rax, rdi
call qword [0x1402f9c88]
imul ebx, eax, 0xffffff85
sar byte [rcx + 0x20], 0x9b
jl 0x1401b75e1
shr edi, 1
out dx, eax
add byte [rax - 0x75], cl
lea ecx, [rax]
add al, byte [rax]
add byte [rdx], dh
enter 0xffffffffffff8d4c, 5
sbb dword [0x14503763c], esi
sbb al, ch
pop rdi
jmp 0x1401b7ae4
enter 0xffffffffffff8b48, 0xffffffffffffff8d
or byte [rdx], al
adc byte [rax], al
call 0x13f248e2c
jmp fcn.1401b7ace
pop rax
stosd dword [rdi], eax
and al, 0x38
call fcn.14000b654
mov eax, ebx
mov rcx, qword [rbp + 0x1001d0]
xor rcx, rsp
call fcn.1400a2770
jns 0x1401b7a8e
pushfq
and al, 0xe0
ret

Function at 0x1401d35d0
Capabilities:
Encode data using xor

Disassembly:
sub edx, dword [rbp + 0x53]
mov edi, 0x41564157
push rdi
movsb byte [rdi], byte [rsi]
lea ebp, [rsp - 0x890168]
or qword [rcx], 0x300c068
mov rax, qword [0x140378dd8]
xor rax, rsp
and dword [rbp - 0x7b], ecx
push rax
add dword [rax], eax
xchg esi, eax
mov edi, r9d
mov rbx, qword [r12 + rcx*2 - 0x74b70d75]
int1
mov qword [rsp + 0x30], rcx
invalid

Function at 0x1401ddb98
Capabilities:
Encode data using xor

Disassembly:
push rsp
and al, 0x38
push 0x278e2
add byte [rax], bh
rol byte [rbx + 0x1389deca], 1
mov r12, qword [rbx + 0x2e08341]
jne 0x1401ddbc4
mov ecx, edx
mov ecx, dword [rdi + rbx*2 + 0x5d]
and ecx, 0x900100
xor edx, ecx
retfq 0xffffffffffff8902
mov eax, r9d
stosb byte [rdi], al
cmpxchg dword [rsi], edx
fdivr dword [rax + 0x75c08545]
sbb byte [rdi + rbx*4 - 0x31], al
movabs rcx, 0x3b8410019f36466
add byte [rdx], ah
mov rdx, rsi
movsb byte [rdi], byte [rsi]
or cl, byte [rax + rbp*8 + 0x103f692]
jne 0x1401ddbea
lahf
iretd
test byte [rbx], 1
cmp eax, dword [rbx]
mov eax, dword [rbx]
xor ebx, dword [rsp - 0x55]
and eax, 0xce9b78
xor dword [rbx], eax
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
ja 0x1401ddbd0
mov cl, reloc.SHELL32.dll_Ordinal_95
ret
Function at 0x140223cec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rdx], rcx
and al, 0x18
push rdi
sub rsp, 0x30
mov rdi, rcx
rcr qword [rbx], 0x38
add dword [rax], eax
add byte [rsi], cl
test edi, ebp
sbb al, 0xc
call qword [0xeb301e50]
movzx esp, word [rax]
add dh, ah
mov ebx, dword [rdi + 0x140140]
add dword [rax + rax], edx
xor dword [rbx + 0x3ea1e8cf], ecx
cmpsb byte [rsi], byte [rdi]
call qword [rdi]
mov ecx, dword [rdi - 0x3fff8829]
jbe fcn.140223cec
mov rdx, rax
sbb bh, bh
adc eax, 0xd44d3
nop dword [rax + rax]
mov qword [rdi - 0x5092b1c8], rax
fistp dword [rdi + 0x74]
jb 0x140223d14
xor ecx, ecx
lea rdi, [rbp + 0x24]
mov rbx, rdx
and al, 0x28
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x8e0970
lea ebx, [r9 + 0xa]
mov r8d, ebx
sub byte [sym.imp.UxTheme.dll_GetThemeMetric], dl
nop dword [rsi + rbx*2 - 0x42]
test eax, eax
xchg ebp, eax
ror byte [r11 + 0x1388f], cl
pop rsi
lea rax, [rsp + rcx*4 + 0x48]
in al, dx
mov dword [rcx + 0x24], esi
mov cs, r9d
mov r8d, ebx
invalid

Function at 0x140225864
Capabilities:
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
push rbx
push 0xffffffffffffffbb
in al, dx
and byte [rbx], dh
fisttp dword [rax + 0x39]
sbb eax, 0x15f633
jne 0x1402258e8
push rsp
mov eax, dword [0x14037c5e8]
lea rdx, [0x140226de0]
xor r9d, r9d
lea ecx, [rbx + 0xd]
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowsHookExW]
nop dword [rcx + rsi*8]
lea ecx, [rcx + 0xc89485b]
xchg ecx, eax
jne 0x1402258b3
add cl, ch
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
setns byte [rax + rax]
sar byte [r8 + 0x38], 0x8d
pop r12
mov esp, 0x253f3228
or eax, 0x441f2e00
add byte [rax], al
test ax, ax
js 0x1402258e8
invalid
add rsp, 0x20
pop rbx
ret

Function at 0x14023fef8
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x55
invalid
adc rax, 0x4c20925c
mov dword [rsp + 0x18], eax
mov qword [rax + rdi*2 + 0x10], rdx
push rbp
push rsi
push rdi
wait
push r13
push r14
xor byte [r9 - 0x7d], dl
in al, dx
xor byte [rax - 0x7d], cl
test al, 0xff
mov r13, rdx
mov r9, qword [rbx + rsi - 0x1e74b30a]
inc r14
adc eax, dword [rdx + 0x39]
xor al, 0x72
jne 0x14023ff25
out dx, eax
mov edi, ebx
or eax, 0x438e35ff
cmp dword [rax + rdi*2], esi
jne 0x14023ff32
mov r8d, 0xa
out 0x15, al
out 0xc2, eax
andps xmm1, xmmword [rax - 0x73]
or eax, 0xf2d08
mov rsi, qword [r15]
call 0x13fd93954
test eax, eax
outsd dx, dword [rsi]
adc edi, dword [rdi + rdi*2 + 0x48ffa47c]
inc ebx
inc rbx
cmp word [rcx + rax*8], dx
jne 0x14023ff61
jmp 0x1402400c7
add dl, byte [r14 + 2]
mov ebp, 0xc0000023
add edx, dword [r11 + 0x48]
lea esi, [rdx + 1]
pop rdx
add edx, ecx
jmp 0x14023813e