joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ef0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14003b060]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd rbx, edx
lea r8, [0x140036360]
mov rdx, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.14000df6c
test eax, eax
jne 0x140001f7b
cmp qword [rsp + 0x20], 0
je 0x140001f7b
mov rcx, rbx
mov qword [rsp + 0x50], rdi
call fcn.14000eb88
mov r9, qword [rsp + 0x20]
mov r8, rbx
mov edx, 1
mov rcx, rax
mov rdi, rax
call fcn.14000e5fc
mov rcx, qword [rsp + 0x20]
call fcn.14000c394
mov rax, rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140005810
add rsp, 0x30
pop rbx
ret
mov ecx, 0xffffffff
call fcn.14000bc84
int3

Function at 0x1400022d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14003b060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0x13]
lea rdx, str.domainserviceupdate
lea rcx, [rsp + 0x20]
call fcn.140003d70
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
movsxd rbx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000236c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002367
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000247c
call fcn.140005830
lea rcx, [rsp + 0x20]
call fcn.140001f90
cmp qword [rax + 0x18], 0x10
jb 0x140002380
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call fcn.140001ef0
mov rsi, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400023ca
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002476
call fcn.140005830
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rcx, str.prepare_to_repair_domain_service_update_setting
call fcn.140001150
mov rdi, rbx
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140007660
lea rcx, str.repairing_stage_1
call fcn.140001150
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbx
lea rcx, str.repairing_finished
call fcn.140001150
mov r8d, 0x8000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005810
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.14000eb10
int3
call fcn.14000eb10
int3
Function at 0x140002890
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400028b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000292c
mov rdi, r14
mov rcx, rbx
call fcn.140003910
test rax, rax
jle 0x140002904
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140007660
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000291c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140002924
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400028c6
sub r14, rdi
jmp 0x140002a19
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140002943
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002945
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000297a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140007660
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140002a16
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400029b5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400029f1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14000e5fc
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x140002a2f
cmp rbp, rax
ja 0x1400029c1
mov r8, rdi
test rdi, rdi
je 0x140002a16
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14000e5fc
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x140002a19
Function at 0x140002e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003b060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002e2d
xor eax, eax
jmp 0x140002f73
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e67
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002e67
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002f73
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002f66
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002eaa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002eb9
movsx ecx, dil
jmp 0x140002f0d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x140002f27
sub eax, 1
je 0x140002f27
cmp eax, 2
jne 0x140002f66
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000bca8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f6b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002f54
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000de24
cmp rsi, rax
jne 0x140002f66
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002f6b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140005810
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000bc84
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000bb17
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bb17
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bb17
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bb17
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bb17
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bb17
cmp dword [rcx + 0xf8], 0
je 0x14000bb17
mov ecx, ebx
call fcn.14000bbb8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000b9a8
cmp dword [rbp + 0x20], 0
je 0x14000bb64
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000bb6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000bab0
Function at 0x140001c80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140250260]
mov edx, dword [0x140250264]
xor edx, 0x937ba9c
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, 0x89f23964
xor ecx, 0x10847347
xor edx, edx
div ecx
mov ecx, eax
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x7eae1556
xor eax, 0x1f814e68
and eax, edx
mov edx, 0xf38a2960
xor edx, 0x92a5725e
mov r8d, 0x55d6d742
xor r8d, 0xaa2928bd
xor edx, r8d
and ecx, edx
or eax, ecx
and eax, 0x2708d0d
mov ecx, 0x4366892e
xor ecx, 0x7bbf75f4
cmp eax, ecx
je 0x140001d90
mov eax, dword [0x140250268]
mov edx, dword [0x14025026c]
mov ecx, eax
xor ecx, edx
mov r8d, 0x9af54b76
xor r8d, 0x650ab489
xor ecx, r8d
or eax, edx
and eax, ecx
mov edx, eax
xor edx, 0x497890f8
mov ecx, 0xe7e433a1
xor ecx, 0x181bcc5e
xor edx, ecx
and edx, 0x497890f8
mov ecx, 0x2d7f2044
xor ecx, 0x2d7f2046
imul ecx, edx
sub ecx, 0x497890f8
sub eax, ecx
mov ecx, 0xb396bed7
xor ecx, 0xe9d659a6
or eax, ecx
mov ecx, 0xb267d39
xor ecx, 0xf5adbf94
and eax, ecx
mov dword [rsp + 0x24], eax
mov rax, qword [0x140269990]
mov ecx, dword [rax]
call fcn.140007b33
mov eax, dword [rsp + 0x24]
cmp eax, 0x65e4e880
jb 0x140001cfb
add rsp, 0x28
ret
mov edi, edx
ret
Function at 0x140007810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x3f], dl
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140250490]
mov r8d, dword [0x140250494]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0x2b5076d8
xor ecx, 0xd4af8927
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xf628c0c6
xor edx, edx
div ecx
mov ecx, 0x99ade2c2
xor edx, edx
div ecx
imul eax, eax, 0xd5b0e90a
cmp eax, 0xbfa4e29b
jae 0x140007aae
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140250498]
mov r9d, dword [0x14025049c]
mov r8d, r9d
xor r8d, 0xffffffff
mov edx, eax
and edx, r8d
mov r8d, eax
xor r8d, r9d
add eax, r8d
sub eax, edx
mov edx, 0xaa132250
xor edx, 0x23e11b34
add eax, edx
sub eax, 0x2a8e8e84
sub eax, 0x89f23964
mov r8d, 0xd686c6c8
xor edx, edx
div r8d
mov edx, eax
mov eax, edx
or eax, eax
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xd3af1c25
mov r9d, 0xffffffff
xor r9d, 0xd3af1c25
and r8d, r9d
xor eax, 0xffffffff
xor r8d, 0xffffffff
and eax, r8d
xor edx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xd3af1c25
and edx, r8d
mov r8d, 0x8952f367
xor r8d, 0x76ad0c98
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
mov dword [rsp + 0x24], eax
mov edx, 1
call fcn.14001bef0
mov r9b, byte [rsp + 0x3f]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x24]
mov rdx, rcx
add rdx, 8
mov qword [rsp + 0x28], rdx
mov rdx, qword [rcx + 8]
mov r8, qword [rcx]
mov byte [rdx + r8 + 8], r9b
mov r8, qword [rcx]
mov rcx, r8
add rcx, 1
mov qword [rsp + 0x30], rcx
xor r8, 0xffffffffffffffff
or rcx, rcx
xor rcx, 0xffffffffffffffff
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r9, 0x328c1628325939f6
movabs r10, 0xcd73e9d7cda6c609
xor r9, r10
xor r8, r9
and rdx, r8
movabs r8, 0xb9a5e32da30af93e
movabs r9, 0x465a1cd25cf506c1
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
and rcx, rdx
cmp rcx, 0
setl cl
mov byte [rsp + 0x3e], cl
cmp eax, 0x59063df1
je 0x140007aae
mov al, byte [rsp + 0x3e]
test al, 1
jne 0x1400079da
jmp 0x1400079e4
call fcn.140007e9d
jmp 0x140007aa9
mov ecx, dword [0x1402504a0]
mov edx, dword [0x1402504a4]
xor eax, eax
sub eax, edx
add ecx, eax
mov edx, 0xafc6e865
xor edx, 0x5039179a
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x3cbae8c8
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3cbae8c8
and ecx, edx
or eax, ecx
mov ecx, 0x9279fc5c
xor ecx, 0x6d8603a3
xor eax, ecx
mov ecx, 0x551abfdd
xor edx, edx
div ecx
mov ecx, 0xcf9e9564
xor edx, edx
div ecx
cmp eax, 0x52c46b2c
je 0x140007ab7
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov r9d, dword [0x1402504a8]
xor r9d, 0x617fbe79
xor r9d, dword [0x1402504ac]
mov eax, r9d
and eax, 0x2223bc46
xor r9d, 0x2223bc46
or eax, r9d
sub eax, 0xe614ce69
sub eax, 0xb28bdf3c
mov qword [r8], rdx
mov rcx, qword [rcx]
mov byte [rcx + rdx + 8], 0
cmp eax, 0x69cce8bb
jb 0x140007a4e
jmp 0x140007aa9
add rsp, 0x48
ret
mov esi, 0xe96646e7
invalid
scasb al, byte [rdi]
invalid
Function at 0x1400084c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140250618]
mov r8d, dword [0x14025061c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
and ecx, 0x7615f958
mov eax, ecx
and eax, 0xe1b127e4
xor ecx, 0xe1b127e4
or eax, ecx
imul eax, eax, 0xea6ec70e
cmp eax, 0xbf3d4756
jae 0x140008585
mov eax, dword [0x140250620]
add eax, dword [0x140250624]
mov ecx, 0x6be0f8f7
xor ecx, 0xe2de3f80
xor edx, edx
div ecx
mov ecx, 0xaca93daf
xor edx, edx
div ecx
mov ecx, 0xe15517bc
xor ecx, 0xe15517bc
mov edx, 0xb881bada
xor edx, 0xdb7e25b9
sub ecx, edx
sub eax, ecx
mov dword [rsp + 0x24], eax
mov rax, qword [0x1402770a8]
mov ecx, 0x39b34cb5
xor ecx, 0x39b34cb4
call rax
mov eax, dword [rsp + 0x24]
cmp eax, 0xf262b301
jae 0x14000851b
add rsp, 0x28
ret
pop rbx
sbb byte [rax + 0x64], ah
jmp 0x14000851b

Function at 0x14000a440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp + 8], rdx
add rcx, 0x2098
mov qword [rsp + 0x10], rcx
add rdx, 0x18
mov qword [rsp + 0x18], rdx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x18]
mov rax, qword [rcx]
mov qword [r8], rax
lock cmpxchg qword [rcx], rdx
mov rcx, rax
sete al
mov qword [rsp], rcx
test al, 1
jne 0x14000a593
mov eax, dword [0x1402506d8]
xor edx, edx
div dword [0x1402506dc]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xfa23ceb5
mov ecx, 0xffffffff
xor ecx, 0x7c47b10b
or eax, edx
or ecx, 0x7c47b10b
xor eax, 0xffffffff
and eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x14d559c1
mov r8d, 0xffffffff
xor r8d, 0x14d559c1
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x14d559c1
or eax, 0x14d559c1
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xee222ef3
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
cmp eax, 0x277fb546
je 0x14000a598
mov rdx, qword [rsp + 0x18]
mov r8, qword [rsp]
mov eax, dword [0x1402506e0]
mov ecx, dword [0x1402506e4]
xor ecx, 0xc5e350fa
sub eax, ecx
and eax, 0xce995bab
xor ecx, ecx
sub ecx, 0x24729c90
sub eax, ecx
mov ecx, 0x37f2b8f7
xor ecx, 0x50d43968
mov r9d, 0x429a898f
xor r9d, 0xbd657670
xor ecx, r9d
mov r9d, 0x1b81b2ab
xor r9d, 0x1b81b2ab
mov r10d, 0x722b4216
xor r10d, 0x722b4217
sub r9d, r10d
sub ecx, r9d
sub eax, ecx
mov ecx, 0xb57e1d13
xor ecx, 0xaf453950
mov qword [rdx], r8
cmp eax, ecx
jb 0x14000a50f
jmp 0x14000a45e
add rsp, 0x20
ret
call [rsi - 0x3f]
add ebp, ecx
outsb dx, byte [rsi]
invalid
Function at 0x14000cdd7
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14000ae7d
mov rdx, qword [rsp + 0x28]
Function at 0x14000e9ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.14000ae7d
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x58
add rsp, 0x28
jmp fcn.14000c5e0

Function at 0x14000e9fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x10
mov qword [rsp], rcx
movabs rax, 0xdc104e8fc2065015
movabs r8, 0xdc104e8fc2065004
xor rax, r8
cmp rdx, rax
mov qword [rsp + 8], rcx
jl 0x14000ea8c
mov rax, qword [rsp]
movabs rdx, 0x849a2bd773570f2e
mov rcx, rax
sub rcx, rdx
add rcx, 0xfffffffffffffffe
movabs rdx, 0x849a2bd773570f2e
add rcx, rdx
movzx ecx, word [rcx]
movabs rdx, 0x6e3ee2a9278f512a
movabs r8, 0x93749139465d9d1c
xor rdx, r8
sub rax, rdx
sub rax, rcx
movabs rcx, 0x926ab44723f2607e
movabs rdx, 0x6f20c7d74220ac48
xor rcx, rdx
add rax, rcx
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 8]
add rsp, 0x10
jmp fcn.14000e9ce

Function at 0x14000ea9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov ecx, 0x10
call fcn.140007bc0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
sub rcx, rax
add rsp, 0x38
jmp fcn.14000e9fb
Function at 0x140012370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x140250a28]
mov eax, dword [0x140250a2c]
xor eax, 0x6b1a0205
sub ecx, 0x4b4bdd8c
add ecx, eax
add ecx, 0x4b4bdd8c
mov edx, 0x1ce0736c
xor edx, 0x7d4b7d18
mov eax, 0x90a10436
xor eax, 0x6f5efbc9
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x26097c91
mov edx, 0xb4d838c5
xor edx, 0xb4d838c5
mov r8d, 0xfa20fb82
xor r8d, 0xfa20fb83
sub edx, r8d
sub ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0x2254fb52
xor ecx, 0xffffffff
or eax, 0x2254fb52
and eax, ecx
cmp eax, 0x1a1d8049
jae 0x14001258e
mov eax, dword [0x140250a30]
mov edx, dword [0x140250a34]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
sub eax, 0x4bdc10b9
mov ecx, 0xc1d1ba91
xor ecx, 0x3f1b9db3
imul eax, ecx
mov ecx, 0x4f61ab9c
xor ecx, 0xb3f90fc1
xor edx, edx
div ecx
mov dword [rsp + 0x48], eax
call fcn.14000ae7d
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0xfb55ae6e
jae 0x1400123fc
mov cl, byte [rsp + 0x4f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x47], al
jne 0x14001257b
jmp 0x140012470
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0x566f3e3cfe805af2
movabs rdx, 0x566f3e3cfe805ae2
xor rcx, rdx
cmp rax, rcx
setb cl
mov byte [rsp + 0x45], cl
mov al, 1
test cl, 1
mov byte [rsp + 0x46], al
jne 0x140012550
mov rcx, qword [rsp + 0x38]
movabs rdx, 0x51285d0224fd979f
movabs rax, 0xaed7a2fddb02686f
xor rdx, rax
mov rax, rcx
add rax, rdx
mov qword [rsp + 0x28], rax
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14001252d
jmp 0x14001253d
call fcn.140007e9d
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14001257b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x46], al
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x45]
mov rax, qword [rsp + 0x50]
mov r8b, byte [rsp + 0x46]
mov byte [rsp + 0x27], r8b
mov r8, qword [rax]
and cl, 1
call fcn.14000fec7
mov al, byte [rsp + 0x27]
mov byte [rsp + 0x47], al
mov al, byte [rsp + 0x47]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x58
ret
ror dword [rsi + 0x10], cl
lodsb al, byte [rsi]
jmp 0x1400123fc
Function at 0x1400132f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, 0x10
call fcn.140007bc0
mov r8, qword [rsp + 0x40]
mov rdx, rax
mov qword [rsp + 0x48], rdx
movabs rax, 0x5b43c06f42affba5
movabs rcx, 0x5b43c06f42affba5
xor rax, rcx
sub rax, rdx
movabs rcx, 0x6fe5e275fbf579c6
movabs r9, 0x6fe5e275fbf579c6
xor rcx, r9
sub rcx, r8
add rax, rcx
movabs rcx, 0xa64eaba8d0192d80
movabs r9, 0xa64eaba8d0192d80
xor rcx, r9
sub rcx, rax
mov qword [rsp + 0x50], rcx
mov rax, rcx
xor rax, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14001338b
call fcn.140007e9d
jmp 0x1400134d3
mov rax, qword [rsp + 0x50]
movabs rcx, 0xe31569f3d2f29d08
movabs rdx, 0xe31569f3d2f29d08
xor rcx, rdx
cmp rax, rcx
jge 0x1400133c0
mov rcx, r8
mov rdx, r8
call fcn.14000cee2
jmp 0x1400134d3
mov rax, qword [rsp + 0x38]
cmp rax, 0
jge 0x1400133df
mov rcx, r8
mov rdx, r8
call fcn.14000cee2
jmp 0x1400134d3
mov eax, dword [0x140250aa8]
xor eax, 0x68ce6fab
mov ecx, dword [0x140250aac]
xor ecx, 0xb5bd6cc5
xor eax, ecx
sub eax, 0x902516bd
sub eax, 0x63e9adbc
mov r8d, 0xfbb31804
xor r8d, 0x84ece903
mov ecx, 0xe7120c24
xor ecx, 0x18edf3db
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xdd591937
xor r8d, 0x22a6e6c8
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x7f5ff107
mov r8d, 0x53d9c5a2
xor r8d, 0x2c8634a5
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x448bb2dd
xor ecx, 0xb15ee1fd
cmp eax, ecx
jae 0x1400134dd
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x140250ab0]
and eax, dword [0x140250ab4]
xor eax, 0x45664a4c
mov r8d, 0xa01dee03
xor r8d, 0x93330504
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
add eax, 0x4f39fbe3
mov dword [rsp + 0x2c], eax
call fcn.1400129e0
mov rcx, qword [rsp + 0x48]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
add rcx, rdx
mov qword [rsp + 0x30], rcx
cmp eax, 0x8a35dda1
ja 0x14001346a
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x1400134d3
mov rax, qword [rsp + 0x20]
add rsp, 0x58
ret
mov bh, byte [rax - 0x7b162935]
invalid
Function at 0x140014570
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140250b38]
mov ecx, dword [0x140250b3c]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, eax
xor ecx, 0x71ff0fb9
mov edx, 0xb5855f2b
xor edx, 0x4a7aa0d4
xor ecx, edx
and ecx, 0x71ff0fb9
shl ecx, 1
sub ecx, 0x71ff0fb9
sub eax, ecx
mov ecx, 0x55ab087d
xor ecx, 0xaa54f782
xor eax, ecx
mov edx, 0xffffffff
xor edx, 0x9330a84b
mov ecx, 0xffffffff
xor ecx, 0x5e1a7907
or eax, edx
or ecx, 0x5e1a7907
xor eax, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x6db2936
mov ecx, 0xffffffff
xor ecx, 0xc99663c8
or eax, edx
or ecx, 0xc99663c8
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0xbeffa4fa
je 0x140014702
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140250b40]
mov edx, dword [0x140250b44]
mov r8d, 0xe1e1fd6
xor r8d, 0xdbed4e8d
xor edx, r8d
and eax, edx
mov r8d, 0x98dd6d37
xor edx, edx
div r8d
mov r8d, 0xd1bc3d9c
xor r8d, 0x1b7d69ff
xor edx, edx
div r8d
mov edx, 0x6b62ad70
xor edx, 0xad7779ae
and eax, edx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x9f464879
jae 0x140014619
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400146e5
jmp 0x140014696
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
movabs rax, 0x4000000000000000
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
movabs rcx, 0x544787368f3d5c6b
movabs rdx, 0x544787368f3d5c6b
xor rcx, rdx
cmp rax, rcx
jne 0x1400146e5
mov rcx, qword [rsp + 0x28]
call fcn.14000e9ce
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rcx, qword [rcx + 8]
mov qword [rax + 8], rcx
add rsp, 0x48
ret
fcmovnu st(0), st(3)
fdiv qword [rax - 0xf117]
dec dword [rdi]
invalid