joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14088a022
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx si, bpl
push rbp
not rsi
mov r8, rcx
jae 0x1408e471d

Function at 0x140890d80
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0xfffffffffc5e4787
sub byte [rsp + 0x30], sil
not rsi
mov r10, rsi
sub r10b, r10b
and word [rsp + 0x10], 0x65ce
lea rsi, [rsi + rsi*2 + 0x322b166b]
or r10w, 0x1334
xor rsi, 0x29607b87
push r8
neg dword [rsp + 0x38]
or byte [rsp + 0x20], 0x6e
movabs r8, 0x1d5f0b0c3fd92466
neg dword [rsp + 0x38]
bswap r10d
and r10d, 0x38830401
test dword [rsp + 0x20], r10d
mov dword [rsp + 0x38], 0x1902222c
push rdx
mov word [rsp + 0x20], 0x5ed6
not r8b
push rcx
jo 0x140890d8e
not qword [rsp + 0x28]
add qword [rsp + 0x40], 0xffffffffffd5e213
add r10, 0x1f7f74ba
mov dword [rsp + 0x48], esi
push rbp
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r10, qword [rsp + 0x28]
mov r8, qword [rsp + 0x18]
mov rcx, qword [rsp + 8]
lea rsp, [rsp + 0x48]
ret 8

Function at 0x1408b17de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap rcx
mov si, 0x6943
mov ecx, 0x5a063494
mov r11, qword [rsp + 0x78]
lea rdi, [r13*8 + 0x3e250dd3]
jge 0x140978cb2
xor ebp, 0x10d34c7d
or dword [rsp + 0x48], esi
movsx edi, word [rsp + 0x38]
mov word [rsp + 0x38], 0x3c85
call fcn.1408eb513

Function at 0x1408b5b6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov sil, byte [rsp + 0x13]
and word [rsp + 0x10], 0x6de
sub esi, ecx
and esi, dword [rsp + 0x1b]
test r11d, 0x42983767
not qword [rsp + 0x10]
mov esi, dword [rsp + 0x14]
sete cl
not ecx
test byte [rsp + 0x15], cl
setns cl
not r11b
xor word [rsp + 0x10], 0x32a9
add qword [rsp + 8], 0xffffffffffc635a1
not cx
mov r10, qword [rsp + 0x28]
call fcn.14085ee65
and r8b, 0x48
setle byte [rsp + 0x18]
movsx si, r9w
jle 0x1408558ec
jge 0x1408b5b80
fistp qword [rax]
mov ah, 0x14
retf 0x94fc

Function at 0x1408ba1bf
Capabilities:
Encode data using xor

Disassembly:
push rcx
pushfq
add qword [rsp + 0x10], 0xffffffffbf645623
movabs rcx, 0x426040657e452b0c
or cx, cx
not ecx
add cx, cx
and cx, 0xd9d
push 0x76552f64
sets byte [rsp]
bswap ecx
mov qword [rsp + 0x18], 0xfffffffffda9e98b
push r12
movabs r12, 0x46eb25fc5b813279
cmp r12b, byte [rsp + 0xa]
not word [rsp + 8]
cmovl cx, word [rsp + 0xd]
xor qword [rsp + 8], 0x12052fa
or cx, 0x1a2
neg r12
ja 0x1408ba1c0
test dword [rsp + 8], ecx
push r14
setl cl
add r12b, r12b
xor word [rsp + 0x10], cx
test cx, cx
movabs r14, 0x26cd424700b70abf
not word [rsp + 0x10]
bswap r14
push r11
call fcn.1408ab8e1

Function at 0x1408c203a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [rsp + 0x81]
mov qword [rsp + 0x68], 0x460d5c67
call fcn.140975467
Function at 0x1408ceee6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and rdx, 0xad03c07
cmovae r8, qword [rsp + 0x38]
xor r13w, 0x55c7
mov r10, qword [rsp + 0x60]
setae byte [rsp + 0x18]
cmp qword [rsp + 0x18], r8
setl byte [rsp + 0x38]
je fcn.1408e4ec5
jg 0x140946411
add qword [rsp + 0x40], 0xffffffffbf75c9b4
mov r13w, dx
movabs rdi, 0x62cb051b5a3f44ce
or r13w, word [rsp + 0x3c]
xor r14, qword [rsp + 0x18]
or edx, dword [rsp + 0x1a]
add qword [rsp], 0xffffffffbf7387d8
mov qword [rsp + 0x38], r8
movzx r13, r14w
not r13d
call fcn.1404aaf76
not bl
call fcn.1408f2d36
jg 0x1409464c6
or eax, 0x5204706e
or ah, bl
test dword gs:[rax - 0x5b062712], edx
xchg esi, eax
xor al, 0x12
invalid
in eax, 0xd8
xchg edi, eax
and dl, byte [rbp + 0x78fd123f]
and edx, dword [rax + 0x31]
movsd dword [rdi], dword [rsi]
in eax, dx
mov bh, 0x8c
adc eax, 0xe080a130
and bl, al
adc eax, 0xe060ca7f
xor al, 0x2f
sbb byte [rbx + 0x43d3a37e], dl
invalid
push 0xffffffffffffffdb
push rax
sbb cl, byte [rbx + 0x1e]
add al, 0x64
cmp al, 0x4d
or byte [rsp + rcx*2 + 0x6b], ah
shr byte [rdx], 1
test edi, eax
in al, dx
loopne 0x14094649b
cdqe
int3

Function at 0x1408cef19
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap r10
not bx
not rsi
bswap edx
movabs r10, 0x68354aa37e41196
bswap rdx
bswap rbx
jg 0x1408db7d1
push 0x9985a12
pushfq
add word [rsp + 8], 0x5de5
or byte [rsp + 8], 0xb4
call fcn.14094d222
Function at 0x1408f2d49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or word [rsp + 0x70], 0x4c25
and qword [rsp + 0x78], r13
add bpl, byte [rsp + 0x70]
not word [rsp + 0x78]
sub bp, bp
add qword [rsp + 0x58], 0x89900
neg dword [rsp + 0x78]
mov dword [rsp + 0x70], 0x1a2c73d2
setne byte [rsp + 0x38]
setge byte [rsp + 0x70]
and r13b, byte [rsp + 0x3c]
sub r13b, bpl
cmp dword [rsp + 0x38], 0x605c6997
setg byte [rsp + 0x70]
add byte [rsp + 0x78], r13b
not r13
not r13w
sub dword [rsp + 0x70], 0x641635db
mov rbp, qword [rsp + 0x98]
cmp word [rsp + 0x70], 0x1bdf
js 0x1404b22f3
and word [rsp + 0x38], 0x6639
test r13b, r13b
jle fcn.140887cec
jo 0x14047c550
test qword [rsp + 0x38], 0x752d3676
not qword [rsp + 0x70]
and r15b, 0x35
jge 0x140906861
add qword [rsp + 8], 0xffffffffbf72995e
cmp byte [rsp + 0x18], r14b
cmovge r15, r14
xor r14b, 0xc5
test dword [rsp + 0x18], r15d
mov r15, qword [rsp + 0x18]
movzx r15w, r14b
mov r15, qword [rsp + 0x10]
lea rsp, [rsp + 0x20]
ret 8
neg byte [rsp + 0x30]
jge fcn.1404d6e6f
and dword [rsp + 0x28], ebp
or r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x80]
cmp dword [rsp + 0x30], 0x6d5f3242
jno 0x1409847c1
not r8
movsxd r8, dword [rsp + 0x10]
not r11b
movzx rdx, cl
mov ecx, 0x76090f18
not cl
pop rsi
setns r8b
cmp qword [rsp], rcx
not cx
setbe byte [rsp + 8]
jns 0x140497ded
neg byte [rsp + 8]
mov r8, qword [rsp + 0x30]
add qword [rsp + 8], 0x17c31d19
test qword [rsp + 0x38], rdx
not byte [rsp]
cmovb rdx, r11
sub word [rsp + 8], 0x5a95
jb 0x14091db6c
add byte [rsp], 0x7e
bswap edx
add qword [rsp + 0x48], 0xfffffffffffd5be2
or byte [rsp + 0x38], 0x33
and word [rsp + 8], 0x1905
movsx cx, cx
xor qword [rsp + 0x38], 0x683f5596
test cl, 2
mov rdx, qword [rsp + 0x18]
js 0x14088adcd
add cx, cx
movzx rcx, word [rsp]
mov rcx, qword [rsp + 0x28]
mov r11, qword [rsp + 0x10]
lea rsp, [rsp + 0x48]
ret
mov r15d, ebx
mov r8, qword [rsp + 0x50]
jg 0x14088ad1e
mov edi, dword [rdi - 0x76cfb701]
cmp al, ch
outsd dx, dword [rsi]
xor dword [rbx + 0x3c4ac4bf], ebp
invalid
push rbp
push r13
push r10
mov rbp, r15
push r14
or r11w, r15w
test bpl, bpl
push 0x30a02ad0
lea r15, [rbp*4 + 0x1c0323ac]
push 0x6a7d85
call fcn.140854a71
popfq
lea rsp, [rsp + 0x18]
call fcn.140ac0513
and word [rsp + 0x78], 0x5594
neg qword [rsp + 0x78]
not r13w
cmp qword [rsp + 0x38], 0x539055f7
lea r13, [rbp + rbp*8 + 0x74731ee4]
movsxd rbp, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x70], 0x1f1b08d7
mov qword [rsp + 0x70], 0x15960aa2
mov byte [rsp + 0x38], 0x79
mov r15, qword [rsp + 0xa0]
seto byte [rsp + 0x38]
jae 0x14047c4f7

Function at 0x140901769
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x38], bp
movsx rbp, byte [rsp + 0x38]
mov dword [rsp + 0x38], ebp
mov rbp, qword [rsp + 0x18]
insb byte [rdi], dx
and al, 0x18
jae 0x14088939b
xchg esp, eax
pop rdx
or byte [rsi - 0x59], ch
cmp rax, 0xffffffff8f8b9f3b
imul esp, dword [rdi - 0xa303865], 0xbf876cbe
movabs eax, dword [0x33ac49404e3bd764]
xlatb
adc bl, bh
sbb al, 0xa2
jle 0x14090177a
invalid
Function at 0x1409059a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in eax, 0xb5
sbb edx, eax
mov byte [rsp + 0x50], 0x59
jb 0x1409165fa
jo 0x1409165fb
sub rbx, qword [rsp + 0x58]
cmp qword [rsp + 0x60], r12
movzx bx, r12b
mov r12, qword [rsp + 0x80]
call fcn.140491ad1
movabs byte [0x79fd3ec33a66e2ae], al
jns 0x140905a19
sal byte [rdi], 0xf7
sbb rax, 0x71830f86
invalid
xor dword [rcx - 0x15], 0xffffffb9
movsd dword [rdi], dword [rsi]
pop rsp

Function at 0x140907e5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r11
not byte [rsp + 0x30]
call fcn.1404c6d71
add r13w, word [rsp + 0x23]
or r8b, byte [rsp + 0x12]
neg r8d
jno 0x1409a7c96
sub byte [rsp + 0x48], r13b
add r8, 0x77467b3c
test r13w, bp
call fcn.1408e5890
and al, 0x2f
or al, 0x6e
invalid

Function at 0x14091d228
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0x4400009e
movzx ebp, dx
cmova r14d, dword [rsp + 0x1c]
or r14d, 0x2d420a39
add r13d, 0x70204874
or rdx, r14
cmp r13d, dword [rsp + 0x19]
cmovl bx, word [rsp + 0x1d]
call fcn.14097c70a
cmc
ror byte [rdi - 0xffa8971], cl
test dh, cl
jrcxz 0x140491996
mov al, 0x1a
xor dword [rsi - 0x78], ecx
sub bh, byte [rbx]
jno 0x140491904
stosb byte [rdi], al
sub eax, 0x2900cee2
shr dword [rbx + 0x31], 0xee
inc byte [rdi]
add eax, 0xee61f071
pushfq
invalid
invalid
cmovge cx, r11w
lea r11, [rcx + r11*8 + 0x735a7075]
not byte [rsp + 0x18]
xor dx, word [rsp + 0x1d]
or edx, edx
neg rdx
bswap edx
or word [rsp + 0x18], 0x78ae
setae dl
call fcn.14093811f
neg byte [rsp + 0x48]
add qword [rsp], 0x4b6da6
xor r13b, r13b
add word [rsp + 0x48], r14w
not r13b
lea r14, [r13*2 + 0x20dd73d5]
cmp byte [rsp + 0x48], r13b
ja 0x140491912
sub r14, qword [rsp + 0x48]
cmovo r14, r13
and r13w, r13w
add r13, r13
not r14
jb 0x140954ef5
je 0x140499451
and qword [rsp + 0x18], 0x70b26e05
neg dword [rsp + 0x18]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.140a4b770
sbb byte [rcx], ah
idiv dword [rdi - 0x875a160]
invalid
lea r14, [r14*2 + 0x37803e0c]
jno 0x1409b778e
not r13
lea r14, [r14 + r14*2 + 0x283d3c4a]
cmp byte [rsp + 0x48], r14b
not r13w
mov r14b, byte [rsp + 0x48]
ret 0x10
Function at 0x1409250ac
Capabilities:
Encode data using xor

Disassembly:
mov r11, r8
neg qword [rsp + 0x40]
fmul dword [rax - 9]
pop rsp
and al, 0x40
cmp word [rsp + 0x40], 0x27ad
setg r10b
cmp r8w, r11w
mov byte [rsp + 0x40], 0x63
mov rbp, r11
bswap r11
sets r11b
test word [rsp + 0x40], 0x4687
setle byte [rsp + 0x40]
add r10b, 0xaa
add r10w, r10w
add qword [rsp], 0xffffffffbf7410b6
and al, 0
mov dh, 0x10
je 0x1409250ae
xor bp, 0x7fdf
movzx r11, byte [rsp + 0x40]
jne 0x140927558
mov cl, 0xde
in al, dx
fmul dword [0x1686f0a63]
jrcxz 0x1409250e8
sbb al, 0xe1
invalid
bswap r11
test qword [rsp + 0x40], r8
cmovg r8, r11
mov rbx, qword [rsp + 0x40]
setbe byte [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
jne 0x140949f49
push r8
pushfq
movabs r8, 0x2c3338ff2d3e22c8
add r8b, 0x19
neg r8w
neg r8
lea r8, [r8 + r8*2 + 0x72ff02da]
cmp r8d, 0x3def53dc
push r14
push r9
push r10
movabs r10, 0x2b6c74a4451556e1
movabs r10, 0x14ef54ad29bc0b26
push r13
movabs r9, 0x43b4a9968c06731
movabs r14, 0x21d414fb09c006b5
not r10
jge 0x140986083
mov r13, r8
push rdx
call fcn.1408ab60e
invalid
and rbp, qword [rsp + 0x40]
neg word [rsp + 0x40]
test r10w, 0x3f58
cmovo r11, r8
test word [rsp + 0x40], 0x1004
call fcn.14093d63d
add qword [rsp], 0x397229
call fcn.140840a5a
not r9
not dx
seta r10b
or r13b, byte [rsp + 4]
call fcn.1408b6a51
test eax, 0x60ebf997
mov cl, 0x15
invalid

Function at 0x140932cad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
add r9d, 0x4b1943fc
not r9b
and r9, 0x19e81d70
call fcn.14099b54d
mov al, 0xbb
and rdx, rax
sbb al, 0xf8
jb 0x1404c9e24
xor al, 0xd9
push rbx
and eax, 0x7c51efb0
retf
push r9
movabs r9, 0x6bab17e13ebb51e7
pushfq
add r9, r9
xor r9, 0x49306652
xor r9w, 0x41bb
mov qword [rsp + 0x10], 0xfffffffff16da151
test r9, 0x1da24e0e
jg 0x1404c9dae

Function at 0x14093562e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r15, [r14 + 0x42b268e5]
movsx rbp, r13b
push rbx
sets bpl
push r9
setb r13b
mov r14d, 0x7a082d7e
push r12
not qword [rsp + 0x38]
test r15w, r14w
ja 0x1404ae6c8
lea rcx, [rdi + rcx + 0x2c09209e]
setne r8b
add ecx, 0x13642936
not dil
je 0x140983fd8
sets r8b

Function at 0x140943dda
Capabilities:
Encode data using xor

Disassembly:
cmp dl, 0x45
push r9
push 0x775229f1
movabs r9, 0x1ed44c9970e219ee
push rsi
mov dword [rsp + 8], 0x31fa5a5c
movabs rsi, 0x1706061f077b1023
push 0x7bc32e71
movzx esi, r9b
push r14
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffffb41074be
push r12
lea rsi, [rsi + r9*4 + 0x1bb77b9e]
lea rsi, [rsi + rsi*8 + 0x2dd819b0]
jb 0x140943e11
mov r14, rsi
mov r12, rsi
or qword [rsp + 0x20], 0x46ad4c68
xor r14d, r9d
push rcx
bswap r12d
sete byte [rsp + 0x18]
push rdx
cmp r14d, dword [rsp + 0x20]
push rbp
push rsi
push r15
movabs rdx, 0x4c6a563753c64d64
not qword [rsp + 0x38]
push r14
push r13
push r12
jns 0x140943e41
sete byte [rsp]
neg qword [rsp + 0x10]
sub word [rsp + 0x50], 0x60ad
movabs rcx, 0x5100780353d74073
sub qword [rsp], r12
add qword [rsp + 0x70], 0xffffffffffac8252
pop r13
push rsi
push r9
mov rcx, qword [rsp + 0x40]
test qword [rsp + 0x68], rsi
movabs r15, 0x32367f1642de5982
lea r15, [rsi*8 + 0x26c42796]
call fcn.14093ad50
Function at 0x140949e57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffff9dfea8e0
setno byte [rsp + 0x10]
xor qword [rsp + 0x10], r11
cmovbe ecx, r15d
and dword [rsp + 0x10], edx
push r12
or byte [rsp + 0x18], 0x6a
add qword [rsp + 8], 0xfffffffffff04468
bswap r15d
not dword [rsp + 0x18]
and r15b, r15b
jle 0x1404994c5
or r11w, word [rsp + 0x1d]
sub r11d, ecx
and r11d, 0x17193011
neg dl
push rdi

Function at 0x14095860f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rsp + 0x30], 0xd4
mov byte [rsp + 0x38], 0x30
call fcn.1408e4765

Function at 0x14095861e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx rcx, cl
mov rcx, qword [rsp + 0x20]
jle 0x14098d0f3
add qword [rsp], 0xffffffffffbb01ae
ret

Function at 0x14096150c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx bx, bx
not word [rsp + 0x60]
movzx r9w, word [rsp + 0x3a]
call fcn.140969686
lea r13, [r13*8 + 0x2d5a2ba4]
movsx r13d, r13b
mov dword [rsp + 8], 0x756f5286
not dword [rsp + 8]
call fcn.140977614

Function at 0x140977614
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffbf69eac2
sub word [rsp + 0x10], 0x78f5
add qword [rsp + 0x10], 0x42192d4e
js 0x1408eca78
mov byte [rsp + 0x10], 0xab
call fcn.1408eca42
movzx r13, r13w
mov r13, qword [rsp + 0x28]
not byte [rsp + 0x10]
jle 0x140961521
and word [rsp + 0x10], 0x222f
sub word [rsp + 0x10], 0x273e
test dword [rsp + 0x10], 0x30761aad
setge byte [rsp + 0x10]
cmp word [rsp + 0x10], 0x3b64
jno 0x1408cc12a

Function at 0x140984908
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add r9b, dil
mov r9w, 0x54a1
mov r9b, 0xf4
setne byte [rsp + 0x20]
and byte [rsp + 0x20], 0x64
je 0x14049ca08

Function at 0x140989a4c
Capabilities:
Encode data using xor

Disassembly:
cmp ebp, 0x20470ec5
setg cl
mov rcx, qword [rsp + 0x18]
test bpl, 0x6e
jno 0x1408eeae1
sub r13d, 0x78ae6ac8
not dword [rsp]
or r10d, dword [rsp]
test byte [rsp + 6], r13b
call fcn.1404c6705
neg r11
or r11w, r11w
jns 0x140849ce1
neg bx
cmp bx, 0x3d40
pop rbx
call fcn.140995337
mov bl, 0x88
invalid
not bp
movabs rbp, 0x4cf345e6056478d5
not rbp
mov bpl, 0x1b
jne 0x1408d3b22
xor cx, bp
jge 0x1404d6ddb
mov bl, 0xac
add byte [rbx], bl
add al, 0x59
xor dword [rdx + 0x152aa324], edx
invalid

Function at 0x1409a56b3
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
not r14
mov r8, rsi
setb sil
jg 0x1409a5b2d
push rdx
invalid
test rsi, 0x302e4b59
movabs r14, 0x3951149117db18cf
push rbp
mov esi, 0x54750936
push r8
push qword [rsp + 0x40]
popfq
mov qword [rsp + 0x40], 0x693f9ee0
push rsi
movabs rsi, 0x6064fe92a8b1736
push r12
movabs r12, 0x409871ec638d1281
xor r12d, 0x64a3628e
bswap esi
mov r12w, 0x2ca5
mov r12d, esi
jb 0x1404ae2a4
xor r12d, 0x4e016250
mov si, 0x7cac
not r12b
xor sil, 0x2f
test r12b, 0x9f
lea rsi, [r12*4 + 0x4dad7865]
not sil
push r14
push rbx
push r11
jl 0x14096d80a
setge r8b
add bx, word [rsp + 5]
cmovge ebx, r14d
xor r12d, dword [rsp + 4]
cmp bl, 0xa4
Function at 0x1409a5ec9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor qword [rsp + 0x10], r8
ja 0x1408d864e

Function at 0x1409b2fc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r14d
mov r14w, 0x4bb5
add r14, 0x327313ac
or r14b, 0x63
movsx r14w, r14b
add r14w, 0x20ba
sub r14, 0x2994355d
je 0x140984782
sub r14d, 0x420f4a81
call fcn.1408db7d6
mov r9, qword [rsp + 0x20]
jg 0x1409b018b

Function at 0x1409b4b8e
Capabilities:
Encode data using xor

Disassembly:
movzx edi, r14w
jo 0x14085a2cb
xor r14, 0x1d91032a
bswap r14d
jb 0x1408ed6ff
add r14b, 0x19
lea r14, [rdi + rdi*8 + 0x42a42913]
and r14d, edi
add r14w, 0x4d6f
not edi
mov dil, r14b
sets r14b
Function at 0x14064d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14064d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14064d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064d06f
add dl, dl
jne 0x14064d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064d0f6
xor eax, eax
add dl, dl
jne 0x14064d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064d1ad
add dl, dl
jne 0x14064d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14064d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14064d07e
mov eax, 1
add dl, dl
jne 0x14064d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064d0fb
sub eax, ebx
mov ebx, 1
jne 0x14064d14c
mov ecx, 1
add dl, dl
jne 0x14064d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14064d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14064d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14064d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064d15d
cmp eax, 0x7d00
jae 0x14064d19b
cmp eax, 0x500
jb 0x14064d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064d07e
cmp eax, 0x7f
ja 0x14064d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14064d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14064d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x1400130a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400143e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014400
xor al, al
jmp 0x140014481
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014413
xor al, al
jmp 0x140014481
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001443d
xor al, al
jmp 0x140014481
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014451
xor al, al
jmp 0x140014481
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014463
xor al, al
jmp 0x140014481
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001447f
xor al, al
jmp 0x140014481
mov al, 1
add rsp, 0x38
ret
Function at 0x140001c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140001c40
sub r9, 1
jne 0x140001c30
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x14003a2a0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001ce0
inc r8
sub r9, 1
jne 0x140001cd0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001d20
sub r8, 1
jne 0x140001d10
mov rcx, rbx
call fcn.140001640
sub rdi, 0x10
add bpl, 0xff
jne 0x140001c70
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001dc0
inc r8
sub r9, 1
jne 0x140001db0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140001df0
sub rdx, 1
jne 0x140001de2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret