joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402db0d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg qword [rsp + 0x10]
and ebp, 0x174532e1
add r12b, 0xe5
or r12b, byte [rsp + 0x13]
xor rbp, 0x6f53203c
neg r14b
movsxd r14, dword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add r12b, r14b
neg byte [rsp + 0x10]
setne r14b
cmp qword [rsp + 0x10], 0x4b902263
jb 0x14052f04a
or qword [rsp + 0x30], 0x5ef90ee8
sub r12b, r14b
mov byte [rsp + 0x30], r12b
add r12w, 0x20a3
jb 0x1403a1dce
xor byte [rsp + 0x10], 0xbd
xor r14b, r14b
and dword [rsp + 0x10], 0x598e7a0d
call fcn.14035c603
mov bh, 0x53
jmp 0x1402db19e
sbb al, 0xa9
sal dword [r9 - 0x16], cl
fimul word [rcx + 0x23]
pop rdi
invalid
push r13
jl 0x1403a1d9e
or r14b, 0x1b
xor bp, 0x35cf
jns 0x140368745
mov r14, qword [rsp + 0x28]
seta r14b
xor r12b, byte [rsp + 0x4e]
xor word [rsp + 0x48], 0x374a
call fcn.140357ef5
pop rsi
xor bh, cl
sbb ch, byte fs:[rbx - 0x4c]
in al, dx
ret
in eax, dx
pushfq
or dword [rax], ecx
lea eax, [rdi + 0x72f7e62c]
xchg edi, eax
mov esp, 0x3ae691d1
mov esp, 0xe48d0284
jmp 0x140396605
xor word [rsp], 0x4453
setg byte [rsp + 0x20]
and al, 0x20
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
call fcn.1406ba392
add byte [rax], al
je 0x140396690
add byte [rdx - 0x52af3971], dl
outsd dx, dword [rsi]
push 0xffffffffffffffd3
push rax
fimul dword [rdi - 0x5f50d880]
jmp 0x1403965b2
invalid
mov r14, qword [rsp + 0x48]
test word [rsp], 0x2970
not qword [rsp + 0x20]
jb 0x14037c491
and qword [rsp + 0x20], 0x25853a7
not qword [rsp]
neg dword [rsp]
mov word [rsp], 0x5b80
neg dword [rsp]
not qword [rsp]
and byte [rsp + 0x20], 0x81
test dword [rsp + 0x20], 0x3fc601a9
mov qword [rsp], 0x66971b78
jl 0x14051e129
not dword [rsp + 0x20]
sub word [rsp + 0x20], 0x570d
jne 0x140547a88
push r13
movabs r13, 0x58a79793fa7041e
pushfq
or r13b, 0x7d
not r13w
push r13
and word [rsp], 0x551e
not qword [rsp]
xor dword [rsp], 0x9207b77
xor r13, r13
not r13w
cmp r13b, 0x52
setle r13b
sete r13b
test qword [rsp], r13
call fcn.14034fa42
push r15
push rsi
pushfq
movabs r15, 0x25af36e33a43569e
movabs rsi, 0x21811e972c1f569c
add r15w, 0x14bd
add sil, sil
lea rsi, [rsi*8 + 0x4ffb1778]
or r15, 0x273d7992
lea r15, [rsi + r15*4 + 0x1c502b2f]
add edi, 0x69375d17
push rdi
not rdi
lea r13, [r13 + r14*4 + 0x2c8820e6]
not qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x68]
jns 0x14052f0af
or r13d, r12d
or byte [rsp], 0xa6
mov dword [rsp + 0x30], 0x3c4c65b1
sub dword [rsp + 0x30], 0x5a504bfa
add qword [rsp + 0x18], 0x1840df
or rbp, qword [rsp + 0x50]
movabs r11, 0xaa53147dd624bc
call fcn.140585cf2
test r14w, r14w
js 0x14051e0e1
push r8
movabs r8, 0x5e44304371b85eb2
push r12
push rbp
movabs r12, 0x32581afa0b73579b
seto r8b
seto r12b
movabs rbp, 0x619e51436f841ce3
and r8d, 0x61583ebc
test r12, 0x6446016d
push r8
bswap r8d
mov r12d, dword [rsp + 3]
movsx r12d, word [rsp + 2]
push rdi
movabs rdi, 0x312674f624ab1753
movzx r14w, word [rsp + 0xb]
jns 0x1402df479
popfq
call fcn.140519af5
cmp ah, byte [rbp + 0x29]
in eax, 0x79
test byte [rbx + rdi + 0x68], al
and esi, ebx
fld dword [rcx + 0x69]
int1
mov bl, dh
invalid
add qword [rsp + 0x20], 0x474535c4
jns 0x1403965fb
Function at 0x140359dc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r8
movabs r8, 0x6e860d9f56b741f8
lea r8, [r8 + rsi*2 + 0x5d3a64ad]
setbe bpl
push r9
lea rbp, [r8 + r8*4 + 0x2ebf09b7]
movabs r9, 0x1b4c3a0d463d2dc5
push rbx
add r9, r8
mov rbp, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x2b9b3f84
push r8
xor r8, r9
movsx esi, byte [rsp + 1]
sub esi, 0x5e5f1a01
movabs rbx, 0xe0a154967c5469c
push r10
xor si, si
push 0x4c025fa4
push r9
mov r10, r8
push rbx
mov si, r10w
and byte [rsp], 0x3f
mov qword [rsp], 0x48ec1e21
seto byte [rsp + 8]
push r13
movabs r13, 0x6f6004781b8376dd
bswap rbx
jle fcn.140359dc0
mov ebx, dword [rsp + 9]
not r8
add word [rsp + 0x18], bx
lea r13, [rsi + rbx*2 + 0x56271c56]
mov rbx, qword [rsp + 0x30]
add qword [rsp + 0x58], 0xffffffffffd1d547
cmp rsi, r9
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x20]
mov r13, qword [rsp]
lea rsp, [rsp + 0x58]
ret

Function at 0x140369077
Capabilities:
Authenticate hmac

Disassembly:
test dil, 0x5b
mov dword [rsp + 0x78], 0x275e0a50
movabs rdi, 0x5bd947a822c52ec1
jns 0x1403b45d2
and qword [rsp + 0x90], 0x717e37e6
cmp byte [rsp + 0x90], 0x5c
setg byte [rsp + 0x88]
mov rdi, qword [rsp + 0x30]
jno 0x140517900
add qword [rsp + 0x10], 0xffffffffffe413af
test qword [rsp + 0x30], 0x63b70c5
setge byte [rsp + 0x20]
and r15, 0x22ba0c96
call fcn.1405858d4

Function at 0x14036a48b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not byte [rsp + 0x30]
and byte [rsp + 0x30], 0xab
sub word [rsp + 0x30], 0x45ac
not dword [rsp + 0x30]
neg qword [rsp + 0x30]
test byte [rsp + 0x30], 0xb2
mov qword [rsp + 0x30], 0x4e4c5e0f
je fcn.14034e85b
add qword [rsp + 0x20], 0xffffffffbfac34d1
neg qword [rsp + 0x30]
jbe 0x14052994f

Function at 0x140370176
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
setae r10b
not cx
test r10d, 0x657522d5
movabs r13, 0x64fc7af3720605d4
seta dl
or r13d, edx
add r15, r13
neg r13w
sub r10w, dx
push r12
test r10, 0x5c5f6ea3
push rdi
not r10d
mov r12, rcx
jg 0x14052f001
add byte [rax], al
add byte [rdi + 0x69], bl
outsb dx, byte [rsi]
imul esi, dword [rcx + rbp*2 + 0x61], 0x657a696c
pop rdi
outsd dx, dword [rsi]
outsb dx, byte [rsi]
js 0x140370234
je 0x14037022c
je 0x140370230
invalid
lea rsp, ss:[rsp + 8]
and al, 8
add byte [rcx + 0xf], cl
int 0xf
mov dword [rsi + 6], eax
invalid
je 0x14052f016
or r12w, r13w
add qword [rsp + 0x38], 0x1d29a9
push r12
mov rdx, qword [rsp + 0x30]
xor r13d, r10d
mov rdi, qword [rsp]
sub rcx, r12
call fcn.140369880
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.14067a75d

Function at 0x14037c78a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x140524034
push rdi
push r13
mov rdx, qword [rsp + 0x18]
movabs rdi, 0xe0511af2bc20489
mov di, 0x1d36
bswap rdi
mov di, 0x737c
sete r11b
add qword [rsp + 0x38], 0xffffffffffe67588
lea r10, [rbx + 0x2e265540]
movzx rsi, bx
Function at 0x14037cd50
Capabilities:
Authenticate hmac

Disassembly:
neg dil
xor di, 0x725c
xor edi, 0x7dd64f9a
movsxd rdi, edi
popfq
lea rdi, [rdi + rdi*4 + 0x67bd6a29]
lea rdi, [rdi + rdi*2 + 0x6cee2088]
lea rdi, [rdi + rdi*4 + 0x7b24703c]
not rdi
not rdi
movzx di, di
call fcn.1405464f4
imul eax, dword [rcx + 0x614a8323], 0x9b3cddab
pop rbx
fdivr qword fs:[rsi + rdi - 0x19]
push rbp
and al, bl
invalid
setl sil
add rsi, 0x25d27ef4
jbe 0x1403b530e
mov r12w, 0x2b4a
sub dl, byte [rsp + 0x3b]
jo 0x14036ec9f
mov r8, qword [rsp + 0x68]
mov r12d, dword [rsp + 0x38]
neg di

Function at 0x14037cd8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx si, cx
jno 0x140396377
sub byte [rsp + 0x18], 0x59
neg qword [rsp + 0x18]
add qword [rsp + 8], 0xffffffffbfc440dd
not byte [rsp + 0x18]
test byte [rsp + 0x18], 0x95
jo 0x14054884d
sub dword [rsp + 0x18], 0x2fb2486a
mov byte [rsp + 0x18], 0x41
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.14068f819

Function at 0x140381b57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov bx, r15w
neg r15
jge 0x140381b9b
cmp qword [rsp + 0x28], r15
je 0x140381ba7
mov rbx, qword [rsp + 0x20]
sub r15b, 0x38
add byte [rsp + 0x28], 0x8e
mov r15b, byte [rsp + 0x28]
and r15w, 0x757d
add qword [rsp], 0x2ebda
test r15, r15
jge 0x140595292
and byte [rsp + 0x28], 0x79
cmp r15, 0x32890843
mov r15b, byte [rsp + 0x28]
jl 0x1403a8480
setle byte [rsp + 0x18]
cmovno r15w, word [rsp + 0x12]
mov si, word [rsp + 0x13]
setno sil
test sil, 0xd8
lea r11, [rsi + 0x146e0961]
call fcn.14035b84b
movabs rdx, 0x57b9748b33031006
mov rdx, qword [rsp + 0x10]
jbe 0x140381b7c
mov r10, qword [rsp + 0x28]
add r15b, 0x25
lea rbx, [rbx + 0x34635269]
movzx r10, byte [rsp + 0x28]
mov bl, byte [rsp + 0x2e]
test dword [rsp + 0x28], r15d
je 0x14039f735
movzx bx, word [rsp + 0x2c]
sub bx, r15w
cmovae rbx, r10
lea r15, [r15 + r10*4 + 0x16781712]
jg 0x140595260
sal dword [rdi + 0x7f817ba6], 1
clc
or al, 0x1d
pop rbp
sub ebp, edi
hlt
jbe 0x1405952c2
or dword [rsp + 0x20], 0x68ef34be
neg byte [rsp + 0x20]
call fcn.1403b5287
invalid
push r10
mov rbx, r15
call 0x140381b57
seta byte [rsp + 0x28]
add r10b, bl
mov r10, qword [rsp + 8]
add r15b, r15b
test byte [rsp + 0x28], 0x1d
mov dword [rsp + 0x28], 0xd491d64
ja 0x1402da644
mov byte [rsp + 0x28], 0x7e
test byte [rsp + 0x28], 0x6a
movzx r15w, r15w
movzx ebx, byte [rsp + 0x2b]
mov r15b, 0xfa
lea r15, [r15 + r15*8 + 0xaed14a2]
jo 0x1403a212e
not r15d
sub r15d, 0x61be2669
sub rbx, rbx
setne r15b
mov ebx, dword [rsp + 0x28]
add byte [rsp + 0x28], 0x13
not r15b
jne 0x1402da632

Function at 0x140398cd0
Capabilities:
Encode data using xor

Disassembly:
neg rbx
bswap esi
add r14w, si
seto bl
movabs r10, 0x46b86c0d4d3314c2
add rbx, 0x2e722efe
and r10b, sil
sete r14b
xor r10b, r11b
not r10
setb r10b
jbe 0x140525200
not r14b
movsx r14w, r10w
neg esi
mov r11, qword [rsp + 0x10]
or qword [rsp + 0x18], 0x7da20001
xor edx, dword [rsp + 0x18]
neg r14b
js 0x140398d04
add r14d, dword [rsp + 0x1a]
add dl, dl
setle r14b
setle dl
setl bl
cmovle ebx, dword [rsp + 0x1c]
jg 0x14039cf55
add rsi, r14
xor rdx, qword [rsp + 0x18]
test sil, 0xd2
call fcn.1403a9f59
invalid
Function at 0x1403b836f
Capabilities:
Encode data using xor

Disassembly:
lea r10, [rcx + rcx*8 + 0x7d6b35e8]
cmp dword [rsp + 0x28], 0x7d9071eb
mov r10, qword [rsp]
mov word [rsp + 0x28], cx
call fcn.1403471ce
not dword [rsp + 0x18]
sete byte [rsp + 0x60]
add cl, byte [rsp + 0x64]
or dword [rsp + 0x60], r11d
xor word [rsp + 0x18], 0x662f
neg cx
mov dword [rsp + 0x60], 0x4e7d72aa
jge 0x1403dd303
xor r10, r11
add qword [rsp], 0xffffffffbfa87785
or r10, 0x39641486
xor byte [rsp + 0x18], 0x11
add qword [rsp + 0x30], 0xffffffffffe6a7bc
mov r11, qword [rsp + 0x28]
sub rcx, qword [rsp + 0x18]
and ecx, r10d
mov dword [rsp + 0x18], 0x37130f09
call fcn.1403d7e38
call fcn.140359eca
invalid
not rcx
setae cl
je 0x1403849a8
or qword [rsp + 0x28], rcx
add word [rsp + 0x28], 0x5cd6
lea rcx, [rcx + rcx*8 + 0x57982fe5]
mov rcx, qword [rsp + 8]
setne byte [rsp + 0x28]
call fcn.14036a48b

Function at 0x1403bf47a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r15, qword [rsp + 0x28]
seta dl
neg r8b
jns 0x1403de679
invalid
jmp 0x1b4c51a9f
xor word [rsp + 0x68], 0x4531
add qword [rsp + 0x18], 0x3779b
not r8d
movzx dx, dl
and dl, 0x38
neg dl
neg r8
or r8, 0x71bb6591
ja 0x140370170
sbb dword [rdi - 0x1e], ecx
lodsd eax, dword [rsi]
jno 0x1403de63a
or ch, al
stc
mov ch, 0x47
pop rdx
xchg ecx, eax
adc dword [rax], eax
insd dword [rdi], dx
movabs eax, dword [0x5cf26f400a47c162]
sbb esi, esi
jnp 0x1403de73a
and bh, byte [rbx]
hlt
test ax, 0xc6a3
xlatb
std
add edi, esp
invalid
Function at 0x140408e8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1403e01b9
call rax
mov r11, rax
stc
cmp r11b, r11b
test rax, rax
jmp 0x14059f029
sub eax, eax
jmp 0x14059ef87
jmp 0x14059f17c
je 0x14059ef80
cmp r11, rsi
jmp 0x14059f037
jne 0x14059f0dd
cmp byte [rsp + 0x180], dil
jmp 0x14059f04a
je 0x14059f0c7
lea rax, [rsp + 0x40]
sub rbp, rax
bts rdx, r9
ror cx, 0x65
cwde
nop
cmove dx, r11w
rdtsc
movsx ax, al
lea rdx, [rsp + rdi + 0x40]
cwde
rol ah, cl
mov ecx, edi
bts ax, r8w
btr eax, r9d
mov eax, 0x391d4502
rol eax, cl
add al, dil
stc
jmp 0x14059f090
xor al, byte [rdx + rbp]
jmp 0x14059f098
mov byte [rdx], al
jmp 0x14059f09f
je 0x14059f0bd
inc rdi
cmp r9b, r12b
cmp rdi, 0x104
jmp 0x14059f0b7
jb 0x14059f06d
lea rbp, [rsp + 0x40]
cqo
bswap rax
mov rdx, rbp
cdqe
mov rcx, rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress_1]
call rax
jmp 0x14059f17c
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x14059f0ea
jne 0x14059f160
movzx edx, byte [rbx + 2]
add rbx, 2
cmp r12w, 0x170d
clc
test dl, dl
jmp 0x14059f106
je 0x14059f158
nop
cbw
cwde
movzx rax, cx
lea eax, [rdx - 0x30]
jmp 0x14059f11c
inc rbx
cmp al, 9
ja 0x14059f158
movsx eax, dl
sbb cx, 0x64df
bts cx, dx
movzx edx, byte [rbx]
movsx rcx, r9w
lea ecx, [rdi + rdi*4]
ror rdi, cl
shr di, 0xef
cmc
lea edi, [rax + rcx*2 - 0x30]
cmc
stc
test dl, dl
jmp 0x14059f152
jne 0x14059f114
movsxd rdx, edi
and ecx, esp
movsx ecx, di
xor r8d, r8d
movzx cx, sil
movsx ecx, bp
mov rcx, r11
call fcn.14059ebb9
jmp 0x14059f17c
mov rbx, qword [rsp + 0x178]
rcl sil, 0x26
shld esi, r9d, 0x61
mov rdi, qword [rsp + 0x150]
inc rsi
sbb ebp, 0x70c00894
add rsp, 0x158
mov sil, spl
jmp 0x14059f1ad
pop rsi
pop rbp
jmp 0x14059f1b4
ret

Function at 0x140524026
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbx, qword [rsp + 0x48]
cmovae ecx, r14d
call fcn.14057ccf9
and byte [rsp + 0x30], 3
neg r10w
neg r10w
mov r10, qword [rsp + 0x28]
sub word [rsp + 0x10], 0xcd9
movsx r11w, byte [rsp + 0x35]
jno 0x14034e888

Function at 0x14053219f
Capabilities:
Encode data using xor

Disassembly:
sub r13b, 0x68
mov dil, 0x4a
mov r13b, reloc.WLDAP32.dll_Ordinal_46
lea r13, [r13 + r13 + 0x53a0337]
xor edi, r13d
mov rdi, qword [rsp + 0x30]
movsx r13, r13w
neg r13w
or r13b, 0x9d
setb r13b
not r13w
bswap r13
not r13w
bswap r13
neg r13b
xor r13b, 0x9c
jns 0x1405321b1
sub r13b, 9
xor r13d, 0x29ec12ec
cmp r13, 0x2315395e
setg r13b
xor r13d, 0x2f191ea6

Function at 0x140541b7d
Capabilities:
Encode data using xor

Disassembly:
neg bp
not rbx
xor r13b, byte [rsp + 0x29]
or r14b, bpl
lea rbp, [r14*4 + 0x3b6a67d4]
xor bx, 0x3f71
jo 0x140541b93
add qword [rsp], 0x1cd10a
and rbx, r14
mov ebp, 0x39611f70
xor r13, qword [rsp + 0x28]
and r13b, bl
lea rbx, [r13 + 0x2ce55922]
jne 0x14035dfce
add byte [rax], al
jae 0x140541c20
imul ebp, dword [rsi + 0x64], 0x6e55776f
imul esp, dword [rbx + 0x6f], 0xf006564
invalid
invalid
mov dword [rsi - 0x169d146b], esi
invalid
Function at 0x140546014
Capabilities:
Encode data using xor

Disassembly:
and dil, 0x6b
mov rdi, qword [rsp + 0x20]
add qword [rsp + 8], 0xffffffffbfa7f23d
add qword [rsp + 0x18], 0xffffffffbfc4fe32
add qword [rsp], 0xffffffffffdf2769
ret 8
sub rbp, rbp
mov rbx, rbp
neg rbx
add qword [rsp + 0x20], 0xffffffffffe5eac9
call fcn.140517183
sub edi, 0x6f7290c
not bp
pop r9
xor ebp, 0x22cd7728
xor rbp, 0x1a9920f7
add rdi, 0x257e72bd
lea rbp, [rbp*4 + 0x390d7edd]
movabs rbp, 0x6b28701979ae7f69
jns 0x1403c42e9
add rbp, 0x5dd975bb
lea rdi, [rbp*4 + 0x53554d27]
movabs rbp, 0x4f296de225f9605f
jbe 0x140356f92
jne 0x1403b01bd
mov qword [rsp + 0x30], r15
mov dl, byte [rsp + 0x10]
mov qword [rsp + 0x30], 0x2266027a
not edx
call fcn.140401f7b
push 0x1d452183
push rbp
mov qword [rsp + 8], 0x7f567802
pushfq
movabs rbp, 0x344b0b811d5c238a
xor bp, bp
push r10
not ebp
bswap ebp
movabs r10, 0x70f938c5261c6853
js 0x140356f9b
xor ebp, 0x2cd52e30
movzx ebp, r10b
jb 0x140546091
add r10w, 0x40c
and bp, bp
test bpl, 0xe3
push rdi
sets r10b
movabs rdi, 0x5eac00141fb20ac6
sub rdi, r10
push r9
movabs r9, 0x497f588a064e1684
mov r10, qword [rsp + 0x10]
jo 0x140349dcc
cmovb edi, r9d
bswap r9
test ebp, 0x4f1246f6
bswap rdi
jge 0x1403c42e6
mov esp, 0x80d0c267
invalid
Function at 0x140547abd
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
call fcn.1403933c5
popfq
call fcn.14037ba05
push rbp
pushfq
movabs rbp, 0x35b2027d5a830aaf
sub rbp, 0x40a81db7
mov bp, 0x5c5
jge 0x1403c910f
add dword [rax], ebx
invalid
jo 0x1403947c6
and rsi, rsi
neg dword [rsp + 0x20]
movabs rsi, 0x772f14a56e614580
cmovl si, word [rsp + 0x24]
setg sil
cmp esi, 0x6019598e
not word [rsp + 0x20]
jno 0x14039cec2
lodsb al, byte [rsi]
movabs rsp, 0x6e5296d60ba2016e
invalid
jae 0x1403947a5
not r11w
push rdi
movsx r12d, r11b
mov r10d, r12d
lea r11, [r11 + r12 + 0xe8a2e67]
test r11, r11
mov r11, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0x35e9f94e
push rsi
movsx r12d, r10w
push r15
call fcn.140367a94
not word [rsp + 8]
cmp ecx, 0x62a431b5
mov rdx, qword [rsp + 0x20]
mov dword [rsp + 8], 0x1fc826d7
movsx di, byte [rsp + 0x66]
not word [rsp + 0x20]
xor dword [rsp + 0x20], esi
test esi, 0x4bfb1e90
lea rsp, [rsp + 8]
ret 8
js 0x1403b0162
setne cl
js 0x14059f96a
mov rcx, qword [rsp + 0x38]
not r14d
sub word [rsp + 0x18], 0x606d
seto r14b
sub r14, 0x65b073a5
jno 0x1403b37bc
add byte [rax], al
add byte [rdi], bh
insb byte [rdi], dx
jne 0x1403b01ea
push 0x62243f40
invalid
xchg edi, eax
setl r14b
setb byte [rsp + 0x18]
call fcn.1403788e2
xor byte [rsp + 0x38], 0xf4
xor r11b, byte [rsp + 0x1b]
push r12
mov r8, qword [rsp + 0x78]
add qword [rsp + 0x18], 0x207d72
neg dword [rsp + 8]
not dword [rsp + 0x20]
add dword [rsp + 8], 0xd8b6306
add rbp, r12
jbe 0x14038aa9c
call fcn.14058fda7
add byte [rax], al
jb 0x140539a5e
outsb dx, byte [rsi]
jne 0x140539a5b
jb 0x140539a66
imul esp, dword [rsi + 0x69], 0x65746163
jae fcn.140539a44
outsb dx, byte [rsi]
push rbx
je 0x140539a6e
jb 0x140539a66
add byte [rcx + 0x56], al
movabs r14, 0x29f3365b0a795fd2
push rsi
pushfq
mov rsi, r14
lea r14, [r14*2 + 0xe887b39]
test r14b, 0xf6
push r11
jg 0x140517109
xor sil, 0x11
cmp rsi, 0x12831fd6
jo 0x1403987d5
test rsi, 0x1a0724a0
call fcn.1403e027f
mov word [rcx + 0x5ffb7c6c], cs
jl 0x140539a58
pop rdi
jle 0x14059f95f
jbe 0x1403b0140
invalid
or qword [rsp + 0x20], 0x1ed96a56
and byte [rsi + 0x6a], dl
fstp dword [rsi]
and r15, qword [rsp + 0x18]
add r15b, 0xfd
call fcn.140369fa5
jns 0x1405399ac
call fcn.1403728e4
pushfq
sub r8d, 0x46b81ec5
xor r8b, r8b
push rcx
call fcn.1403685bc
rcl byte [rsi - 0x64], 0x48
mov esi, 0x33197421
invalid
Function at 0x14057a3d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xffffffffbfacb170
or qword [rsp + 0x18], 0x3b942d2f
or word [rsp + 0x18], 0x5262
neg dword [rsp + 0x18]
xor qword [rsp + 0x18], 0x14225973
sets byte [rsp + 0x18]
sub dword [rsp + 0x18], 0x2cb16966
or qword [rsp + 0x18], 0x33a45c33
je 0x140396341
setb byte [rsp + 0x18]
neg byte [rsp + 0x18]
add dword [rsp + 0x18], 0x7e32510f
sqrtps xmm6, xmmword [rdx]
jle 0x14057a428
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.1406c234c
jb 0x14057a482
je 0x14057a44f
xor byte [rbp + 0x24648d48], bl
cmp al, ch
adc eax, 0x7200147f
xchg r15, rax
xchg edi, eax
push rbp
jb 0x14057a424
and al, 0x91
pop rsp
sbb eax, 0x10665e0d
invalid
insd dword [rdi], dx
fistp dword [rdx + 0x66]
invalid
add al, 0x5e
add ah, byte [rsi - 0x22]
mov ch, 0x24
test eax, 0xb7f1e099
xchg ebp, eax
invalid

Function at 0x14057c3a9
Capabilities:
Encode data using xor

Disassembly:
jl 0x1406e770a
and dword [rsp + 0x10], 0x22fb2000
mov r9, qword [rsp + 0x38]
cmp qword [rsp + 0x18], 0xedb27fe
je 0x1406e777c
test word [rsp + 0x10], 0xcc4
call fcn.14052d3e3
or al, 0xa1
xchg esi, eax
invalid
not r9w
pushfq

Function at 0x140581651
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [rdi + rdx*8 + 0x7f134a5c]
movzx r15d, dil
push r10
call fcn.1405225f4
add byte [rax], al
je 0x1405816be
insd dword [rdi], dx
jo 0x1405816be
invalid
jmp qword [rbx]
cmp eax, 0x5d3ef268
imul r9d, dword [r9], 0x97c27760
in al, 0xc6
mov eax, 0xae18c796
xor ebp, dword [rax + 0x3b]
mov esp, 0x97694fa8
loop 0x1405816a2
invalid

Function at 0x140585708
Capabilities:
Encode data using xor

Disassembly:
out 0xa2, al
cdq
imul eax, dword [rax + 0x6bcabbad], 0x40
add sil, r15b
insd dword [rdi], dx
int 0x7b
test al, 0x95
mov edi, 0x866dcb69
jg 0x1403c0f06
out dx, eax
movq mm0, qword [rax]
movabs rsp, 0x7f956a08b20069a9
adc esp, 0x483f9125
outsd dx, dword [rsi]
fld xword [rcx]
sub dword [rdx], ecx
adc ah, byte [rcx]
xor r10w, r10w
neg ebp
mov qword [rsp + 0x20], 0x67b4e44f
mov ah, 0x67
setle r10b
jns 0x14037210d
push rbx
pop rsp
xor ah, ch
lodsd eax, dword [rsi]
jrcxz 0x1403c0ee3
mov ebx, 0xebe006e3
pop rsp
test bl, ch
enter 0x6072, 0x17
adc al, 0xbd
push rdx
adc eax, dword [rsp + rdx]
add ebp, dword [rsi + rdi]
stc
jmp 0x1403c0e9f
movsxd r12, r12d
add di, 0x5858
bswap r12d
and edi, 0xfbf7bfb
sub di, r12w
call fcn.1405488df
bswap r15d
lea r15, [rsi*2 + 0x75563950]
add qword [rsp + 8], 0xffffffffbfc7e4a9
not bl
sub rbx, rsi
and ebx, esi
or bx, 0x6744
movsx r15d, r15b
test ebx, r15d
call fcn.140543061
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx + 0x52], al
push r10
pushfq
movabs r10, 0x68243f4a2298465a
or r10b, 0x58
push rbp
movabs rbp, 0x72100f9a44701180
setno r10b
not r10
lea rbp, [rbp + rbp*4 + 0x42f7162a]
sete r10b
neg r10
cmp r10b, 0x5f
push rbx
lea rbp, [r10*2 + 0x5f7a71a1]
jb 0x1403c0ed6
add qword [rsp + 8], 0xffffffffbfbfd20d
test dword [rsp + 0x20], 0x289e045e
not word [rsp + 0x18]
call fcn.140403211
Function at 0x140585adb
Capabilities:
Encode data using xor

Disassembly:
je 0x1403b6adc
lea r15, [r8 + 0x6e1b1bd9]
neg ebp
mov r13, qword [rsp + 0x20]
cmp byte [rsp + 0x20], r15b
jbe 0x14053100b

Function at 0x1405902ae
Capabilities:
Encode data using xor

Disassembly:
not r14w
mov rcx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
add r12b, r9b
or qword [rsp], rbx
and r14w, word [rsp + 0x33]
and esi, r8d
mov r12d, ebx
call fcn.1403a8a81
lea rcx, [r8 + rdx*8 + 0x77755b60]
not r8b
neg r8d
xor rcx, 0x590d2b93
neg dx
je 0x1403522b2
cmp r8w, 0x507e
jl 0x1403789ee
or al, 0xa8
cmp ch, ah
retf 0xb4c9
neg r8d
add r8d, ebx
push rbx
push rcx
je 0x14036873b
mov ebx, 0x18941917
push rsi
movabs rcx, 0x2d7173e720523ea
cmova ecx, dword [rsp + 0x13]
mov rsi, qword [rsp + 0x10]
not r14
sub ecx, 0x68a357a5
neg rbx
movabs rcx, 0x53d13da3591a6d26
mov esi, 0x2c18397f
bswap rbx
neg rbx
or esi, ecx
setle cl
xor si, 0x62ff
push r12
add qword [rsp + 0x30], 0x241932
and r14, rbx
call fcn.1403679b9
call fcn.140523b7c
push rsi
or rsi, r14
and esi, dword [rsp + 3]
jge 0x1405170d5
add byte [rax], al
add byte [rdi], bh
ja 0x14037e9d4
je 0x14037e9d6
imul ebp, dword [rdi + 0x73], 0x7361625f
jae 0x14037e9ee
push rcx
pop r15
pop rdi
pop rdx
add byte [rsi - 9], ah
and al, 0x38
mov ecx, 0x3991e807
std
jmp qword [rsi + 0x41]
or sil, sil
xor sil, 0xfd
test byte [rax - 0x80], 0xf6
std
movzx esi, bl
or rsi, rbx
mov esi, 0x51606b8f
push r14
not ebx
push r11
mov r11, rbx
fisttp dword [rax - 0x75]
pop rsp
and al, 0x28
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0xffffffffd5094549
mov r14, r11
bswap esi
push rdx
movabs rdx, 0x76fe26ec770f0f10
xor r11b, r11b
neg rdx
cmp si, 0x14ee
push r10
call fcn.14052405a
push rbp
not byte [rsp + 8]
mov r14, qword [rsp + 0x28]
movabs rbp, 0x442f7eb074c63de8
test bp, 0x2d39
setb bpl
sub r11b, byte [rsp + 9]
mov esi, 0x61823671
lea rsi, [rbp + rsi + 0x33dc6e08]
add byte [rsp + 8], sil
lea rsi, [rbp + r11*4 + 0x1dc1b74]
neg sil
bswap ebp
and word [rsp + 8], 0x25d
add r11w, r11w
sub word [rsp + 8], si
jae 0x1403c115e
call fcn.14053216f
sub edx, 0x5554073d
setg dl
neg dl
mov rdi, qword [rsp + 0x28]
xor r8d, 0x64a13f51
sets r8b
or cl, 0xd8
cmp rdx, 0x3ab728f9
jae 0x14036fa86
add r14d, 0x7f712d51
mov r14d, 0x7f4f5427
or r14b, 0x49
and r14, 0x3022154c
cmp cx, 0x34f
jb 0x1403679c8
push r8
push rax
and r14, r14
push rbx
movabs rbx, 0x172b496f1eaa2212
or ecx, ecx
movabs rbx, 0x7cb75c0d7df75bea
mov r14b, 0x6a
movabs r8, 0x2686241349fc6e3f
mov r8w, 0x20d3
xor r14w, 0x6708
movzx ebx, r14b
cmp r14d, 0x7152cba
setae r14b
not rbx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x192a6a82
jne 0x14037e8ec
and al, 0x28
invalid
sub dword [rsi], edx
or eax, 0xff60a918
push 0xffffffffffffffe7
test eax, 0xe76aff60
jle 0x1405902d2
cwde
sub al, 0xf6
xor dword [rsi - 0x31], ecx
mov ecx, 0x804e373f
jle 0x14059031f
jno 0x14059032f
shl edx, cl
xchg dh, cl
mov cl, 0x82
sub dh, ch
pushfq
sbb byte [rcx], ah
push rbp
xchg byte [rax + 0x67], ch
fist word [rax + 0x3731c74b]
push rdx
sal byte ss:[rcx], 0xb7
xchg edx, eax
out dx, al
retf