joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ead34
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400ead6b
call fcn.1400de4e0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400ea534
xor eax, eax
jmp 0x1400eadf9
mov rdx, r9
mov rcx, r8
call fcn.1400eacd0
mov rbx, rax
test rax, rax
je 0x1400eadf6
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400eabfc]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400eade3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400de454
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400eadca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400eadd9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400edc50
jmp 0x1400eadf6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400eadf3
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ee364
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.GetTempPath2W
mov edi, ecx
lea rdx, str.GetTempPath2W
mov ecx, 5
lea r8, [0x14011cc30]
call fcn.1400eddb8
test rax, rax
je 0x1400ee3ae
movabs r10, 0xa3e5bf4030d1b870
mov rdx, rbx
mov ecx, edi
call qword [0x140103920]
jmp 0x1400ee3b9
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f36c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400f36d6
mov al, 1
jmp 0x1400f3736
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400f36e7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400f3734
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400e7c40
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f3734
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400f3734
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400f3734
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400f3736
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400f5464
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400f5484
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400de454
or eax, 0xffffffff
jmp 0x1400f5486
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400fa83c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400fa86c
xor eax, eax
jmp 0x1400fa92f
mov rbp, rbx
cmp word [rax], si
je 0x1400fa891
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400fa878
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400fa874
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400f7414
movsxd r14, eax
test eax, eax
jne 0x1400fa8cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400fa865
mov rcx, r14
call fcn.1400eed74
mov rdi, rax
test rax, rax
jne 0x1400fa8e8
xor ecx, ecx
call fcn.1400edc50
jmp 0x1400fa8c4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400f7414
test eax, eax
jne 0x1400fa919
mov rcx, rdi
call fcn.1400edc50
jmp 0x1400fa923
xor ecx, ecx
call fcn.1400edc50
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400fa94c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400fa9d3
mov rsi, rbx
cmp word [rax], bp
je 0x1400fa992
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400fa97c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400fa978
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400eed74
mov rdi, rax
test rax, rax
je 0x1400fa9c0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400cc610
mov rbp, rdi
xor ecx, ecx
call fcn.1400edc50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400fdf3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400f08a8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400fdfdd
cmp ebx, dword [rsp + 0x30]
je 0x1400fdfd6
test esi, esi
je 0x1400fdfd6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400fdfb1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400fdfbe
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400fdf9b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400fdfc2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400fdfdf
mov eax, 1
jmp 0x1400fdfdf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140100294
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400ea0c4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400ea0c4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401003e4
cmp rax, 0xffffffffffffffff
je 0x1401003e4
xor edi, edi
test rbp, rbp
jle 0x14010038f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400edc8c
mov rbx, rax
test rax, rax
jne 0x14010031c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140100385
mov edx, 0x8000
mov ecx, r14d
call fcn.1400ebb24
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400e9b4c
cmp eax, 0xffffffff
je 0x140100365
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14010032c
mov edx, r15d
mov ecx, r14d
call fcn.1400ebb24
jmp 0x140100385
cmp byte [rsi + 0x38], dil
je 0x14010037c
cmp dword [rsi + 0x34], 5
jne 0x14010037c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x140100385
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400edc50
jmp 0x1401003f8
jns 0x1401003f8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400ea0c4
cmp rax, 0xffffffffffffffff
jne 0x1401003b0
cmp byte [rsi + 0x30], dil
je 0x1401003f8
mov edi, dword [rsi + 0x2c]
jmp 0x1401003f8
mov ecx, r14d
call fcn.1400e7c40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401003f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1401003f8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401003f1
mov eax, dword [rsi + 0x2c]
jmp 0x1401003f6
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400ea0c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140101220
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400d616c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1401012aa
cmp byte [rbp - 0x21], r15b
je 0x1401012a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1401012e0
call fcn.1400ee024
test eax, eax
jne 0x1401012cc
cmp byte [rbp - 0x21], r15b
je 0x1401012c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1401012e0
cmp byte [rbp - 0x21], r15b
je 0x1401012dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400e01b0
test eax, eax
jne 0x140101380
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400d616c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14010131f
cmp byte [rbp - 0x21], r15b
je 0x140101354
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140101354
call fcn.1400ee024
test eax, eax
jne 0x140101340
cmp byte [rbp - 0x21], r15b
je 0x140101339
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140101354
cmp byte [rbp - 0x21], r15b
je 0x140101351
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400e01b0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140101380
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140101383
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140101391
mov rcx, rdi
call fcn.1400edc50
cmp byte [rbp + 0x3f], r15b
je 0x1401013a0
mov rcx, qword [rbp + 0x27]
call fcn.1400edc50
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000127c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
jmp 0x14000121c
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
mov dl, al
mov r8b, byte [rsp + 0xf]
cmovno eax, dword [rax - 0x77bb7940]
and al, 0x7f
mov r9, qword [rsp + 0x70]
and al, 0x70
sub r9, qword [rsp + 0x70]
mov qword [rsp + 0x70], r9
mov r9, qword [rsp + 0x60]
add r9, 0xffffffffd9bf8484
mov r10, qword [rsp + 0x10]
mov byte [r10 + rcx], dl
mov r11, qword [rsp + 0x70]
xor r11, 0x9319c93
add rcx, r9
mov qword [rsp + 0x70], r11
add eax, 1
mov qword [rsp + 0x50], rcx
mov si, word [rsp + 0xc]
or si, 0x6a40
mov word [rsp + 0x6e], si
mov dword [rsp + 0x38], eax
cmp rcx, 0x100
je 0x14000118e
jmp 0x1400011a1
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x60]
add rcx, 0x36cfc65a
mov dx, word [rsp + 0xc]
mov word [rsp + 0x6e], dx
mov r8b, byte [rsp + 0x7e]
add r8b, 5
mov r9, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x70]
xor r9, 0x3368d3c6
mov qword [rsp + 0x70], r9
mov r10b, byte [rsp + 0x7e]
add r10b, 0xa
mov dword [rsp + 0x28], eax
mov r9, qword [rsp + 0x40]
mov qword [rsp + 0x58], r9
mov byte [rsp + 0x2f], r10b
mov r9, qword [rsp + 0x10]
add r9, qword [rsp + 0x58]
mov r10b, byte [rsp + 0x2f]
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x30], ecx
mov r9, qword [rsp + 0x30]
mov r11b, byte [r9]
mov byte [rsp + 0x3f], r11b
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x68], eax
mov r9, qword [rsp + 0x70]
or r9, qword [rsp + 0x70]
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x4c], 0x30461c6d
cmp r8b, r10b
jae 0x14000121c
mov eax, 0x100
mov cl, byte [rsp + 0x3f]
mov qword [rsp + 0x70], 0x5155d8a4
mov edx, dword [rsp + 0x68]
and edx, dword [rsp + 0x68]
movzx r8d, cl
mov r9d, dword [rsp + 0x28]
mov dword [rsp + 0x68], edx
add r9d, r8d
mov byte [rsp + 0x7f], 0xae
mov edx, dword [rsp + 0x68]
or edx, dword [rsp + 0x68]
mov r10, qword [rsp + 0x58]
mov r8d, r10d
mov dword [rsp + 8], eax
mov eax, r8d
xor r8d, r8d
mov dword [rsp + 4], edx
mov edx, r8d
mov r8d, dword [rsp + 0x1c]
div r8d
mov r11d, dword [rsp + 4]
mov dword [rsp + 0x68], r11d
mov edx, edx
mov r10d, edx
mov byte [rsp + 0x7f], 0x20
mov rsi, qword [rsp + 0x20]
movzx edx, byte [rsi + r10]
add r9d, edx
mov cl, byte [rsp + 0xf]
and cl, cl
mov byte [rsp + 0x7f], cl
mov eax, r9d
cdq
mov r9d, dword [rsp + 8]
idiv r9d
movsxd r10, edx
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x10]
mov cl, byte [rbx + r10]
mov byte [rdi], cl
mov r11d, dword [rsp + 0x68]
xor r11d, 0x3e054c21
mov dword [rsp + 0x68], r11d
mov cl, byte [rsp + 0x3f]
mov byte [rbx + r10], cl
mov r10, qword [rsp + 0x58]
and al, 0x58
add r10, 1
mov qword [rsp + 0x40], r10
imul rdi, qword [rsp + 0x70], 0x7f5b351a
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x4c], edx
cmp r10, 0x100
jne 0x14000121c
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
Function at 0x140004e9c
Capabilities:
Encode data using xor

Disassembly:
movabs eax, dword [0xc028d008bf8f225f]
xchg esp, eax
jb 0x140004f1f
sub esp, dword [rax + 0x7095df31]
push rax
mov edi, 0xeb015358
insd dword [rdi], dx
sbb edi, dword [rdx - 0x20866d16]
retf
jne 0x140004f65
mov ecx, dword [rsi + 0x36]
xor ebp, dword [rcx - 0x5e]
invalid
out dx, eax
movsb byte [rdi], byte [rsi]
xor dword [rdi + rax + 0xeb1d5b5], edi
push 0xfffffffff89f9804
sub eax, 0x664eb50d
ror dword [rbp + 0x6b], 1
mov fs, word [rdx - 0x2d297273]
add esp, edi
or al, 0x55
cmp al, 0x7d
fsub dword [rbp + 3]
push rax
xor al, 0x35
push rdi
mov ch, 0xdf
invalid

Function at 0x140005550
Capabilities:
Encode data using xor

Disassembly:
push rsp
hlt
jle 0x140005405
mov esi, 0x70f2858e
and byte [0x1334c0eaa], dh
invalid
ror byte [r14 + 0x758f05c8], 1
jae 0x140005507
jrcxz 0x1400054e5
add ebx, edi
push rsi
js 0x140005443
cmpsb byte [rsi], byte [rdi]
sub eax, 0x9b10146c
out dx, eax
sbb dword [rax + 0x1fb97744], edi
movabs byte [0x6a3f5a996a819919], al
leave
invalid
push rsp
sbb eax, 0x3ec510a8
xor eax, dword [rcx + 0x6ea5a699]
add al, byte [rsi - 0x3c]
stosd dword [rdi], eax
push 0xffffffffacfd9258
and al, 0x1a
xor dword [rdi + 0x7d], ecx
scasb al, byte [rdi]
jge 0x14000548c
neg dword [rbp + rbp*2 + 0x554ec29]
adc al, 0x9c
js 0x1400054c3
adc ebp, ebp
adc eax, 0xc15c7cd2
mov ebx, 0x997caf5
inc dword [rsi]
cdq
outsb dx, byte [rsi]
push 0x67314f5f
sub dword [rax], edx
push 0
adc dword [rcx - 0x27], ebx
jrcxz 0x1400054db
sal dword [rcx - 0x14e2f7ef], cl
xchg dword [rdi - 0x536be7ab], ebx
xchg dword [0x12acc9016], ebx
imul edx, dword [rcx + 0x56], 0xffffffff
xchg ecx, eax
mov edx, 0xa557b1cb
jmp 0x107e1001a
mov cl, 0x11
or byte [0x1959fdcfb], bl
sbb byte [rsp + rbp*4 + 0x3afd1d87], dl
int3
or al, 0xfa
loop 0x1400054e5
insd dword [rdi], dx
pop rbp
xchg esp, eax
mov ah, byte [rax]
iretd

Function at 0x14000890c
Capabilities:
Encode data using xor

Disassembly:
invalid
ficomp dword [rdi - 0x4b72ea83]
movabs eax, dword [0x327b7f23f39d46d3]
and edi, dword [rsi]
add eax, 0x6b84774a
adc eax, 0xd3a1b48d
popfq
and edi, dword [rdi + 0x7b]
xor ah, byte [rbx]
add eax, 0x6b84774a
jp 0x1400088e1
jns 0x14000886d
test dl, ch
cmpsb byte [rsi], byte [rdi]
sub dword [rbx - 0x1e], esi
int 0xae
mov dh, 0x52
out dx, eax
mov esi, dword [rdi]
xchg edx, eax
push rdi
cmp esp, dword [rcx + 0x63]
jge 0x1400088b4
fcmovnu st(0), st(6)
shr dword [rcx + 0x54], 0xe5
xchg esp, eax
push rdx
loope 0x14000893d
sal ecx, 1
loopne 0x1400088b1
invalid
and bl, 0xa6
ret 0x3e10
Function at 0x140009ef8
Capabilities:
Encode data using xor

Disassembly:
sub byte [rbx - 0x68], cl
lodsb al, byte [rsi]
mov esp, 0xe6b8670c
invalid
pop rbp
imul eax, dword [rsp + rdx*2], 0x26
fdiv qword [rdi - 0x18cadaa5]
xchg edi, eax
mov ebp, 0x4dde7fff
and eax, 0x479b713c
in eax, dx
push rsi
pop rbx
mov edx, 0x5dbe200a
sub dword [rbx + 0x78824024], esp
add dh, byte [rbp - 0x2c]
test dword [r13 + 0x7598d5ab], esp
movsd dword [rdi], dword [rsi]
stosd dword [rdi], eax
invalid
cwde
jne 0x140009ecd
invalid
sub dword [rbx - 0x53], eax
push 0x24
sbb bl, cl
and eax, 0x2b9933d0
xchg dword [rax + 0x72], ecx
xor bl, byte [rcx + 0x637545c4]
jns 0x140009ec3
pop rax
loop 0x140009ea8
xor ebx, edx
jl 0x140009f7a
out dx, eax
test byte [rdi + 0x5f], dl
adc al, 0x96
in al, dx
movabs eax, dword [0x77187391fc988402]
cmp ecx, edi
shr byte [rbx - 0x24], 1
invalid
mov ecx, 0xc53e72d2
jmp 0x11c1f27c7

Function at 0x14000d488
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [rsi - 0x7e392593]
and edx, 0xffffffd3
add edx, dword [rdx]
xor al, 0x28
pop rsi
ja 0x14000d487
jnp 0x14000d47e
mov ecx, 0xee6e23c6
enter 0xffffffffffffe0e0, 0xffffffffffffff9b
loopne 0x14000d435

Function at 0x14000f058
Capabilities:
Encode data using xor

Disassembly:
add al, 0xb0
add dword [rdi + 0x3750ab3b], 0x49
xor byte [rax + 0x54fee6dc], dl
pop rsp
scasb al, byte [rdi]
lahf
sub byte ss:[rsi], bl
ficomp dword [rdx + rsi - 0x44709155]
pushfq
xor ch, byte [rbx - 0x63447092]
pushfq
xor ch, byte [rbx - 0x63447092]
jae 0x14000f081
and byte [rdx], 0xec
cli
xchg esi, eax
xchg r14, rax
rcl dword [0x19d095be8]
sub dh, al
ja 0x14000f041
cmpsd dword [rsi], dword [rdi]
push 0x78
invalid
sbb esi, ebx
invalid

Function at 0x140010c08
Capabilities:
Encode data using xor

Disassembly:
push rdx
loope 0x140010bfa
cli
rcr byte [rax - 0x612a491e], 0xd0
invalid
sahf
shl byte [rcx - 0x4d8dc0fa], 1
or eax, 0xee8ad19c
cmp byte [rcx], bh
cmp bh, al
pop rdi
lahf
sub eax, ecx
pop rsp
fimul word [rax - 0x284af549]
xlatb
xor al, byte [rsi]
cmc
mov edx, 0xaf2f1557
mov bl, cl
push rcx
cmp eax, 0x6c4080a7
cdq
xchg edi, eax
mov esi, 0xa176cd26
int1
cmp al, 0xce
movabs dword [0x29c524761897ccac], eax
jrcxz 0x140010bc8
fdivr dword [rcx]
adc ah, byte [rcx]
or eax, 0xc8219d5a
loopne 0x140010c2f
int 0x8e
invalid

Function at 0x1400122b8
Capabilities:
Encode data using xor

Disassembly:
stosb byte [rdi], al
in eax, dx
pop rbx
mov edx, 0xc3ea5318
mov ebx, 0xff3b5035
add al, byte [rdi]
xor al, 0x77
xor dl, ah
adc byte [rsi - 0x60f405b6], ch
mov bl, 0x43
cmpsb byte [rsi], byte [rdi]
jnp 0x1400122a4
iretq
Function at 0x140015304
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xddcf2e54
jl 0x140015326
popfq
sub edi, dword [rsi]
jp 0x140015374
pop rdi
std
invalid
je 0x14001532b
stosb byte [rdi], al
cmc
add byte [rbx - 0x2d], 0xf5
sal r13d, cl
and ah, dl
stosd dword [rdi], eax
pushfq
mov bh, byte [rdi - 0x51]
enter 0xffffffffffff9740, 0x10
fimul dword [r10]
fimul dword [rdx]
adc eax, 0xf9016e62
wait
sbb dword [rdi], ebp
and al, 0x97
invalid
xlatb
cmpsq qword [rsi], qword [rdi]
or ebx, dword [rdi + 0x344e7f7]
idiv dword [rdi]
or al, 0xeb
add al, 0x82
mov word [rsi], fs
call 0xcc4922c6
jge 0x14001533b
iretd
xor al, 0x10
cmp bl, cl
or al, 0x22
cmp byte [rsi], bh
xchg esp, eax
sub edi, dword [rdi]
adc eax, 0x8b06f85f
jnp 0x140015387
invalid

Function at 0x140016878
Capabilities:
Encode data using xor

Disassembly:
sub ch, al
adc ecx, dword [rdx + 0x7836d650]
or eax, 0x31cf41f6
jae 0x140016837
xchg edx, eax
mov bh, 0xa8
push rsi
xor ah, byte [rbx]
adc edx, edx
cdq
fstp qword [rcx]
cli
sub al, r12b
sbb al, 0x84
loope 0x140016813
invalid
invalid
and ax, 0xa9af
fst qword [rbx - 0x3195fae2]
invalid
add eax, 0xdb5bce6a
rcl byte [rdi + 0x15], 0xf8
loop 0x140016837
push 0x3e770aa6
mov rax, cr5
or edi, dword [rsp + riz*2 + 0x43]
movabs eax, dword [0x6a565bb84cc7406f]
mov esi, 0x6adfca88
push rdi
jle 0x140016804
invalid
sbb al, 0xe8
fcom st(0)
mov dl, byte [rax + 0x44]
sti
mov ebx, dword [rcx - 0x2db2ec81]
jae 0x1400168fa
mov word [rbp - 0x4754c057], ds
int 0x4c
jle 0x140016813
add al, 0x2b
add eax, 0x7ca99eb1
loope 0x14001683e
fst st(1)
jge 0x140016852
push rax
invalid
mov r13d, 0x542c1b5e
imul edi, dword [rax - 0x474f01de], 0x55302432
rcl byte [rdx + 0x7d5d2a0]
invalid
mov eax, dword [rbx - 0x6706a487]
push rbp
ffreep st(1)
mov ch, byte [rdx]
sbb byte [rbp - 0x3d7873cf], cl
sbb al, dh
pop rbp
nop
or byte [rdi*2 + 0x24b2b5b9], dh
jl 0x1400168d0
add dword [rsi], edx
fiadd dword [rdx]
cmpsb byte [rsi], byte [rdi]
mov esi, 0x166ef636
invalid

Function at 0x14001fb3c
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [rsi]
mov bl, 0xd
mov spl, 0x19
pop rbx
pop rbp
sbb dword [rbx + 0x5d], ebx
mov esi, 0xc09b43c7
xor edx, esp
jge 0x14001fb41
mov dl, 0xd4
cmc
invalid

Function at 0x140024dd8
Capabilities:
Encode data using xor

Disassembly:
int1
lodsb al, byte [rsi]
in al, dx
push rax
test al, 0x8f
invalid
js 0x140024d80
mov esp, 0x78f7b559
xchg ebp, eax
xchg dword [rdx], esi
invalid

Function at 0x14002c430
Capabilities:
Encode data using xor

Disassembly:
add dword [rax], esi
lodsd eax, dword [rsi]
cmp ch, byte [0xf83cdb4d]
test eax, 0x386a1778
push 0x38
lahf
xlatb
xor dword [rsp + rax*8 + 0x2525f93], eax
push rbp
xor rsi, qword [r10 + r15*4 - 0x52]
xor esi, dword [rdx + rdi*4 - 0x52]
sub eax, 0x3e8345bd
movabs dword [0x6a163f3c5ae9eb18], eax
pop rdx
mov dh, 0xee
wait
popfq
mov eax, 0xcd3f1eae
xchg bh, ch
jno 0x14002c43e
invalid

Function at 0x14002e5a0
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [rax + rbp*2]
or bl, cl
or al, 0x3c
lahf
leave
push rsi
xchg esi, eax
mov byte [rdi - 0x56], ch
jg 0x14002e594