joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401286b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1401286dd
mov rdi, qword [rdx + 0x10]
jmp 0x14012872e
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1401286fe
call fcn.140027630
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140128718
call fcn.140027630
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x14012872e
call fcn.140027630
call fcn.140058dec
cmp qword [rax + 0x68], 0
je 0x140128748
mov rdx, rdi
mov rcx, rbp
call fcn.140126d3c
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401284d0
mov rcx, qword [rbp + 0xb8]
mov rsi, rax
test rcx, rcx
je 0x14012876f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xb8], 0
test rsi, rsi
je 0x14012877e
mov rdi, rsi
mov qword [rbp + 0xb8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14012917c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x40d9
call fcn.140160fcc
lea r8, [rbx + 0x1b8]
mov edx, 0x40da
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x268]
mov edx, 0x40db
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140161224

Function at 0x140134270
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x4090
call fcn.140160fcc
lea r8, [rbx + 0x1b8]
mov edx, 0x4104
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x288]
mov edx, 0x4102
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x330]
mov edx, 0x408e
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x3d8]
mov edx, 0x4106
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x480]
mov edx, 0x4103
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x528]
mov edx, 0x4101
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x5d0]
mov edx, 0x40d9
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x678]
mov edx, 0x4105
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x720]
mov edx, 0x4082
mov rcx, rdi
call fcn.140161224
lea r8, [rbx + 0x728]
mov edx, 0x408f
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140161224
Function at 0x140135f8c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x110]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x4265
call fcn.140160fcc
lea r8, [rbx + 0xb88]
mov edx, 0x425d
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x1600]
mov edx, 0x421c
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x16a8]
mov edx, 0x421d
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x1750]
mov edx, 0x421a
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x17f8]
mov edx, 0x421b
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x18a0]
mov edx, 0x4219
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x1b68]
mov edx, 0x421a
mov rcx, rdi
call fcn.140161224
lea r8, [rbx + 0x1b70]
mov edx, 0x421c
mov rcx, rdi
call fcn.140161224
lea r8, [rbx + 0x1b78]
mov edx, 0x421d
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140161224

Function at 0x140136c90
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x128]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x40f7
call fcn.140160fcc
lea r8, [rbx + 0x1d0]
mov edx, 0x40fa
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x278]
mov edx, 0x4082
mov rcx, rdi
call fcn.140160fcc
lea r8, [rbx + 0x320]
mov edx, 0x4082
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140161224

Function at 0x140139004
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x11
mov ebx, edx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov si, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r11w, ax
and r11d, 0x8000
and esi, 0x8000
je 0x140139053
cmp ebx, 0x43
je 0x140139064
cmp ebx, 0x2d
je 0x140139064
cmp ebx, 0x56
je 0x14013905d
test r11d, r11d
je 0x140139080
cmp ebx, 0x2d
jne 0x140139080
mov edx, 0x302
jmp 0x140139069
mov edx, 0x301
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14013909c
test esi, esi
je 0x140139089
cmp ebx, 0x58
je 0x140139093
test r11d, r11d
je 0x14013909a
cmp ebx, 0x2e
jne 0x14013909a
mov edx, 0x300
jmp 0x140139069
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14016f860
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0xe8]
mov rbx, rcx
mov rcx, rdi
mov edx, 1
call fcn.140160fcc
lea r8, [rbx + 0x190]
mov edx, 0x4084
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140161224

Function at 0x140173aa0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov bl, r8b
movzx ebp, dx
mov rdi, rcx
call qword [rax + 0x2a0]
mov ecx, ebp
mov edx, 2
mov esi, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test bl, bl
jne 0x140173af7
test esi, esi
js 0x140173af7
cmp ax, 0x20
je 0x140173ae9
cmp bp, 0x71
jne 0x140173af7
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401835fc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14018caa0
nop
cmp dword [0x14025aaf8], 1
je 0x1401835a8
mov dword [0x14025aaf4], 1
mov byte [0x14025aaf0], r12b
test ebx, ebx
jne 0x140183594
mov rcx, qword [0x14025cf90]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140183581
mov rcx, qword [0x14025cf88]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140183520
call fcn.140189934
cmp qword [rdi], rax
jne 0x140183520
jmp 0x140183506
cmp rdi, rsi
jb 0x140183581
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140189934
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14025cf90]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14025cf88]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14018355f
cmp r13, rax
je 0x14018357f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140183506
lea rdx, [0x1401b9a80]
lea rcx, [0x1401b9a68]
call fcn.140183350
lea rdx, [0x1401b9a90]
lea rcx, [0x1401b9a88]
call fcn.140183350
nop
test r12d, r12d
je 0x1401835b7
mov ecx, 8
call fcn.14018c9a0
test r12d, r12d
jne 0x1401835e2
mov dword [0x14025aaf8], 1
lea ecx, [r12 + 8]
call fcn.14018c9a0
mov ecx, r15d
call fcn.1401832e4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140183470

Function at 0x140183608
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140183470
Function at 0x140189e87
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14024f530]
jne 0x14018286a
rol rcx, 0x10
test cx, 0xffff
jne 0x140182866
repz ret
ror rcx, 0x10
jmp 0x140189de0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14025b100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14025b1f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140189e65
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14025b100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140189e87
mov rax, qword [rsp + 0x88]
mov qword [0x14025b1f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14025b198], rax
mov rax, qword [0x14025b1f8]
mov qword [0x14025b070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14025b180], rax
mov dword [0x14025b060], 0xc0000409
mov dword [0x14025b064], 1
mov rax, qword [0x14024f530]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14024f538]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14025b0f8], eax
mov ecx, 1
call fcn.14018cfe8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140209dc0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14025b0f8], 0
jne 0x140189f0e
mov ecx, 1
call fcn.14018cfe8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140194ce4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140189934
xor ebx, ebx
mov rdi, rax
cmp qword [0x14025b988], rbx
jne 0x140194dea
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140194ebf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140194ebf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140209ff0]
mov rcx, rsi
mov qword [0x14025b988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140209fd8]
mov rcx, rsi
mov qword [0x14025b990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14025b998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14025b9a8], rax
test rax, rax
je 0x140194de1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14025b9a0], rax
jmp 0x140194df1
mov rax, qword [0x14025b9a0]
jmp 0x140194df8
mov rax, qword [0x14025b9a0]
mov r11, qword [0x14025b9a8]
cmp rax, rdi
je 0x140194e60
cmp r11, rdi
je 0x140194e60
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14025b9a8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140194e60
test rax, rax
je 0x140194e60
call rsi
test rax, rax
je 0x140194e5a
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140194e5a
test byte [rsp + 0x38], 1
jne 0x140194e60
bts ebp, 0x15
jmp 0x140194e9e
mov rcx, qword [0x14025b990]
cmp rcx, rdi
je 0x140194e9e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140194e9e
call rax
mov rbx, rax
test rax, rax
je 0x140194e9e
mov rcx, qword [0x14025b998]
cmp rcx, rdi
je 0x140194e9e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140194e9e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14025b988]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140194ebf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140194ec1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140017e84
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
jmp 0x140018181
mov rsi, rsi
mov dword [rsp - 0x24], esi
mov dword [rsp - 0x3c], 0x6eb093
xor eax, eax
lea rdi, [rsp + 0x30]
mov dword [rsp - 0x28], 0x601916f5
mov dword [rsp - 0xc], edx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140016b40
mov dword [rsp - 0x44], 0xd45c5f4
mov dword [rsp - 0x24], 0x2cb602f2
jmp 0x140018166
Function at 0x14001ee29
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or eax, 0x744a7500
xor r8d, 0xb0ff91a7
pop rbp
ret
pop rdi
pop rsi
xchg r8, r8
mov rsp, rsp
mov r11, r11
mov rcx, rcx
mov dword [rsp - 0x3c], 0x298c6270
jmp 0x14001e40d
pop rbx
ret
pop rbx
pop r15
pop r14
mov dword [rsp - 0x40], 0x7d27c267
mov rsi, rsi
jne 0x14001e530
je 0x14001e530
jnp 0x14001e5cc
rcl ebx, 0xe8
rcr r13d, 0x3d
ja 0x14001df0f
lea r13d, [rcx - 0x86d0]
lea r8d, [rcx - 0x5c1b]
int3
jmp 0x14001ee21
add byte [rax], al
insd dword [rdi], dx
add byte [rcx], dl
mov dword [rsp - 0x1c], 0x413731d8
mov dword [rsp - 0x3c], 0x686b64f2
xchg rbp, rbp
mov dword [rsp - 0x2c], edi
mov dword [rsp - 0xc], 0xc7fbbdb
mov rbx, qword [rsp + 0xc68]
jmp 0x14001ee98
je 0x14001eea2
call fcn.14001ecfb
add rsp, 0x4b
jmp 0x14001e4de
xor eax, eax
mov dword [rsp - 0x34], 0x6b20a835
mov dword [rsp - 0x20], 0xd8d9351
jmp 0x14001e75e
mov dword [rsp - 0x18], ecx
mov r10, r10
pop r13
pop rbp
pop r12
jne 0x14001ee7d
je 0x14001ee7d
pushfq
and ecx, 0x979dbb88
jnp 0x14001f981
call fcn.14001eff4
int3
jmp 0x14001e49b
add rsp, 0xc10
push rbx
movabs rbx, 0x220365fffff639e9
jne 0x14001eea2
jmp 0x14001e4e0
jmp 0x14001eba8
add eax, 0x54890000
and al, 0xd0
mov r10, r10
mov dword [rsp - 0x14], 0x60ab8cca
mov dword [rsp - 0x24], 0x111a9f89
mov dword [rsp + 0x34], 0x1d006d
jmp 0x14001fb66
mov dword [rsp + 0x38], 0x13002e
mov dword [rsp + 0x3c], 0x5e0024
mov r13, r13
mov dword [rsp - 0x28], 0x5ba3e9fa
mov dword [rsp - 0x10], 0x76cb8bc
mov dword [rsp + 0x40], 0x2b006a
mov dword [rsp + 0x44], 0x10003a
jmp 0x140020499
mov dword [rsp + 0x48], 0x2a0047
mov dword [rsp + 0x4c], 0x440024
mov dword [rsp - 0x34], edx
mov dword [rsp - 0x30], 0x5d753439
mov dword [rsp - 0x20], edi
mov dword [rsp - 0x14], 0x7b305c22
xchg rdi, rdi
Function at 0x1400204c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor cx, dx
mov word [rbp + rax*2 + 0x20], cx
mov rax, qword [rsp + 0x20]
mov dword [rsp - 0x44], 0x72169830
mov dword [rsp - 0x18], 0x5b4468d2
add rax, r14
mov qword [rsp + 0x20], rax
jmp 0x14001fb2a
jmp 0x14002047f
jmp 0x140020152
mov dword [rsp - 0x3c], 0x1be0026c
mov dword [rsp + 0x50], 0x1002e
mov dword [rsp + 0x54], 0x42003f
mov dword [rsp + 0x58], 0x360061
mov dword [rsp - 0x38], 0x6aeaa8c3
mov dword [rsp - 0xc], 0x3d709fc1
je 0x14001f94d
jne 0x14001f94d
movabs r14, 0x7c695b000009eae9
int3
jmp 0x14002033c
mov rax, qword [rsp + 0x20]
cmp rax, 0x1a
xchg r12, r12
mov dword [rsp - 0x1c], esp
jb 0x140020351
mov word [rbp + 0x54], bx
jmp fcn.14001ff90
movabs r12, 0x4001c9000002dfe9
jne 0x14001fedd
jmp 0x1400201c1
je 0x14001fedd
call fcn.140020081
add rsp, 0x5e
pop r12
jmp loc.1400201c0
mov r14, r14
mov dword [rsp - 0x18], 0x6ba8ec22
mov rax, qword [rsp + 0x20]
push r12
jne 0x14001ff21
je 0x14001ff21
and edi, 0x6626784f
add r15d, 0xf2dabf21
dec rsi
movabs r12, 0x57b2820a0f09b8eb
and esi, 0x8c3300fb
add r8d, 0xee8682be
call rax
call fcn.14001efa3
jmp 0x14001fedb
jne 0x14001f90a
je 0x14001f90a
call int.1400202de
jmp 0x140020479
pop r12
and cl, 3
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x28]
mov dword [rsp - 0x3c], 0x57acb5d7
jne 0x1400201fc
mov rdx, rdx
mov dword [rsp - 0x28], 0x3336f7d3
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
mov dword [rsp - 0xc], 0x79f74575
jne 0x140020379
je 0x140020379
cpuid
pop rdi
test r12d, 0x69197bc4
invalid
invalid
jnp 0x140020384
imul eax, dword [rcx - 0x3f], 0xf9c42d6
cmp dword [rbx], 0xb
add byte [rax], al
movabs rdx, 0x629f42fffffb7be9
ret
jmp 0x14001fef9
add rsp, 0x5e
pop rbx
ret
pop rbx
jmp 0x14001f8a1
hlt
invalid
invalid
jne 0x1400204cc
je 0x1400204cc
call rax
movabs rdx, 0x7c6fb1fffff446e9
dec rcx
rcr r11d, 0x24
lea r14d, [rcx - 0x9da2]
invalid
dec dword [rdi]
xchg byte [rdi], ah
add al, 0
invalid
jmp 0x14001f917
and r12d, 0xfd9faec
call 0x140020155
sub r9d, 0xca7d68b1
jmp 0x14001f912
add byte [rax], al
je 0x140020a2f
call fcn.140020a37
add rsp, 0x20
jmp 0x1400209b1
pop rdi
ret
pop rdi
jmp 0x1400209da
xchg rbx, rbx
ret
jmp 0x1400209b3
sbb byte [rcx], cl
add byte [rax], al
ret

Function at 0x140020b1a
Capabilities:
Encode data using xor

Disassembly:
and al, 0xcc
test byte [rbx + rdi], dl
add byte [rax - 0x75], cl
xlatb
lea rax, [0x140001148]
mov qword [rcx + 0x28], rax
jmp 0x140020bf9

Function at 0x140023851
Capabilities:
Execute syscall

Disassembly:
mov dword [rbp + 0x34], 3
call qword [rax + 0x30]
mov dword [rsp - 0x1c], ecx
xchg r13, r13
mov dword [rsp - 0x40], 0x1698c3d7
mov dword [rbp + 0x28], 0xe
je 0x14002387f
jne 0x14002387f
syscall
pause
ret
jmp 0x14002390b
invalid
sub al, 0xe
Function at 0x140028f0d
Capabilities:
Encode data using xor

Disassembly:
xchg edi, edi
mov dword [rsp - 0x34], ebp
push r11
movabs r11, 0x33fc4f00000142e9
jmp 0x140028f24
Function at 0x14002d4ef
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rcx
mov dword [rsp - 0x10], 0x39d963e2
mov dword [rsp - 0x1c], 0x2ffaad72
mov rbx, rax
jmp 0x14002d838
call fcn.1400f1464
mov dword [rsp - 0x24], 0x16ca14cc
xchg r14, r14
je 0x14002d543
jne 0x14002d543
rcr r8d, 0x79
jmp rax
jmp 0x14002d4a0

Function at 0x14002f4b2
Capabilities:
Execute syscall

Disassembly:
add eax, 0x41000004
pop rsp
call rax
mov rbx, rax
test rax, rax
jmp fcn.14002e6d7
add edx, 0x502fe41e
ror edx, 0xe
call rcx
lea esi, [rdi - 0xd01b]
ror r15d, 0x89
sub r9d, 0xb946366b
div rdx
movabs rbp, 0x14f2ebfffffa80e9
lea ecx, [rcx - 0x93d4]
call fcn.14002fb7e
pushf
js 0x14002e7c3
ret
Function at 0x140034a04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test edx, ebx
add al, 0
add byte [rax + rax], al
sbb eax, 0xde85c700
add al, 0
add byte [rdx], ah
add byte [rbp], al
Function at 0x1400358e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg rsi, rsi
add byte [rsi], al
add byte [rsi], ah
mov dword [rsp - 0x34], 0x5fd7f08
xchg rdi, rdi
jmp 0x1400353ee

Function at 0x14003995d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ret
pop r15
mov dword [rbp + 0x214], 0x29006f
mov dword [rbp + 0x218], 0x1e0028
mov rcx, rcx
movabs r15, 0x1dc2fcfffffed5e9
jne 0x1400390d2
jmp 0x140038fac
je 0x1400390d2
call fcn.140039126
add rsp, 0x65
pop r15
jmp 0x140038fab
push rdi
jmp 0x1400390d0
ret
pop rbp
xchg r9, r9
mov qword [rbp + 0x10a8], r14
lea r14d, [rsi - 0x17]
je 0x140039888
jne 0x140039888
lea r11d, [rbp - 0x5e4]
bswap rcx
bswap r12
jb 0x1400391db
add ebp, 0x7597bdef
jge 0x14003a3a7
inc r9
popfq
xor ebx, 0x3dbcaf23
sub r12d, 0xa0b0901d
movabs r14, 0x4d2573000000bde9
mov ebx, 0xecb8343e
add edi, 0x574611de
ror r8d, 0xa
sub edx, 0xa756033c
ret
jmp 0x14003994a
mov rax, qword [rbp + 0x10a8]
mov dword [rsp - 0x18], 0x7986fa5c
mov rsp, rsp
jmp 0x140039ada
jns 0x140039960
add byte [rax], al
pop rsi
mov dword [rbp + 0x2c8], 0x18006d
mov dword [rbp + 0x2cc], 0x36004b
add byte [rbx], cl
add bh, al
test eax, edx
add al, byte [rax]
add byte [rdi], bh
add byte [rdi], bl
jmp 0x140039de6
jmp 0x140039a89
movabs rbp, 0x1b59c6fffffb44e9
jne 0x140039cfa
jmp 0x140039843
je 0x140039cfa
call 0x140039cef
add rsp, 0x78
pop rbp
jmp 0x140039842
xchg rbp, rbp
mov rdi, rdi
mov dword [rbp + 0x2d4], 0x64007c
mov dword [rbp + 0x2d8], 0x540068
mov dword [rbp + 0x2dc], 0x6a0027
push rbp
jmp 0x140039cf8
hlt
Function at 0x1400488cf
Capabilities:
Encode data using xor

Disassembly:
ror byte [rax - 0x77], 0x44
and al, 0x40
xchg r9, r9
mov r8, r8
je 0x140047d9c
mov dl, 0xb
add byte [rax], al
test byte [rsi + 0xffffffa], cl
mov word [rsi], es
cli
invalid
sbb ebp, dword [rsi]
mov qword [rsp + r12 - 0x30], 0x1a2e2f42
cpuid
cpuid
pop r12
rcl r11d, 0xfd
ret
invalid
jrcxz 0x140048687
add byte [rax], al
xchg r12, r12
mov rcx, rcx
mov word [rbp + 0xbb2], bx
add rax, rcx
lea rdx, [rbp + 0xb64]
mov r12, r12
jmp 0x140048ceb
mov r9d, 0x10
mov dword [rsp - 0x34], 0xf9161f
mov dword [rsp - 0x38], ebx
jmp 0x140048b87
mov rdx, rdx
mov rax, qword [rsp + 0x40]
cmp rax, r14
jb 0x140048d41
mov r13, r13
xchg r11, r11
mov dword [rsp - 0x20], 0x71a9364a
jmp 0x140048d6e
movabs rdi, 0x311880000000f2e9
jne 0x14004887f
jmp 0x140048976
je 0x14004887f
jmp 0x14004896b
mov rcx, qword [rsp + 0x40]
mov dword [rsp - 0xc], 0x19ed6263
mov dword [rsp - 0xc], 0x3325217b
mov dword [rsp - 0x3c], 0x2ea8ee06
mov rax, qword [rsp + 0x40]
and cl, r15b
shl cl, 3
jmp 0x140048d07
mov dword [rbp + 0x1fc], 0x2a0061
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
xchg r12, r12
mov dword [rsp - 0xc], 0x5a937c87
jmp 0x140048d41
rep stosb byte [rdi], al
lea rdi, [rbp + 0x918]
mov dword [rsp - 0x20], 0x26279a7b
mov rsp, rsp
mov dword [rsp - 0x40], 0x2767ab15
jmp fcn.140047ca1
mov qword [rsp + 0x40], rax
mov dword [rsp - 0x40], esi
mov dword [rsp - 0x14], 0xc40cc6b
mov dword [rsp - 0x30], 0x2c55f193
mov rax, qword [rsp + 0x40]
jmp 0x1400489ae
xchg rbx, rbx
mov ecx, 0x63
mov word [rbp + 0x940], bx
jmp 0x140048a0f
xchg rsi, rsi
mov dword [rbp + 0x1b4], 0x2b0057
mov dword [rbp + 0x1b8], 0x100038
push rdi
jmp 0x14004887d
not rax
movabs rcx, 0x4e04da5d9048bfe4
add rax, rcx
jmp 0x1400487bc
call 0x1400488cf
add rsp, 0x30
pop rdi
ret
pop rdi
jmp 0x140048ed5
cmp rax, rsi
cmp eax, esi
jb 0x140048890
xchg rsp, rsp
mov rdi, rdi
mov dword [rsp - 0x10], 0x11cbe657
je 0x1400489f4
jne 0x1400489f4
div rcx
sub r13d, 0xe0e7e052
or r15d, 0x56e3e0f0
pushf
jmp rcx
jmp 0x140048925
mov word [rbp + 0x200], cx
mov dword [rsp - 0x3c], ecx
mov dword [rsp - 0x10], 0x7f9e91c5
xchg r11, r11
jmp 0x140048939
ret
pop r12
xor ecx, ecx
rol rax, 0x25
jmp 0x140048d53
mov dword [rsp - 0x3c], 0x7e96fa8
lea rdi, [rbp + 0xb64]
mov rcx, r14
jmp 0x1400488e1
mov dword [rsp - 0x1c], esi
mov dword [rsp - 0x34], 0x5d02ae45
shl cl, 3
movzx edx, word [rbp + rax*2 + 0x1b4]
mov eax, r12d
jne 0x140048b65
je 0x140048b65
jo 0x14004985a
lea edx, [rcx + 0xb31b]
add r14d, 0x1ca26109
mov r10d, 0xf0473bc3
movabs r14, 0x15a9410000010ee9
call rax
rcr r13d, 0x85
call rax
cmp r8d, 0x60938266
lea r14d, [rdx - 0x4057]
neg r15
ret
jmp 0x140048c78
not rax
push r12
movabs r12, 0x1f5cf0ffffff15e9
je 0x140048bc8
jmp 0x140048aa8
jne 0x140048bc8
lea r12d, [rdi - 0x8933]
call rcx
call rax
syscall
popfq
cmp r14, rbx
call rcx
rcl r8d, 6
jno 0x14004982c
rcl ecx, 0x33
invalid
invalid

Function at 0x140048f33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp - 0x2c], 0x525f855b
mov dword [rsp - 0x1c], 0x2da47764
mov dword [rsp - 0x38], 0xbdcdb12
xchg rbx, rbx
jmp 0x1400487d3
Function at 0x14004c79a
Capabilities:
Execute syscall

Disassembly:
add byte [rdi], ah
sub al, byte [rax]
jmp 0x14004c77b
mov dword [rbp + 0xf4], 0x75006d
mov dword [rbp + 0xf8], 0x36007c
mov dword [rbp + 0xfc], 0x420022
xchg r10, r10
xchg edx, edx
mov dword [rsp - 0x2c], 0x353987e4
mov dword [rsp - 0x30], 0x2fe40d9f
jne 0x14004c7de