joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087080
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140087180
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140089740
cmp esi, dword [rbx + 0x48]
jae 0x140087100
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140089780
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov rdi, rax
test rax, rax
je 0x14008718d
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov r14, rax
test rax, rax
je 0x14008718d
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x1400870cf
call fcn.1400862b0
mov rbx, rax
jmp 0x1400870ba
mov rcx, r13
call fcn.140089780
mov eax, 0xc
jmp 0x1400870ed

Function at 0x140087210
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140087238
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.1400862b0
test rax, rax
jne 0x14008722a
add rsp, 0x28
ret

Function at 0x1400872a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400872c8
add rax, 0x18
add rsp, 0x28
ret
call fcn.1400862b0
test rax, rax
jne 0x1400872ba
jmp 0x1400872be

Function at 0x1400873e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140167238]
test eax, eax
jne 0x1400873f8
xor eax, eax
add rsp, 0x28
ret
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140087428
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x1400873ee
test byte [rax + 0x40], 3
je 0x1400873ee
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x1400873f0
call fcn.1400862b0
test rax, rax
jne 0x14008740e
jmp 0x1400873ee
Function at 0x140087440
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140087480
test ebx, ebx
jle 0x140087470
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.1400862b0
test rax, rax
jne 0x14008745d
add rsp, 0x20
pop rbx
ret

Function at 0x140087570
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400875e8
test byte [rbx + 0x40], 0xc
jne 0x14008759f
mov eax, dword [0x140167238]
test eax, eax
jne 0x1400875b0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140085480
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1400875d3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1400875d3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400875fc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140085750
call fcn.1400862b0
mov rbx, rax
test rax, rax
jne 0x14008758f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14008761a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140085750
call fcn.140087490
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400876a0
call fcn.140088810
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x1400876d8
call fcn.140086200
mov ecx, dword [0x140131be8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140087730
test esi, esi
je 0x1400876b6
call fcn.140087570
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140087710
mov edx, edi
call fcn.1400888e0
call fcn.140087570
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140087720
call fcn.140087570
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140087570
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140086200
mov ecx, dword [0x140131be8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140087675
call fcn.1400862b0
mov rbx, rax
jmp 0x140087675
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008768e
call fcn.1400862b0
jmp 0x1400876b6
call fcn.1400862b0
mov rbx, rax
jmp 0x140087671
Function at 0x140087630
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400875e8
test byte [rbx + 0x40], 0xc
jne 0x14008759f
mov eax, dword [0x140167238]
test eax, eax
jne 0x1400875b0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140085480
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1400875d3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1400875d3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1400875fc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140085750
call fcn.1400862b0
mov rbx, rax
test rax, rax
jne 0x14008758f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14008761a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140085750
call fcn.140087490
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400876a0
call fcn.140088810
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x1400876d8
call fcn.140086200
mov ecx, dword [0x140131be8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140087730
test esi, esi
je 0x1400876b6
call fcn.140087570
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140087710
mov edx, edi
call fcn.1400888e0
call fcn.140087570
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140087720
call fcn.140087570
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140087570
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140086200
mov ecx, dword [0x140131be8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140087675
call fcn.1400862b0
mov rbx, rax
jmp 0x140087675
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008768e
call fcn.1400862b0
jmp 0x1400876b6
call fcn.1400862b0
mov rbx, rax
jmp 0x140087671

Function at 0x140087740
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140086200
mov ecx, dword [0x140131be8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400877b0
test esi, esi
je 0x140087790
call fcn.140087570
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400877c0
mov edx, esi
call fcn.1400888e0
call fcn.140087570
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140087570
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140087570
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400862b0
mov rbx, rax
jmp 0x140087761
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008777a
Function at 0x140088b00
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x140131bf8]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call fcn.140089740
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x140088b49
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x140088b49
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call fcn.140089780
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call fcn.140084ea0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
nop
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
neg eax
mov dword [rcx + 0xc], eax
mov rbx, rcx
lea rcx, [rcx + 0x20]
mov dword [rcx - 0x10], 0
call fcn.140085750
lea rcx, [rbx + 0x18]
add rsp, 0x20
pop rbx
jmp fcn.140085750

Function at 0x140088f90
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140088dd0
test eax, eax
je 0x140088fb8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.140085480
test eax, eax
jne 0x140088fe1
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140088ff8
mov rcx, rdi
call fcn.140085750
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140088b00
lea r12, [rsi + 0x20]
mov rcx, r12
call fcn.140085480
mov ebp, eax
test eax, eax
je 0x140089020
mov rcx, rdi
call fcn.140085750
mov edx, ebp
jmp 0x140088fe3
mov eax, dword [rsi + 0x10]
sub dword [rsi + 0xc], eax
mov rcx, r12
mov dword [rsi + 0x10], 0
call fcn.140085750
mov rcx, rdi
mov esi, eax
call fcn.140085750
test esi, esi
mov edx, esi
cmove edx, eax
jmp 0x140088fe3

Function at 0x1400892c0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140088a90
test eax, eax
jne 0x140089340
mov rsi, qword [rbx]
mov edx, dword [rsi + 8]
test edx, edx
je 0x140089310
lock sub dword [rsi + 8], 1
lea rcx, [rsi + 0x20]
call fcn.140085750
lea rcx, [rsi + 0x18]
mov edi, eax
call fcn.140085750
test edi, edi
cmove edi, eax
mov edx, edi
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.140088b00
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.140085480
mov edx, eax
test eax, eax
jne 0x1400892fd
lock add dword [rsi + 0x10], 1
mov eax, dword [rsi + 0x10]
test eax, eax
je 0x140089350
mov rcx, rdi
call fcn.140085750
mov edx, eax
jmp 0x1400892fd
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, [rsi + 0x28]
call fcn.14008a0b0
mov rcx, rdi
mov dword [rsp + 0x2c], eax
call fcn.140085750
mov edx, dword [rsp + 0x2c]
test edx, edx
cmove edx, eax
jmp 0x1400892fd
Function at 0x2fc5fd450
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc5fde52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc620108]
test eax, eax
je 0x2fc5fdeea
lea rax, [0x2fc6200e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc620110]
mov qword [rbp - 8], rax
jmp 0x2fc5fdece
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5fdec2
cmp qword [rbp - 0x10], 0
je 0x2fc5fdec2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5fde88
lea rax, [0x2fc6200e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5fdeeb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5fdff0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5fe018
mov eax, 0
jmp 0x2fc5fe066
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5fe041
mov eax, 0
jmp 0x2fc5fe066
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc5fe061
mov eax, 0
jmp 0x2fc5fe066
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc5fe06c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5fe0ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5fe0e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5fe0e1
mov rax, qword [rbp - 8]
jmp 0x2fc5fe0ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5fe0b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1408368ff
Capabilities:
Encode data using xor

Disassembly:
push r10
push r9
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0x4dd640fe
push 0x1b067fbf
pop r12
push r12
setbe r12b
xor byte [rsp], 0x7d
pop rsi
jb 0x140836916
call fcn.14089bf8c
cmc
cmc
invalid

Function at 0x14086024d
Capabilities:
Encode data using xor

Disassembly:
movabs r13, 0x19403e3044eb414a
mov r10, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x4c1e74ff
seto r13b
xor dil, 0x72
bswap rdi
cmp r13b, dil
lea rdi, [rdi*8 + 0x4e8b6491]
push r8
push 0x5d941b1e
jge 0x140860269
push rbx
lea r13, [r13 + rdi*4 + 0x14112dd3]
mov r8, r13
mov rbx, qword [rsp + 8]
jne 0x140895f45

Function at 0x140883dc1
Capabilities:
Check for software breakpoints

Disassembly:
mov r11, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xfffffffff5050aa5
movabs rcx, 0x499463dd06e55d52
neg rbx
cmp cl, 0xcc
mov bx, cx
lea rcx, [rbx*8 + 0x3b5558fb]
lea rcx, [rbx + rcx*4 + 0x14be0f78]
setb bl
lea rbx, [rbx + 0x2584a75]
push r10
movabs r10, 0x327061124e7e5533
sub bl, ch
not ecx
movzx r10w, r10b
sub r10d, 0x2ea71a49
test r10w, 0xc02
cmova rcx, rbx
add rbx, 0x4d0d61df
xor rcx, 0x55b6425
or cl, 0xa4
or ebx, 0x65d71c99
setg bl
push r10
add qword [rsp + 0x18], 0xffffffffffeec2da
xor r10, 0x40443f99
sub rcx, 0x6f6c35dd
seto cl
lea r10, [r10 + rcx*4 + 0x5a25412d]
mov rbx, qword [rsp + 0x20]
test cx, 0x99b
sete cl
test byte [rsp], 0x6a
lea r10, [rcx + rcx*4 + 0xcdb061e]
setl r10b
add r10d, dword [rsp]
setl byte [rsp]
call fcn.140994e70
movabs rbx, 0x657e32ff1c0c14a9
not bx
push rcx
movsx r11d, bx
jbe 0x140883dcb
cmp r11b, bl
jle 0x14082ffe8

Function at 0x14088bed5
Capabilities:
Encode data using xor

Disassembly:
and word [rsp + 0x60], r9w
sub r15b, r9b
test word [rsp + 0x68], r9w
mov dword [rsp + 0x38], r15d
ja 0x14086d54f

Function at 0x1408a80f1
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x10]
call fcn.1408b0b70
push r12
pushfq
movabs r12, 0x4450249935c271e6
push r15
push r13
mov r15, r12
movabs r13, 0xb3f5a9f7f476e6a
and r15, 0x745e492a
and r15, r13
not r12
lea r13, [r15 + r13 + 0xbc2716e]
jbe 0x14097c116
add r12w, 0x7e1a
push rdi
movabs rdi, 0x6dbb49f41cab44ce
xor r13, r15
not r15w
neg r13
add r12b, 0xae
mov r13d, 0x34e54578
not edi
and di, r13w
call fcn.140830d21
Function at 0x1408f452a
Capabilities:
Encode data using xor

Disassembly:
push rbx
movabs rbx, 0x4b2714a2788c4f30
pushfq
or bx, 0x73f
push r10
or bl, 0xcf
add qword [rsp + 0x18], 0xffffffffbf7481fa
and rbx, 0x5cba3ef3
movabs r10, 0x74b711581e966f6c
cmp bx, 0x784c
js 0x1408f1a27

Function at 0x1409698ce
Capabilities:
Encode data using xor

Disassembly:
cmovge r14d, r11d
test bl, r14b
cmovb r11, qword [rsp + 0x10]
jle 0x1409d0648
and word [rsp + 0x50], 0x6ea8
not byte [rsp + 0x50]
seta byte [rsp + 0x20]
add dword [rsp + 0x10], 0x3f7521e9
sets byte [rsp + 0x10]
setno byte [rsp + 0x50]
call fcn.1409ae779

Function at 0x14096ad00
Capabilities:
Check for software breakpoints

Disassembly:
add dword [rsp + 0x80], 0x71e036f5
mov qword [rsp + 0x28], 0x39661733
mov byte [rsp + 0x80], 0x17
call fcn.140874812
call fcn.14090d5f2
cmovg rsi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
cmp byte [rsp + 0x68], 0x24
jno 0x140916027

Function at 0x140988c8b
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + 0x20], 0x47111911
xor dword [rsp + 0x20], r8d
add qword [rsp + 8], 0xffffffffbf7393e3
and r14w, 0x2c20
sub qword [rsp + 0x20], r8
add qword [rsp + 0x40], 0x3f197f
xor word [rsp + 0x20], 0xb4b
je 0x140863540
test r8b, r14b
jg 0x14097cca5
add qword [rsp + 0x18], 0x6985e
or r13b, 0xdd
not r10d
movsx r13d, byte [rsp + 0x33]
or word [rsp + 0x30], 0x7287
not r14d
mov r8d, 0x5aa16d3d
add qword [rsp], 0xffffffffffea226d
add word [rsp + 0x30], 0x49ab
neg dword [rsp + 0x30]
cmp r8, 0x5b360fbd
lea r13, [r14 + r8*8 + 0xbeb010d]
mov qword [rsp + 0x30], r14
mov r13, qword [rsp + 0x28]
ret
xor byte [rsp + 0x20], r14b
xor r13, 0x52e03a57
test dword [rsp + 0x20], 0x48a608b0
mov r13, qword [rsp + 0x10]
lea rsp, [rsp + 0x28]
ret 8
bswap r12d
not qword [rsp + 0x38]
call fcn.1409d846a
xor r13b, r13b
movsx ecx, word [rsp + 0x1b]
push r14
sbb eax, dword [rcx + 0x56]
lea rcx, [r13*8 + 0x60c14887]
movzx ecx, byte [rsp]
not cx
add r14, rcx
cmp ecx, dword [rsp + 0x24]
not byte [rsp]
not r13w
lea r14, [r13*4 + 0x32ec1f6b]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0x593929c6
setle byte [rsp + 0x20]
add qword [rsp + 0x28], 0xae73a
cmp r13w, word [rsp + 0x22]
jne 0x14086352a
je 0x140988cf8
fadd dword [rsi + 0x6a]
adc al, cl
push rbp
push rbp
sub byte [rsi], bl
jnp 0x140988c9f
push 0x7c
js 0x140988d1c
xor esp, dword [rsi + 0x6c2b4c21]
and al, 0x18
sub r13b, dil
bswap r13
neg word [rsp + 0x18]
test dword [rsp + 0x19], r13d
lea r13, [r14 + r13*4 + 0x49a361a0]
push r10
cmovl rdi, qword [rsp + 0x20]
mov rdi, r13
push r8
mov rdi, qword [rsp + 0x38]
setg r14b
movabs r10, 0x2ddb29db468f2b09
test r13, 0x1df2516b
setle r13b
jl 0x140988d2f
add r10, 0x61d2741b
bswap r13d
jo 0x1408965ef
jno 0x14099e437
pop rax
or eax, edi
jge 0x140988dcf
adc eax, dword [rax]
fidivr dword [rbp - 0x58]
popfq
or al, 0x82
int3
invalid
movzx r14w, r10w
xor word [rsp + 0x28], 0x62c3
call fcn.1408965e6
Function at 0x14098c736
Capabilities:
Encode data using xor

Disassembly:
test byte [rsp + 0x10], 0x3e
call fcn.140982d94
xchg ecx, eax
imul edx, dword [rdx - 0xb641bda], 0xffffff8e
ret
je 0x14089e3ac
sub r9d, 0x78573805
add r9d, 0x5180602
mov byte [rsp + 0x20], 0xf1
cmp rbp, r9
movabs rbp, 0x14496bd87cb5406e
js 0x14096a6ff
xor r9b, byte [rsp + 0x20]
call fcn.1409904a7
fldenv [rdi - 0x40]
push rsi
lea eax, [rdx]
invalid

Function at 0x1409ae459
Capabilities:
Encode data using xor

Disassembly:
je 0x1408e76b7
sub r14d, r8d
mov dl, 0x21
and r14b, 0x30
call fcn.1408b0aaa
push rbp
mov r8, qword [rsp + 0x30]
mov r14d, r9d
add qword [rsp + 8], 0x14f7a7
mov rbp, r9
call fcn.1408abff1
movabs r14, 0x41f26e682c227f8e
jl 0x14088fb2f
add qword [rsp + 0x40], 0xbdcf
mov r12, qword [rsp + 0x48]
add byte [rsp + 0x50], 0xd3
cmp word [rsp + 0x50], 0x616f
sets byte [rsp + 0x38]
and dword [rsp + 0x50], 0x60fd09cf
cmp byte [rsp + 0x50], 0x9a
not qword [rsp + 0x58]
jb 0x140983253
add word [rsp + 0x58], 0x37e0
not byte [rsp + 0x30]
cmp byte [rsp + 0x38], 0xb6
sete byte [rsp + 0x50]
js 0x14089dc8e
xor qword [rsp + 0x30], 0x14833033
not word [rsp + 0x58]
and byte [rsp + 0x58], 0x39
jae 0x14097d6ed
call fcn.1408cb8a4
push rdx
movabs rdx, 0x2ce130e5e194943
not edx
pushfq
or edx, edx
and edx, 0x50464e25
push r8
add rdx, rdx
movabs r8, 0x3d9b53df765e652e
cmp r8b, dl
bswap edx
setae r8b
push r14
jle 0x1409055da
jg 0x1404fac00
call fcn.1408768ce
je 0x1409ae4cd
clc
push rcx
invalid
adc al, ch
sti
adc esi, esi
invalid

Function at 0x1409c05ea
Capabilities:
Encode data using xor

Disassembly:
xor r8b, r8b
add qword [rsp + 8], 0xffffffffffe9dffd
sub r8b, r8b
add qword [rsp + 0x20], 0xffffffffbf7ba691
xor byte [rsp + 0x18], 0x42
and r8w, 0x792c
call fcn.140830112
setne byte [rsp + 0x28]
or byte [rsp + 0x28], 0xc8
or dword [rsp + 0x30], 0x416e4845
jb 0x14087cc8b
or qword [rsp + 0x50], 0x43e56ed7
call fcn.14088eb40

Function at 0x1409da6df
Capabilities:
Encode data using xor

Disassembly:
lea r15, [r15 + rdx*4 + 0x4d506be]
add r15, 0x1a942d98
not dl
add rdx, 0x2a7a6e66
movsx r15d, r15w
or edx, edx
xor r15w, 0x79a6
not rdx
lea rdx, [r15 + rdx*4 + 0x130b4d83]
mov qword [rsp + 0x38], 0xffffffff8ee6464d
add r15, 0xb6e7490
neg r15w
ja 0x1409da6f7
neg dx
cmp rdx, 0x127f2dd8
push rsi
setbe r15b
add qword [rsp + 0x38], 0xfffffffffff94f32
mov r15w, 0x2ad5
not edx
not dl
movsx edx, dl
mov r15d, 0x43e024a5
sub r15d, edx
push 0x1f121b59
cmp qword [rsp], r15
pop rsi
push r13
mov rdx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x28]
push qword [rsp + 0x18]
popfq
mov rsi, qword [rsp + 8]
lea rsp, [rsp + 0x40]
ret
Function at 0x1409e03d5
Capabilities:
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
test r8, 0x49c46253
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffe3e0a706
push rdx
movabs rdx, 0x6a3157d33a5d62a2
lea rdx, [rdx + 0xb6d718e]
push rbp
jbe 0x1408545f5
cmp rdx, 0xa65cc4
mov rbp, rdx
push r11
setg bpl
movabs r11, 0x5ffc480303960e16
neg r11
push rcx
push r8
movzx dx, r11b
sub r11d, r11d
or dl, 0x9d
mov rbp, qword [rsp + 0x18]
movabs r8, 0xa701d9f667c125e
not r11b
test r8d, 0x7c1e5cb9
movabs rcx, 0x7e82da757c66a44
jne 0x14087f74e

Function at 0x1409e9c52
Capabilities:
Encode data using xor

Disassembly:
or r11d, 0x5f314f22
mov r11b, 0x69
bswap r11
lea r11, [r8*2 + 0x326d6544]
mov r8, qword [rsp + 8]
add qword [rsp], 0x12f3b8
mov r11w, 0x3462
or r11d, 0x668678fa
add r11d, 0x6a176658
or r11, 0x7f7d2d3a
bswap r11
not r11b
xor r11b, 0x12
ret 8
mov edx, 0x6a4d4de7
pop rsi
mov rdi, qword [rsp + 0x28]
call fcn.1408ea16c
add r11, 0x198d60cb
cmp r11w, 0x465
jne 0x140882584
xor cl, ch
jnp 0x1409e9c6b
mov edx, 0x125abc30
loopne fcn.1409e9c52
mov esp, 0xe067125a
loope 0x1409e9cd6
jnp 0x1409e9c3f
jnp 0x1409e9c3f
invalid
invalid
jns 0x1409e9c9c
cmp al, 0x40
sub ch, ah
sub al, 0x6e
mov ch, 0x72
invalid