joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093840
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1401b6080]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x79], rax
lea r13, [0x1401be940]
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x69], r13
mov dword [0x1401be940], 0
xor r12d, r12d
mov qword [0x1401be948], r12
mov qword [0x1401be950], r12
mov ecx, 0x50
call fcn.1400deb78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1401be948], rax
mov qword [0x1401be958], r12
xorps xmm0, xmm0
movdqa xmmword [0x1401be960], xmm0
mov qword [0x1401be970], 7
mov qword [0x1401be978], 8
mov dword [0x1401be940], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [0x1401be958]
call fcn.140093d00
nop
mov rax, qword gs:[0x60]
mov r15, qword [rax + 0x68]
mov esi, r12d
cmp dword [r15 + 0xc], r12d
jbe 0x140093a90
mov r14d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
mov ecx, 0x200
call fcn.1400deb78
mov rdx, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], 0xff
mov qword [rbp - 0x21], 0xff
movzx eax, r12w
mov rdi, rdx
mov ecx, 0xff
rep stosw word [rdi], ax
mov word [rdx + 0x1fe], r12w
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
mov ecx, 0x200
call fcn.1400deb78
mov rdx, rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0xff
mov qword [rbp - 0x41], 0xff
movzx eax, r12w
mov rdi, rdx
mov ecx, 0xff
rep stosw word [rdi], ax
mov word [rdx + 0x1fe], r12w
mov eax, dword [r15 + 0x14]
add rax, r14
mov eax, dword [rax + r15 + 4]
lea rbx, [rax + rax*2]
mov edi, dword [r15 + 0x10]
add rdi, r15
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 7
cmova rcx, qword [rbp - 0x39]
mov r8d, dword [rdi + rbx*8 + 0xc]
mov edx, dword [rdi + rbx*8 + 4]
add rdx, r15
call fcn.1400e09b3
mov eax, dword [rdi + rbx*8 + 0x10]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rcx, qword [rbp - 0x59]
mov r8d, dword [rax + r15 + 0x10]
mov edx, dword [rax + r15 + 0xc]
add rdx, r15
call fcn.1400e09b3
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140093610
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.140093610
nop
lea r8, [rbp + 7]
lea rdx, [rbp - 0x69]
call fcn.140093e40
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rbp - 0x19]
cmp rcx, rax
je 0x140093a59
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
call fcn.14000d1b0
nop
lea rcx, [rbp - 0x19]
call fcn.14000d150
nop
lea rcx, [rbp + 7]
call fcn.14000d150
nop
lea rcx, [rbp - 0x59]
call fcn.14000d0e0
nop
lea rcx, [rbp - 0x39]
call fcn.14000d0e0
inc esi
add r14, 8
cmp esi, dword [r15 + 0xc]
jb 0x140093920
mov rax, r13
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400dea30
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140099c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r10, dword [rcx + 0x3c4]
mov rsi, rdx
xor edx, edx
mov rax, r9
div r10
xor r14d, r14d
mov r15, r9
mov rdi, r8
mov rbx, rcx
test rax, rax
je 0x140099d0e
mov qword [rsp + 0x40], rbp
nop
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140099830
mov ecx, dword [rbx + 0x3c4]
xor edx, edx
mov rax, rdi
test ecx, ecx
jle 0x140099cd7
lea r8, [rbx + 0x3ec]
sub r8, rdi
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3c4]
cmp edx, ecx
jl 0x140099cc0
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3ec]
call fcn.1400e09b3
movsxd rcx, dword [rbx + 0x3c4]
xor edx, edx
mov rax, r15
inc r14d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r14d
cmp rcx, rax
jb 0x140099c90
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14009a370
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.1400df990
sub rsp, rax
mov rax, qword [0x1401b6080]
xor rax, rsp
mov qword [rbp + 0xf70], rax
mov r15, rcx
mov rbx, r8
lea rcx, [0x140195910]
mov r14, rdx
jmp 0x140c79914

Function at 0x14009a7b0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1401b6080]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, rcx
xor r13d, r13d
lea rcx, [0x1401958f0]
jmp 0x140c7b214
Function at 0x1400ab800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov r15, rdx
mov rbp, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400ab82e
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
test r8, r8
je 0x1400ab863
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x1400ab850
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400ad290
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400ab88c
mov qword [r15], rcx
mov byte [r15 + 8], r13b
jmp 0x1400aba32
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
jne 0x1400ab8aa
lea rcx, str.unordered_map_set_too_long
call qword [0x1400ea348]
int3
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x38
call fcn.1400deb78
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.14000b9f0
mov qword [rsi + 0x30], r13
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400ab8ee
cvtsi2ss xmm0, rcx
jmp 0x1400ab903
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400ab916
cvtsi2ss xmm1, rcx
jmp 0x1400ab92b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x1400ab9da
mov rcx, rbp
call fcn.1400ac250
mov rax, qword [rbp + 0x30]
and rax, rdi
add rax, rax
mov rdx, qword [rbp + 0x18]
mov rbx, qword [rdx + rax*8 + 8]
mov rcx, qword [r12]
cmp rbx, rcx
jne 0x1400ab969
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r13
jmp 0x1400ab9cf
mov r13, qword [rdx + rax*8]
mov r12, qword [rsi + 0x20]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400ab983
mov rdx, qword [rdx]
lea rcx, [rsi + 0x10]
cmp qword [rsi + 0x28], 0xf
jbe 0x1400ab992
mov rcx, qword [rsi + 0x10]
cmp r12, rax
jne 0x1400ab9a3
mov r8, r12
call fcn.1400e0b11
test eax, eax
je 0x1400ab9ae
cmp rbx, r13
je 0x1400ab9bd
mov rbx, qword [rbx + 8]
jmp 0x1400ab971
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
jmp 0x1400ab9cb
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea r12, [rbp + 8]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1400aba13
mov qword [rcx + rax*8], rsi
jmp 0x1400aba25
cmp r9, rdx
jne 0x1400aba1e
mov qword [rcx + rax*8], rsi
jmp 0x1400aba2a
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400aba2a
mov qword [rcx + rax*8 + 8], rsi
mov qword [r15], rsi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bd710
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1401b6080]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rdx
mov r13, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rcx, [0x140195f70]
jmp 0x140c90b8c

Function at 0x1400c0e80
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1401b6080]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0x28], rdx
xor r15d, r15d
lea rcx, str.x2h
jmp 0x140c96296

Function at 0x1400cb620
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x15
syscall
ret

Function at 0x1400cb62b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x16
syscall
ret

Function at 0x1400cb636
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x17
syscall
ret

Function at 0x1400cb641
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x18
syscall
ret

Function at 0x1400cb650
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc
syscall
ret

Function at 0x1400cb65b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd
syscall
ret

Function at 0x1400cb666
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe
syscall
ret

Function at 0x1400cb671
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xf
syscall
ret
Function at 0x1400ce710
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1b
syscall
ret

Function at 0x1400ce71b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1c
syscall
ret

Function at 0x1400ce726
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1d
syscall
ret

Function at 0x1400ce731
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1e
syscall
ret

Function at 0x1400ce740
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret

Function at 0x1400ce74b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x24
syscall
ret

Function at 0x1400ce756
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x25
syscall
ret

Function at 0x1400ce761
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x26
syscall
ret

Function at 0x1400ce770
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x16
syscall
ret

Function at 0x1400ce77b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x17
syscall
ret

Function at 0x1400ce786
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x18
syscall
ret

Function at 0x1400ce791
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x19
syscall
ret

Function at 0x1400ce7a0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3c
syscall
ret

Function at 0x1400ce7ab
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3d
syscall
ret

Function at 0x1400ce7b6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3e
syscall
ret

Function at 0x1400ce7c1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x1400ce7d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x37
syscall
ret

Function at 0x1400ce7db
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x38
syscall
ret

Function at 0x1400ce7e6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x39
syscall
ret

Function at 0x1400ce7f1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x1400dfba0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400ea050]
test rax, rax
je 0x1400dfbea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dfbea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dfbea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dfbea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dfbea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400dfbec
xor al, al
add rsp, 0x28
ret

Function at 0x1401cac50
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x10]
call fcn.140bf54a1
Function at 0x1401d2550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401d257c
xor al, al
jmp 0x1401d26a0
movdqa xmm0, xmmword [0x1401f2ae0]
movdqa xmm1, xmmword [0x1401f2af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1401f2b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1401f2b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1401d2692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401d25f9
mov r11d, 2
jmp 0x1401d261d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401d2613
mov r11d, 1
jmp 0x1401d261d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1401d26b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401d265a
mov byte [rcx + 2], 0x3d
jmp 0x1401d266a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1401d267c
mov byte [rcx], 0x3d
jmp 0x1401d2683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1401d25e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1401d269b

Function at 0x1401d6395
Capabilities:
Encode data using xor

Disassembly:
setle r12b
test r12d, 0x4ced05b2
setl dil
xor r12, r12
mov r12, qword [rsp + 0x28]
setb dil
add edi, 0x1b2d5c4b
or dil, dil
not di
neg di
je 0x140aa8de0
mov rdi, qword [rsp + 0x18]
jle 0x14098f227
call fcn.1401ca7ac

Function at 0x14032555e
Capabilities:
Encode data using xor

Disassembly:
movsx r10d, r14w
add qword [rsp], 0xffffffffbfce6cd0
mov r10, qword [rsp + 8]
cmp r14d, 0x6d825e1a
call int.1404c8fe0

Function at 0x1405fa017
Capabilities:
Encode data using xor

Disassembly:
sub rsi, rcx
movzx ecx, r15w
mov r15, qword [rsp + 0x38]
seta cl
lea rcx, [rsi + rcx*4 + 0x158906f7]
and cx, cx
movsx esi, cx
mov rsi, qword [rsp + 0x18]
bswap ecx
movsx ecx, cx
xor rcx, 0x1b957953
jl 0x1408fd0ca
sub ecx, ecx
not rcx
mov rcx, qword [rsp + 0x10]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
call fcn.140c471de
imul edi, ecx, 0x10
and eax, 0x27fa0c0d
invalid
ja 0x1401ca7e0
Function at 0x140677d9b
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.140c45d82
or ebp, eax
add dword [rax - 0x55bdb85a], edi
stosb byte [rdi], al
cmp dword [rbx], edi
sti
xchg byte [rsi + 5], cl
neg dword [rbx]
or cl, byte [rcx + 0x1f]
imul dword [rdi - 0x34c9a9ab]
test al, 0x1e
push rsi
xor byte [rsp + rbx + 0x48296009], al
xor al, 0x18
or al, 0x9f
jnp 0x140677dac
add al, 0x1d
cmp eax, dword [rcx - 0x29]
mov bl, 0xa0
jmp 0x140677e00
in al, dx
add al, 0x9f
and al, 0xc2
invalid

Function at 0x140754286
Capabilities:
Encode data using xor

Disassembly:
je 0x1409c0438
mov rdi, qword [rsp + 8]

Function at 0x14085b03a
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xdb
sbb eax, 0xc61812f2
cmpsd dword [rsi], dword [rdi]
mov ecx, 0x5c43a0c1
movabs al, byte [0x81c7e14f204f6f7c]
mov esp, 0x8d82251e
invalid
paddsb mm0, mm7
xchg esp, eax
call qword [rdx + 0x63]
mov al, 0x28
add dword [rdi + 0x54810bbb], edx
sbb al, 0x4c
je 0x14037cf25
out dx, eax
sti
je 0x14037ce7e
lea ecx, [rbx + 0x76400ba8]
sub eax, dword [rax + 0x74]
push rsp
int 0
je 0x14037cf00
jae 0x14037cf0d
hlt
mov esp, dword [rdi - 1]
jrcxz 0x14037cead
mov ecx, edi
lodsd eax, dword [rsi]
xchg ebx, eax
push rsi
hlt
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
lea esp, [rsp + 0x40]
call fcn.140bf54a1
mov ebp, 0x934c7fc1
xchg rbx, rax
or dword [rbx - 0x23], eax
mov bh, 0xaa
xor byte [rdx], cl
pop rdx
jbe 0x14037cf19
add bh, byte [rbp - 0x5f]
mov ebp, 0x2e2eb133
mov es, word [rsi - 0x2d]
mov eax, 0x6e1f91e5
pop rbp
in eax, 2
mov r14b, 0xea
mov al, 0x79
jno 0x14037cef7
dec edi
xchg esi, eax
xchg r11d, eax
clc
xor eax, 0xef9186d1
shl dword [rdx + 0x320ac421], 1
popfq
invalid
xor r11d, 0x1f531d42
mov rbp, qword [rsp + 0x10]
setns r11b
lea rdx, [rdx + 0x7bdd781c]
setae r11b
movsx dx, r11b
mov rdx, qword [rsp + 0x20]
lea r11, [r11 + 0x113b7395]
xor r11, 0x733a05e8
cmp r11d, 0x29064b6a
jbe 0x1406cfdc6
mov r11, qword [rsp + 0x18]
js 0x14037cf07

Function at 0x140885455
Capabilities:
Encode data using xor

Disassembly:
test rcx, 0x5be532c
lea rcx, [rcx + 0x59e11477]
mov rcx, qword [rsp + 0x28]
jge 0x140a4c0f5
push r15
call fcn.140315a94
movabs byte [0xf52078cc8a6258b8], al
movsb byte [rdi], byte [rsi]
cmc
jle 0x1407e43d5
jp 0x1407e4442
ror dword [rax - 0x6aef33a1], cl
mov ds, edi
pop rdi
invalid
je 0x1407e44b8
invalid
mov bl, bh
lodsd eax, dword [rsi]
invalid
jbe 0x1407e4448
int 0x4c
push rbx
std
fisttp dword [rbx]
sbb al, 0x27
movsd dword [rdi], dword [rsi]
jbe 0x1407e4538
enter 0xffffffffffff91d7, 0x78
xchg ecx, eax
wait
lea ebx, [rdi - 0x34]
invalid
push rbx
mov dh, 0xc9
push rbx
invalid
nop
mov esp, 0x4c675256
jge 0x1407e4529
invalid
jno 0x1407e43c7
add byte [rdx + 0xd], al
fimul word [r13 - 0x64]
pushfq
je 0x1408854c3
movsb byte [rdi], byte [rsi]
test eax, 0x5b9f76f6
mov al, 0x7a
mov esp, dword [rax + 0x75ad5ea9]
pop rdi
mov eax, 0x1f7544a0
xor sil, byte [0x10ae2f500]
jp 0x140885461
push rbp
fdiv qword [rdi + 0x7c]
invalid
mov al, 0x44
sar ebp, 0x99
or edx, eax
invalid
Function at 0x1408dac59
Capabilities:
Encode data using xor

Disassembly:
fxam
mov word [rax + 0x24], es
int 0xeb
invalid
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.140c2e600
cmp al, 0x79
rep insd dword [rdi], dx
imul edi, dword [rdi - 0x29a1b60f], 0x6dc6a29c
xor al, 0xd
jb 0x1408dac12
ror qword [0x1a690e764], 1
pop rax
invalid

Function at 0x140b63d2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
push r11
push rsi
movsx r11w, r14b
movzx esi, r13w
push rbx
cmove r11, rsi
push r10
xchg r11d, r11d
push rcx
movsx esi, dx
movsx r11, r10w
pushfq
test r11b, 0x2b
movzx rcx, r9w
push rax
cdqe
jmp 0x140b8f2fe
xor eax, 0x2fe35e71
bswap eax
stc
cmp sil, cl
clc
neg eax
add eax, 0x18501b2b
rol eax, 1
cmc
cmp rbp, 0x49626e37
add eax, 0x182a7ea5
rol eax, 1
cmp r14b, r11b
test ah, 0x37
bswap eax
xor eax, 0x39461a40
clc
ror eax, 1
cmp r14w, 0x19ab
test bpl, r13b
xor eax, 0x6123328a
push r11
sbb r11w, r9w
xor dword [rsp], eax
pop r11
movsxd rax, eax
test cl, r15b
add rsi, rax
push rsi
ret
inc r8d
xadd si, di
rcl ax, cl
neg r8d
setns dil
inc r8d
rcr sil, 0x3b
rdtsc
btr si, 0x55
ror r8d, 3
adc r11b, dil
cmp si, sp
add r8d, 0x53272221
ror r11b, 0xee
add r8, rcx
movabs rcx, 0x100000000
btr r11w, r10w
cmc
lea r8, [r8 + rcx]
stc
movsx ax, bh
rdtsc
mov rdi, rsp
sal r11, cl
rcl ah, 0xce
movzx eax, r11w
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
inc dh
mov r11, r8
sbb si, r8w
movabs rdx, 0
rcl esi, cl
adc esi, 0xd66a4
bts rsi, r11
sub r11, rdx
setp sil
btr rax, r10
lea rsi, [0x140b83f50]
bts ax, bx
and rax, r10
sub r8, 4
and rax, r13
btc rax, 0xc3
not rax
mov eax, dword [r8]
cmc
xor eax, r11d
cmc
bswap eax
jmp 0x140b6a8fc
push r8
cdqe
shrd cx, r12w, 0x10
push rdx
dec sil
btr r8w, ax
push r12
xor r8w, 0x926
bsf r11, r9
push r13
rol eax, 0x83
push rdi
cwde
sub dil, 0x65
add cl, r9b
push r15
push r9
cwd
push r14
movzx rcx, r8w
bts rdx, rdx
dec r8b
movabs rcx, 0
push rcx
cdq
mov r8, qword [rsp + 0x90]
shrd dx, r15w, 0x49
sbb r11b, 0x4b
bsf dx, dx
bswap r8d
xor r8d, 0x4b596d7e
cdqe
xchg dil, dl
dec r8d
movzx si, r15b
movsxd rax, r13d
cmc
rol r8d, 3
movsx r11, r9w
jmp 0x140b83eb9
Function at 0x140c5a13e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
ret
bswap edx
jmp 0x140c52af2
and rsp, 0xfffffffffffffff0
adc edx, 0x57357a8b
and rdx, 0x373a5236
mov rbp, r8
movabs rax, 0
inc dh
cdq
sub rbp, rax
lea rdi, [0x140c490fd]
rol dl, cl
sub r8, 4
mov edx, dword [r8]
cmc
xor edx, ebp
test rax, 0x29167d6
cmp dil, r8b
cmp r10b, 0xa7
sub edx, 0x67076ad
jmp 0x140bb5022
inc edx
test ch, ch
xor edx, 0x5a1537cf
push rbp
bsf ebp, ebx
shrd rbp, r10, 0xb4
movsx ebp, di
xor dword [rsp], edx
pop rbp
cmp r14, 0x163d3dcf
movsxd rdx, edx
test r8b, sil
stc
add rdi, rdx
jmp 0x140ba76b6
push r10
push rcx
sete r10b
push rdi
movsxd r10, r12d
movzx rdi, si
setle r10b
push rdx
movsx di, spl
push r13
push rbx
xchg dx, di
push rax
movzx r10w, r14b
movzx r10, r11w
cbw
push r11
rdtsc
push r9
setne r10b
push rsi
xchg al, r11b
push r8
lahf
movzx rdx, si
mov ah, 0xda
push r14
cqo
push rbp
rdtsc
cwde
push r15
movsx r10d, r11w
cqo
push r12
mov al, r12b
bswap edx
pushfq
sal r10b, 0xb3
rcr r10b, 0x74
shld ax, r11w, 0x23
movabs r11, 0
sal r10w, 0xed
push r11
neg r8b
cmp r14b, r9b
stc
mov r8, qword [rsp + 0x90]
mov eax, r13d
xor r8d, 0x423a0960
rol r8d, 1
dec r8d
test r14b, 0x1f
bswap r8d
lea r8, [r8 + r11]
movabs rax, 0x100000000
sal di, 0xbe
stc
add r8, rax
mov r10, rsp
mov bp, r13w
cmovge edi, r10d
cmc
sub rsp, 0x180
movzx edi, r13w
rcr bpl, 0x29
jmp 0x140c490d6

Function at 0x140f5c800
Capabilities:
Execute anti-debugging instructions

Disassembly:
and rsp, 0xfffffffffffffff0
adc edx, 0x57357a8b
and rdx, 0x373a5236
mov rbp, r8
movabs rax, 0
inc dh
cdq
sub rbp, rax
lea rdi, [0x140e5ccc0]
rol dl, cl
sub r8, 4
mov edx, dword [r8]
cmc
xor edx, ebp
test rax, 0x29167d6
cmp dil, r8b
cmp r10b, 0xa7
sub edx, 0x67076ad
jmp 0x140f29a72
push rdi
ret
bswap edx
jmp 0x140f3deaa
inc edx
test ch, ch
xor edx, 0x5a1537cf
push rbp
bsf ebp, ebx
shrd rbp, r10, 0xb4
movsx ebp, di
xor dword [rsp], edx
pop rbp
cmp r14, 0x163d3dcf
movsxd rdx, edx
test r8b, sil
stc
add rdi, rdx
jmp 0x140eb1078
push r10
push rcx
sete r10b
push rdi
movsxd r10, r12d
movzx rdi, si
setle r10b
push rdx
movsx di, spl
push r13
push rbx
xchg dx, di
push rax
movzx r10w, r14b
movzx r10, r11w
cbw
push r11
rdtsc
push r9
setne r10b
push rsi
xchg al, r11b
push r8
lahf
movzx rdx, si
mov ah, 0xda
push r14
cqo
push rbp
rdtsc
cwde
push r15
movsx r10d, r11w
cqo
push r12
mov al, r12b
bswap edx
pushfq
sal r10b, 0xb3
rcr r10b, 0x74
shld ax, r11w, 0x23
movabs r11, 0
sal r10w, 0xed
push r11
neg r8b
cmp r14b, r9b
stc
mov r8, qword [rsp + 0x90]
mov eax, r13d
xor r8d, 0x423a0960
rol r8d, 1
dec r8d
test r14b, 0x1f
bswap r8d
lea r8, [r8 + r11]
movabs rax, 0x100000000
sal di, 0xbe
stc
add r8, rax
mov r10, rsp
mov bp, r13w
cmovge edi, r10d
cmc
sub rsp, 0x180
movzx edi, r13w
rcr bpl, 0x29
jmp 0x140e5cc99