joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9d88
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ed6a0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x140299787]
call fcn.1400aac15
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140206120]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400ed7e5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400ed739
mov dword [rbp + 0x160], 1
jmp 0x1400ed743
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400ed7e0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400ed7ba
cmp qword [rbp + 0x198], 2
jb 0x1400ed7ba
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ed7ba
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ed7ba
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ed704
jmp 0x1400ed87f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400ed87f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400ed856
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ed856
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ed856
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ed7e5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400a9e9b
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401f85c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401f85e0
xor al, al
jmp 0x1401f8661
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401f85f3
xor al, al
jmp 0x1401f8661
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401f861d
xor al, al
jmp 0x1401f8661
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401f8631
xor al, al
jmp 0x1401f8661
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401f8643
xor al, al
jmp 0x1401f8661
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401f865f
xor al, al
jmp 0x1401f8661
mov al, 1
add rsp, 0x38
ret
Function at 0x1400aa8dc
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ed580
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140299787]
call fcn.1400aac15
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140206120]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400ed5ff
mov dword [rbp + 0x120], 1
jmp 0x1400ed609
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400ed652
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400ed5ca
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1400aa913
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400beca0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x140280d08]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1402996ea]
call fcn.1400aac15
mov qword [rbp + 8], 0
mov edx, dword [rbp + 0x700]
mov ecx, 0x18
call fcn.1400a945a
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400bed6a
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x438
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a9ae0
test eax, eax
je 0x1400bed6a
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400bed59
mov rax, qword [rbp + 0x68]
mov qword [rbp + 8], rax
jmp 0x1400bed6a
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a8681
test eax, eax
jne 0x1400bed37
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140206060]
call fcn.1400aa4a4
mov rax, rdi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400a94d7
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret
Function at 0x1400aadb9
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400bedf0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x140280d08]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1402996ea]
call fcn.1400aac15
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.1400a945a
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400bee9d
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a9a27
test eax, eax
je 0x1400bee9d
mov rdx, qword [rbp + 0x440]
lea rcx, [rbp + 0x7c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400bee8c
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x1400bee9d
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400aa5f3
test eax, eax
jne 0x1400bee6f
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402060e0]
call fcn.1400aa4a4
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400a94d7
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140731cc6
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
sub qword [rsp + 0x80], 0x71140541
or dword [rsp + 0x80], 0x750263a5
neg byte [rsp + 0x80]
cmp word [rsp + 0x80], 0xaf
mov byte [rsp + 0x80], 0x67
setge byte [rsp + 0x80]
ja 0x1408be5e4

Function at 0x140731d04
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push r12
pushfq
movabs r12, 0x2ea30ea72198013b
mov r12b, 0xf2
or r12d, 0x5ede180f
or r12d, 0x86e35dd
or r12d, 0x70dc4d9c
and r12d, r12d
and r12w, 0x6448
push rbx
add qword [rsp + 0x18], 0xfffffffffff8c627
xor r12w, r12w
movabs rbx, 0xd4627d9603b69f9
or r12d, 0x5531a7d
add ebx, 0x61977cf
lea rbx, [rbx + rbx*8 + 0x4c9f0f51]
setns bl
lea r12, [rbx*2 + 0x4e48380b]
xor bx, r12w
bswap ebx
add r12d, 0x6e951870
push r13
movabs r13, 0xf601c0a335d43e2
add r12d, 0x28a5397d
jl 0x140e14f5a

Function at 0x140745f77
Capabilities:
Check for software breakpoints

Disassembly:
or r14d, 0x3334566e
mov r14, qword [rsp + 0x10]
add qword [rsp], 0xffffffffbf72d0ae
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.140ebe3eb
jg 0x14074601a
cli
sal esp, 0x14
jmp 0xe632325a
outsd dx, dword [rsi]
jae 0x140746081
imul ebp, dword [rcx], 0x66ee8b49
and esi, ebp
add byte [rax], 0x41
push rbx
Function at 0x1407cfeb5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movabs r14, 0x43820fd2526a36b9
cmp byte [rsp + 0x38], 0xb5
movzx di, byte [rsp + 0x2e]
mov byte [rsp + 0x28], 0x5a
cmovae r14w, word [rsp + 0x39]
add byte [rsp + 0x28], 0x1f
not dword [rsp + 0x40]
neg dword [rsp + 0x30]
mov r9b, dil
setl r14b
seto bl
lea r14, [rdi*4 + 0x65832de2]
setle bl
mov r14, qword [rsp + 0x18]
neg dword [rsp + 0x30]
jbe 0x1407d0e4e
neg byte [rsp + 0x40]
ja 0x140ddaf5f
cmp dword [rsp + 0x30], 0x2bd316b7
lea rdi, [rdi + rdi + 0x47c776f]
sete byte [rsp + 0x38]
neg byte [rsp + 0x28]
add qword [rsp], 0xffffffffffacfd02
xor dword [rsp + 0x30], r9d
xor qword [rsp + 0x40], 0x2002786c
and dword [rsp + 0x28], 0x27c434b0
mov qword [rsp + 0x38], r9
or byte [rsp + 0x38], bh
movzx rdi, bx
mov word [rsp + 0x38], bx
ret 8
mov dword [rsp + 0x58], 0x2886d57
je 0x1407cfeb5
not dword [rsp + 0x50]
cmp dword [rsp + 0x68], 0x336e35f8
call fcn.14086c66e
sub rdx, rsi
add ebp, dword [rbx + 0x7487bf5]
mov eax, 0xeb772fc2
jge 0x140800154
iretd
sal byte [rax], 1
stosb byte [rdi], al
sti
ret
setne r9b
mov r13, qword [rsp + 0x40]
xor dword [rsp + 0x28], r14d
call fcn.140ddaf45
invalid
mov rbx, qword [rsp + 0x30]
sub word [rsp + 0x30], 0x6a6b
test r9b, 0xf
je 0x1408000fe
not r14w
test r14d, 0x5c2d737b
movzx rbx, word [rsp + 0x28]
jne 0x140861fe4
and r8b, r8b
setne r8b
lea r8, [r8 + r8 + 0x7dcc2a3a]
sub r8, 0x34470221
neg r8
setl r8b
lea r8, [r8*4 + 0x36354010]
or r8b, 0xe5
neg r8
push r13
push r9
movabs r9, 0x248815256b9648dc
push r9
and r8w, r9w
mov r13, r8
lea r8, [r13 + r8 + 0x6653009c]
movzx r8d, r13b
push r9
sete byte [rsp + 8]
add r13b, byte [rsp + 4]
push r8
jle 0x14082070d
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0xffffffff80fffe06
test dword [rsp], 0x535342f3
jge 0x140dba216
test rcx, 0x6d2e64cb
bswap r11d
mov r12b, 0x46
push r12
bswap rcx
push rbp
mov r11, qword [rsp + 0x28]
call fcn.14073d8ff
sub dword [0x14aca4a52], ebp
cmp al, 0xb5
add eax, 0x78e81846
invalid
cmovs r13w, word [rsp + 0x12]
neg r9d
push 0x3e6855c0
test qword [rsp + 0x10], 0x6a202cd
push rbx
push r14
push rdi
movabs r14, 0x7cc01795426a6ba0
jno 0x140892a98
movabs rbp, 0x3bb951291d3e4341
test ecx, r15d
not r14d
lea r13, [r13 + r13*8 + 0x2fd96178]
jb 0x1408c6b21
sets cl
setg r13b
movsx r13, bp
neg r15d
add r13b, 0xe6
setae bpl
test byte [rsp + 0x20], 0x2d
not rdx
mov rcx, qword [rsp + 0x68]
lea r14, [r12 + rdx + 0x576c302c]
lea rsp, [rsp + 0x10]
ret
jbe 0x1408c35bc
not dword [rsp + 0x30]
and dword [rsp + 0x40], 0x1e7e2e4e
call fcn.140db946b
mov dil, byte [rsp + 0x34]
movzx rdi, r14b
lea r14, [r9 + r14*2 + 0xdcb3961]
neg byte [rsp + 0x30]
mov word [rsp + 0x38], 0x4ba3
call 0x1407cfeb5
mov r13, qword [rsp + 8]
mov r12, r14
mov qword [rsp + 0x58], 0xffffffffb9230c97
and dil, dil
ja 0x140dedc2d
Function at 0x1407dadda
Capabilities:
Encode data using xor

Disassembly:
sub r11d, 0x3b397319
push rbp
and r11, qword [rsp + 0x40]
xor r9d, 0x134e0df3
push 0x61e54e70
add qword [rsp + 0x30], 0xffffffffbf8caacc
not r11
pop rbp
mov r11, qword [rsp + 0x38]
xor r9w, word [rsp + 0x46]
not byte [rsp + 0x40]
lea rbp, [rbp*2 + 0x638248a4]
movzx ebp, byte [rsp + 0x41]
movsx ebp, bp
jl 0x1407dade1
neg bp
xor r9d, 0x44884b9a
add qword [rsp + 0x10], 0xffffffffbf8b544f
test dword [rsp + 0x44], r9d
jge 0x14082b58f

Function at 0x14085db99
Capabilities:
Encode data using xor

Disassembly:
invalid
jl 0x140859d7b
mov rdx, qword [rsp + 0x60]
jne 0x1407db477
sti
stosd dword [rdi], eax
jp 0x14085dc06
mul dword [rcx + 0x3fa78403]
mov ebp, gs
mov dh, 0xa7
adc dword [rsi + 0x33], 0x72e1a7bd
push rax
sbb byte [rax + 4], bl
jg 0x14085db81
pop rbp
pop rax
cli
out 0x8a, eax
in al, 0xa7
mov ch, 0x92
test dword [rcx - 0x29a98159], edi
lodsb al, byte [rsi]
cmpsd dword [rsi], dword [rdi]
sub eax, 0x58027835
sub eax, 0x585427ed
lahf
adc dword [rcx + 0x41b6a79a], edi
cdq
jbe 0x14085dc42
add bl, byte [rax + 0x2d]
in eax, dx
invalid
scasd eax, dword [rdi]
cld
ja 0x14085dc32
pop rax
leave
test eax, 0x3a48584f
retf 0xa7ea
pop r8
mov cs, word [rsi + rbx*2 + 0x58]
or al, 0xe8
pop rbp
invalid
test eax, 0x750fc650
invalid
sub al, 0x1b
scasb al, byte [rdi]
xchg edx, eax
jmp 0x14085dbd9

Function at 0x140868d5d
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
setno byte [rsp + 0x20]
test byte [rsp + 0x34], r8b
call fcn.1407e965d

Function at 0x140868d6c
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
seta byte [rsp + 0x38]
test byte [rsp + 0x38], 0x8e
jae 0x140e14f48
pop rsi
bswap rcx
setns cl
sub rcx, rcx
cmp ecx, 0x193a54cc
lea rcx, [rcx + rcx + 0x75436863]
bswap ecx
ret 8

Function at 0x140878632
Capabilities:
Encode data using xor

Disassembly:
or rcx, 0x30f145d1
neg edx
movzx rcx, r14b
lea rdx, [r14 + rcx + 0x5b772c04]
seto dl
test cx, 0x6ad1
jo 0x140dd7cc5

Function at 0x1408aadb9
Capabilities:
Encode data using xor

Disassembly:
push r10
add qword [rsp + 8], 0xfffffffffff70b90
not r15b
movzx r14d, r14b
push rsi
neg r14d
movabs r10, 0x4fa58e40f96339c
mov r15, qword [rsp + 0x28]
movabs rsi, 0x662463bc53a96ab6
add si, r14w
mov r10d, r11d
call fcn.14088372a
movzx r12w, word [rsp + 0x36]
cmovne ebp, r12d
xor r12w, bp
cmp word [rsp + 0x30], 0x4323
not word [rsp + 0x30]
mov byte [rsp + 0x30], 0x91
jge 0x1408aadf4
or byte [rsp + 0x30], 0xbf
neg byte [rsp + 0x30]
xor r12d, 0x24934689
and rbp, rbp
movsxd r12, dword [rsp + 0x30]
add bp, word [rsp + 0x35]
mov r12, qword [rsp]
call fcn.1407224e2
jl 0x1408aae62
jmp 0x1408aae74
or eax, 0x85bfd342
insb byte [rdi], dx
mov edx, 0x34d41e8c
mov ebp, 0x38c7cb73
push 0xffffffffffffff8c
add dword [rbx], eax
jae 0x1408aae2a
invalid

Function at 0x1408b5a9c
Capabilities:
Check for software breakpoints

Disassembly:
mov rbp, qword [rsp + 0x60]
and word [rsp + 0x58], r8w
sub r8b, 0x1e
or qword [rsp + 0x58], rdi
cmp bx, r8w
movsx rbx, word [rsp + 0x58]
jg 0x14083d501
Function at 0x140dc41d2
Capabilities:
Encode data using xor

Disassembly:
movabs r13, 0x4f7041ad34957eef
xor di, 0x2ebd
xor r13d, 0x3f0577a1
movzx r13w, r13w
movsx di, r8b
push r10
push r13
test dword [rsp], edi
bswap r8
jbe fcn.140dc41d2
movabs r10, 0xcd1254f5dd75066
push rcx
movabs rcx, 0x42e91e2e7ddf3bfa
add qword [rsp + 0x18], 0x5513f2
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 8]
lea r13, [r13 + r13*2 + 0x651b1bbc]
sub byte [rsp + 8], 0xff
setae dil
or cx, 0x57d4
call fcn.140ddc41f
outsd dx, dword [rsi]
cmp al, 0xc1
adc cl, byte [rbx + 0xb797bf5]
movsb byte [rdi], byte [rsi]
shr byte [rcx], 1
adc dword [rdx + 0x18b20bd8], ecx
test al, 0xa9
adc eax, 0xe12dd090
invalid

Function at 0x140df2f95
Capabilities:
Encode data using xor

Disassembly:
neg r11b
add qword [rsp], 0x53067c
lea r11, [r11 + rdx*4 + 0x5ec63e88]
not r11
mov r11b, 0x69
call fcn.1408afe13
xor eax, 0xa31ff5f8
cmp eax, 0x92d8541c
sub byte [rbx + rcx], bl
loopne 0x140df2fec
leave
mov ebx, 0xcb4427a5
jge 0x140df2fc8
retf
lahf
fstp xword [rax]
push rdi
fcom dword [rbp - 0x33]
popfq
or al, 0x60
xor ebx, ebp
invalid
insd dword [rdi], dx
out 0x9f, eax
lahf
leave
xor ebx, dword [rax]
fsub dword [r8 - 0x1fe5e7b2]
outsd dx, dword [rsi]
out dx, eax
mov edi, 0x7dba27b4
jns 0x140df2fee
lahf
invalid

Function at 0x140df9704
Capabilities:
Encode data using xor

Disassembly:
lea r10, [r10 + 0x1583026d]
jo 0x140872f14
add word [rsp + 0x58], 0x3110
add qword [rsp + 0x18], 0xffffffffbf73d7e2
mov word [rsp + 0x58], r14w
xor qword [rsp + 0x58], r10
mov r10b, byte [rsp + 0x5b]
not r14
xor r10b, 5
neg byte [rsp + 0x58]
mov r10d, r14d
sub r14w, word [rsp + 0x5b]
add r14w, 0x6f4c
add qword [rsp + 0x10], 0xffffffffbf78cf5a
neg byte [rsp + 0x58]
not r14
cmp r10, qword [rsp + 0x58]
mov r10, qword [rsp + 0x40]
lea r14, [r14 + r14*4 + 0x6ef71dbb]
bswap r14d
jl 0x140df9734
call fcn.140dc89a6

Function at 0x140dfc9bb
Capabilities:
Encode data using xor

Disassembly:
not rdx
push r9
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffff8043d6e6
lea rbp, [rdx*4 + 0x30f648b6]
lea r13, [r13 + rbp*2 + 0x3094235d]
push 0x403c6278
not r13b
mov r9, qword [rsp]
bswap rdx
push r14
jns 0x140dea36e
Function at 0x414e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41500b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414ee5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414ef4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414f13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414f23
cmp rbx, 0x1000
jae 0x414eeb
jmp 0x414f8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414f35
xor edx, edx
jmp 0x414f84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414f19
jmp 0x414f08
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004c81ca]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004c8608]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004ca701]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x415040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415266
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4150b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4150c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4150e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4150f5
cmp rbx, 0x1000
jae 0x4150b9
nop
jmp 0x415178
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41510d
xor esi, esi
jmp 0x41516a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4150eb
jmp 0x4150d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x00710d30]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415200
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004c8621]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004c8608]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004c53f6]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4151a0
call sym.runtime.printlock
lea rax, [0x004c8621]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004c8608]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004c9f90]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS