joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a490
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x14130d19c]
lea r8, [0x14130d8dd]
mov rcx, rax
call fcn.140012e50
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001a51b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001a500
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14001a531
mov rcx, rbx
mov rdx, rsi
call fcn.140014860
jmp 0x14001a556
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140017220
mov rcx, rsi
mov edx, edi
call fcn.1400194a0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14001a5b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x14130d19c]
lea r8, [0x14130d8ec]
mov rcx, rax
call fcn.140012e50
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
movups xmm0, xmmword [rdi + 0x28]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001a63b
xor ebp, ebp
nop word [rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001a620
mov byte [rsi + 4], 0
test r14, r14
je 0x14001a651
mov rcx, r14
mov rdx, rsi
call fcn.140014860
jmp 0x14001a676
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.140015fe0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400161a0
mov rcx, rsi
mov edx, edi
call fcn.1400194a0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001a6e0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14130d19c]
lea r8, [0x14130d90a]
mov rcx, rax
call fcn.140012e50
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001a75a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001a740
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14001a770
mov rcx, rdi
mov rdx, rsi
call fcn.140014860
jmp 0x14001a795
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140017220
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14001a8f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14130d19c]
lea r8, [0x14130d920]
mov rcx, rax
call fcn.140012e50
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001a96a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001a950
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14001a980
mov rcx, rdi
mov rdx, rsi
call fcn.140014860
jmp 0x14001a9a5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14001a9d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14130d19c]
lea r8, [0x14130d933]
mov rcx, rax
call fcn.140012e50
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001aa4a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001aa30
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14001aa60
mov rcx, rdi
mov rdx, rsi
call fcn.140014860
jmp 0x14001aa85
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14001aab0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14130d19c]
lea r8, [0x14130d941]
mov rcx, rax
call fcn.140012e50
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001ab2a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001ab10
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14001ab40
mov rcx, rdi
mov rdx, rsi
call fcn.140014860
jmp 0x14001ab65
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14001ab90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14130d19c]
lea r8, [0x14130d94c]
mov rcx, rax
call fcn.140012e50
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001ac0a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001abf0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14001ac20
mov rcx, rdi
mov rdx, rsi
call fcn.140014860
jmp 0x14001ac45
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400161a0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14001ac90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x14130d19c]
lea r8, [0x14130d994]
mov rcx, rax
call fcn.140012e50
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001ad1b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001ad00
mov byte [rsi + 4], 0
test r14, r14
je 0x14001ad31
mov rcx, r14
mov rdx, rsi
call fcn.140014860
jmp 0x14001ad56
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.140015fe0
mov rcx, rsi
mov edx, ebx
call fcn.140017f00
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001ada0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x14130d19c]
lea r8, [0x14130d99f]
mov rcx, rax
call fcn.140012e50
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14001ae2b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14001ae10
mov byte [rsi + 4], 0
test r14, r14
je 0x14001ae41
mov rcx, r14
mov rdx, rsi
call fcn.140014860
jmp 0x14001ae66
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, [0x14130d1ae]
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.140015fe0
mov rcx, rsi
mov rdx, rdi
call fcn.140015fe0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002915c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400292ac
cmp rax, 0xffffffffffffffff
je 0x1400292ac
xor edi, edi
test rbp, rbp
jle 0x140029257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f068
mov rbx, rax
test rax, rax
jne 0x1400291e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002924d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a088
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d430
cmp eax, 0xffffffff
je 0x14002922d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400291f4
mov edx, r15d
mov ecx, r14d
call fcn.14001a088
jmp 0x14002924d
cmp byte [rsi + 0x38], dil
je 0x140029244
cmp dword [rsi + 0x34], 5
jne 0x140029244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002924d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae1c
jmp 0x1400292c0
jns 0x1400292c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c754
cmp rax, 0xffffffffffffffff
jne 0x140029278
cmp byte [rsi + 0x30], dil
je 0x1400292c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400292c0
mov ecx, r14d
call fcn.140018540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400292c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400292c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400292b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400292be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1409b5cfc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1409b5d06
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1409b5d2f
pop rbp
sub rbp, 0x33
sub rbp, 0x9b5cfc
sub rsp, 0x20
jmp 0x1409b5d4e
mov rax, 0x9b5cfc
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffff831143ef
xor byte [rax], dl
inc rax
dec rcx
jne 0x1409b5d6d
jmp 0x1409b5d84
cmpsd dword [rsi], dword [rdi]
invalid
Function at 0x140005f2c
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x1c
and eax, 0x3abfb2f9
outsb dx, byte [rsi]
sub dword [rcx - 0x276a7fb0], eax
movabs byte [0x342458024128e147], al
sbb al, 0x25
stc
mov dl, 0xbf
cmp ch, byte [rsi + 0x29]
adc dword [rax - 0x80], 0x47a2d895
loope 0x140005f66
sub byte [rcx + 2], al
pop rax
and al, 0x34
add bl, byte [r8 + 0x24]
xor al, 0xa8
movabs eax, dword [0xc31d43d0afd31c8]
loopne 0x140005f3d
test al, 0xa1
enter 0xfffffffffffffd31, 0xa
cmp eax, 0xe00c31d4
out dx, al
int1
test eax, 0x5daff6c7
jb 0x140005f2d
fbstp tbyte [rax]
cmpsd dword [rsi], dword [rdi]
push rdi
mov ebp, 0x22304394
adc byte [rbp + 0x642693a5], cl
invalid
invalid

Function at 0x14001766c
Capabilities:
Encode data using xor

Disassembly:
insb byte [rdi], dx
add esp, ebp
invalid
and dword [rdi], esp
test byte [rdx], bl
jl 0x1400175bf
out 0x1d, eax
xor dword [rbp + 0x6b], 0x67
insd dword [rdi], dx
mov ebp, esi
jo 0x1400176ab
cmc
mov cl, 0x46
fimul word [rbp - 0x5d378d52]
wait
cmpsb byte [rsi], byte [rdi]
and eax, 0x1035a020
lea ebx, [rbp - 0x7ce5b4c9]
pop rcx
jb 0x1400176ac
movabs dword [0x4ef9732eb88df965], eax
stc
lea edi, [rax + 0x4ef9732e]
jle 0x14001764d
lodsd eax, dword [rsi]
pop rbx
sahf
loop 0x140017654
invalid
mov ch, 0xc6
jge 0x14001761e
jae 0x14001768f
invalid
mov ebx, 0xd93d76d1
and ebx, dword [rdi + 0x65ad02d]
xor al, 0xfd
test byte [rdi + 0x6149255b], dl
in eax, 0xeb
in eax, 0xd9
cli
and al, 0xfc
jg 0x14001768f
xchg edi, eax
invalid

Function at 0x140035060
Capabilities:
Encode data using xor

Disassembly:
sub dword [rdi + 0x3f], ebx
in eax, 0x34
add ebp, edi
mov r13d, r10d
movabs al, byte [0x52f8b5ad7b8ce565]
jle 0x140035054
xor al, 0xd9
pop rdx
mov r8b, 0x44
in al, 0x68
invalid
mov bh, 0x63
sub dword [rcx], eax
sbb byte [rax + 0x3f], ah
in eax, 0x7d
add al, byte [rdx]
xor r12d, r13d
xor esp, ebp
xor esp, ebp
wait
cmp dword gs:[rbp - 0x7855285], ecx
push rdi
jle 0x140035018
xor eax, 0xb1885ad4
in al, 0xdb
invalid
Function at 0x140038850
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push r12
push rbx
push rdi
push r15
push rsi
push r14
push rbp
sub rsp, 0x170
mov word [rsp + 0x16e], 0x6e14
mov byte [rsp + 0x157], 2
mov dword [rsp + 0x150], 0x8808833
mov al, byte [rsp + 0x16d]
mov cl, al
and cl, 0xd0
mov byte [rsp + 0x16d], cl
mov qword [rsp + 0x148], 0x7390df7c
mov dx, word [rsp + 0x16a]
mov r8d, dword [rsp + 0x150]
mov r9d, 0x446060b0
sub r9d, r8d
mov dword [rsp + 0x134], r9d
mov r10, qword [rsp + 0x158]
lea r11, [rsp + 0x110]
imul r9d, r8d, 0x20807880
mov dword [rsp + 0x164], r9d
lea rsi, [rsp + 0x90]
mov r9d, r8d
imul r9d, r9d
mov cl, byte [rsp + 0x157]
mov bl, 0x70
sub bl, cl
mov byte [rsp + 0x110], bl
mov bl, 0x76
sub bl, cl
mov byte [rsp + 0x111], bl
mov bl, cl
xor bl, 0x66
mov byte [rsp + 0x112], bl
mov bl, 0x58
mov byte [rsp + 0x63], al
mul bl
mov byte [rsp + 0x16d], al
mov byte [rsp + 0x16d], 0x54
mov al, byte [rsp + 0x63]
xor al, 0x22
mov bl, 0x6e
mov dil, bl
sub dil, cl
mov byte [rsp + 0x16d], al
mov byte [rsp + 0x113], dil
mov al, byte [rsp + 0x63]
add al, al
mov byte [rsp + 0x16d], al
mov al, byte [rsp + 0x157]
sub bl, al
mov byte [rsp + 0x114], bl
mov al, byte [rsp + 0x157]
mov cl, 0x30
sub cl, al
mov byte [rsp + 0x115], cl
mov al, byte [rsp + 0x157]
add al, 0x62
mov byte [rsp + 0x16d], 0x49
mov byte [rsp + 0x116], al
mov ebp, r8d
and ebp, 0x53861688
mov dword [rsp + 0x164], ebp
mov ebp, r8d
add ebp, 0xd91ed1ab
mov dword [rsp + 0x164], ebp
mov al, byte [rsp + 0x157]
mov cl, byte [rsp + 0x63]
mov byte [rsp + 0x16d], cl
add al, 0x6a
mov byte [rsp + 0x117], al
not cl
mov byte [rsp + 0x16d], cl
mov al, byte [rsp + 0x157]
xor al, 0x6e
mov byte [rsp + 0x118], al
mov dword [rsp + 0x164], r8d
mov al, byte [rsp + 0x157]
xor al, 2
mov byte [rsp + 0x119], al
imul ebp, r8d, 0x39654bb4
mov dword [rsp + 0x164], ebp
mov al, byte [rsp + 0x157]
xor al, 0x75
mov byte [rsp + 0x11a], al
add byte [rax], al
Function at 0x140038a18
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
add byte [rax], al
mov byte [rsp + 0x16d], 0
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0x90], xmm0
imul ebp, r8d, 0x5ae9e1bd
mov dword [rsp + 0x164], ebp
mov r14w, word [rsp + 0x16e]
mov dword [rsp + 0x164], 0x40336262
xor r14w, 0x6e78
mov word [rsp + 0xa0], r14w
imul r15, r10, 0x1eb51492
mov qword [rsp + 0x158], r15
mov r14w, word [rsp + 0x16e]
mov r15, r10
add r15, 0x4dc9f139
mov qword [rsp + 0x158], r15
mov r12w, 0x6e14
sub r12w, r14w
mov word [rsp + 0x16a], 0xeed6
mov word [rsp + 0xa2], r12w
mov r14w, word [rsp + 0x16e]
add r14w, 0x9263
mov word [rsp + 0xa4], r14w
mov word [rsp + 0x16a], dx
mov word [rsp + 0xc6], 0
mov qword [rsp + 0xbe], 0
mov qword [rsp + 0xb6], 0
mov qword [rsp + 0xae], 0
mov qword [rsp + 0xa6], 0
mov r15, r10
xor r15, 0x3fb82d31
mov qword [rsp + 0x158], r15
movsx ebp, byte [rsp + 0x12c]
mov r14w, bp
mov qword [rsp + 0x158], r10
mov word [rsp + 0xc8], r14w
mov word [rsp + 0x16a], 0x8ea1
movsx ebp, byte [rsp + 0x12d]
mov r14w, bp
mov word [rsp + 0x16a], 0x27a0
mov word [rsp + 0xca], r14w
mov al, 0x21
mov cl, byte [rsp + 0x63]
sub al, cl
mov byte [rsp + 0x16d], al
mov word [rsp + 0x16a], dx
movsx ebp, byte [rsp + 0x12e]
mov r14w, bp
mov dword [rsp + 0x164], r9d
mov word [rsp + 0xcc], r14w
mov al, byte [rsp + 0x12f]
mov byte [rsp + 0x16d], 0x2c
movsx r9d, al
mov r14w, r9w
mov word [rsp + 0xce], r14w
mov r9d, dword [rsp + 0x150]
xor r9d, 0x8808803
mov r15, qword gs:[r9d]
mov byte [rsp + 0x16d], cl
mov r9d, r8d
add r9d, 0x37a0c1f3
mov dword [rsp + 0x164], r9d
and cl, 0xc5
mov rax, qword [r15 + 0x60]
mov byte [rsp + 0x16d], cl
mov cl, byte [rsp + 0x63]
and cl, 0xb
mov byte [rsp + 0x16d], cl
mov rax, qword [rax + 0x18]
mov r15, rax
add r15, 0x20
mov rax, qword [rax + 0x20]
mov qword [rsp + 0xd0], 0
cmp rax, r15
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x56], dx
mov dword [rsp + 0x50], r8d
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
je 0x140038fa8
jmp 0x140038d3f
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov ecx, dword [rsp + 0x50]
add ecx, 0x1436d9c1
mov dword [rsp + 0x164], ecx
Function at 0x1400391f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
push r15
push rsi
push rdi
push rbp
push r13
push r14
sub rsp, 0x1b8
mov al, 0xe1
mov r8b, 0x20
mov r9b, 0x11
mov r10d, dword [rsp + 0x1b4]
mov r11d, r10d
and r11d, 0x7dd1968b
mov dword [rsp + 0x1b4], r11d
mov word [rsp + 0x1a4], 0xc587
mov qword [rsp + 0x198], 0x3c3ac0
mov bl, byte [rsp + 0x1a7]
mov sil, bl
shl sil, 5
mov byte [rsp + 0x1a7], sil
mov dword [rsp + 0x194], 0x12ff29d0
mov byte [rsp + 0x193], 0xad
mov sil, byte [rsp + 0x193]
imul r11d, r10d, 0x7c657b40
mov dword [rsp + 0x1b4], r11d
mov r11d, r10d
or r11d, 0x712a40ac
mov dil, sil
xor dil, 0x1d
mov dword [rsp + 0x1b4], r11d
mov byte [rsp + 0xcf], dil
mov dil, 0x17
sub dil, sil
mov r14, qword [rsp + 0x1a8]
mov dword [rsp + 0x1b4], r10d
mov byte [rsp + 0xa7], dil
imul r15, r14, 0x434c416a
mov qword [rsp + 0x1a8], r15
mov r11d, dword [rsp + 0x194]
mov ebp, 0x5c8c47f9
sub ebp, r11d
mov dword [rsp + 0x144], ebp
mov qword [rsp + 0x1a8], r14
lea r15, [rsp + 0xd0]
mov r12, r14
add r12, r12
mov qword [rsp + 0x1a8], r12
movaps xmm0, xmmword [0x140043110]
movaps xmmword [rsp + 0xd0], xmm0
sub r9b, byte [rsp + 0x193]
mov byte [rsp + 0xe0], r9b
mov dword [rsp + 0x1b4], 0x2cf74fe9
mov r9b, byte [rsp + 0x193]
xor r9b, 0xc9
mov byte [rsp + 0xe1], r9b
mov r11d, r10d
or r11d, 0x3da0eb0b
mov dword [rsp + 0x1b4], r11d
mov r9b, bl
and r9b, 0x6c
mov sil, byte [rsp + 0x193]
mov byte [rsp + 0x1a7], r9b
add sil, 0xc5
mov byte [rsp + 0xe2], sil
mov r9b, byte [rsp + 0x193]
mov r12, r14
xor r12, 0x3b784541
mov qword [rsp + 0x1a8], r12
add r9b, 0xb8
mov byte [rsp + 0xe3], r9b
mov r9b, byte [rsp + 0x193]
mov r13w, word [rsp + 0x1a2]
mov word [rsp + 0x1a2], 0x698d
add r9b, 0xc6
mov byte [rsp + 0xe4], r9b
mov byte [rsp + 0x1a7], bl
mov r9b, byte [rsp + 0x193]
mov dword [rsp + 0x1b4], 0x7c311e2c
sub r8b, r9b
mov dword [rsp + 0x1b4], r10d
mov byte [rsp + 0xe5], r8b
mov r8b, bl
sub r8b, 0x39
mov byte [rsp + 0x1a7], r8b
mov r8b, byte [rsp + 0x193]
add r8b, 0x53
mov byte [rsp + 0xe6], r8b
mov r12, r14
xor r12, 0xe41eadb
mov r8b, byte [rsp + 0x193]
mov qword [rsp + 0x1a8], r12
mov r12, r14
xor r12, 0xffffffffffffffff
sub al, r8b
mov qword [rsp + 0x1a8], r12
mov byte [rsp + 0xe7], al
mov qword [rsp + 0x168], 0
mov r12, r14
or r12, 0x5bd413ad
mov qword [rsp + 0x1a8], r12
cmp rdx, 0
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov word [rsp + 0x46], r13w
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x34], r10d
mov byte [rsp + 0x33], bl
je 0x140039a77
jmp 0x140039804