joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14003457a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140034570
cmp r10, rax
jb 0x14003460d
cmp r10, rdx
ja 0x140034621
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140034572
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140034550
jmp 0x1400345e2
ja 0x14003457a
mov rax, r10
cmp r11, r8
jne 0x140034520
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400345e6
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x1400345c0
mov rsi, rbx
sub ecx, edi
jns 0x1400345d9
jmp 0x1400345e8
cmp rbx, rdx
je 0x1400345f3
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x1400345e8
xor al, 1
cmp rsi, rdx
jne 0x1400345a0
jmp 0x1400345e8
xor eax, eax
jmp 0x1400345e8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140037730
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140037b30
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140037b20
ud2

Function at 0x140036260
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400362aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400362aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400362aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400362aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400362aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400362ac
xor al, al
add rsp, 0x28
ret
Function at 0x140036d30
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.14002f2e0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140036d8f
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140036e08
mov r8, rdx
not r8
shr r8, 0x3f
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140007dd0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x140036e15
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x140036e08
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140007dd0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x140036df7
jmp 0x140036e08
Function at 0x140004ae0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140004b14
cmp word [rcx], 0x5a4d
jne 0x140004b14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140004b14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140004a20
test eax, eax
jne 0x140004b30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140004a90
test rax, rax
je 0x140004b25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400052df
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400051e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005180
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005634
Capabilities:
Check if file exists

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1406e6c98]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1406e6c94]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140005682
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000567a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140005769
inc ebx
add rax, 0x28
jmp 0x14000565a
mov rcx, r12
call fcn.140005e61
mov rbp, rax
test rax, rax
jne 0x1400056a1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400055d0
movsxd rbx, ebx
mov rax, qword [0x1406e6c98]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140005f0f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1406e6c98]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx

Function at 0x140005b5a
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
setne byte [rsp + 8]
js 0x140708f92
cmp r11b, 0xa3
call fcn.140701a03
xchg qword [rsp + 0x10], rbp
push rcx
push r8
call fcn.1406f2775

Function at 0x140005b90
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1406e6d00]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1406e6ce0]
test rbx, rbx
je 0x140005bdc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140005bd6
test eax, eax
jne 0x140005bd6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140005bae
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140005d90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005db3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005db3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005db4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140005dee
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005de5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005df0
inc r8d
add rax, 0x28
jmp 0x140005dcc
xor eax, eax
ret

Function at 0x140005e61
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1406dbb70]
mov r8, rcx
mov rcx, r9
call fcn.140005d90
test eax, eax
je 0x140005e8d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005db4
xor eax, eax
add rsp, 0x28
ret

Function at 0x1406f81e0
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
lea rcx, [rcx + 0x4d1f240d]
je 0x1407ec299
shl dword [rsp + 0x28], 0x69
or dword [rsp + 0x28], r12d
sets r12b
mov rsi, qword [rsp + 0x28]
cmp r11d, dword [rsp + 0x2c]
jb 0x1407dc0d8
Function at 0x140706610
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
sub r11d, dword [rsp + r11 - 0x573747c5]
shr r11, 0xf0
and r11b, r11b
mov byte [rsp + r11 + 0x38], 0x93
mov r11, qword [rsp + r11 + 0x48]
not word [rsp + 0x38]
jo 0x14079f0ae
sub dword [rsp + 0x38], 0xb3b51a02
jns 0x1407e715c
setge byte [rsp + 0x38]

Function at 0x140706650
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
movabs rbp, 0xd610962edfb68c17
xor rcx, 0xffffffffce254f00
lea rax, [rax - 0x76dc92c7]
shl bpl, 0x6a
add rbp, rbx
js 0x1407be043
not rcx
shl rcx, 0x27
movsx bp, bl
call fcn.1406fd3c6
add qword [rsp + 0x48], 0xffffffffbf84e0fb
movabs rax, 0x118c698b128974a4
test bl, 0x32
movsx r9w, r9b
push rbp
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmovl rcx, r9
setl r9b
je 0x1406f76eb
push rdi
test esi, esi
setbe sil
push rdx
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
call fcn.1406f6ceb

Function at 0x1407078ed
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
add word [rsp + 0x30], 0x2e80
test rbp, 0xffffffffb3a5310d
jbe 0x1407be013
mov r9, qword [rsp + r9 + 0x12740157]
cmp r12b, 0xd
call fcn.1407aa707

Function at 0x140779c3d
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r12, rbp
mov rbp, qword [rsp + rbp - 0x3ef69d5c]
mov rbp, qword [rbp + r12 - 0x3ef69d64]
sub byte [rsp + r12*2 - 0x7ded3ab8], r12b
not byte [rsp + r12 - 0x3ef69d54]
jae 0x1406f32aa
mov r11, qword [rsp + 0x28]
seta byte [rsp + r11 + 0x4afd81b7]
jne 0x140797280
mov qword [rsp + r12 - 0x3ef69d5c], r12
jb 0x1407a296e
call fcn.1407f4144
call fcn.140794cf4
call fcn.14078b034
xor byte [rcx + 2], cl
wait
rol byte [rcx], 1
pop rdx
cmp esp, dword [rax - 0x6f]
retf 0x823
setb byte [rsp + 8]
shl qword [rsp + 8], 0xa9
xor qword [rsp + 8], 0xffffffffc109629b
add qword [rsp], 0xfffffffffffc26dc
mov rbp, qword [rsp + 8]
not ebp
test bp, 0x248c
push r12
jne 0x1406f27c0
xor al, al
jmp 0x1400056e2
xchg qword [rsp + r11 + 0x4afd81c7], rbp
mov r11, qword [rsp + r11 + 0x4afd818f]
and word [rsp + 0x28], 0xbd97
mov byte [rsp + 0x28], 0x29
and word [rsp + 0x28], 0xa0aa
and qword [rsp + 0x28], 0xfffffffff5b76ab1
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
ret 8
je 0x140818f65
shl cl, 0xe1
push rbp
shl cl, cl
movabs rbp, 0x6c897390e40dd9bb
add rbp, 0xffffffff8a0c30a6
add qword [rsp + 0x18], 0x6ae4
push r8
movabs r8, 0x8084412c03adf931
mov r8w, 0xeb0e
movabs rax, 0x3484d5218b93bbbe
add qword [rsp + 0x10], 0xffffffffffff851e
add rax, rax
jb fcn.1406f7e85
or cl, 0x2c
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
call fcn.1407cc601
mov rbp, r9
movzx ebp, r9w
mov rbp, qword [rsp + rbp - 0xf6d4]
mov rbp, qword [rbp + riz]
test r9b, 0xa9
jne 0x1407732e7

Function at 0x1407818c1
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
jbe 0x1407078c5
neg r12w
lea rax, [rax + r12*2 - 0xedb3aa7]
mov r13, qword [rsp + 0x40]
call fcn.140808aec
add dword [rax], ecx
invalid
Function at 0x14079766b
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp + 8], 0xffffffffbf8f224c
xchg qword [rsp + 0x20], rbp
push rbx
call fcn.1407a5ff9
mov rdi, rdx
xchg qword [rsp + r11 + 0x30], rbp
mov r11, qword [rsp + r11 + 0x28]
setae r9b
add qword [rsp + r9 - 0x4aa00001], 0xffffffffbf8510a1
add qword [rsp + r9 - 0x4a9ffff9], 0x88a56
neg r9d
movsxd r9, r9d
lea rsp, [rsp + r9 + 0x4aa00009]
ret 8
shr r9d, 1
jge 0x1406fadf6
xor r11, r11
jae 0x1407a03ee
neg r9w
jno 0x140700e9c

Function at 0x14079767d
Capabilities:
Execute shellcode via indirect call

Disassembly:
dec dword [rbp + 0x33]
fisttp dword [rdi]
xor dword [rcx - 0x73], 0
add byte [rax - 0x7f], cl
add qword [rsp], 0xfffffffffff25218
invalid
mov eax, 0x2182f88
mov dh, 0x5c
invalid
setle byte [rsp + 0x48]
neg qword [rsp + 0x48]
call fcn.14076a931
mov ch, 0xfa
movabs eax, dword [0x6c894cce25a53a36]
mov qword [rsp + 0x20], r13
shl r12d, 0x8f
push r12
lea rbx, [rbx + r12 - 0x17a66bdc]
call fcn.140798c52
cmp al, 0x2d
jbe 0x140797673
invalid

Function at 0x140798cc7
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
shl r12w, 0xce
add qword [rsp + r12], 0xfffffffffff82880
nop
push rsi
movabs rdi, 0xe2036337ab1f189
mov rsi, r12
neg di
test r12, rsi
movzx si, dil
mov rdi, qword [rsp + r12*2 + 8]
mov rdi, qword [rdi + r12]
mov qword [rsp + r12 + 8], r12
setb r12b
setg sil
or byte [rsp + rsi + 8], 0xbf
cmp qword [rsp + rsi + 8], 0x3c0b11ab
call fcn.1407bd446

Function at 0x14079ded2
Capabilities:
Get thread local storage value

Disassembly:
push r12
add r11d, 0xb5a787ad
lea rbx, [rbx + 1]
push rdx
movabs r12, 0x5ca2459c6c3af505
push r10
push rdi
jo 0x140005bbe
push r13
shl r12, 0x2c
mov qword [rsp + 0x60], rbx
movabs r10, 0x3291ff09442130aa
add r10, 0x6099a485

Function at 0x1407a36f1
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
movabs r12, 0xfe854023658e77b7
not r13b
test r13, 0xd0178a1
mov r13w, 0x21bb
sete r12b
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
jb 0x14080cbfa
mov qword [rsp + r13 - 0x21b3], r13
neg r13w
neg r12

Function at 0x1407a5f4c
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
push rbx
call fcn.14078d362
call fcn.1408210e9
and byte [rsi - 0x7c], al
cvttps2pi mm5, xmm7
scasd eax, dword [rdi]
cli
sub byte [rsp + rdi - 0xe833], r12b
mov rcx, qword [rsp + r12*2 - 0x1bf98e]
mov rcx, qword [rcx + rdi - 0xe84b]
jo 0x1407a1563
jl 0x140770090
and dword [rsp + r12*2 - 0x1bf986], 0xbcbdebbb
not r12b
shr r12w, 0x18
lea rcx, [rcx + rdi*2 + 0x58bdc8f6]
neg byte [rsp + rdi - 0xe833]
mov qword [rsp + rdi - 0xe83b], r12
jo 0x1407e9885
cmp byte [rsp + rdi*2 - 0x1d086], 0x2d
push r9
sete dil
xchg qword [rsp + rdi*2 - 0x1cfb8], rcx
mov rdi, qword [rsp + r12*8 - 0x67ffc0]
jo 0x1407be00d
cmp qword [rsp + r12*4 - 0x33ffe8], 0x208d128b
call fcn.1407f570d
xor al, bh
ret
movabs rcx, 0xf23dbf9af827d411
mov qword [rsp + 0x38], rsi
jbe 0x14070f956
call 0x1406f8930
xor eax, 0xcde11bba
js 0x1407e9873
iretd
Function at 0x1407a8457
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + r8*2 + 0x5189b408], r8
push r14
xor bx, bx
xchg qword [rsp + r8*2 + 0x5189b438], rax
mov r8, qword [rsp + 0x18]
test qword [rsp + 0x20], 0xffffffff97979abc
jge 0x140779bfb

Function at 0x1407ae3c1
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
mov rbp, qword [rsp + 0x48]
call fcn.1407976b1
sbb dl, al
xor eax, 0x90fcb214
xchg qword ds:[rsp + 0x30], rbx
jno 0x14081dd59
pop rdx
jle 0x14078a8af

Function at 0x1407be05f
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140005703
mov rax, qword [0x1406e6c98]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400055d0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140005763
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140005763
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1406e6c98]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140005763
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400055d0
inc dword [0x1406e6c94]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
jg fcn.14078d857
jo 0x1400056dd
shl r12w, 0xfc
mov r12, qword [rsp + 0x28]
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1407c0f59
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
jbe 0x140782647
js 0x1407da996
setae r15b
mov rsi, qword [rsp + r15 - 0x4b0c99e9]
test word [rsp + rsi - 0x4b0c8fe7], si
mov r15, qword [rsp + r15 - 0x4b0c99e1]
push qword [rsp + rsi - 0x4b0c8ff4]
popfq
mov rsi, qword [rsp + rsi - 0x4b0c9004]
lea rsp, [rsp + 0x28]
or rcx, 0xffffffff9d0215a4
and r13w, 0x9e0c
neg r13
movzx r13d, cx
neg r13
call fcn.1407afc69
mov edi, 0xf7bc653e
insd dword [rdi], dx
and al, 0x4f
invalid
mov qword [rsp + 0x40], rdx
jae 0x1407c2d0c
jne 0x140775a2e
and word [rsp + r15 - 0x4b0c9a0c], 0xd187
cmp r15, qword [rsp + r15 - 0x4b0c9a0c]
push rsi
mov qword [rsp + 0x30], rax
jne 0x140700700
Function at 0x1407cce8f
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + rdx - 0x1db61], rax
mov rdx, qword [rsp + rdx*4 - 0x76de4]
jle 0x1407d759e
add dword [rax + 0xb], eax
add byte [rax - 0x2c], al
add al, 0
cmp byte [rdx + rcx], ah
xor edx, dword [rcx + rcx]
xor al, 8
add byte [rax], cl
add al, 0xc0
add dh, byte [rax]
add byte [rcx + 0x55], al
call fcn.1406fd255
int3
enter 0x730d, 0xffffffffffffff82
ret
jl 0x1406f2372
bnd jmp qword [rsi - 9]
neg si
lea rdi, [rdi + 1]
test esi, 0x1833fb22
call fcn.14080bdf6
jnp fcn.1407cce7b
jns 0x1407cce33
shr dword [rdx + 0x722b70e1], cl
cmp dword [rax], ebx
jb 0x1407ccedf
test al, 0xf3
or al, byte [rcx - 0x10]
stosd dword [rdi], eax
xor bh, byte [rcx + 8]
push rbx
jp 0x1407cce93
sbb byte [rbx + 0x12], dh
mov r11b, dl
xchg edx, eax
leave
cwde
ret
xchg ebx, eax
cmp dword [rbx], esi
xchg edx, eax
sbb al, 0x99
test al, 0x5a
invalid
call 0x140774e2f

Function at 0x1407da984
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
lea r12, [r12*2 - 0x5ffa10ec]
mov qword [rsp + r12 + 0x5ffa0fb2], 0x45102b26
call fcn.14070cca5
movsx r14d, r14b
mov r9, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
push r15
push r8
movabs r8, 0x7d1f10379805f81c
xor r8d, r14d
jb 0x1406f6387
not r14d
movabs r15, 0x52206e1ccc209085
lea r15, [r8 + r14*8 - 0x2b754c60]
add r15b, r14b
add qword [rsp + 0x10], 0x5df74
call fcn.140814352

Function at 0x1407daa0b
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
je 0x1407ec21c
sub dword [rsp + 0x18], 0x2d8c1c

Function at 0x1407daa44
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
lea rax, [rax + 0x489a033d]
sub byte [rsp + 0x10], 0xa9
xor dword [rsp + 0x30], 0x851d22ac
jo 0x1407df615
sub word [rsp + 0x40], 0x338e
movabs rdi, 0x6c0c9e8d6708a006
jle 0x1406fac9f

Function at 0x1407daa54
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
or r15b, 0xad
mov r8, qword [rsp + 0x30]
or qword [rsp + 0x18], 0xffffffffe99317b7
ja 0x1408052f2
shl di, 0xc4
mov r8w, 0x83b3
neg r15
lea r15, [r15*2 - 0x3c7095c7]
seto dil
lea rdx, [rdx - 0x45c4a8df]
and r15w, 0x5ebe
mov qword [rsp + 0x18], r15
not dil
shl qword [rsp + 0x18], 0xa8
mov di, 0x8dbc
xchg qword [rsp + 0x38], rdx
mov rdi, qword [rsp + 0x10]
test r15d, 0x948db0a0
sete r15b
jbe fcn.1406f4a5c
jne 0x1407818a1

Function at 0x1407dae16
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + r12 + 0x41acbdd1], 0xffffffffff7ef513
mov cl, r12b
neg r12d
lea rdi, [rdi - 0x58cd56ea]
bswap r12
mov qword [rsp + rcx*2 + 0x608fffa2], rcx
or r12d, ecx
add cl, byte [rsp + 0x39]
sub rdx, qword [rsp + 0x20]
and byte [rsp + 0x20], dh
xchg qword [rsp + rcx + 0x3047ffb0], rdi
mov r12, qword [rsp + 0x28]
jae 0x1406fd7a6
setns dl
jge 0x1407ac335
movabs rdx, 0xef04270fceb9ab8d
not qword [rsp + r12 + 0x41acbdf9]
jns 0x1406fbc83
adc ecx, dword [rax + 0x49]
adc cl, byte [rbx]
imul eax, dword [rdx - 0x65], 0x43d279d0
sbb byte [rcx], ah
push 0x7b
and byte [rcx + 2], ch
jae 0x1407dae6d
stc
movabs byte [0x8ae16823da81006b], al
invalid
sbb r9b, spl
wait
jle 0x1407daeb5
invalid
wait
invalid
Function at 0x1407dc0fd
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
add qword [rsp + 0x18], 0xffffffffa093ee27
jbe 0x1406f7eed
movsx bx, bl
movabs rbp, 0x7a8aa89caa37c23c
xchg qword [rsp + 0x20], rsi
mov rbx, qword [rsp]
test byte [rsp + 0x18], bpl
call fcn.140005b1e
add qword [rsp + 0x78], 0x1a16ee9f
sub byte [rsp + 0x78], 0xa9
call fcn.140804668
call fcn.1407c598e
jno 0x1407f4bf6
jne 0x1406f409f
mov cx, r12w
mov r10, qword [rsp + 0x38]
and cl, r12b
jae 0x1407c40e6
call fcn.1406f60dc
invalid
sets r12b
movsx r12w, byte [rsp + 0x7c]
call fcn.1407fe334
js 0x1407852e8
add ebp, 0x45b0b908
add qword [rsp + 0x18], 0x3a9a8
cmp word [rsp], 0x604
nop
jle 0x14080a0f6
pop rdx
invalid
movabs rdx, 0xf1bcec08929d062f
call fcn.1407808fb

Function at 0x1407dfb40
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
xchg qword [rsp + 0x20], rax
jo 0x1407fa4e0
push r8
mov word [rsp + 8], bx
mov r8, rbx
jne 0x1407e373c
setns byte [rsp + 0x18]
cmp r12w, 0x72b2
lea rsi, [rsi + 0x2ba38ca5]
push r8
jg 0x140707898
add r11w, word [rsp + 0x23]
and r12d, 0x89b0d13
push rdi
xchg qword [rsp + 0x40], rsi
mov r11, qword [rsp + 0x38]
movabs rdi, 0x2a048b3a1032e30c
jbe 0x14081d299
call fcn.1407bf37e
push r8
js 0x1406f2feb
lea rax, [rax - 0x1db20e5]
mov qword [rsp + r15 - 0x369e], r9
call fcn.1406f6325

Function at 0x140802cc7
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
jle 0x14079deac
mov qword [rsp + 0x20], rdx
ja 0x1407f3d8b
call fcn.1407af694
sub esi, esi
xchg ah, cl
int3
jg fcn.1407ee167
cmp byte [rsp + 0x10], 0xe
lea rsp, [rsp + 0x38]
ret
jle 0x1406f76e0
add qword [rsp], 0xffffffffffff34a4
movabs rax, 0x55104c3a1e163b0c
lea rax, [rax + rax*4 + 0x78b33c8f]
push rdx
movabs rdx, 0x162efabd63b53a0e
sub dx, 0x3618
call fcn.14080d715
jae 0x140700460
shr r11, 0x50
shl r11b, 0xf7
test r11, r11
mov r11d, 0x283571b6
setbe r11b
xchg qword [rsp + r11*2 - 0x506ae1e8], rax
jge 0x14080cbdb
jo 0x1407f9609
or r11w, 0xccbd
neg r11d
cmp r11, 0x42a4ddbe
setae r11b
mov r11, qword [rsp + 0x10]
mov qword [rsp + 0x10], rax
jle 0x1406f2622
jne 0x1407c4e51

Function at 0x14080a97f
Capabilities:
Check if file exists
Execute shellcode via indirect call

Disassembly:
mov rsi, qword [rsp + rsi*2 - 0x59cdaa72]
xchg qword [rsp + 0x18], rsi
jno 0x1407be021

Function at 0x14080cbd0
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call

Disassembly:
sets bl
neg qword [rsp + 0x18]
call fcn.14070d7f4
mov bx, word [rsp + 0x1e]
js 0x140804630
Function at 0x1410cc583
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
sub edi, edi
dec bx
jmp 0x1410cc59a
movzx ebx, r8b
dec r11b
mov r9b, sil
mov r11, rcx
movsx r10, r12w
mov r8, rdi
jmp 0x1410cc5b6
nop
inc r9b
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
inc r11
inc rdx
stc
test bl, bl
jmp 0x1410cc5d0
je 0x1410cc5fd
mov ecx, r8d
mov eax, 0xde82d6b7
cmc
rol eax, cl
test r14, r10
add al, r8b
cmc
jmp 0x1410cc5ed
xor r9b, al
jmp 0x1410cc5f5
inc r8
clc
cmp ax, 0xfb3b
test r9b, r9b
je 0x1410cc614
cmp r9b, r10b
jmp 0x1410cc60e
je 0x1410cc5ba
cmp r9b, r10b
jmp 0x1410cc61c
jae 0x1410cc646
or eax, 0xffffffff
setle bl
xchg edi, ebx
mov rbx, qword [rsp + 8]
movzx di, r14b
cmovl edi, r12d
not dil
mov rdi, qword [rsp + 0x10]
jmp 0x1410cc645
ret
mov rbx, qword [rsp + 8]
seta dil
xchg al, ah
jmp 0x1410cc656
mov eax, edi
cmovle di, r9w
mov rdi, qword [rsp + 0x10]
jmp 0x1410cc667
ret