joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022f3c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140022f6c
xor eax, eax
jmp 0x14002302f
mov rbp, rbx
cmp word [rax], si
je 0x140022f91
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140022f78
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140022f74
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400204a4
movsxd r14, eax
test eax, eax
jne 0x140022fcf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140022f65
mov rcx, r14
call fcn.14001dc80
mov rdi, rax
test rax, rax
jne 0x140022fe8
xor ecx, ecx
call fcn.14001af90
jmp 0x140022fc4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400204a4
test eax, eax
jne 0x140023019
mov rcx, rdi
call fcn.14001af90
jmp 0x140023023
xor ecx, ecx
call fcn.14001af90
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14002304c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400230d3
mov rsi, rbx
cmp word [rax], bp
je 0x140023092
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002307c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140023078
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001dc80
mov rdi, rax
test rax, rax
je 0x1400230c0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000bf70
mov rbp, rdi
xor ecx, ecx
call fcn.14001af90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400279c0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400159b4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140027a4a
cmp byte [rbp - 0x21], r15b
je 0x140027a45
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140027a80
call fcn.14001f4e0
test eax, eax
jne 0x140027a6c
cmp byte [rbp - 0x21], r15b
je 0x140027a64
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140027a80
cmp byte [rbp - 0x21], r15b
je 0x140027a7d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001549c
test eax, eax
jne 0x140027b20
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400159b4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140027abf
cmp byte [rbp - 0x21], r15b
je 0x140027af4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140027af4
call fcn.14001f4e0
test eax, eax
jne 0x140027ae0
cmp byte [rbp - 0x21], r15b
je 0x140027ad9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140027af4
cmp byte [rbp - 0x21], r15b
je 0x140027af1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001549c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140027b20
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140027b23
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140027b31
mov rcx, rdi
call fcn.14001af90
cmp byte [rbp + 0x3f], r15b
je 0x140027b40
mov rcx, qword [rbp + 0x27]
call fcn.14001af90
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400290e0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c8ec
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c8ec
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029230
cmp rax, 0xffffffffffffffff
je 0x140029230
xor edi, edi
test rbp, rbp
jle 0x1400291db
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f250
mov rbx, rax
test rax, rax
jne 0x140029168
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400291d1
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a1f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d5ec
cmp eax, 0xffffffff
je 0x1400291b1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029178
mov edx, r15d
mov ecx, r14d
call fcn.14001a1f8
jmp 0x1400291d1
cmp byte [rsi + 0x38], dil
je 0x1400291c8
cmp dword [rsi + 0x34], 5
jne 0x1400291c8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400291d1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001af90
jmp 0x140029244
jns 0x140029244
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c8ec
cmp rax, 0xffffffffffffffff
jne 0x1400291fc
cmp byte [rsi + 0x30], dil
je 0x140029244
mov edi, dword [rsi + 0x2c]
jmp 0x140029244
mov ecx, r14d
call fcn.1400186b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029244
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029244
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002923d
mov eax, dword [rsi + 0x2c]
jmp 0x140029242
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c8ec
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14000100f
Capabilities:
Terminate process

Disassembly:
jmp 0x140001e4c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14000116d
test al, al
je 0x140001d13
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.1400010eb
mov bl, al
mov ecx, dword [0x140008160]
cmp ecx, 1
je 0x140001d1e
test ecx, ecx
jne 0x140001c49
mov dword [0x140008160], 1
lea rdx, [0x140006660]
lea rcx, [0x140006330]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x140001c2a
mov eax, 0xff
jmp 0x140001d03
lea rdx, [0x140006220]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x140008160], 2
jmp 0x140001c51
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.1400011a4
call fcn.1400010c3
mov rbx, rax
cmp qword [rax], 0
je 0x140001c84
mov rcx, rax
call fcn.140001118
test al, al
je 0x140001c84
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14000b010]
call fcn.1400010e6
mov rbx, rax
cmp qword [rax], 0
je 0x140001ca6
mov rcx, rax
call fcn.140001118
test al, al
je 0x140001ca6
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov rdi, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov rbx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov r8, rax
mov rdx, rdi
mov ecx, dword [rbx]
call fcn.140001096
mov ebx, eax
call fcn.140001154
test al, al
je 0x140001d28
test sil, sil
jne 0x140001cdd
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140001159
mov eax, ebx
jmp 0x140001d03
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140001113
nop
mov ecx, 7
call fcn.140001113
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140001181
add rsp, 0x28
jmp 0x140001bbc

Function at 0x140001118
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14000228c
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000231a
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14000231a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000231a
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140002301
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400022fb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140002303
add rdx, 0x28
jmp 0x1400022e0
xor edx, edx
test rdx, rdx
jne 0x14000230c
xor al, al
jmp 0x140002320
cmp dword [rdx + 0x24], 0
jge 0x140002316
xor al, al
jmp 0x140002320
mov al, 1
jmp 0x140002320
xor al, al
jmp 0x140002320
add rsp, 0x18
ret
Function at 0x140001154
Capabilities:
Parse pe header

Disassembly:
jmp 0x14000287c
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400028c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028c7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028c7
cmp dword [rcx + 0xf8], 0
je 0x1400028c7
mov al, 1
jmp 0x1400028c9
xor al, al
add rsp, 0x28
ret
Function at 0x140020b06
Capabilities:
Execute syscall

Disassembly:
int3
and byte [rbp + 0x2d], dh
je 0x140020b36
dec rbp
rol r11d, 0xbb
je 0x1400212ee
ret
jmp fcn.14002068f
mov dword [rsp - 0xc], ebp
mov r12, r12
mov dword [rsp - 0x14], 0x44e2bc01
ret
jne 0x14002133f
je 0x14002133f
call 0x14002122a
jmp 0x14002134c
mov dword [rsp - 0x1c], 0x5557714
mov dword [rsp - 0x10], 0x11b9e99d
mov dword [rsp - 0x14], 0x7b29302e
xchg r10, r10
mov edx, 0x920
mov rcx, rbx
je 0x140021293
jne 0x140021293
test esi, 0x6b254ca0
jne 0x14002207c
test r8, rbp
neg r11
test r11d, 0xfcb0105a
bswap rbx
call rax
cmp r13, rbx
lea r13d, [rdi + 0xf7d0]
call rax
ja 0x1400215f6
movabs r15, 0x2ba3bb7136fb10eb
call rcx
mul rcx
jmp 0x140020ada
jmp 0x1400212a5
call fcn.1400989a0
mov rsi, qword [rsp + 0x38]
mov dword [rsp - 0xc], 0x76e639f1
jmp 0x1400212bc
xchg rsp, rsp
mov rbx, rbx
mov dword [rsp - 0x24], 0xa7b0198
mov rax, rbx
jmp 0x140021332
cmp dh, byte [rsp + rax + 0x75]
add cl, byte [rcx - 0x48]
jmp 0x14002130e
mov dword [rsp - 0x40], 0x6264cdd1
mov qword [rdi + 0x78], 0
call fcn.1400efc48
test sil, 1
je 0x1400212aa
jmp 0x14002123a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push r10
movabs r10, 0x6e09a367682b12eb
jmp 0x140021224
jmp 0x140021353
add rsp, 0x57
pop r10
ret
pop r10
pop rdi
mov r11, r11
je 0x140021383
jne 0x140021383
bswap rdi
lea ecx, [rdx - 0x4a1]
div rsi
lea ecx, [rbx - 0x6f5c]
rol r15d, 0x85
div r14
int3
jmp 0x140021214
add ebx, 0xa2bcd293
sub edi, 0x34ce2439
syscall
rcl ebx, 0x28
test rbp, rbp
rcl r13d, 0xcb
ret
jmp [rcx - 0x5df0902d]
ja 0x140022066
jl fcn.140022087
add byte [rax], al
cdq
mov dword [rbp + 0x77], 7
add byte [rax], al
add byte [rbx + 0x44c703e2], al
and al, 0xd8
sar ah, 0x11
jle 0x14002207f
mov ch, 0xe
add byte [rax], al

Function at 0x140021042
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x3c], 0x1bf0693b
mov rbx, rcx
mov qword [rcx], rax
mov rdx, rdi
pop rbx
lea r10d, [rbp + 0xc881]
push r12
call rax
mov esi, 0xf3279b2a
lea r14d, [rbx + 0x24d9]
rcl ebp, 0x8f
jno 0x140021bc9
call fcn.14002080a
lea rax, [0x1400010c8]
xchg rsi, rsi
mov dword [rsp - 0x1c], 0x33aaaf2c
je 0x1400210bc
jne 0x1400210bc
or edi, 0xdac0f5fa
lea edx, [rbx + 0x6759]
syscall
ret
jmp 0x140020fe0

Function at 0x140022b60
Capabilities:
Execute syscall

Disassembly:
add rsp, 0x23
pop r9
ret
jne fcn.140022b58
je fcn.140022b58
call fcn.140022b58
jmp 0x140021f4e
Function at 0x140026379
Capabilities:
Execute syscall

Disassembly:
je 0x140027014
movabs rbp, 0x1629b40000022ee9
ror esi, 0x46
ret 0x10
lea esp, [rcx - 0x5fc0]
pop rcx
syscall
push rbx
rcl edx, 7
rol r12d, 0xe8
movabs r12, 0x441699000009cee9
ret

Function at 0x14002669b
Capabilities:
Execute syscall

Disassembly:
and r9d, 0xea278f56
popf
call rax
push r12
call rax
add r13d, 0x7a1be3db
rcr r15d, 0x79
pushfq
syscall
rcl r9d, 0xfe
invalid
mov ebp, 0xc07e9
add byte [rdi], bl
pop rcx

Function at 0x1400272ba
Capabilities:
Execute syscall

Disassembly:
lea r8, [rbp + 0x1d8]
mov rdx, rdx
mov dword [rsp - 0x14], esi
mov dword [rsp - 0x38], 0x5f53cf64
mov r8, r8
mov dword [rsp - 0x28], edi
mov dword [rsp - 0x1c], 0x3c74ea11
jne 0x1400266be
je 0x1400266be
mov r10d, 0x1a343407
jmp 0x1400272ca
mov esp, esp
call fcn.1400ef850
mov dword [rsp + 0x28], esi
jmp 0x14002666c
mov rsi, rsi
mov r9d, 2
mov dword [rsp + 0x20], 0xff5b5b5b
jmp fcn.140027525

Function at 0x140029f28
Capabilities:
Execute syscall

Disassembly:
invalid
hlt
std
invalid
jmp 0x14002a617
jmp 0x14002a98e
sub ecx, 0x37
mov dword [rbp + 0x2c], r15d
mov dword [rbp + 0x28], ecx
mov rcx, rdi
mov dword [rsp - 0x28], 0x71ed4f84
mov dword [rsp - 0x1c], 0x286e5675
push r8
jne 0x140029dc6
je 0x140029dc6
ror ebx, 0x12
call fcn.14002a04b
call rcx
cpuid
lea r13d, [rbx + 0xb748]
mov ecx, 0xbaffd34e
jmp rcx
jmp 0x14002a1aa
mov rcx, r14
xchg r15, r15
mov r8, r8
call fcn.14008e900
lea rdx, [rbp + 0x30]
mov rdi, rax
mov dword [rsp - 0x30], 0x6a97c8dd
je 0x140029ecc
jne 0x140029ecc
ja 0x14002ac25
lea edi, [rcx - 0xdc0d]
movabs r14, 0x3317b1000007e7e9
mov r8d, 0xfc7401c1
jmp rax
jmp 0x14002a6b8
jmp 0x14002a50d
add al, ch
invalid
sub byte [rax], 0xfc
invalid
jmp 0x14002aa9e
movabs r8, 0x780cffffffe8de9
jne 0x14002a1ac
mov r14, r14
mov dword [rsp - 0x10], 0x51e37b2b
cmp eax, ecx
jle 0x14002a276
jmp 0x140029e9d

Function at 0x14002a89e
Capabilities:
Execute syscall

Disassembly:
mov ecx, 0xae98349
mov rbx, qword [rcx + 0x60]
mov rcx, r14
mov dword [rsp - 0x10], 0x2a3cb0e9
mov dword [rsp - 0x44], edx
je 0x14002a8db
invalid
jne 0x14002a8db
sub edx, 0x11b31c77
jle 0x14002ae5d
lea r13d, [rcx - 0xcafa]
rol r14d, 0x4f
rcr r10d, 0xad
or r15d, 0x9eb0246a
rcl r13d, 0x3c
jns 0x14002a4b5
lea edx, [rbx - 0xc084]
syscall
rcl r11d, 0x59
movabs rbx, 0x397ffafffff767e9
lea ecx, [rdx + 0x83ce]
cmp r13d, 0x1abb6ea9
mov r9d, 0x53ae298a
ret
jmp fcn.14002a047
mov dword [rsp - 0x44], 0x519a6f0e
call fcn.14008e900
lea rdx, [rbp + 0x30]
mov rdi, rax
mov dword [rsp - 0x28], 0x7bac1ff3
mov dword [rsp - 0x44], 0x359358fa
mov rcx, qword [rax]
invalid
leave
invalid

Function at 0x14002c023
Capabilities:
Execute syscall

Disassembly:
mov dword [rbx + 0x280], eax
mov rax, qword [rbp + 0x1b8]
jmp 0x14002c2ae
test rax, rax
je 0x14002c1c4
mov dword [rsp - 0x2c], 0x79b86de4
jmp 0x14002c2c4
xchg rbx, rbx
mov dword [rsp - 0x34], ebx
lea r14, [rsp + 0x38]

Function at 0x14002fc39
Capabilities:
Execute syscall

Disassembly:
fsub st(0), st(0)
cmp al, 0x38
jnp 0x14048e620
add byte [rax], al
Function at 0x140033b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol eax, 0xc
mov r8d, eax
mov r12d, 0x2d55430f
cmp eax, 0x30b
jne 0x1400360c3
jmp 0x140033a33
cmp r8d, 0xc0351000

Function at 0x140033f95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp - 0x44], 0x4f30fab1
mov rdx, rdx
rep stosb byte [rdi], al
lea rdi, [rbp + 0x732]
jmp fcn.14003a07d
cmp rax, r14
xchg rdi, rdi
xchg rsi, rsi
mov r14, r14
mov dword [rsp - 0x20], 0x14ea390a
jb 0x140034d6e
jmp 0x14003454e
mov dword [rsp - 0x3c], edx
mov r15, r15
mov dword [rsp - 0x28], esi
mov dword [rsp - 0x1c], 0x467157fa
jmp 0x140033ae9
xchg r9, r9
mov dword [rsp - 0x2c], 0x6c0812b2
mov dword [rsp - 0x20], ebp
push rsi
jmp 0x140033a9d
shr eax, cl
mov dword [rsp - 0x30], 0x44d03b37
mov dword [rsp - 0x28], 0x5744001a
xchg rsp, rsp
jmp 0x140034863
mov dword [rbp + 0x6a2], 0x260068
mov dword [rbp + 0x6a6], 0x590075
mov dword [rsp - 0x20], 0x6d84cf39
mov rsp, rsp
jmp 0x1400341b4
push r10
movabs r10, 0x70f5d700000a19e9
sbb dword [rdx], ecx
add byte [rax], al
xlatb
cmc
jo 0x140033b0c
invalid
jmp 0x1400344ac
jmp 0x140034b82
movabs rsi, 0x6d38430000117de9
jne 0x140033a9f
jmp 0x140034c21
je 0x140033a9f
call fcn.140033b48
add rsp, 0x44
jmp 0x140034c1f
push r14
movabs r14, 0x5330f900001126e9
jne 0x140033aed
jmp 0x140034c18
je 0x140033aed
jmp 0x140034c0c
mov dword [rsp - 0x20], 0x4501da1a
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xb0]
mov rdi, rdi
je 0x140033c5b
jne 0x140033c5b
pushf
jmp rax
jmp 0x140035117
mov dword [rsp - 0x24], ecx
mov word [rbp + rax*2 + 0xe98], cx
mov rax, qword [rbp + 0x10b8]
jmp 0x140033a8a
mov dword [rsp - 0x44], 0x2203f474
mov dword [rbp + 0x682], 0x26007b
mov dword [rbp + 0x686], 0xd0027
mov dword [rbp + 0x68a], 0x2c0069
mov dword [rsp - 0x2c], edx
je 0x140033cf0
jne 0x140033cf0
rcr r10d, 0x8f
jmp rax
jmp 0x140034be8
mov dword [rsp - 0x18], 0x44cf3736
mov dword [rsp - 0x20], 0x4f937be1
movzx edx, word [rbp + rax*2 + 0x60a]
mov eax, r12d
jmp 0x14003396c
ret
pop rbp
xor eax, eax
jmp 0x140034ee1
mov dword [rbp + 0x65e], 0x480027
mov dword [rbp + 0x662], 0x37007c
mov dword [rsp - 0x40], ebp
mov rsp, rsp
mov dword [rbp + 0x666], 0x5f0034
add byte [rdi], bl
mov dword [rbp + 0x66a], 0x63007b
mov dword [rbp + 0x66e], 0x42002c
jmp 0x140033739
push 0x34
mov qword [rsp + r12 - 0x10], 0x64404961
xchg rcx, rcx
mov dword [rbp + 0x6c2], 0x6d007b
xchg r8, r8
mov dword [rsp - 0x38], 0x769bb2d9
mov dword [rsp - 0x44], ebx
mov qword [rbp + 0x10b8], rdi
mov rax, qword [rbp + 0x10b8]
jmp 0x140034d6e
mov dword [rsp - 0x44], 0x1dca7cc0
mov dword [rbp + 0x6aa], 0x630060
mov dword [rbp + 0x6ae], 0x4c0021
mov dword [rbp + 0x6b2], 0x260064
mov dword [rsp - 0x28], 0x5063b912
jmp 0x14003381f
push rbp
movabs rbp, 0x4e506bfffffc76e9
jne 0x140034283
jmp 0x140033efe
je 0x140034283
call 0x14003442b
add rsp, 0x44
pop rbp
jmp 0x140033efd
ret
pop r10
inc rax
xchg r9, r9
jmp 0x140035312
mov rbx, qword [rbp + 0x10a0]
mov word [rbp + 0xf54], di
xchg rbp, rbp
xchg rsi, rsi
mov rdi, rdi
je 0x1400345a9
jne 0x1400345a9
jmp rcx
invalid
pop rax
invalid
Function at 0x140034259
Capabilities:
Encode data using xor

Disassembly:
mov dword [rax + 0x20], ebx
xchg ecx, ecx
loope 0x14003429c
ror esi, 4
movabs rdi, 0x37a7030000061ee9
add byte [rax], al
add esp, dword [rdi - 0x2008b6c9]
jo 0x14003359b
lea r8d, [rdx + 0xf230]
test r9, rbx
jmp 0x140033727
invalid
xor eax, eax
mov dword [rsp - 0x14], ebp
push r10
movabs r10, 0x8f132fffff900e9
jne 0x140034ae1
jmp 0x1400343e6
je 0x140034ae1
call 0x140034c6d
jmp 0x1400343df
Function at 0x14003a6ed
Capabilities:
Execute syscall

Disassembly:
syscall
lea esi, [rdi - 0x854a]
ret

Function at 0x140043cf9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rsi - 0x77], ah
add al, 0x51
sbb ebp, ebx
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
jne 0x140043c94
je 0x140043c94
pushfq
rol edi, 0xa1
jmp rcx
xlatb
push rdi
sub r8d, 0x9b2aa1e2
movabs rcx, 0x512282000000e5e9
call rcx
cpuid
pause
inc rdi
add r11d, 0x4a0f689f
mov r14d, 0x9fdb4ea9
pushfq
jmp 0x140043d7e
push rbx
movabs rbx, 0x6bec55000000a6e9
jne 0x140043cbb
jmp 0x140043d66
je 0x140043cbb
call 0x140043cf9
add rsp, 0x59
pop rbx
jmp 0x140043d65
movzx eax, byte [rsp + rcx + 0x40]
xchg r8, r8
mov dword [rsp - 0x28], 0x7f8cf605
mov dword [rsp - 0x28], 0xcad8fee
jne 0x140043d45
je 0x140043d45
pop r15
sub r9d, 0xac4184e7
rcl r9d, 2
or r11d, 0xf697f863
cmp r10, rdi
mov ebx, 0x69b2d9df
popfq
push r10
jg 0x140043712
rcl r9d, 2
jns 0x1400444f9
lea r9d, [rdi - 0x285c]
jns 0x1400435d8
movabs r10, 0x79cbaf00000097e9
cmp r11d, 0x6603f101
pushfq
cmp r8, rbp
and esi, 0x65169b05
jb 0x140043a08
jmp 0x140043de1
ret
ret
pop rbx
lea rdx, [rbp + 0x58]
xor ecx, ecx
mov dword [rsp - 0x2c], esp
mov dword [rsp - 0x14], 0x39c31495
jmp 0x14004403e
mov dword [rsp - 0x3c], edi
mov dword [rsp - 0x28], 0xa477659
test rax, rax
je 0x140043e92
je 0x140043dd6
jne 0x140043dd6
xor ebx, 0x1f31ed78
lea r9d, [rbx + 0x3528]
lea esi, [rcx + 0xd10e]
mul rbp
inc r15
add r12d, 0xb50e4622
lea esi, [rdx + 0x4730]
rcl r14d, 0x27
int3
jmp 0x140043ceb
mov word [rdx + rcx*2], ax
add rcx, r15
cmp rcx, qword [rbp + 0x88]
jb 0x140043ceb
jne 0x140043e13
je 0x140043e13
rol ecx, 0xd5
add r9d, 0x13b2b414
cmp r14, rdi
rcl ebp, 0x4b
jmp rax
jmp 0x140043e2d
mov r11, r11
mov dword [rsp - 0x14], 0x7cdc927c
mov dword [rsp - 0x38], esp
jmp 0x140043e92
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.1400f5e60
mov rcx, qword [rbp + 0x50]
xchg rsp, rsp
xchg rdi, rdi
mov dword [rsp - 0x3c], 0x4a42a100
jne 0x140043ee7
je 0x140043ee7
jle 0x14004458e
call rax
call rax
cpuid
jne 0x140044951
cpuid
ror ecx, 0x34
jmp 0x1400440e1
xchg r11, r11
mov dword [rsp - 0x38], 0x697de84a
mov qword [rbp + 0x50], rdx
jne 0x140044060
je 0x140044060
jmp 0x140043c63
xchg r14, r14
push r15
invalid
invalid
invalid
invalid
invalid
invalid
Function at 0x140048ad9
Capabilities:
Execute syscall

Disassembly:
mov dword [rbp + 0x8c], 0x4c0021
mov r10, r10
mov dword [rsp - 0x10], edx
je 0x140048b1e
jne 0x140048b1e
call rax
test r14, rdi
xor r14d, 0xd2a3e83
inc rsi
push r13
call rax
syscall
ret
jmp 0x140048ee6
mov dword [rbp + 0x524], 0x420036
mov dword [rbp + 0x528], 0x330062
mov dword [rbp + 0x52c], 0x590034
mov dword [rsp - 0x3c], 0x5c648139
mov r9, r9
mov dword [rbp + 0x530], 0x210066
jmp 0x140048eac
mov dword [rsp - 0x3c], ebp
mov dword [rsp - 0x10], 0xe1df9b0
mov dword [rsp - 0x24], 0x31ec481c
mov word [rbp + rax*2 + 0x7c8], cx
mov rax, qword [rsp + 0x40]
add rax, rsi
mov qword [rsp + 0x40], rax
je 0x140048c23
jne 0x140048c23
jbe 0x14004942b
push r13
rol ecx, 0xf
rcl r8d, 0xf6
jmp rcx
jmp 0x140049124
mov dword [rsp - 0x28], 0x423f6bc9
mov dword [rsp - 0x30], 0x5b287b1f
mov ecx, 0x7b
mov word [rbp + 0x7f0], bx
mov word [rbp + 0x57c], cx
mov dword [rbp + 0x4f8], 0x2c0056
jmp 0x140049101
invalid
mov dword [rsp - 0x14], ebx
xchg rsp, rsp
mov dword [rsp - 0x10], 0x738efecc
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
and cl, r15b
mov dword [rsp - 0x40], 0x72652177
je 0x140048d46
jne 0x140048d46
ror ecx, 1
jmp rax
jmp 0x140048e41
mov dword [rsp - 0x34], 0x14ae0f44
mov dword [rbp + 0x9c], 0x4a003a
mov dword [rbp + 0xa0], 0x2d0066
mov dword [rbp + 0xa4], 0x680075
mov dword [rsp - 0x10], ecx
jmp 0x140049037
mov dword [rbp + 0x98], 0xf002f
mov rsi, rsi
xchg r12, r12
jmp 0x140048d6a
mov rdi, rdi
shl cl, 3
mov dword [rbp + 0x534], 0x480039
mov dword [rsp - 0xc], 0x392dee90
mov dword [rsp - 0x1c], 0x2062c2b7
mov r11, r11
mov dword [rbp + 0x90], 0x760061
mov dword [rbp + 0x94], 0x75
jmp 0x140048d99
mov dword [rbp + 0x518], 0x2a002f
mov dword [rbp + 0x51c], 0xd0026
mov dword [rsp - 0x18], 0xd7f94f5
mov dword [rsp - 0x2c], 0x44af6d3b
mov dword [rbp + 0x520], 0x2d0066
jmp 0x140048b61
call fcn.140049094
add rsp, 0x3b
pop r14
ret
pop r14
mov dword [rbp + 0x500], 0xb002f
jmp 0x140049171
mov dword [rsp - 0x24], 0x5388ca65
xchg r11, r11
mov dword [rbp + 0xa8], 0x31007d
mov dword [rbp + 0xac], 0x5f003a
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
jmp 0x140048ce9
mov dword [rbp + 0x50c], 0x5f0034
mov dword [rbp + 0x510], 0x63006a
mov dword [rsp - 0x2c], 0x6a9d486f
mov dword [rsp - 0x14], 0x31547a29
invalid
test dword [rax + 0x1c0000], edx
invalid