joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405bb9d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg r14w
mov word [rsp + 0x18], 0x4847
movsx r14w, word [rsp + 0x1c]

Function at 0x1405c29ed
Capabilities:
Encode data using xor

Disassembly:
and qword [rsp + 0x40], 0x1e683ed2
add qword [rsp + 0x58], 0xffffffffbf9a31cb
movabs r10, 0x14cc025d6a32394a
movabs rcx, 0x270569c966200961
mov word [rsp + 0x30], 0x4dcf
push r9
not r15d
sub qword [rsp + 0x48], r10
pop r11
not r11b
mov rcx, qword [rsp + 0x60]
not byte [rsp + 8]
add qword [rsp + 0x68], 0xffffffffffa7626f
test dword [rsp + 0x50], 0x17690d84
setg byte [rsp + 0x50]
sub qword [rsp + 0x40], 0x7fe01a5e
sub word [rsp + 0x30], r9w
and word [rsp + 0x40], r15w
or word [rsp + 0x30], 0x51d4
or dword [rsp + 8], r15d
call fcn.14069b32b

Function at 0x14064f5a5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sub r11b, byte [rsp + 0x3e]
jns 0x1406de2c2
test r15b, 0x4b
mov qword [rsp + 0x50], 0x25096229
jno 0x140bdb021
std
movabs eax, dword [0xab628e0f4e379d4e]
push rcx
adc byte [rcx - 0x63], dh
invalid
call fcn.1406505a7
mov dh, 0xbf
clc
jae 0x140b34c35
invalid
mov cl, bl
adc ch, byte [rdi + rdi*4 - 0x28ed31df]
pop rax
movsb byte [rdi], byte [rsi]
cmp ebp, ebp
push rsi
mov dh, 0xd
and al, 0x6d
adc ebp, dword [rcx - 0xd]
fst dword [rdx - 0x3cf10333]
xchg edx, eax
movsxd r15, ecx
mov eax, 0x85d7057e
pop rcx
and al, 0x20
xor dh, cl
invalid
lea r11, [r11*4 + 0x281c6d0d]
push r14
movabs r14, 0x218f269101487f5e
mov r14, qword [rsp]
add r11d, 0x58f93fdf
neg r11d
jge 0x140b34be9
neg r11d
setae r11b
bswap r11d
movsxd r11, r11d
test r11, 0x15d81ff4
call fcn.14071ebf0
movsx r15d, byte [rsp + 0x38]
not r15w
cmp ecx, dword [rsp + 0x3a]
lea r15, [r15 + rcx*8 + 0x39313c40]
push r9
setg r11b
neg r15b
mov r9, qword [rsp + 0x40]
sub edx, edx
cmp r9w, word [rsp + 0x45]
cmovne r9d, edx
and r9w, dx
xor r9, qword [rsp + 0x40]
neg ecx
test qword [rsp + 0x40], rcx
push rsi
bswap r11d
setbe r9b
lea rcx, [rdx + 0x54580e73]
mov rsi, qword [rsp + 0x48]
seto cl
mov rcx, qword [rsp + 0x40]
jno 0x14062b05f
push r11
movabs r11, 0x6b743aa625c18d4
jo 0x140b5a123
lea rsp, [rsp + 0x20]
call fcn.140c4655c
or eax, 0x8776e70a
jns 0x140bdb0aa
jl 0x140bdb0ba
invalid
invalid
jg 0x140bdb130
invalid
loope 0x140bdb154
invalid
ja 0x140bdb104
mov byte [rsi], cl
not dword [rax + 0x5b]
invalid
cld
cmp byte [0x18a233655], r14b
fld st(3)
invalid

Function at 0x140650046
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
cmp rdi, r14
mov rdi, qword [rsp + 0x38]
not r13w
sete r13b
xor byte [rsp + 0x20], r14b
add r14, qword [rsp + 0x20]
xor byte [rsp + 0x20], 0x51
cmovno ebp, dword [rsp + 0x22]
not r14
or byte [rsp + 0x20], bpl
call fcn.140b2c000
Function at 0x140650beb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setno r9b
add r9d, r14d
cmp r9w, r14w
lea r9, [r14 + 0x1ce1098]
mov r9, qword [rsp]
bswap r14
lea r14, [r14 + 0x538c606f]
movsx r14d, r14b
jge 0x14067e8eb
mov r15, r12
sets r12b
cmp r15d, 0x7b1d328b
ja 0x140b3ebb8
pop rsi
je 0x1406916c5
popfq
call fcn.1405b143e
movzx r9d, r14w
setbe r14b
cmp r9b, 0xd9
setle r9b
jb 0x14062bd42
sbb dl, byte [rcx + 0x6841fdbd]
hlt
sub r14b, 0x3f
jg 0x1406b91ba
imul ebx, dword [rbp + 0x67], 0x5b
mov dword [rsi - 0x2ce2f76], esi
cld
push rbx
sub esi, ecx
invalid
lea rdx, [rdx + rdx + 0x79f91eaf]
pushfq
add rdx, rdx
js 0x1405b9097
push rsi
call fcn.140692058

Function at 0x14065d5ee
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov rbp, r9
not rcx
ja 0x1406c3299
jno 0x140b51cb3
or ecx, 0x7864051f
jae 0x14071cb03
not cx
xor cx, cx
test cl, 0xa0
movabs rcx, 0x28ed10d412192c0c
push r9
push rbp
push r14
movabs r14, 0x778e728f069a39c4
seto cl
neg r14w
movabs r9, 0x1725308b28156df9
not r14b
test r9w, 0xdc6
cmova ecx, r9d
jg 0x14064f573
xlatb
jle 0x14071cbbd
pop rbx
xor eax, 0x31c6a90a
mov cl, 0x38
jo 0x14071cb95
invalid
add dl, bh
xor dword [rsi - 0x35], ebx
fsubr dword [rsi + rcx*8]
and dword [rcx], ebx
mov esi, 0x117adf06
and dword [rdi + rbx*8], eax
loop 0x14071cba4
xlatb
fidiv dword [rcx]
xor bl, byte [rbp + 0x18]
adc ebx, ebp
xchg esp, eax
stosb byte [rdi], al
mov ebx, 0x74c72bf4
xlatb
xchg dword [rdi + 0x6f], esi
sub byte [rsi - 0x412a0c19], ah
imul esi, dword [rdx + rsi], 0x24
push rsp
invalid
cmpsb byte [rsi], byte [rdi]
out 0xf3, eax
invalid

Function at 0x1406c6226
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dword [rsp + 0x18], 0x29a94ad1
lea r10, [r13*8 + 0x787d6766]
jne 0x140bc7de6
setle r10b
sub byte [rsp + 0x18], 0x43
mov r14, qword [rsp + 0x18]
and byte [rsp + 0x18], 0x16
cmovbe r10, r14
mov r14, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x7d11aace
test r10w, r13w
jbe 0x14068719f
call fcn.140b90772
je 0x140b5cafd
add qword [rsp + 8], 0xffffffffbf437d67
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.140c35a7f
push r14
movabs r14, 0x2b1716df218443cb
pushfq
cmp r14b, 0x49
push r12
mov r12, r14
jns 0x140679c93
neg r14w
setbe r14b
jl 0x140b4004c
mov r11, qword [rsp + 0x58]
lea r15, [r8 + r8*4 + 0x330b1436]
movsxd r10, ebp
not qword [rsp + 0x20]
jle 0x14063ba1b
ja 0x140680585
test r14d, 0x628d0208
cmovl r10, r13
jg 0x1407228f4
Function at 0x1406ce666
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
neg r8
setl r8b
or r11d, 0x315b6e4e
or r8w, 0x2f68
test r8d, 0x55632672
jae 0x140bc9d1d
loop 0x1406658d1
outsd dx, dword [rsi]
scasd eax, dword [rdi]
add al, 0x47
sahf
fist word [rax + 2]
invalid
movabs r15, 0x69d50b7e28c7578e
bswap r14
push r12
bswap r14
push r11
not r8b
push r9
not r15b
push rdi
movabs r11, 0x40ba065556ef1950
movabs r15, 0x126020d2480e3792
mov r10, qword [rsp + 0x28]
mov r12, r14
mov rdi, r11
neg r11d
and r8b, r11b
not r15b
mov r8b, 0x73
lea r12, [r12 + 0x61ba2be1]
cmp r8d, r14d
mov r9, rdi
ja 0x1406c2b93
and r8d, 0x50bd42ad
movsx r15w, r9b
test r8d, 0x15b03c4e
setne r12b
mov edi, 0x1e1c2ecd
and r11d, 0x6dd3ca0
test r15w, r12w
mov r9b, r15b
lea r12, [r11 + r12*2 + 0x5a77d12]
jb 0x1407148f8
pop rdi
or r12d, 0x5bb048b5
movsx r11d, r9b
cmp r8d, 0x3ffa0e58
call fcn.1406c6ee1
xor r12b, r15b
xor r12, 0x5a3c2c09
jge 0x140b23ad4
add qword [rsp + 0x38], 0xffffffffbf4ab0a1
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x78]
call fcn.140c95a9d
not r8b
lea r8, [r8 + r8*4 + 0x1bfd6f1a]
movsx r8d, r8w
xor r8, 0x691c5499
test r8b, 0xd8
not r8w
not r8b
jl 0x1406c2be6
test r8b, 0xd9
movabs r8, 0x56a847d7169563ab
jb 0x1406658e5
mov r8, qword [rsp + 0x20]
jle 0x1406c2bd2
jne 0x140658ac5
fcmovnu st(0), st(0)
out dx, eax
push rcx
stosb byte [rdi], al
invalid
jbe 0x1406c6f12
movsx r8w, r14w
neg r12b
xor r15d, 0x394e6d6d
mov r14, qword [rsp + 0x38]
neg r9d
je 0x14072f89a
mov r12d, 0x112585
test r8, 0x2f247d73
jo 0x1406c2baa
add qword [rsp], 0xa7e1c
xor r15w, r8w
call fcn.140ba5865
lea r11, [r11 + r11*8 + 0x3c8c7c32]
setg r11b
xor r11w, 0x54b
add r11d, 0x6c5447e2
mov qword [rsp + 0x10], 0x10df7dcf
xor r11w, 0x35ed
push rdi
mov rdi, r11
jge 0x14073d13a
bswap r11
push r11
setae byte [rsp]
xor edi, 0x53da49c5
push r15
mov dword [rsp + 8], r11d
jns 0x140b507af
xor qword [rsp + 0x38], 0x4a5562ca
lea r15, [r8*2 + 0x61cc67f8]
sub r15d, r8d
seta r8b
sub r15w, r8w
movzx r15, r15w
add r8w, 0x2dbe
add qword [rsp], 0xfffffffffff1084c
call fcn.1406d5f73
mov r11, qword [rsp + 0x38]
sub dword [rsp + 0x20], 0x200b7cab
call fcn.140bdb5dc
test r15w, r8w
lea r14, [r9 + r12*8 + 0x42022fcc]
mov r12d, r8d
mov r8w, 0x28cb
not r12b
lea r15, [r15 + r14*4 + 0x697e04f9]
call fcn.1407148f5
movabs r15, 0x53f90d1808e91957
bswap r11
cmovns r11d, edi
mov r15, qword [rsp]
or dword [rsp + 8], 0x56d538cf
movzx r11w, dil
neg dil
call fcn.1406976be
call fcn.14070e9d9
stosw word [rdi], ax
or byte [rdx + rcx + 0x42add25d], cl
not byte [rsi - 0x35995212]
or dword [rax], ecx
movsb byte [rdi], byte [rsi]
cmp ch, bl
jg 0x140b5081f
push rdx
push rbx
test al, 0x6a
in eax, dx
pop rbx
loopne 0x140b50853
cmp al, 0xdb
lodsd eax, dword [rsi]
pop r15
xchg ebx, eax
fldcw word [rbp + 0x99cefb3]
movsb byte [rdi], byte [rsi]
invalid
ficomp word [rdx + 0x7252120b]
xchg esi, eax
xchg esp, eax
hlt
sbb byte [rdi], dl
invalid

Function at 0x1406d75a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffffa6a589
push rbp
call fcn.140bcdffb
Function at 0x1406dd8ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x68], 0x2a972e43
sub qword [rsp + 0x68], 0x2e9d2ad9
setl byte [rsp + 0x68]
not word [rsp + 0x68]
or dword [rsp + 0x68], 0x484761f0
mov qword [rsp + 0x68], 0x34ce63bf
add qword [rsp + 0x18], 0xffffffffbf92cc9f
add qword [rsp + 0x20], 0xffffffffbf466369
not qword [rsp + 0x68]
xor qword [rsp + 0x68], 0x5104689e
xor qword [rsp + 0x68], 0x27a74390
mov byte [rsp + 0x68], 0x99
not word [rsp + 0x68]
cmp word [rsp + 0x68], 0x3b57
jl fcn.1405bddf2
jge 0x1407149a2
sub dword [rbp + rsi*4 - 0x3b], 0xdb7af18e
movsb byte [rdi], byte [rsi]
leave
in al, dx
sub al, 0xed
push rdx
invalid
jns 0x140b5a18e
push 0x1b
mov dword [rbx + rax*8 + 0x66e3284c], edi
jnp 0x1406dd911
and al, 0x11
test byte [rsp + 0x6b], bl
setno byte [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
jno 0x14062179e
movabs byte [0xc0b9e2018f41c4fb], al
mov ebx, 0xbf4c0f37
imul edi, dword [rbx + rcx], 0xffffffb1
ror byte [rsi], 0x3c
call 0x1b8906279
mov edi, 0x4628bad0
mov edi, 0x4d568db3
mov edi, 0xb78d0af0
sal byte [rbx - 0x40b8ee47], 0xd7
mov r14b, 0x40
mov edi, 0xbebb0348
shr byte [rbp - 0x3f5fdfdd], 0x29
test ebp, ecx
push rbp
mov edi, 0xa8c9be29
rcr byte [rsi + rcx*4 - 0x3f3f5bd6], 0x9d
in al, 0x5b
mov edi, 0x5feab822
mov edi, 0x54946789
mov edi, 0x54353352
mov edi, 0x9af56e05
mov edi, 0x1c106a3a
pop rcx
loop 0x140b5a275
pop rdx
rol byte [rdi - 0x57], cl
stc
test eax, 0x52c842a8
adc dl, dl
cmp eax, 0x32a66914
fstp dword [rdx + 0x1a]
scasd eax, dword [rdi]
cmp al, 0xe
cmpsd dword [rsi], dword [rdi]
in eax, 0xc4
push rbx
movsb byte [rdi], byte [rsi]
xor byte [rax], cl
pop rsp
sbb dh, byte [0x1a65c6838]
ret 0xd312
pop rsp
xchg esp, eax
outsd dx, dword [rsi]
lahf
movabs dword ds:[0x3fce53e6f0f9527f], eax
scasb al, byte [rdi]
ret 0xf8d6
Function at 0x140b2901d
Capabilities:
Check http status code

Disassembly:
sub dword [rsp + 0x30], edx
jle 0x140b60100
add qword [rsp + 0x70], 0xfffffffffff70960
or qword [rsp + 0x30], 0x11ed75fa
movsx r13w, word [rsp + 0x5a]
mov rdx, qword [rsp + 0x40]
or r13b, byte [rsp + 0x4f]
and word [rsp + 0x58], r13w
or word [rsp + 0x30], 0x3684
neg r13d
neg dword [rsp + 0x58]
call fcn.140b90660
jo 0x1406251c9
mov ebx, dword [rax - 0x17faae0f]
jl 0x140625232
imul eax, dword [rdx + 0x38], 0x506563e5
xchg edi, eax
invalid
and al, 0x68
call fcn.140cce675
test eax, 0x6d64f8a4
invalid
xchg edx, eax
invalid
je 0x140b60100
jae 0x140ba228d
and byte [rsp], 0x5f
mov r8, qword [rsp + 0x18]
or dword [rsp], 0x26d442c3
setge byte [rsp]
neg qword [rsp]
mov dword [rsp], 0x615b2833
add dword [rsp], 0x10646765
xor qword [rsp], 0x197f0ae4
or byte [rsp], 0x90
add qword [rsp], 0x111776b4
xor qword [rsp], 0x38c87297
xor qword [rsp], 0x35ca1ce4
and dword [rsp], 0x9985fbc
add word [rsp], 0x6cef
ret
or qword [rsp], 0x47c62933
not dword [rsp]
test byte [rsp], 0x44
call fcn.1406393a8
pop rax
sbb byte [rbp - 0x65c961d8], 0x8b
js 0x140b29037
shr dword [rsi + 0x74], 0x13
int 0x84
in eax, dx
wait
invalid
test edx, r11d
jle 0x1405c7a4e
test word [rsp + 0x18], 0x7464
setge r13b
sub r11d, edx
call fcn.140b600f9
adc cl, byte [rsi - 0x51]
pop rbx
ficom word [rdi - 0xc]
ret
and word [rsp + 0x20], 0x63dc
jb 0x140625163
neg qword [rsp + 8]
xor r11, qword [rsp + 0x20]
or dword [rsp + 8], 0x50d50418
call fcn.140625a86
invalid
and dx, 0x4af7
test byte [rsp + 0x38], 0x57
sete byte [rsp + 0x38]
setle byte [rsp + 0x38]
mov r11, qword [rsp + 0x58]
xor r13w, word [rsp + 0x4a]
add r13b, 0x2f
js 0x140b54208
call fcn.140b5b85a
or r12w, word [rsp + 0x4a]
bswap r12d
call fcn.140bc8011

Function at 0x140b2c000
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
jbe 0x140628028
setns byte [rsp + 0x28]
mov r14, qword [rsp + 0x48]
sub word [rsp + 0x28], 0x2e32
sub qword [rsp + 0x28], r13
jo 0x140650065
add rbp, 0x237f0785
jns 0x140bc8315
and rbp, 0x361d433b
sub r13w, bp
jne 0x14072f7fb
Function at 0x140b2d10d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or word [rsp + 8], 0x4506
jns 0x1406af771
mov qword [rsp + 0x20], 0x28a7511a
not dword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
setae r11b
not dword [rsp + 0x18]
neg r12w
movzx r11w, r12b
lea r11, [r12*4 + 0x5f305813]
add r11b, byte [rsp + 0x1c]
test qword [rsp + 0x18], r11
test dword [rsp + 0x18], ebx
mov r11b, byte [rsp + 0x22]
mov r11b, r12b
jl 0x14065af50
ja 0x140b3a688
mov eax, 0xee5bf617
cli
leave
cmp al, 0xdf
sal esi, cl
pop rbx
or eax, 0xcfbd5d31
and byte es:[rbx + rax*4 + 0x78cefd4a], bh
xchg ecx, eax
xchg ebx, eax
add al, 0x31
add esp, ebx
movabs dword [0xc6cefb641a012029], eax
jb 0x140b2d13e
add byte [rcx], dh
or dword [rax - 0x28], ebp
sub ah, byte [rax]
mov esp, dword [rax]
sub byte [r8], r12b
ret 0x808f
mov word [rsp + 0x10], 0x31bb
and dword [rsp + 0x20], 0x61440e1e
sub byte [rsp + 0x10], 0xe2
je 0x1406c6235
add word [rsp + 0x18], 0x5637
test byte [rsp + 0x1e], r12b
bswap r11
setb r11b
mov r12, qword [rsp + 0x28]
add r11d, dword [rsp + 0x14]
lea r11, [r11 + r11 + 0x519c3133]
test byte [rsp + 0x10], r11b
not r11b
not qword [rsp + 0x18]
call fcn.1407129ae
add byte [rax], al
add byte [rcx], al
invalid

Function at 0x140b31640
Capabilities:
Check http status code

Disassembly:
push r8
jg 0x140b95a10
neg r11b
mov r15, qword [rsp + 0x48]
sub byte [rsp + 0x30], r11b
lea rsi, [r11*2 + 0x725d7426]
setne r12b
jle 0x1405b77bd
add qword [rsp + 0x40], 0xffffffffbf9d25c8
test r11, 0x737864e7
mov r13, qword [rsp + 0x18]
mov r12b, byte [rsp + 0x31]
sets byte [rsp + 0x30]
or rsi, qword [rsp + 0x30]
add qword [rsp + 0x38], 0xffffffffbf46a5df
sub r12d, dword [rsp + 0x30]
add bp, r13w
add qword [rsp + 8], 0xffffffffbf4daade
and rsi, 0x36957f3c
bswap rbp
neg word [rsp + 0x30]
and r13b, byte [rsp + 0x37]
add qword [rsp + 0x70], 0x57bf
mov r8, rsi
call fcn.140b49492

Function at 0x140b470b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test word [rsp + 0x23], dx
push 0x549f5125
jb 0x140bb12c7
mov rdx, qword [rsp + 0x38]
sub r9d, 0x39f964c9
add r9b, 0x74
mov r8, qword [rsp + 0x28]
lea r12, [r8 + r8*2 + 0x29797174]
or qword [rsp + 0x28], 0x2c0c4476
xor word [rsp + 0x28], 0x3112
or r9d, 0x32e658b3
movzx r12w, word [rsp + 4]
movsxd r8, dword [rsp]
cmp r9b, byte [rsp + 0x2b]
lea r8, [r12 + r8*2 + 0x418d3cc3]
movzx r8w, r8w
not byte [rsp]
call fcn.140bc4b04
invalid
Function at 0x140b5236f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r8b
cmovle ebp, r12d
cmp esi, r12d
push rbx
je 0x140b52364
sbb bh, byte [rax]
xchg ebx, eax
mov esp, 0x89f097bc
mov esp, 0x9aea82c2
mov esp, 0x780f3042
pop r12
sub eax, 0x8bbc8b35
adc edi, dword [rdi - 0x6c]
mov esp, 0x8311dc7d
mov esp, 0x7f74e3a5
adc eax, 0xbc8f5dba
add byte [rdx], dh
ret 0xbc9d
cmp r8, 0x791552a4
lea rsi, [rsi + rsi*2 + 0x589b6bcd]
bswap r8d
mov rbx, r8
movzx r8w, word [rsp + 0x1c]
mov dword [rsp + 0x18], r8d
movsx bx, bx
mov r12b, byte [rsp + 0x1d]
call fcn.140673169
add dword [rsi], eax
add al, byte [rax]
invalid
and dword [rsp + 8], 0x3eea6547
neg word [rsp + 8]
je 0x140b52387
not word [rsp + 8]
add qword [rsp], 0xfffffffffffbca8e
ret 0x10
mov rbp, qword [rsp + 0x20]
jle 0x1406c5a75
or dword [rsp + 8], 0x53a2437d
jbe 0x140ba7288
xor dword [rsp + 8], r13d
mov r13d, dword [rsp + 8]
lea r13, [r13*8 + 0x361604fe]
setg byte [rsp + 8]
add r13, qword [rsp + 8]
and r13, r13
mov word [rsp + 8], 0x3229
mov r13, qword [rsp + 0x10]
mov qword [rsp + 8], 0x6e590e2b
not word [rsp + 8]
mov dword [rsp + 8], 0x7ccc0de6
add dword [rsp + 8], 0x65a71028
not byte [rsp + 8]
cmp word [rsp + 8], 0x889
mov dword [rsp + 8], 0x47db1a1a
jge 0x140714216
push rdi
and r9b, byte [rsp + 0x15]
cmp word [rsp + 0x28], cx
setne byte [rsp + 0x28]
call fcn.140bc0a98
setge r13b
lea r10, [r13 + 0x129e5303]
mov r10, qword [rsp + 0x10]
sub qword [rsp], r13
sets byte [rsp]
and r13b, r13b
not qword [rsp]
not r13w
sete r13b
or qword [rsp], r13
lea r13, [r13 + 0x498d7b50]
and byte [rsp], 0x8f
mov word [rsp], r13w
call 0x140b5236f

Function at 0x140b5a165
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdi, qword [rsp + 0x60]
cmovl edx, dword [rsp + 0x6b]
sub word [rsp + 0x30], 0x3d3e
add qword [rsp + 8], 0xffffffffbf9b9533
mov dword [rsp + 0x68], 0x3fbb452b
not ecx
call fcn.14073d14c

Function at 0x140b9b458
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x60]
call fcn.140c35a7f
movabs r11, 0x415200d03c095074
push rsi
push r8
bswap r11d
not r12b
push r11
movsx r11d, byte [rsp + 2]
movsx r12d, r12w
jg 0x140b3d842
js 0x140b9b465
mov rsi, rcx
add ecx, r11d
push rbp
sub rsi, qword [rsp + 8]
mov r11, qword [rsp + 0x28]
cmovle r15, rsi
movzx ecx, word [rsp + 0xc]
add qword [rsp + 0x40], 0xffffffffbf43bd5e
mov r8, rsi
add qword [rsp + 0x48], 0xffffffffffae55ec
xor esi, dword [rsp + 0xb]
jbe 0x140b9b483
and esi, dword [rsp + 0xc]
movabs rbp, 0x39d103bb00f36018
movsx r15d, word [rsp + 0xb]
lea r8, [rbp + 0x4ab95ed6]
test ebp, r12d
call fcn.14068a53e
jg 0x140b9b513
sbb ah, byte [rdx + rcx*4 - 0x38]
scasb al, byte [rdi]
xchg ecx, eax
mov ah, 0x23
sub dword [r14 + 0x397b1cf5], r9d
jns 0x140b9b565
invalid
sub esp, 0xffffffc1
fstp dword [rdi]
mov bl, 0xc
int 0xcc
cqo
jns 0x140b9b553
int1
invalid
in eax, dx
invalid
insd dword [rdi], dx
xchg edx, eax
mov cl, 0x23
invalid

Function at 0x140ba726c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1406ce666
not r10
setle r13b
sub r10, qword [rsp]
setl r13b
lea r10, [r13 + 0x24e015ac]
Function at 0x140ba72ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r13b, dl
mov r13b, byte [rsp + 0x82]
lea rsp, [rsp + 0x30]
ret
sub r13b, 8
or byte [rsp + 0x60], 0xe2
mov rsi, qword [rsp + 0x88]
or rdi, rdx
je 0x14071b044
call fcn.1405c9fb6

Function at 0x140ba7eeb
Capabilities:
Encode data using xor

Disassembly:
sub ebp, 0x4ba14317
mov rbp, qword [rsp + 0x40]
and rbx, rbx
sub ebx, ebx
or ebx, 0x5b9859c7
add ebx, 0x3e1e2384
add qword [rsp + 8], 0xd4b21
and ebx, 0x1178631b
xor bl, 0x77
or ebx, ebx
call fcn.140b2ba29
jp 0x14062e7da
stosb byte [rdi], al
ficom dword [rdi + 0x1b]
and eax, 0x58e2f6dd
and eax, 0x4bf8c3c3
and eax, 0xa91d2132
fimul dword [rsp + rdi*2 - 0x25daa5d9]
insd dword [rdi], dx
and eax, 0x52038d2c
and eax, 0xae660225
fidiv dword [0x165c13730]
mov r11b, 0xd0
and rax, 0xffffffffa17754cc
ficom dword [rsi]
cmp ebp, dword [rcx + 0x46]
and eax, 0x5d782ed5
and eax, 0x4e62b3c2
and eax, 0xac876152
fidiv dword [rbp + 0x74]
mov ebp, 0x72ba255f
test dword [rax + 0x25], 0x5799cd8d
and eax, 0xabfcf2b4
ficomp dword [rax + rcx]
adc al, 0xab
invalid
sub dword [rsp + 8], 0x5e74c7b
lea rdi, [rdi + rdi*4 + 0x400e1635]
add byte [rsp + 0x10], 0x8b
sub dword [rsp + 8], 0x69915cc9
movsx di, byte [rsp + 0x15]
lea rdi, [rdi + rdi*8 + 0x3b820754]
bswap rdi
or word [rsp + 8], 0x75ea
mov dword [rsp + 0x10], edi
not byte [rsp + 0x10]
not edi
mov rdi, qword [rsp + 0x18]
xor byte [rsp + 8], 0xf9
neg word [rsp + 0x10]
sub qword [rsp + 0x10], 0x2b554288
sub dword [rsp + 8], 0x541d72fb
not word [rsp + 0x10]
not byte [rsp + 8]
neg byte [rsp + 0x10]
or word [rsp + 0x10], 0x1101
setge byte [rsp + 8]
and word [rsp + 0x10], 0x4936
xor dword [rsp + 8], 0x16de42d4
call fcn.14070ac6c
bswap r12
sub word [rsp + 0x10], 0x6288
xor di, 0xfed
and rdi, 0x70083848
test qword [rsp + 8], 0x3f8204f0
mov r12, qword [rsp + 0x28]
lea rdi, [rdi + rdi*4 + 0x2b404469]
movzx di, dil
jno 0x140bd649f
cwde
invalid
add byte [rsp + 8], 0x71
neg rdi
and dword [rsp + 0x10], edi
or di, word [rsp + 0xd]
xor rdi, rdi
sub byte [rsp + 0x10], 0xfd
not word [rsp + 8]
jns 0x140679c5e
add rbp, 0x60940dcb
sub r8d, 0x3d5b2189
push rbx
neg ebp
neg r8w
cmp ebp, 0x5abb2418
push r13
jg 0x140bd653b
mov r13, rbp
setae r13b
mov ebp, r8d
movabs rbx, 0x4f3d5ef07d3060db
movzx r8w, r13b
or r13, 0x5dcd7d75
bswap rbp
cmp r8w, bx
jge 0x14062e7cb
setle bl
test bx, 0x5434
movzx ebx, bpl
not rbx
setg bl
movsx rbx, bl
mov r13, qword [rsp]
add r8, 0x51ef7ae3
sub r8b, 0x9a
test ebx, ebp
movzx r8d, bp
lea rbp, [rbx*4 + 0x7b7979e9]
js 0x14062e7af
call fcn.1405b2395

Function at 0x140baa46d
Capabilities:
Encode data using xor

Disassembly:
add bpl, bpl
and bp, bp
setl bpl
bswap rbp
xor ebp, 0x691b566c
jb 0x140691efd
and bpl, 0xdc
add qword [rsp + 8], 0xfffffffffff7bcaf
add bp, 0x86c
lea rbp, [rbp + rbp*4 + 0x4029334e]
lea rbp, [rbp*8 + 0x2673625]
not rbp
jae 0x14062c9ce
lea rbp, [rbx + rbp*8 + 0x38f138d8]
mov rbx, qword [rsp + 0x10]
setbe bpl
neg bpl
and bp, 0x5b68
lea rbp, [rbp + rbp + 0x116b3281]
neg bp
cmp bp, 0x4a60
not rbp
lea rbp, [rbp + rbp*2 + 0x673d7f4a]
jl 0x140691ef7
call fcn.140711bb6
Function at 0x140bc5832
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rcx
movsx r10w, word [rsp + 6]
jno 0x140ba7352

Function at 0x140bc7dc4
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
test bpl, 0x82
jno 0x140688ccb
test bpl, 0x97
jg 0x1405b825b
mov r10d, 0x7a552e26
and rbp, rbp
bswap r10d
test bpl, r10b
setbe bpl
call fcn.140b8d9cc

Function at 0x140bc84e3
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x18], 0xffffffffbf4bbdb4
test byte [rsp + 0x20], 0x77
mov byte [rsp + 0x30], 0x94
not dword [rsp + 0x28]
call fcn.140653779
push r9
push rbp
setae r15b
add qword [rsp + 0x20], 0x4870b8
movabs r9, 0x5a053d85a1b4bbe
xor r12, 0xd20554
or r9w, 0x6cf2
push r8
push rdx
movabs rbp, 0x59992ab20f406937
and r15b, 0xba
push r9
mov r12, qword [rsp + 0x50]
call fcn.14070c4c3

Function at 0x140bd1ef2
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
movzx r14, word [rsp + 8]
mov rsi, rdx
sub edx, edi
and dword [rsp + 8], r9d
movabs r10, 0x1ddb6b9a399b608e
lea r9, [rbp + r14*4 + 0x7c1f405b]
push r11
xor byte [rsp + 0x10], 0x88
setno r9b
xor edi, dword [rsp + 0x10]
mov r11, r14
setl r14b
mov rdi, qword [rsp + 0x30]
sub rdx, rsi
call fcn.140b51c98

Function at 0x140bd1f37
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jns fcn.140ba7314
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.140c24dbe
enter 0xffffffffffffb33d, 0x69
or eax, 0x8596498f
scasd eax, dword [rdi]
xor dword [rcx - 0x6a], ecx
enter 0x14ea, 0xffffffffffffffb3
imul ebp, dword [rsi + 0x69b8e794], 0x4d217e58
xchg esi, eax
mov byte [rdi + riz - 0x21cf9649], 0x42
mov esi, 0x2d5c2e69
xchg r14, rax
loop 0x140bd1f2a
fld qword [rbp - 0x6a]
invalid