joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1410e5e98
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
test di, di
mov rsi, rdi
mov r9, rsi
setne dil
push r11
and r9, r9
mov r11, rdi
test r9d, esi
lea rsi, [r11 + rdi + 0x60337cb4]
mov r9b, 0xa1
lea r9, [r9 + rsi*4 + 0x561a2820]
push r15
lea rsi, [rdi + r9*8 + 0x57f54fff]
movabs r15, 0x704c1cd76c3335d6
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0x54dfd8fa
push r9
movzx si, r11b
mov r15, r9
push rbp
push rbx
push r12
mov rbp, qword [rsp + 0x18]
lea rbp, [r15 + rbp + 0x6d5623c1]
mov rbx, qword [rsp + 0x18]
mov r12, rsi
lea rbx, [rbx*8 + 0x45cf18a8]
lea r9, [r12 + rbx*8 + 0x4ccc7ff8]
cmovne ebx, esi
lea r11, [rsi*4 + 0x215b702c]
call fcn.141127d80

Function at 0x1410e5f29
Capabilities:
Execute anti-debugging instructions

Disassembly:
add qword [rsp + 0x30], 0xffffffffbf637366
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
call fcn.141323bd7

Function at 0x1410e920a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x141127deb
not word [rsp + 0x78]
jl fcn.1410c3c1e
mov dword [rsp + 0x78], 0x77042d52
movsxd rcx, r13d
test word [rsp + 0x80], dx
jo fcn.14106abc2
test qword [rsp + 0x40], r10
lea r10, [r11 + rdx*8 + 0x2dd642fd]
jno 0x1410b3085

Function at 0x1410f15fb
Capabilities:
Authenticate hmac

Disassembly:
sub word [rsp + 0x50], 0x701f
or r15, r15
call fcn.1409a28d3
add byte [rax], al
add dword [rax], eax
add byte [rax], al
or r12w, si
lea rsi, [rsi + r14*2 + 0x3c6d2729]
not r8w
and r8, qword [rsp + 0x30]
add r12, 0x62095cb4
cmp r12d, dword [rsp + 0x33]
mov rsi, qword [rsp + 0x28]
mov dword [rsp + 0x30], 0x69055a0b
lea r8, [r8 + r14*8 + 0x2dc02a07]
not r12w
lea rbx, [rbx + rbx*4 + 0x3cb313a3]
mov r8b, byte [rsp + 0x1e]
setle byte [rsp + 0x18]
not ebx
ja 0x140a059f1
invalid
setle byte [rsp + 0x50]
or r15, 0x5e0c3668
neg r15b
lea r15, [r15*4 + 0x26f76d98]
not byte [rsp + 0x50]
test qword [rsp + 0x50], r15
jne 0x140a3db03
push 0x1251c939
cmp esi, 0x7d
pop rdi
sub eax, edi
sub bh, al
invalid

Function at 0x1410f24eb
Capabilities:
Authenticate hmac

Disassembly:
add edi, 0x48e351e7
sub dil, dil
call fcn.1410e3daf
outsd dx, dword [rsi]
int 0x5d
or byte [rsi + 0x37656cff], ch
ret
or edi, edi
jno 0x1409cf6fa
not cl
neg ecx
not rcx
xor cl, 0xb9
push rdx
neg ecx
neg cl
push r9
push rsi
cmp ecx, 0x164941e0
call fcn.14115cff3
mov rdx, qword [rsp]
call fcn.14112003d

Function at 0x1410f43da
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0x245c50d627862652
neg r9w
xor r9b, 0xf1
and r9b, 0x97
sub r9, r9
call fcn.140a507db
movabs rbx, 0x19ee14416921552a
push r12
movabs r12, 0x43db7e506d47544d
push r9
jle 0x1410f25c4
call fcn.1410b11de
invalid
jne 0x14114df5b
neg ebx
add r9b, bl
xor r9d, ebx
lea r9, [rbx*2 + 0x4b534b3a]
push r12
xor r9b, 0x24
mov r12, qword [rsp + 0x28]
sub bx, 0x58d2
jg 0x1410d1550
xor word [rsp + 0x10], 0x3df6
add dword [rsp], 0x5bcd4823
neg r9
or byte [rsp + 0x10], bh
or byte [rsp], 0x32
neg r9w
jae 0x1411488a2
jns 0x1410f25dc
lea rsp, [rsp + 0x18]
ret
Function at 0x1410fcc6f
Capabilities:
Encode data using xor

Disassembly:
mov r13, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffffed68cd95
lea rsi, [rcx + 0x5ec81056]
not r11
sete sil
lea rcx, [rsi + rcx*4 + 0x3bae7584]
xor rcx, 0x2dfa1199
movzx r11w, cl
push rdi
movabs rdi, 0x625d0379571d58b7
mov rcx, rsi
push r9
call fcn.1411357a5
mov ebp, 0xe675079b
or byte [rsp + rdi*8], dl
mov al, byte [rsi + 0x8a4df5c]
mov ah, 0x76
mov bl, bh
or byte [rdi + 0x750d90d1], ch
jae 0x1410fcc93
invalid

Function at 0x14110511f
Capabilities:
Encode data using xor

Disassembly:
setbe cl
mov cx, 0x785f
bswap ecx
xor ecx, 0x67e14b53
sets cl
mov rcx, qword [rsp + 0x20]
add qword [rsp], 0xffffffffbf623ca3
call fcn.1410d4937
push 0xffffffffdf1823dc
xlatb
jnp fcn.14110511f
invalid

Function at 0x14110625a
Capabilities:
Authenticate hmac

Disassembly:
call fcn.141313e45
cmp r10b, 0xd2
jns 0x1410ae95b
jo 0x141106275
test qword [rsp + 0x30], 0x18b23be8
push r11
movabs r11, 0x36d716114ded0c6d
jge 0x1409e2d62

Function at 0x14110633e
Capabilities:
Authenticate hmac

Disassembly:
sub bpl, 0xa8
mov rbx, qword [rsp + 0x10]
bswap rbp
xor bp, word [rsp + 0xc]
test byte [rsp + 8], 0x11
mov r8, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
lea rsp, [rsp + 0x48]
ret 8
not ecx
jle 0x141106346
lea rcx, [rcx + rcx*4 + 0x759e557b]
and rcx, 0x7b036baf
neg cl
bswap ecx
neg rcx
xor cx, 0x6838
lea rcx, [rcx + 0x633a546f]
add rcx, 0x7487420e
jo 0x141106346
and cl, 0xde
neg ecx
mov rcx, qword [rsp + 0x10]
jno 0x141158e2e
invalid
ja 0x1409e73fd
jbe 0x14115d017
not r15b
cmp dword [rsp + 0x28], r15d
jbe 0x1409cb763
push r13
pushfq
movabs r13, 0x271a3d00062d5fff
push rbx
mov rbx, r13
and r13b, 0x42
push rcx
setbe bl
movsx r13w, bx
cmp ebx, 0x5f5b15e8
push r8
mov rcx, r13
mov cx, bx
push 0x39666e25
lea r13, [rbx*8 + 0x6ae85fbe]
push rbp
mov rbp, qword [rsp + 8]
call fcn.1410fefec
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.141348a6f

Function at 0x14111379a
Capabilities:
Encode data using xor

Disassembly:
seta r12b
add cl, 0x83
cmp r12w, word [rsp + 0x11]
cmovl rcx, r12
cmp r12b, byte [rsp + 0x11]
sete sil
not r10b
and r12, 0x6dd202c1
neg byte [rsp + 0x10]
sub word [rsp + 0x48], 0xfec
movzx r10, word [rsp + 0x10]
mov bh, 0x54
and al, 0x10
mov r12, qword [rsp + 0x18]
neg word [rsp + 0x48]
call fcn.1411248a4
push 0xffffffffcfc9bde0
mov al, 0xdd
movabs byte [0xc47257a2f40eb2a3], al
fsub qword [rdx + 0x3bbcf8ab]
pop rbp
stc
pop rsp
fnsave dword [rsi]
pop rbp
xchg esi, eax
xor byte [rax], bl
shl byte [rdx - 0x912c016], cl
movabs byte [0x1f6696a2d999b213], al
int1
movabs byte [0xbf3e2e5d39a9af31], al
and bl, byte [rbp - 0x67]
scasd eax, dword [rdi]
or ebx, ebx
movabs byte [0x7d520fa2f2b7ba13], al
fisub dword [rdx + 0x3d05e0fb]
pop rbp
movabs eax, dword [0xd4a1686e5d306464]
movabs byte [0x7e7aa2a2f0543f02], al
out 0xa2, al
js 0x1411137cb
cmp byte [rax], bh
fild word [rdi]
movabs dword [0x5f7de2c941d2e069], eax
sub eax, 0xd2c4d9d3
invalid

Function at 0x141114bce
Capabilities:
Authenticate hmac

Disassembly:
sete r12b
test r11w, r11w
call fcn.1410da87a
Function at 0x14111999f
Capabilities:
Authenticate hmac

Disassembly:
neg r14d
jno 0x140a34106
not r10
mov r14, r10
jno 0x140a30961
add byte [rax], al
add byte [rbx + 0x65], dl
je 0x1411199f5
insb byte [rdi], dx
imul esi, dword [rax + 0x62], 0x6472616f
invalid
mov esi, dword [rsp + 0x30]
mov qword [rsp + 0x18], rbx
call fcn.1409b156d

Function at 0x14111b241
Capabilities:
Encode data using xor

Disassembly:
not rcx
push r13
movabs r13, 0xc4340bf4400230c
jne 0x1410d93f5
invalid
push r14
test r13, 0x30855829
call fcn.140a309d5
call fcn.1410b5a53
cmp al, 0xd
adc dword [rax + 0x18], edi
invalid
movabs r14, 0x19f8566f37f913bb
mov r14d, ecx
jbe 0x14111b293
test rcx, 0x2803767f
mov qword [rsp + 0x30], 0xffffffff93983dd3
jl 0x1410bf0cf
cmove r13w, r14w
not cl
movzx r14d, cx
bswap r14d
lea r13, [r14 + r14 + 0x1a560f21]
push r15
bswap rcx
not rcx
push rdx
movabs rdx, 0x145900d64af847b5
cmp dl, 0x2d
bswap r13d
push r12
push r11
movabs r11, 0x2ce5144568db5729
push r13
jg 0x1410b2071
push r11
lea rdx, [rcx + r11*8 + 0x73666474]
push r10
mov rcx, qword [rsp + 0x60]
Function at 0x14114882b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
pushfq
movabs rsi, 0x244316cd225b7661
movsx si, sil
push r12
sub si, 0x3c1d
jge 0x141148849
movabs r12, 0x57de766a155b647e
push rcx
movabs rcx, 0x292d33e775c87125
mov rsi, qword [rsp + 0x18]
sub cl, 0xdd
xor cx, 0x2218
pop rcx
and r12b, 0x2f
movabs r12, 0x7ec62c9552f66916
test r12w, 0x7008
not r12
mov r12w, 0x91f
not r12w

Function at 0x14114889a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r9, [r9 + r9*4 + 0x50635668]
cmp r9w, 0x1b73
setl r9b
not r9

Function at 0x1411488b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 8]
ret
sub al, 0xc6
jle 0x1411488e1
test r12d, 0xf7497008
invalid
or dword [rsi + 0x41], esp
not esp
movsx r12, r12b
not r12w
jg 0x1410b048f
pushfq
ror dword [rcx - 9], 0xd1
ja 0x140a64d2c
ja 0x141148877
xchg ecx, eax
dec dword [rax - 9]
neg rbx
test qword [rsp + 0x48], 0x74344ed3
invalid
neg rbx
test qword [rsp + 0x48], 0x74344ed3
call fcn.140a79057
cmp bh, bh
cmp dword [rdi - 0x34], eax
jae 0x1411488b1
xchg ecx, eax
invalid
jle 0x141148887
push rbp
stosb byte [rdi], al
sti
wait
mov eax, 0x6e90f3f4
mov eax, 0x38d2d4b5
cmpsb byte [rsi], byte [rdi]
or dh, cl
xchg edi, eax
cmp r13b, byte [r10 + 0x74]
xchg edx, eax
invalid

Function at 0x14114df3d
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movabs r8, 0x623660e421ea2151
mov r8d, 0x63b85dfe

Function at 0x141152cc3
Capabilities:
Encode data using xor

Disassembly:
call fcn.1410701a7
outsd dx, dword [rsi]
sub esp, esi
invalid
Function at 0x14115570b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call rax
jmp 0x14123a846
call rax
mov r11, rax
clc
jmp 0x14123a6f6
call 0x1409cbdfe
call rax
mov r11, rax
test r15b, r15b
stc
cmp r14, 0x5a1e135d
test rax, rax
jmp 0x14123a6d9
sub eax, eax
jmp 0x14123a846
jne 0x14123a704
lea rcx, [rsp + 0x40]
movsx rax, r14w
cbw
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1410e2a7d
test rax, rax
jmp 0x14123a6fe
je 0x14123a649
cmp r11, rsi
jmp 0x14123a70c
jne 0x14123a7a2
cmp byte [rsp + 0x180], dil
jmp 0x14123a71f
je 0x14123a789
lea rax, [rsp + 0x40]
movzx rcx, bx
ror cl, 6
sub rbp, rax
setns ch
nop
jmp 0x14123a740
lea rdx, [rsp + rdi + 0x40]
movsxd rcx, esi
bswap rcx
mov ecx, edi
cmc
cdqe
mov eax, 0x28004f26
rol eax, cl
clc
cmc
add al, dil
cmp r12b, dl
xor al, byte [rdx + rbp]
jmp 0x14123a767
mov byte [rdx], al
je 0x14123a784
inc rdi
cmp rdi, 0x104
jmp 0x14123a77e
jb 0x14123a740
lea rbp, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
movzx ax, r10b
not al
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1409cbe2d
cmp byte [rbx + 1], 0x23
cdq
lea rdx, [rbx + 1]
jmp 0x14123a7b0
jne 0x14123a825
movzx edx, byte [rbx + 2]
stc
add rbx, 2
cmc
cmp r14b, 0x28
clc
test dl, dl
jmp 0x14123a7cc
je 0x14123a81b
nop
movzx eax, si
inc ax
lea eax, [rdx - 0x30]
jmp 0x14123a7e1
inc rbx
cmp al, 9
jmp 0x14123a7eb
ja 0x14123a81b
movsx eax, dl
movsx ecx, r13w
rcr dx, 0xce
movzx edx, byte [rbx]
ror cx, cl
sar ch, cl
lea ecx, [rdi + rdi*4]
movsx di, r8b
lea edi, [rax + rcx*2 - 0x30]
test dil, dil
test dl, dl
jne 0x14123a7d9
movsxd rdx, edi
cmp dil, spl
inc ch
neg ch
sub r8d, r8d
mov cl, dl
movzx ecx, r15w
xchg cl, cl
mov rcx, r11
call fcn.14123a269
jmp 0x14123a846
mov rbx, qword [rsp + 0x178]
movzx ebp, r10w
mov rdi, qword [rsp + 0x150]
add rsp, 0x158
pop rsi
not bpl
bswap bp
pop rbp
jmp 0x14123a86e
ret

Function at 0x141157cc6
Capabilities:
Authenticate hmac

Disassembly:
lea rsi, [r13 + r10 + 0x135a3bd3]
not r15w
cmove rsi, r10
cmovbe r10, r13
not sil
mov rsi, qword [rsp + 0x40]
add qword [rsp + 8], 0xffffffffff8ee9ca
add qword [rsp + 0x40], 0x234046de
neg byte [rsp + 0x40]
cmp si, 0x6ab0
call fcn.141069a93

Function at 0x141158ef4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rdi
movabs rdi, 0x34a36c1f42111f36
mov r8b, 0x67
add r8d, 0x74911a68
not r8w
call fcn.140a5ead2
invalid
jg 0x1412318bc
push r8
movabs r8, 0x538e377369a44666
pushfq
xor r8d, 0x156c6ccf
jg 0x1411136c6
add qword [rsp], 0x92fa5
mov r14, qword [rsp + 0x48]
and rcx, 0x4cac1a03
sub word [rsp + 0x38], cx
xor qword [rsp + 0x68], 0x2409708d
seto cl
jge 0x14112709e
jnp 0x141231934
ret 0xb131
loope 0x1412319af
outsb dx, byte [rsi]
sub dword [rbp - 0x14], eax
iretd
test byte [rsi - 1], bl
mov ecx, edx
test al, 0x18
invalid
jl 0x1412319c1
pushfq
invalid
sub eax, 0x9c65b540
xlatb
sub dil, byte [r11]
push 0xffffffffffffffd2
mov edi, 0x20696715
mov esi, 0x2ce43a2a
jp 0x141231964
xor eax, 0x23b2bfd6
and dword [r14 - 0x2879de37], r15d
mov esi, 0x28f3ce02
int1
out dx, eax
insd dword [rdi], dx
rol dword [rcx - 0x49], 1
retf 0x5819
Function at 0x14115c617
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bx, 0x5ea1
mov bx, 0x49aa
push r13
push r9
mov rbp, qword [rsp + 8]
jge 0x141109695
and r12d, dword [rsp + 0x24]
pop rbp
jle 0x141113704
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x7cb604fb
pop r15
neg r9
cmovae di, word [rsp]
mov r15b, dil
seta r9b
push rcx
cmp rbp, r15
movzx r15, r15w
push rdx
mov edi, 0x72e312c8
call fcn.140a41c87
and r9, 0x72f50c67
bswap r9
cmp r15, 0x63191c7b
push r11
push 0x7f400a42
mov r11, r15
bswap r12
movsx r12d, r9w
lea r9, [r15 + r9 + 0x1d4c4357]
movzx r15w, r12b
call fcn.1409c6a2c
test r13d, r13d
call fcn.1410d9c26
invalid
setg r9b
push r12
lea r9, [r14 + r9*2 + 0x4fbe77ac]
mov r14, qword [rsp + 0x30]
not byte [rsp + 0x40]
mov r12, r9
movsx r12d, r12b
ja 0x141133275
cmp r15w, 0x52e6
pop rdx
sets byte [rsp + 8]
or r15w, 0x659b
xor r9b, r15b
lea r15, [r15 + r9*8 + 0x6d31533e]
cmovge r9w, word [rsp + 0xc]
setae bpl
movsxd rbp, ebp
xor r9d, r9d
movzx r9w, r15b
mov r9, qword [rsp + 0x28]
setg byte [rsp + 8]
sub byte [rsp + 8], 0x52
cmp bpl, r15b
jns 0x141064e0d
and r15w, 0x1b66
test dword [rsp + 0xb], ebp
not dword [rsp + 8]
not ebp
call fcn.1410f2cff
jns 0x14115c6bd
inc dword [rax + 0x39]
stosd dword [rdi], eax
loopne 0x14115c6f0
outsd dx, dword [rsi]
sub eax, 0xde93bd3
push rcx
pushfq
movabs rcx, 0x64fa6d827f6778af
not cl
push rbx
movabs rbx, 0x18ac477754cd4759
sub bx, 0x70cc
or cx, 0x73e2
cmp bx, 0x41dd
mov cl, 0x2c
mov rbx, rcx
mov cx, bx
jae 0x140a6de18
push rdi
invalid
call fcn.1410a9bc0
cmc
jmp qword [rcx + 0x28]

Function at 0x14115c6c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bx, 0x5ea1
mov bx, 0x49aa
push r13
push r9
mov rbp, qword [rsp + 8]
jge 0x141109695
and r12d, dword [rsp + 0x24]
pop rbp
jle 0x141113704
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x7cb604fb
pop r15
neg r9
cmovae di, word [rsp]
mov r15b, dil
seta r9b
push rcx
cmp rbp, r15
movzx r15, r15w
push rdx
mov edi, 0x72e312c8
call fcn.140a41c87
and r9, 0x72f50c67
bswap r9
cmp r15, 0x63191c7b
push r11
push 0x7f400a42
mov r11, r15
bswap r12
movsx r12d, r9w
lea r9, [r15 + r9 + 0x1d4c4357]
movzx r15w, r12b
call fcn.1409c6a2c
test r13d, r13d
call fcn.1410d9c26
invalid
setg r9b
push r12
lea r9, [r14 + r9*2 + 0x4fbe77ac]
mov r14, qword [rsp + 0x30]
not byte [rsp + 0x40]
mov r12, r9
movsx r12d, r12b
ja 0x141133275
cmp r15w, 0x52e6
pop rdx
sets byte [rsp + 8]
or r15w, 0x659b
xor r9b, r15b
lea r15, [r15 + r9*8 + 0x6d31533e]
cmovge r9w, word [rsp + 0xc]
setae bpl
movsxd rbp, ebp
xor r9d, r9d
movzx r9w, r15b
mov r9, qword [rsp + 0x28]
setg byte [rsp + 8]
sub byte [rsp + 8], 0x52
cmp bpl, r15b
jns 0x141064e0d
and r15w, 0x1b66
test dword [rsp + 0xb], ebp
not dword [rsp + 8]
not ebp
call fcn.1410f2cff
jns 0x14115c6bd
inc dword [rax + 0x39]
stosd dword [rdi], eax
loopne 0x14115c6f0
outsd dx, dword [rsi]
sub eax, 0xde93bd3
push rcx
pushfq
movabs rcx, 0x64fa6d827f6778af
not cl
push rbx
movabs rbx, 0x18ac477754cd4759
sub bx, 0x70cc
or cx, 0x73e2
cmp bx, 0x41dd
mov cl, 0x2c
mov rbx, rcx
mov cx, bx
jae 0x140a6de18
push rdi
invalid
call fcn.1410a9bc0
cmc
jmp qword [rcx + 0x28]
Function at 0x14115d03c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
and r12b, byte [rsp + 0x1e]
or qword [rsp + 0x30], r14
cmp rbx, qword [rsp + 0x30]
movzx r14, word [rsp + 0x30]
setge r8b
lea r14, [r14 + rbx + 0x26035ff2]
neg dword [rsp + 0x30]
neg r8w
mov r14w, word [rsp + 0x31]
test byte [rsp + 0x34], r14b
movzx r14w, byte [rsp + 0x35]
mov rbx, qword [rsp + 0x50]
not r14
movsx r14, r14w
mov r12, qword [rsp + 0x30]
seto byte [rsp + 0x30]
not r14b
xor word [rsp + 0x30], r12w
sub word [rsp + 0x18], 0x3087
bswap r8d
setno r12b
cmp byte [rsp + 0x30], 0x5c
ja 0x141070980
movzx r8w, word [rsp + 0x1a]
xor word [rsp + 0x18], 0x1539
seta r14b
or qword [rsp + 0x30], 0x4dbe3734
xor r14w, r12w
sub r12, r12
xor byte [rsp + 0x18], 0xec
add qword [rsp + 8], 0xab2dc
not r14d
not r12b
or r8d, dword [rsp + 0x32]
not dword [rsp + 0x30]
xor r8d, dword [rsp + 0x19]
not r12d
mov r14, qword [rsp + 0x38]
not r8d
not word [rsp + 0x18]
setge byte [rsp + 0x30]
xor r8b, r8b
jno 0x1410d9c74
sub r12, r12
add qword [rsp], 0xffffffffbeef52ea
bswap r12d
add r12b, 0xcd
test byte [rsp + 0x36], r8b
lea r12, [r12 + r12*4 + 0x567c7ac6]
mov qword [rsp + 0x30], 0x6450713f
lea rsp, [rsp + 8]
ret 8
xor r8b, 0xd8
jge 0x140a059f1
neg dword [rsp + 0x18]
test dword [rsp + 0x30], 0x2e4d7552
setne byte [rsp + 0x30]
add byte [rsp + 0x30], r8b
cmp r8w, 0x4404
sete r8b
add qword [rsp], 0x670297
ret 0x18
Function at 0x141233b82
Capabilities:
Encode data using xor

Disassembly:
sets r15b
neg r15d
call 0x141135d37
jno 0x1411059e7
push r8
pushfq
movabs r8, 0x69017ac973d60d75
add r8w, r8w
jge 0x1410b741e
movsd dword [rdi], dword [rsi]
outsb dx, byte [rsi]
invalid
push r14
mov r14, r8
setae r8b
and r14, 0x2c6734f7
not r14
not r14d
and r8b, 0xad
loopne 0x1410b73e5
cmp r14, 0x5a58320d
lea r14, [r8*2 + 0x7b6b5821]
setbe r8b
bswap r14d
push r14
push r13
test r8d, r8d
mov word [rsp + 8], 0x4b99
lea r8, [r8 + r14*2 + 0x35f41cbd]
and al, 8
cdq
lea r8, [r8 + r14*2 + 0x35f41cbd]
setl r14b
neg r8d
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffa1727d6c
add r14b, r14b
call fcn.140a57a7d
xchg edx, eax
jnp 0x1410b7457
sbb eax, 0x24511125
jne 0x1410b7436
in eax, 0xb4
pop rsi
or byte [0x1a3a528bb], al
xchg byte [rdx + 0x15], bl
fnsave dword [rcx + 0x11ab04bc]
cmpsb byte [rsi], byte [rdi]
invalid
jae 0x141158ea2
jmp 0x162bad0aa
xor r11w, 0x4bcf
cmp r12w, 0x474
jbe 0x140a588d7
test bpl, 0x57
lea rdi, [r11 + 0x459557cb]
pop rdi
mov r8, qword [rsp + 0x10]
mov r11d, ebp
movsx r11w, r12b
jg 0x1410f5887
add qword [rsp + 0x20], 0xffb6
neg byte [rsp + 0x40]
neg rsi
mov qword [rsp + 0x68], 0x35f34774
not dword [rsp + 0x40]
neg qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test byte [rsp + 0x40], 0xd8
not dword [rsp + 0x40]
mov word [rsp + 0x40], 0x5ec7
lea rsp, [rsp + 0x20]
ret 0x10
neg qword [rsp + 0x68]
mov r15w, 0x7703
or esi, esi
not rsi
and sil, 0xd7
not r15d
ja 0x141106ef3
jb 0x1412326d6
js 0x141158393
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.141313e45
xor eax, 0x196640f3
add ebp, edi
mov esi, 0x2b17e493
retf
not r11d
or r12w, r11w
test r15w, 0x7b98
mov r11w, r12w
lea r15, [rbp + r11*2 + 0x47aa38d3]
pop r11
setbe r15b
and r12, r15
cmovb r15w, r12w
movabs rbp, 0x48e246796530790a
add r15w, 0xb46
call fcn.14111842e
mov r13, qword [rsp + 0x20]
or si, word [rsp + 0x2b]
add qword [rsp + 0x18], 0xffffffffff9802ce
test qword [rsp + 0x28], 0xa736fb
not r10w
mov word [rsp + 0x28], 0x3deb
mov r11, qword [rsp + 0x10]
mov r10, qword [rsp + 8]
mov rsi, qword [rsp]
lea rsp, [rsp + 0x18]
ret 8
not r15b
not r15w
lea rsi, [r15 + r15 + 0x229c7c39]
jae 0x1411410fc
mov r14, qword [rsp + 0x38]
or r12, 0x4aa374d8
xor r12d, 0x7560e52
xor r12, 0x67923354
jne 0x140a66d27

Function at 0x1412351eb
Capabilities:
Encode data using xor

Disassembly:
setle dl
mov r13, qword [rsp + 0x60]
setbe dl
add r14b, byte [rsp + 0x2d]
test dword [rsp + 0x28], 0x7d932ab1
jg 0x14123705d
Function at 0x140006ca0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140006cc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140006d3c
mov rdi, r14
mov rcx, rbx
call fcn.140008450
test rax, rax
jle 0x140006d14
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14000cae0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140006d2c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140006d34
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140006cd6
sub r14, rdi
jmp 0x140006e1f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140006d53
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140006d55
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140006d87
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14000cae0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140006e1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140006dc2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140006dfd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140017298
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140006e1c
cmp rbp, rax
ja 0x140006dd0
test rbp, rbp
je 0x140006e1c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140017298
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140009610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
call fcn.140002cb0
mov ecx, eax
call fcn.140004bd0
test al, al
jne 0x1400096d8
movdqa xmm0, xmmword [0x14003c1c0]
xor ebx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov edx, ebx
mov dword [rbp - 0x10], 0x89958b8a
mov word [rbp - 0xc], 0xd6
nop
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x38]
inc edx
xor byte [rcx], al
cmp edx, 0x15
jb 0x140009650
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xb], bl
call fcn.1400010e0
mov edx, ebx
mov dword [rbp + 0x10], 0xb8bfa8b8
mov word [rbp + 0x14], 0xa9
movsxd rax, edx
lea rcx, [rbp + 0x10]
add rcx, rax
lea eax, [rdx - 0x38]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x140009681
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x15], bl
call fcn.140015fc8
movdqa xmm0, xmmword [0x14003c1d0]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], al
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rbx - 0x38]
inc ebx
xor byte [rcx], al
cmp ebx, 0x10
jb 0x1400096c0
jmp 0x140009716
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x14003c1d0]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], al
xor ebx, ebx
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rbx - 0x38]
inc ebx
xor byte [rcx], al
cmp ebx, 0x10
jb 0x140009700
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x10], 0
call fcn.140015fc8
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rbp
ret

Function at 0x140009730
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400097b4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140031460]
cmp byte [rcx + rax], 0
je 0x1400097b4
dec r8
sub rdx, 1
jne 0x14000979a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000b98c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b9d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b9d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b9d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b9d6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b9d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b9d8
xor al, al
add rsp, 0x28
ret