joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006fa0
Capabilities:
Encode data using xor

Disassembly:
adc cl, bh
cdq
clc
invalid
insb byte [rdi], dx
add eax, 0x77d60f9
loop 0x14000701f
call 0x17095c49c
rcl ecx, cl
xchg esi, eax
push rsi
or dword [0x142b3bc7a], esi
ja 0x14000701a
in al, dx
mov edx, cs
test eax, 0x99254c2b
jns 0x140006f61
pop rsp
invalid
wait
cwde
invalid
and eax, dword [rax]
sub dword [rcx + 0x53], ecx
insd dword [rdi], dx
add bl, byte [rdx - 0x15cc1d1e]
nop
and eax, dword [rdx - 0x605c67c4]
xor byte [rsi - 0x32f33a0e], ch
mov esi, 0x1567776c
movsb byte [rdi], byte [rsi]
jo 0x14000706a
loop 0x14000705d
invalid
outsb dx, byte [rsi]
add eax, 0x8e7e60f9
scasd eax, dword [rdi]
jb 0x140007028
out dx, eax
jmp 0x140006ff9
push rax
xchg esp, eax
std
add ebx, dword [0x18a6dc260]
invalid
test dword [r11], r9d
invalid

Function at 0x140028fcc
Capabilities:
Encode data using xor

Disassembly:
push rdx
insd dword [rdi], dx
add cl, byte [rbx + 0x2d296516]
cmpsd dword [rsi], dword [rdi]
sbb dword [rsi + 0x2c], esi
or edx, ebx
and rax, 0x2a53e823
jbe 0x140028f9a
stosb byte [rdi], al
and byte [rdx + riz*8 - 7], cl
mov edx, dword [rsi - 0x1e]
shr byte [rcx + 0x380de2], 1
loopne 0x140028f80
add al, 0xa4
sub byte [rax + 0x34], dh
js 0x14002903c
or cl, bh
popfq
div bl
rcr dword [rdi + 0x71], cl
adc ecx, dword [0x1ad75b371]
push r15
cli
and eax, 0x319627ae
pop rdi
invalid
nop
test ecx, edi
push rcx
insd dword [rdi], dx
invalid

Function at 0x14002c518
Capabilities:
Encode data using xor

Disassembly:
pop rcx
sbb eax, 0xd78fb5a1
idiv ch
xlatb
sbb byte [rdx + 0x26], dl
jae 0x14002c59a
sbb byte [rdx - 0x13698ae2], ah
in al, dx
and esp, edi
ja 0x14002c58e
xchg esp, eax
pop rbx
movabs al, byte [0x54b87154ba706c91]
insd dword [rdi], dx
xchg dword [rbx + 0x50], ecx
xor ecx, esi
imul eax, dword [eax], 0x78
scasd eax, dword [rdi]
jbe 0x14002c52b
jo 0x14002c5b8
out 0xe, al
invalid
test eax, 0xd43acd2a
movabs eax, dword cs:[0xfc6fa1bc08d655cc]
sbb eax, 0x90e21814
invalid
jrcxz 0x14002c5df
xor dl, byte [rdi - 0x6b]
push rdi
xchg ebp, eax
adc byte [rcx], dh
push rdi
add ebx, dword [rdi]
retf
sti
xor dword [rdi], eax
mov edx, dword [rbx]
sbb byte [rsi + 0x6b96b9], dh
js 0x14002c556
jbe 0x14002c58b
push rax
imul esp, esi, 0xe
idiv byte [rdx + rax]
test al, 0x76
push rdi
add ebp, dword [rax - 0x27]
out 0x90, al
and eax, 0x52a6be1
mov ebx, dword [rbx]
push 0x2d435405
pop rbx
sbb edx, dword [rax + 0x5b]
cli
outsb dx, byte [rsi]
cmp ecx, edi
xchg esi, eax
stc
ret
movabs al, byte [0x568b2c73230964fe]
cmp edi, dword [rbx + rax + 0x2b]
invalid

Function at 0x1400484a0
Capabilities:
Encode data using xor

Disassembly:
xchg byte [rdi - 0x7c], dh
and byte [rdx + rbx*4 + 0x6c], cl
pop rax
cmp ch, byte [rax - 0x5887a4b]
js 0x14004849a
int 0xac
insd dword [rdi], dx
or edx, ebp
invalid
retf
test eax, 0xfbbbf914
and eax, 0x6bce68f6
and dword [rcx - 0x16], 0x7491a050
jo 0x14004846d
imul edx, ebp, 0xffffff84
xchg ebp, eax
xchg ecx, eax
and cl, ah
or eax, 0xcd9464e4
fmul qword [rcx + 0x25]
shl byte [rdx], 1
pavgb mm0, mm5
add al, 0x4f
mov ebp, 0x5f621dbe
invalid
Function at 0x14006402c
Capabilities:
Check for software breakpoints

Disassembly:
test eax, 0x51f995f0
insd dword [rdi], dx
xor eax, 0x3c6a1b66
movabs r8, 0x962153df8385fcf5
mov eax, 0x8385fcf5
fist word [rbx + 0x21]
xchg esi, eax
cmp al, 0xcc
div dword [rdi + 0x4c]
xor eax, eax
in eax, 0x51
cmp byte [rax + rbp*8], dh
sub al, byte [0x18b45c54c]
sbb byte [rdi], bl
add eax, 0x234388d7
jae 0x1400640bb
pop rbp
lahf
xchg dword [rdx - 0x1a], esi
retf
insd dword [rdi], dx
mov ah, byte [rdi + rbp*2]
adc bl, byte [rcx + 0x642a53e8]
cmp al, 0xc3
loope 0x1400640fb
movsxd rsp, dword [rcx + 0x4adaee6c]
insb byte [rdi], dx
add dword [rdx + 0x54ef1df1], ebx
movsb byte [rdi], byte [rsi]
movabs dword [0x3aef7b3b568b2c73], eax
invalid
insb byte [rdi], dx
adc esp, dword [rbx]
invalid

Function at 0x14008260c
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x544ea5a1
push rsp
movsb byte [rdi], byte [rsi]
or al, 0xe
cmpsb byte [rsi], byte [rdi]
adc qword [r13 + 0x5ad0ff3e], 0x21
mov byte [rdx - 0x36], 0xa7
xor esp, dword [rax + 0x69849ab6]
jg 0x140082607
push rbx
jg sym.DUI70.dll_public:_unsigned_int___cdecl_DirectUI::CCTreeView::GetItemState_struct__TREEITEM__const___ptr64____ptr64
invalid

Function at 0x140090c48
Capabilities:
Encode data using xor

Disassembly:
in al, dx
insb byte [rdi], dx
adc al, 0xac
and eax, 0x73a9917c
pop rbx
wait
js 0x140090caa
stc
jno 0x140090c91
invalid
test eax, 0x8028a404
xor al, 0x38
add bh, al
or edi, dword [rdx + rax - 0x72]
shr byte [rdx + 0x66], cl
or byte [rcx], r12b
or byte [rcx], ah
je 0x140090c7f
xchg esp, eax
push rsi
cld
and eax, 0xabab9cf6
ficomp dword [rax + 0x60]
and edi, dword [rbx]
jmp [rax + 0x13]
insd dword [rdi], dx
add bl, byte [rdx + 0x38d7cf18]
invalid

Function at 0x140094ffc
Capabilities:
Encode data using xor

Disassembly:
rol dword [rbx - 0x20], 0x13
loopne 0x140095013
xor esi, dword [rdi]
enter 0x7371, 0xffffffffffffffbc
in eax, 0x82
mov ch, 0xf
ja 0x140094ffe
invalid
invalid

Function at 0x1400a7ac0
Capabilities:
Encode data using xor

Disassembly:
movsd dword [rdi], dword [rsi]
cmp ecx, dword [rax + 0x5e]
fcmove st(0), st(2)
jbe 0x1400a7b31
mov ebp, 0x38f85999
cli
imul edi, dword [rax + 0x4e63ba67], 0xfc5134a5
sub ch, byte [rsi + 0x5121c682]
push rbx
xchg byte [rcx + rbx*8 + 0x374c2dbe], dl
add ah, byte [rsi - 0x43]
cdq
push rcx
stc
invalid
imul edi, dword [rax + 0x4e63ba67], 0xfc5134a5
sub ch, byte [rsi - 0x13de397e]
je 0x1400a7bbc
test byte [rdx], ah
jb 0x1400a7bbc
invalid
test byte [rsi - 0x10224551], 0x45
insd dword [rdi], dx
invalid

Function at 0x1400b22a4
Capabilities:
Encode data using xor

Disassembly:
sbb edi, dword [rdi]
pop rax
mov dword [rdi + rcx - 0x59e68809], ebx
stosb byte [rdi], al
cmp al, 0x4c
test eax, 0xf23ddb3a
insd dword [rdi], dx
cmpsd dword [rsi], dword [rdi]
mov ecx, 0xdf63f8b
int1
test dword [r15 - 0x7e], r12d
loop 0x1400b22c5
push rdi
cmp eax, 0x4f5feab2
jp 0x1400b2329
pop rax
out dx, al
invalid
test r11b, r8b
cmp qword [rax + 0x5761e42b], 0xffffffffbc04b46a
shl byte [rdi + 2], cl
mov edx, ss
invalid
Function at 0x1400b7358
Capabilities:
Encode data using xor

Disassembly:
add byte [rcx], dh
xlatb
add edx, dword [rcx - 0x78ebafe1]
fld xword [rbp + 2]
mov edx, dword [rdi]
sar word [rax - 0x7c], 1
mov esi, 0x6d90b85f
jne 0x1400b72f4
invalid

Function at 0x1400dad30
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbp
push r15
push r14
push rbx
sub rsp, 0x1a8
mov word [rsp + 0x196], 0x7996
add dword [rax], eax
add byte [rsi - 0x7b74b787], dl
and al, 0xa0
add dword [rax], eax
add dh, al
test byte [rdx*4 - 0x6dffffff], ah

Function at 0x1400dadb4
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
mov si, r11w
mov edi, 0x59b1
sub edi, r11d
mov bx, di
mov word [rsp + 0xde], bx
mov r10b, r9b
xor r10b, 0xd4
mov byte [rsp + 0x137], r10b
lea rdx, [rsp + 0x140]
lea r14, [rsp + 0x90]
mov r10b, r9b
xor r10b, 0xfc
mov byte [rsp + 0x140], r10b
mov r10b, r9b
xor r10b, 0xe6
mov byte [rsp + 0x141], r10b
mov r10b, r9b
xor r10b, 0xf6
mov edi, r11d
imul edi, edi
mov bx, di
mov word [rsp + 0x19a], bx
mov byte [rsp + 0x142], r10b
mov qword [rsp + 0x1a0], 0x3d3ac6
mov r10b, 0xfe
sub r10b, r9b
mov byte [rsp + 0x143], r10b
mov edi, ecx
xor edi, 0x24996961
mov dword [rsp + 0x19c], edi
mov r9b, byte [rsp + 0x195]
add r9b, 0xda
mov byte [rsp + 0x144], r9b
mov r9b, byte [rsp + 0x195]
add dword [rax], eax
add byte [rcx - 0x4e], al
rol byte [rbp + 0x28], 0xca
mov qword [rsp + 0x1a0], rax
mov byte [rsp + 0x145], r10b
mov r9b, r8b
and r9b, 0x39
mov byte [rsp + 0x199], r9b
xor r11d, 0x38de
mov bx, r11w
mov r9b, byte [rsp + 0x195]
mov word [rsp + 0x19a], bx
add r9b, 0xd2
mov byte [rsp + 0x146], r9b
mov r9b, r8b
not r9b
mov byte [rsp + 0x199], r9b
mov r9b, byte [rsp + 0x195]
add r9b, 0xda
mov byte [rsp + 0x147], r9b
mov r9b, byte [rsp + 0x195]
xor r9b, 0xfe
mov byte [rsp + 0x148], r9b
mov word [rsp + 0x19a], si
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x80], al
int1
xchg edx, eax
mov byte [rsp + 0x149], r9b
mov r9b, r8b
add r9b, 0xa9
mov byte [rsp + 0x199], r9b
cdq
add dword [rax], eax
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x4e], al
scasb al, byte [rdi]
Function at 0x1400daef8
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
mov si, r11w
mov edi, 0x59b1
sub edi, r11d
mov bx, di
mov word [rsp + 0xde], bx
mov r10b, r9b
xor r10b, 0xd4
mov byte [rsp + 0x137], r10b
lea rdx, [rsp + 0x140]
lea r14, [rsp + 0x90]
mov r10b, r9b
xor r10b, 0xfc
mov byte [rsp + 0x140], r10b
mov r10b, r9b
xor r10b, 0xe6
mov byte [rsp + 0x141], r10b
mov r10b, r9b
xor r10b, 0xf6
mov edi, r11d
imul edi, edi
mov bx, di
mov word [rsp + 0x19a], bx
mov byte [rsp + 0x142], r10b
mov qword [rsp + 0x1a0], 0x3d3ac6
mov r10b, 0xfe
sub r10b, r9b
mov byte [rsp + 0x143], r10b
mov edi, ecx
xor edi, 0x24996961
mov dword [rsp + 0x19c], edi
mov r9b, byte [rsp + 0x195]
add r9b, 0xda
mov byte [rsp + 0x144], r9b
mov r9b, byte [rsp + 0x195]
add dword [rax], eax
add byte [rcx - 0x4e], al
rol byte [rbp + 0x28], 0xca
mov qword [rsp + 0x1a0], rax
mov byte [rsp + 0x145], r10b
mov r9b, r8b
and r9b, 0x39
mov byte [rsp + 0x199], r9b
xor r11d, 0x38de
mov bx, r11w
mov r9b, byte [rsp + 0x195]
mov word [rsp + 0x19a], bx
add r9b, 0xd2
mov byte [rsp + 0x146], r9b
mov r9b, r8b
not r9b
mov byte [rsp + 0x199], r9b
mov r9b, byte [rsp + 0x195]
add r9b, 0xda
mov byte [rsp + 0x147], r9b
mov r9b, byte [rsp + 0x195]
xor r9b, 0xfe
mov byte [rsp + 0x148], r9b
mov word [rsp + 0x19a], si
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x80], al
int1
xchg edx, eax
mov byte [rsp + 0x149], r9b
mov r9b, r8b
add r9b, 0xa9
mov byte [rsp + 0x199], r9b
cdq
add dword [rax], eax
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x4e], al
scasb al, byte [rdi]

Function at 0x1400daf18
Capabilities:
Access peb ldr_data

Disassembly:
cdq
add dword [rax], eax
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x4e], al
scasb al, byte [rdi]
sub r10b, r9b
mov byte [rsp + 0x14a], r10b
mov byte [rsp + 0x199], r8b
movaps xmm0, xmmword [0x1400e5180]
movaps xmmword [rsp + 0x90], xmm0
mov bx, word [rsp + 0x196]
add bx, 0x86d6
mov word [rsp + 0xa0], bx
mov bx, word [rsp + 0x196]
mov bp, 0x7996
sub bp, bx
mov word [rsp + 0xa2], bp
mov bx, word [rsp + 0x196]
mov bp, 0x79b2
sub bp, bx
mov byte [rsp + 0x199], r8b
mov word [rsp + 0xa4], bp
mov qword [rsp + 0x1a0], rax
mov word [rsp + 0xc6], 0
add byte [rax], al
mov qword [rsp + 0xbe], 0
mov qword [rsp + 0xb6], 0
mov qword [rsp + 0xae], 0
mov qword [rsp + 0xa6], 0
imul r15, rax, 0x2656ff72
mov qword [rsp + 0x1a0], r15
movsx r11d, byte [rsp + 0x15c]
mov bx, r11w
mov word [rsp + 0x19a], 0x5bf3
test byte [rdx + rbx*4], ah
add dword [rax], eax
add bl, dh
pop rbx
Function at 0x1400dafa4
Capabilities:
Access peb ldr_data

Disassembly:
cdq
add dword [rax], eax
add byte [rdx + rcx*4 - 0x74], al
and al, 0x95
add dword [rax], eax
add byte [rcx - 0x4e], al
scasb al, byte [rdi]
sub r10b, r9b
mov byte [rsp + 0x14a], r10b
mov byte [rsp + 0x199], r8b
movaps xmm0, xmmword [0x1400e5180]
movaps xmmword [rsp + 0x90], xmm0
mov bx, word [rsp + 0x196]
add bx, 0x86d6
mov word [rsp + 0xa0], bx
mov bx, word [rsp + 0x196]
mov bp, 0x7996
sub bp, bx
mov word [rsp + 0xa2], bp
mov bx, word [rsp + 0x196]
mov bp, 0x79b2
sub bp, bx
mov byte [rsp + 0x199], r8b
mov word [rsp + 0xa4], bp
mov qword [rsp + 0x1a0], rax
mov word [rsp + 0xc6], 0
add byte [rax], al
mov qword [rsp + 0xbe], 0
mov qword [rsp + 0xb6], 0
mov qword [rsp + 0xae], 0
mov qword [rsp + 0xa6], 0
imul r15, rax, 0x2656ff72
mov qword [rsp + 0x1a0], r15
movsx r11d, byte [rsp + 0x15c]
mov bx, r11w
mov word [rsp + 0x19a], 0x5bf3
test byte [rdx + rbx*4], ah
add dword [rax], eax
add bl, dh
pop rbx
Function at 0x1400dd0b0
Capabilities:
Authenticate hmac

Disassembly:
add byte [rcx - 0x77], al
in al, dx
or r12d, 0xf092fd2
mov dword [rsp + 0x10c], r12d
cmp ebx, edi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x3c], ebx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x24], ebp
je 0x1400dd250
jmp 0x1400dd610
Function at 0x1400dd410
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x21f3f97d
mov ecx, eax
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x10c], 0x5aa37cd2
mov edx, dword [rsp + 0xf4]
add edx, 0xd8c0b492
mov r8w, word [rsp + 0x56]
xor dl, 0xca
xor al, 0x5c
mov byte [rsp + 0xff], 0x28
cmp byte [rsp + 0xd7], dl
setne dl
and dl, 1
mov byte [rsp + 0xaf], dl
mov qword [rsp + 0xa0], 0
cmp al, cl
jbe 0x1400dd288
jmp 0x1400dd250
Function at 0x1400de350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x68
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x55], 0xe3
mov dl, byte [rsp + 0x55]
imul r8, rax, 0x2f49e3eb
xor dl, 0x63
mov qword [rsp + 0x58], r8
mov byte [rsp + 0x54], dl
mov dl, byte [rsp + 0x55]
mov r9d, dword [rsp + 0x64]
xor dl, 0xd2
mov r10b, byte [rsp + 0x54]
add rax, 0x596636d6
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x47], r10b
mov dword [rsp + 0x40], r9d
mov byte [rsp + 0x3f], dl
mov qword [rsp + 0x30], rax
call fcn.1400e15d0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov dl, byte [rsp + 0x3f]
mov r10b, byte [rsp + 0x47]
cmp dl, r10b
mov qword [rsp + 0x28], rax
jne 0x1400de3cb
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
add rsp, 0x68
push 0xffffffffffd332e9
invalid

Function at 0x1400defb0
Capabilities:
Encode data using xor

Disassembly:
mov ax, 0xf19d
mov qword [rsp + 0x38], 0x6907800
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x38], 0x74cc726b
mov qword [rsp + 0x10], rcx
sub ax, word [rsp + 0x1e]
mov rcx, qword [rsp + 0x10]
cmp word [rcx], ax
je 0x1400defca
mov al, 0x9d
mov cl, 0x48
mov dl, byte [rsp + 0x27]
xor dl, 0xff
mov byte [rsp + 0x27], dl
sub cl, byte [rsp + 0x1d]
sub al, byte [rsp + 0x27]
mov byte [rsp + 0x27], al
mov byte [rsp + 0x1c], cl
mov al, byte [rsp + 0x27]
add al, 0xba
mov cl, byte [rsp + 0x1d]
mov byte [rsp + 0x27], al
mov r8w, word [rsp + 6]
xor r8w, 0xbc07
xor cl, 0x96
mov word [rsp + 0x36], r8w
cmp cl, byte [rsp + 0x1c]
je 0x1400def2e
mov eax, 0x59693711
mov ecx, eax
mov eax, dword [rsp]
and eax, 0x2c0d631a
mov rdx, qword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x28]
xor r9, 0xffffffffa696b711
sub rcx, rdx
xor r8, qword [rsp + 0x38]
mov qword [rsp + 0x38], r8
mov eax, dword [rsp]
or eax, eax
ror byte [rax - 0x75], 0x54
and al, 0x10
ror byte [rax - 0x75], 0x54
and al, 0x10
mov dword [rsp + 0x44], eax
add rdx, r9
and rdx, rcx
mov qword [rsp + 8], rdx
jmp 0x1400deefb
mov eax, 0x545aaebb
mov byte [rsp + 0x27], 0x21
mov rcx, qword [rsp + 0x38]
add rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x38], rcx
mov r8w, word [rsp + 6]
or r8w, 0x2335
movsxd rcx, dword [rdx + 0x3c]
mov rdx, qword [rsp + 0x10]
mov word [rsp + 0x36], r8w
sub eax, dword [rsp + 0x20]
mov r9d, dword [rdx + rcx]
mov qword [rsp + 0x38], 0xffffffffdd6b03b6
cmp r9d, eax
jne 0x1400def2e
mov eax, dword [rsp]
xor eax, 0x19b88839
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x10]
add rsp, 0x48
ret
Function at 0x1400e0908
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [rsp + 0x1a4], r11d
add r15w, 0x60f0
mov word [rsp + 0x11a], r15w
mov r9, r10
add r9, 0x569ea0ea
mov r11d, dword [rsp + 0x17c]
mov qword [rsp + 0x198], r9
add r11d, 0xdd33d29a
mov r9, qword gs:[r11d]
mov rax, r10
add rax, rax
mov qword [rsp + 0x198], rax
mov rax, qword [r9 + 0x60]
mov rax, qword [rax + 0x18]
mov r9, rax
add r9, 0x20
mov byte [rsp + 0x187], 0xc8
mov rax, qword [rax + 0x20]
mov r15w, bp
add r15w, 0x4121
mov word [rsp + 0x196], r15w
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x198], r10
cmp rax, r9
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov byte [rsp + 0x77], bl
mov word [rsp + 0x74], bp
mov qword [rsp + 0x68], r10
mov dword [rsp + 0x64], r8d
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], rax
and al, 0x50
je 0x1400e0ec9
jmp 0x1400e10fb
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x100], rax
jmp 0x1400e0fe2
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x158], rax
jmp 0x1400e0bb4
mov rax, qword [rsp + 0x80]
cmp rax, 0
je 0x1400e09cd
jmp 0x1400e0f5e

Function at 0x1400e1944
Capabilities:
Access peb ldr_data

Disassembly:
mov r10w, word [rsp + 0x1b2]
xor r10w, 0xc300
mov word [rsp + 0xa4], r10w
mov r11b, cl
and r11b, 0xfe
mov byte [rsp + 0x1af], r11b
mov r10w, word [rsp + 0x1b2]
mov byte [rsp + 0x1af], 0xd7
mov r13w, 0xc3d8
sub r13w, r10w
mov qword [rsp + 0x1a0], 0
mov word [rsp + 0xa6], r13w
mov qword [rsp + 0x1a0], 0xc04d855
mov dword [rsp + 0x1b4], 0xb6038040
mov r10w, word [rsp + 0x1b2]
xor r10w, 0xc36c
mov word [rsp + 0xa8], r10w
imul r8d, edx, 0x33eec66d
mov dword [rsp + 0x1b4], r8d
mov r10w, word [rsp + 0x1b2]
mov r13w, 0xc39c
sub r13w, r10w
mov word [rsp + 0xaa], r13w
mov r12, rax
not r12
mov qword [rsp + 0x1a0], r12
mov word [rsp + 0xc4], 0
mov qword [rsp + 0xbc], 0
mov qword [rsp + 0xb4], 0
mov qword [rsp + 0xac], 0
mov r11b, 0xea
mov qword [rsp + 0x58], rax
mov al, cl
mul r11b
movsx r8d, byte [rsp + 0x14b]
mov r10w, r8w
mov byte [rsp + 0x1af], al
mov word [rsp + 0xc6], r10w
mov qword [rsp + 0x1a0], r12
mov al, byte [rsp + 0x14c]
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], r12
mov r8, qword [rsp + 0x190]
movsx esi, al
mov r10w, si
mov dword [rsp + 0x1b4], edx
xor r8, 0x292e69cf
cmp r15, r8
mov qword [rsp + 0x50], r14
mov byte [rsp + 0x4f], cl
and al, 0x4f

Function at 0x1400e1d54
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x4f
mov dword [rsp + 0x48], edx
mov word [rsp + 0x46], r9w
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x36], r10w
jne 0x1400e1d1e
jmp 0x1400e1c00
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x160], rax
jmp 0x1400e20d9
movabs rax, 0x13c1c6cf3d8aa1fd
mov cx, word [rsp + 0x36]
mov word [rsp + 0xc8], cx
movsx edx, byte [rsp + 0x14d]
mov r8w, dx
mov word [rsp + 0xca], r8w
mov r9, qword [rsp + 0x58]
mov edx, r9d
and edx, 0x594632c8
enter 0x4632, 0x59
mov r10d, edx
mov qword [rsp + 0x1a0], r10
movsx edx, byte [rsp + 0x14e]
mov r8w, dx
mov byte [rsp + 0x1af], 0x84
mov word [rsp + 0x1b0], 0x2058
mov edx, dword [rsp + 0x198]
xor edx, 0x6ad33856
invalid
invalid
invalid
test byte [rsp + rcx*8], ah
Function at 0x1400e1d94
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rdx + rcx*4 - 0x64], al
and al, 0x4f
add dword [rax], eax
add byte [rcx + 0xf], al
mov esi, 0x894166f3
invalid

Function at 0x1400e2548
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x7c], r9d
xor r11, 0xdfec523
mov r12d, r15d
add r12d, 0x4288ba80
mov dword [rsp + 0x74], r12d
mov qword [rsp + 0x40], r11
mov r11, r10
add r11, 0x150db595
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x24], r8d
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x17], bl
mov dword [rsp + 0x10], r15d
mov qword [rsp + 8], r10
mov word [rsp + 6], di
jmp 0x1400e25ce
Function at 0x180001000
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp edx, 1
mov eax, 0x1bfe2385
mov ebx, 0x3d166699
cmove ebx, eax
mov eax, 0x2ef0d799
mov r14, qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea r15, [0x1800010a0]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
cmp eax, 0x3d166699
je 0x180001083
cmp eax, 0x2ef0d799
je 0x18000107f
cmp eax, 0x1bfe2385
jne 0x180001040
mov rcx, rsi
call r14
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, r15
xor r9d, r9d
call rdi
mov eax, 0x3d166699
jmp 0x180001040
mov eax, ebx
jmp 0x180001040
mov eax, 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140001b70
Capabilities:
Authenticate hmac
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
test eax, eax
js 0x140001d3d
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001bf0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140001d7b
mov qword [rsp + 0x58], 0xf
cmp rbx, 0x10
jae 0x140001c3c
mov qword [rsp + 0x50], rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], r15b
jmp 0x140001cd8
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001c71
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005920
test rax, rax
je 0x140001c9c
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001cb5
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001ca3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d81
jmp 0x140001c56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001cb2
call fcn.140005920
mov r14, rax
jmp 0x140001cb5
mov r14, r15
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], r15b
mov eax, dword [0x140007750]
mov dword [rsp + 0x30], eax
movzx ecx, word [0x140007754]
mov word [rsp + 0x34], cx
movzx eax, byte [0x140007756]
mov byte [rsp + 0x30], 0x5c
xor byte [rsp + 0x31], 0x36
xor byte [rsp + 0x32], 0x37
xor byte [rsp + 0x33], 0x38
xor cl, 0x39
mov byte [rsp + 0x34], cl
xor byte [rsp + 0x35], 0x3a
xor al, 0x3b
mov byte [rsp + 0x36], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400047c0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
jmp 0x140001d4f
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov rax, rsi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140005900
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011f0
int3
call fcn.140001150
int3