joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d560
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005d60a
cmp byte [rcx], 0
je 0x14005d60a
test rdx, rdx
jne 0x14005d5a2
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005d58c
test rdx, rdx
je 0x14005d607
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005d5b4
not r8d
mov eax, r8d
ret

Function at 0x140060d90
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rax
mov rdi, qword [rcx + 0x10]
xchg rdi, rax
mov rdx, rcx
test rax, rax
jne 0x140060da7
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x140060dd7
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060dd4
xchg rcx, rdi
mov rdi, qword [rdx + 0x10]
xchg rcx, rdi
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060db5
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret

Function at 0x140060df0
Capabilities:
Encode data using xor

Disassembly:
push r14
mov qword [rsp], rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
je 0x140060e59
cmp byte [rcx], 0
je 0x140060e59
push rax
call 0x140279cca
and eax, 0x8000ffff
jge 0x140060e25
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x140060e56
nop word [rax + rax]
xchg rcx, rax
mov rcx, qword [rbx + 0x10]
xchg rcx, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x140060e3a
mov byte [rbx], 0
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret

Function at 0x140060e70
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x140060e83
ret
cmp byte [rcx], 0
jne 0x140060ebd
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060eba
nop dword [rax + rax]
xchg r12, rax
mov r12, qword [rdx + 0x10]
xchg r12, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060e96
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 1
ret
Function at 0x1400d68f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbx
mov qword [rsp], rbp
push rdi
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg r14, r8
mov r8, r14
xchg r8, r14
mov r12, rdx
test rdx, rdx
je 0x1400d6b05
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d6b05
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d6b05
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d6b05
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d6afa
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 1
shl rbx, 2
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d6aec
mov ecx, 0x60
call fcn.1401541a0
mov rsi, rax
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d6a1b
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
xchg r15, rax
mov qword [rsp + 0x88], r15
xchg r15, rax
mov edx, dword [rax]
add rdx, r12
mov rcx, rsi
call fcn.1400dd550
lea rax, [0x140003e48]
xchg r9, rax
mov qword [rsi], r9
xchg r9, rax
jmp 0x1400d6a39
xchg r11, r15
mov rsi, r11
xchg r11, r15
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
mov qword [rsp + 0x88], rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.1401541e4
mov rbx, rax
test rax, rax
je 0x1400d6a62
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.140155236
jmp 0x1400d6a64
xor ebx, ebx
mov r8d, dword [r15]
xchg rbx, rax
mov rbx, qword [rsp + 0x88]
xchg rbx, rax
mov edx, dword [rax]
xchg r10, r12
mov r10, qword [rsp + 0x78]
xchg r12, r10
add rdx, r12
xchg rbp, rcx
mov rbp, rbx
xchg rcx, rbp
call fcn.140155260
xchg r10, rax
mov r10, qword [rsi]
xchg r10, rax
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0x10]
mov qword [rsp + 0x88], rsi
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x1400d6ad6
xchg rsi, r11
mov qword [rdx], r11
xchg r11, rsi
nop
sub qword [r14 + 8], 0x41930cba
add qword [r14 + 8], 0x41930cc2
jmp 0x1400d6ae6
lea r8, [rsp + 0x88]
mov rcx, r14
call fcn.1400d5b10
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d6995
test r13d, r13d
setne al
jmp 0x1400d6b07
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
push rcx
push rdx
push rax
push rax
push rdx
push rdx
push rcx
xchg qword [rsp + 0x38], r15
pop rcx
pop rdx
pop rdx
pop rax
pop rax
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rdx
xchg qword [rsp + 8], r13
add rsp, 0x10
push rcx
push rbx
push rax
xchg qword [rsp + 0x18], r12
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
push rdx
xchg qword [rsp + 0x10], rsi
pop rdx
pop rcx
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400d6ed0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xchg rcx, r9
mov qword [rsp + 0x20], rcx
xchg rcx, r9
xchg rdx, r8
mov qword [rsp + 0x18], rdx
xchg r8, rdx
xchg rcx, r9
mov qword [rsp + 8], r9
xchg r9, rcx
push rbx
push rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
mov rbx, r9
mov rsi, rdx
xchg rsi, rcx
mov r9, rsi
xchg rcx, rsi
xor ebp, ebp
test rdx, rdx
jne 0x1400d6f49
mov eax, ebp
jmp 0x1400d6f76
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d6f65
xchg rbp, rsi
mov rax, rsi
xchg rsi, rbp
jmp 0x1400d6f76
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d7092
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d7092
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d7062
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d7056
mov qword [rsp + 0xa8], rdx
xchg rcx, r14
mov qword [rsp + 0x30], r14
xchg r14, rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rdi, rcx
mov rdi, qword [rbx + 0x38]
xchg rcx, rdi
test rcx, rcx
je 0x1400d7114
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d7062
xchg r8, rbx
mov rbx, qword [rsp + 0xb0]
xchg r8, rbx
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d6fc3
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg r9, rcx
test rcx, rcx
je 0x1400d708b
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg rdi, rbp
mov qword [rbx + 0x38], rdi
xchg rdi, rbp
mov al, 1
jmp 0x1400d70bd
xchg r11, rcx
mov r11, qword [rbx + 0x38]
xchg r11, rcx
test rcx, rcx
je 0x1400d70bb
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rbp, r9
mov qword [rbx + 0x38], r9
xchg r9, rbp
xor al, al
add rsp, 0x58
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r13
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
push rbx
push rcx
push rbx
push rcx
xchg qword [rsp + 0x20], rsi
pop rcx
pop rbx
pop rcx
pop rbx
add rsp, 8
push rcx
push rdx
xchg qword [rsp + 0x10], rbp
add rsp, 0x18
nop
xchg qword [rsp], rbx
add rsp, 8
ret
call fcn.140154fec
nop
int3
Function at 0x1400d76c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
nop
push r12
mov qword [rsp], rdi
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rcx, rdx
mov rdi, rcx
xchg rdx, rcx
test rdx, rdx
jne 0x1400d76ed
mov eax, ebx
jmp 0x1400d7718
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d7707
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x1400d7718
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg r10, rbp
mov qword [rsp + 0x50], r10
xchg r10, rbp
mov ecx, 0x20b
xchg r14, rsi
mov qword [rsp + 0x58], r14
xchg rsi, r14
xchg r12, r8
mov qword [rsp + 0x60], r8
xchg r8, r12
mov qword [rsp + 0x28], r14
xchg r15, rcx
mov qword [rsp + 0x20], rcx
xchg r15, rcx
cmp word [rax + 0x18], cx
jne 0x1400d77c2
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x1400d77c2
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x1400d77c2
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.14005d560
cmp eax, r13d
je 0x1400d7815
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x1400d7792
xor eax, eax
xchg r15, r10
mov r10, qword [rsp + 0x20]
xchg r10, r15
xchg rcx, r14
mov rcx, qword [rsp + 0x28]
xchg rcx, r14
xchg r12, r9
mov r9, qword [rsp + 0x60]
xchg r9, r12
mov rsi, qword [rsp + 0x58]
xchg rbp, r13
mov r13, qword [rsp + 0x50]
xchg rbp, r13
add rsp, 0x30
nop
xchg qword [rsp], r13
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
xchg qword [rsp], rbx
add rsp, 8
ret
xchg r14, rax
mov r14, rbp
xchg r14, rax
jmp 0x1400d77c4
Function at 0x1400daf5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add bh, al
test dword [rsi - 0x9fffffb], esi
div dh
test bh, 0x85
sysret

Function at 0x1400dd640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdx, r8
mov r11, r8
xchg r8, rdx
mov r10, rcx
test rdx, rdx
je 0x1400dd6be
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400dd6ab
movzx eax, byte [r10]
test bl, bl
je 0x1400dd68d
lea rcx, [r9 - 1]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400dd67c
jmp 0x1400dd6ab
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400dd69c
inc r10
sub r11, 1
jne 0x1400dd65e
xchg r10, rbx
mov r10, qword [rsp]
xchg rbx, r10
add rsp, 8
ret

Function at 0x1400dfcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rsi
mov qword [rsp + 0x10], rbx
xchg rbx, rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg r8, rdi
mov r8, rdi
xchg r8, rdi
mov rbx, rdx
xchg rsi, r11
mov r11, rcx
xchg rsi, r11
test r8, r8
je 0x1400dfe77
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfe0a
mov edx, 0x3e
xor ecx, ecx
call fcn.1400e0500
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfe4e
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400dfd1a
mov qword [rsi], rbx
jmp 0x1400dfe7a
mov qword [rcx], rdx
mov rax, rsi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], rbp
ret
Function at 0x1400e0500
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg rbp, r15
mov qword [rsp + 0x20], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
mov eax, 0x13b0
call fcn.140154550
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.14015507e
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x1c
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1400e0554
mov ebp, 0x80000000
mov dword [rsp + 0x20], 0x270
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg rbx, rax
mov qword [rsp + 0x13d0], rbx
xchg rbx, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1400e05dc
call fcn.1400e07c0
mov ecx, eax
jmp 0x1400e063e
inc edi
mov ebx, edi
call fcn.1400e07c0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1400e062c
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400e062c
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1400e07c0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400e0611
shr rcx, 0x18
shr rcx, 4
shr rcx, 2
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg rbp, rsi
mov rsi, qword [r11 + 0x18]
xchg rbp, rsi
lea ecx, [rdx - 0x80000000]
xchg r14, rsi
mov r14, qword [r11 + 0x28]
xchg r14, rsi
cmovae eax, ecx
mov rsp, r11
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x1400e07c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r10, r9
mov r10, qword [rcx]
xchg r10, r9
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400e082f
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400e07ea
mov ecx, dword [r9]
jmp 0x1400e092a
cmp ecx, 0x4e0
jb 0x1400e092a
lea r10, [r9 + 0x9c4]
xchg rbx, r12
mov qword [rsp], r12
xchg r12, rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e0854
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e08a8
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
xchg rbx, rdi
mov rdi, qword [rsp]
xchg rdi, rbx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 4
shr ecx, 2
shr ecx, 5
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xe
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 7
shr eax, 2
shr eax, 7
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
ret
Function at 0x14014b0b0
Capabilities:
Execute syscall

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
sub rsp, 0x98
xchg rbx, r8
jmp 0x14014b642

Function at 0x140182570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14018259d
xor al, al
jmp 0x1401826ff
mov rax, qword [0x1401a16c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401a16c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401a16d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401a16d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401a16e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401a16e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401a16f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401a16f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401a1700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401826f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140182649
mov r11d, 2
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140182663
mov r11d, 1
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140182715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401826b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401826ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401826da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401826e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140182630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401826fa
Function at 0x1406e5870
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1401f3a99

Function at 0x14073f4f9
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1401c6b8a

Function at 0x140d1d7d6
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
test r10b, 0x16
mov r11, qword [rsp + 0x28]
mov eax, dword [rdx + 8]
mov rbx, r9
lea r10, [r8 + r11]
add r9b, 0x44
rcr r9w, 0x4c
mov r9, rcx
cmp r14, rdx
cmp rax, r10
jmp 0x140d1d805
jae 0x140d1d81f
sub al, al
movsx ebx, dx
mov bx, 0x6795
mov rbx, qword [rsp + 8]
jmp 0x140d1d81e
ret
mov edx, dword [rdx + 4]
stc
add rdx, qword [rcx]
test r10b, r15b
clc
test r11, r11
jmp 0x140d1d832
je 0x140d1d872
sub rbx, r8
nop
movsx rax, r10w
clc
bswap ax
mov eax, dword [r9 + 8]
mov ecx, r8d
rol eax, cl
add al, r8b
inc r8
test r14w, sp
test r15, 0x64a645c
xor al, byte [r8 + rdx - 1]
sub r11, 1
mov byte [rbx + r8 - 1], al
jne 0x140d1d844
mov rbx, qword [rsp + 8]
xchg al, al
mov al, 1
ret
Function at 0x6d7d4de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f65e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d4f68
mov rax, qword [0x6d7f65e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d4e2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d4eb5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d4e10
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d4f9d
mov rax, qword [0x6d7f65e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f65e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d4f80
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d4eae
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d4f10
add dword [0x6d7f65e4], 1
cmp edi, 8
jae 0x6d7d4ee3
test dil, 4
jne 0x6d7d4f54
test edi, edi
je 0x6d7d4ed8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d4f6f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d4ed8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d4efc
jmp 0x6d7d4ed8
add rsi, qword [0x6d7f65e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d4eae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d4ed8
xor esi, esi
jmp 0x6d7d4e37
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d4ed8
mov rax, qword [0x6d7f65e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d56f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f68c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f68a0]
test rbx, rbx
je 0x6d7d5744
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d573b
test rsi, rsi
je 0x6d7d573b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d5720
lea rcx, [0x6d7f68c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]