joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400672b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.140068650]
mov rdi, rax
test rax, rax
jne 0x1400672f2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140067339
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140067392
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140067350
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400673d3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14007847a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14007847b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400673a0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400682c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006830a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006830a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006830a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006830a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006830a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006830c
xor al, al
add rsp, 0x28
ret
Function at 0x1400945a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400945cd
xor al, al
jmp 0x14009472f
mov rax, qword [0x1400b46b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400b46b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400b46c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400b46c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400b46d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400b46d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400b46e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400b46e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400b46f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140094721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140094679
mov r11d, 2
jmp 0x14009469d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140094693
mov r11d, 1
jmp 0x14009469d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140094745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400946e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400946fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14009470a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140094718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140094660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14009472a
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400135f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014930
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014950
xor al, al
jmp 0x1400149d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014963
xor al, al
jmp 0x1400149d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001498d
xor al, al
jmp 0x1400149d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400149a1
xor al, al
jmp 0x1400149d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400149b3
xor al, al
jmp 0x1400149d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400149cf
xor al, al
jmp 0x1400149d1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400049e4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140004a68
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140006380]
cmp byte [rcx + rax], 0
je 0x140004a68
dec r8
sub rdx, 1
jne 0x140004a4e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140004d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140004a80
mov ebx, eax
test eax, eax
jne 0x140004d60
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140004dc3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004dba
test al, 0x10
je 0x140004dba
bt eax, 0xa
jae 0x140004db3
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140004dd4
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140004daf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140004daf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140004dba
and dword [rsp + 0x3c], 0
jmp 0x140004dbf
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005850
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000589a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000589a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000589a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000589a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000589a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000589c
xor al, al
add rsp, 0x28
ret
Function at 0x140002880
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov esi, ecx
movabs rdi, 0x5f8bff5b8abf2b8a
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7065656c53
xor rcx, rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400028e7
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x38]
xor qword [rsp + 0x48], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x1400028d0
movabs rbx, 0x32336c656e72656b
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
xor rax, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140002947
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x140002930
lea rcx, [rsp + 0x38]
call entry0
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140001090
imul ecx, esi, 0x3e8
call rax
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x636f725074697845
xor rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, 0x737365
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400029d7
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x1400029c0
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x48], 2
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140002a37
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + rax*8 + 0x28], rcx
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jb 0x140002a20
lea rcx, [rsp + 0x28]
call entry0
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140001090
xor ecx, ecx
call rax
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1405e5210
Capabilities:
Packed with generic packer

Disassembly:
shr eax, 0xc8
add ax, 0x84b5
cmp eax, 0x581e3c9f
mov rax, qword [rsp + rax - 0xe8afdd]
mov rax, qword [rax]
jg 0x1409c139b
neg word [rsp + 0x18]
mov r9, qword [rsp + 0x20]
je 0x1405df86d
setne byte [rsp + 0x18]
neg word [rsp + 0x10]
test byte [rsp + 0x18], 0x97
jl 0x1407e3701
jl 0x1405e570d
push qword [rsp + 0x28]
popfq
setno bpl

Function at 0x1405e524c
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + rsi - 0x5c55586b], rax
shr esi, 0x41
lea rsi, [rsi + rsi + 0x2d2d1399]
xor sil, 0x8e
push r13
and sil, 0x8f
push r12
test si, 0xbd32
mov r13, rsi
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
not r13w
js 0x1407e5ffc
shl r13d, 0x1e
and r13d, 0x179dfd39
call fcn.1405e65bc
jo 0x1409b3ae3
add qword [rsp + 8], 0xffffffffbfa344f1
lea rdi, [rdi + 0x2cb93880]
and dword [rsp + 0x28], 0x8e225291
mov qword [rsp + 0x18], rbx
add qword [rsp], 0xfffffffffffc2ff8
shl dword [rsp + 0x18], 0x8e
setbe byte [rsp + 0x18]
shl qword [rsp + 0x28], 0x86
xchg qword [rsp + 0x30], rdi
mov rbx, qword [rsp + 0x10]
neg qword [rsp + 0x28]
shr qword [rsp + 0x18], 0xee
add edx, dword [rsp + 0x49]
js 0x14090f14a
mov qword [rsp + 0x10], r15
call fcn.1408bb1bb
cmp r13b, 0xb4
mov r11, qword [rsp + r11 - 0x6b875d09]
movzx r13d, cx
ja 0x1407e4de4
add cl, cl
add qword [rsp + rcx - 0x6a875ca0], 0xffffffffbf6993a9
mov rcx, qword [rsp + r13 - 0x5cc0]
or byte [rsp + r13*2 - 0xb9b8], 0x8c
test dword [rsp + r13 - 0x5cb8], 0xa186520f
seto r13b
and word [rsp + r13*8 - 0x2e7b8], 0x128e
jle 0x140a933df
add dword [rsp + r13*2 - 0xb9b8], 0x51d3ba4
neg qword [rsp + r13 - 0x5cb8]
mov r13, qword [rsp + r13*2 - 0xb9d0]
neg word [rsp + 0x48]
call fcn.1405df778
mov rdx, qword [rsp + 0x58]
movabs rbp, 0x6f2550b4a0ad5f83
not rbp
mov r11, rcx
xor ecx, dword [rsp + 0x4c]
setle bpl
neg r13b
mov rbp, qword [rsp + 0x20]
bswap r13d
setge cl
je 0x1409677d4
jge 0x1408c685f
mov r8, qword [rsp + r11 - 0x6b875d11]
add qword [rsp], 0xffffffffbf61cc1f
sub r13w, r13w
jge 0x1408f8f4e
lodsd eax, dword [rsi]
sub byte [rcx - 0x49a43ca0], cl
sub bh, byte [rbx + 0x5c]
pop rbp
insd dword [rdi], dx
lahf
imul edx, dword [rbx - 0x46674800], 0x57
mov dword [0x1aa334a3b], esp
xchg esi, eax
invalid
not r15
lea rbx, [rbx + 0x11947484]
call fcn.140a5493a
mov dh, 0xf8
cmp dword [rbp - 0x3b7aa02d], esp
pop rdx
sbb dh, byte [rsi]
test al, 0x5a
invalid
xor dword [rsp + 8], 0xdc073cb3
call fcn.1407ba928
shr dword [rax - 0x68], 1
cmp cl, byte [rcx - 0x76]
test eax, 0x71e7b753
and dword [rax], edx
invalid
Function at 0x140707ae8
Capabilities:
Packed with generic packer

Disassembly:
push r13
add qword [rsp + 0x18], 0xfffffffffffbd820
cmp word [rsp + r8 - 0x4f24976d], 0x24b6
movabs r10, 0xf9343727671cf715
call fcn.1405ccf21
mov qword [rsp + 8], 0x7a33461a
not byte [rsp + 8]
not word [rsp + 8]
not byte [rsp + 8]
call fcn.140793c1e
and rbp, 0xffffffff9510a5a0
not rbp
push 0x7a8d493c
seto byte [rsp + rbp + 0x1102001]
call fcn.140009f7a
xchg edi, eax
and dword [rax], eax
add byte [rax], al
mov ecx, 0xf9005d59
pop rcx
pop rbp
add byte [rax - 0x17ffa2b5], bh
pop rsi
mov es, word [rbp]
invalid
jg fcn.1408a36b0
cmp r14w, word [rsp + 0x28]
push r14
lea rdx, [rdx + 0x12126f21]
push rdi
push r8
mov r8, qword [rsp + 0x10]
jb 0x1408124a1
xchg qword [rsp + 0x58], rdx
mov r8, qword [rsp]
not r14b
movzx ecx, word [rsp + 0x44]
xor word [rsp + 0x10], r14w
movzx r14, word [rsp + rcx - 0x860a]
mov r10, rcx
mov rdi, rcx
xor dword [rsp + r14*4 - 0x3bc], ecx
mov r14, qword [rsp + r14*2 - 0x1d6]
movzx r10d, byte [rsp + rcx*2 - 0x10bf0]
jns 0x140904cad
int3
call fcn.140a73716
test dword [rbp - 0x74], esp
lodsb al, byte [rsi]
jns 0x1407d5104
outsd dx, dword [rsi]
sbb eax, ebx
sbb eax, 0x58b441e9
je 0x1407d5104
invalid
jb 0x1409dcbc2
push rcx
lea rcx, [rcx + 1]
lea r8, [r8 + r8*2 + 0x179e4a25]
mov qword [rsp], r8
ja 0x1405d0ef0
cmp r8, 0xffffffff8c3d151e
mov qword [rsp + 0x20], rcx
not word [rsp]
call fcn.140725d88
push r14
mov r14, qword [rsp + 0x18]
or rdx, rdx
sub qword [rsp + 0x18], 0x6d9eac98
mov r14, qword [rsp]
lea rsp, [rsp + 0x10]
ret 0x10
pushfq
sbb byte [rax], bh
mov bl, 0x2a
sbb dword [rdx], ebx
mov ss, word [rdi + rdx + 0x2a668e56]
cmc
mov eax, 0xfc3df88e
invalid
mov dword [rsp + rdi - 0x860a], 0xb8155c9d
xor word [rsp + rcx*8 - 0x43090], r10w
mov rdi, qword [rsp + rdi*2 - 0x10c2c]
jb 0x14087afea
mov cx, 0x231d
jo 0x1407d511f
mov r10, qword [rsp + r10 + 0x16]
add cl, 0xe
or dword [rsp + rcx - 0x22eb], ecx
shr ecx, cl
add word [rsp + rcx + 0x3c], 0x5818
shl cl, cl
xor qword [rsp + rcx - 0x30], 0xffffffff853e0e9e
shl byte [rsp + rcx*2 - 0x70], 0x15
mov rcx, qword [rsp + rcx*4 - 0xc8]
cmp byte [rsp + 0x10], 0x39
ja 0x1408eeec4
test byte [rsp + 0x40], 0xb1
jbe 0x1405df884
shl dword [rsp + 0x40], 0x25
and qword [rsp + 0x10], 0xffffffffe7acbdab
add qword [rsp + 0x18], 0xffffffffbf570b00
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
ret
call fcn.140a41ca0

Function at 0x1407727d0
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [rdi]
invalid
loop 0x14077277a
div byte [rdi - 0x382300b3]
movabs byte [0xdce491b992230221], al
sal dword [rdi - 0x231719], 0xcd
invalid
xor byte [rsp + 0x50], 0x8d
call fcn.1405d2d2c
push r13
mov qword [rsp], 0xffffffffa04f084e
call fcn.140ba26ef
jno 0x14077279b
mov esp, 0x270b5b4f
adc byte [rbx - 0x65f901da], dh
pop rsi
shl dword [rsi], cl
xor al, 0xfb
invalid

Function at 0x14078e13c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0xfffffffff5b2ceee
call fcn.140bb1555
push rsi
mov qword [rsp], 0xffffffffa0e0e8f5
call fcn.140aea846

Function at 0x1407a3586
Capabilities:
Encode data using xor

Disassembly:
jge 0x1400065b5
jns 0x1407a35e5
invalid
invalid
Function at 0x1407a9ca6
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1409d3e68
invalid
movabs rbp, 0xfaada9a3223885ba
add r8b, 0x1c
jbe 0x140818789
add qword [rsp], 0xfffffffffff370b3
and r8w, 0x3891
lea rbp, [r8 + r8*2 - 0x53e2fcef]
jae 0x140764f7e
cwde
invalid

Function at 0x1407e5fc9
Capabilities:
Packed with generic packer

Disassembly:
test byte [rsp + 0x30], sil
jno 0x140961ab5
test byte [rsp + 0x30], sil
push r15
lea rsp, [rsp + 0x18]
ret

Function at 0x14091574d
Capabilities:
Packed with generic packer

Disassembly:
shl sil, 1
not qword [rsp + 8]
shr qword [rsp + 8], 0x9c
ja 0x1405e5257
neg sil
add qword [rsp + 0x28], 0x1255f3
lea rsi, [r11*8 - 0x777d2f7a]
xor r13w, si
sub r13, r11
mov rax, qword [rsp + r11 + 0x54383b63]
mov rax, qword [rax + r13*2 + 0x124b4]
add r11b, byte [rsp + r11 + 0x54383b4a]
neg qword [rsp + r11 + 0x54383b43]
and si, r11w
call fcn.140783db7

Function at 0x1409649e0
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1400088fe
and al, 0x48
mov ebx, dword [rsp + 0x30]
push rdx
xor si, si
mov sil, 0x9a
add qword [rsp + 8], 0x171bf
test si, 0x6d9d
not esi
movsx r8w, r8b
movsx r8d, r8b
jbe 0x1405eceeb
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
jne 0x1409a8787
mov bl, byte [rdi + 0x3be782ab]
jge 0x14071ebd0
jge 0x14071eb55
outsb dx, byte [rsi]
ficomp dword [rax + 0x7d]
add al, 0xb4
movabs eax, dword [0x35cd82a30de6de82]
shl dword [rdx - 0x172d317e], cl
pop rax
jge 0x14071ebdf
wait
push rsp
jge 0x14071eb97
invalid
stosb byte [rdi], al
invalid
invalid
push rbx
movabs byte [0x82ae7add6082ab08], al
sub bh, bl
int 0xa8
invalid
jbe 0x14071eb3e
setge r8b
not r8
add qword [rsp + 0x10], 0xffffffffbfa1f48b
test sil, 0xbb
not rsi
bswap rsi
bswap esi
lea rdi, [rdi - 0x25f54ff7]
movzx rsi, r8b
call fcn.14084177a

Function at 0x1409e1f2e
Capabilities:
Encode data using xor

Disassembly:
lea r12, [rbx*2 + 0x171b5d36]
movsx rbx, bl
call fcn.140926ec9
call fcn.14094fb37
mov cl, 0x9c
sti
or bl, dh
mov ecx, dword [rdx - 0x1c]
retf 0xb3a2
sti
invalid
loopne 0x1409e1e61
invalid
jge 0x1409e1eac
invalid
jns 0x1408776f4
cmp sil, 0x80
jg 0x14099c087
loopne 0x1409e1f75
sub byte [rax], dh
frstor dword [rax - 0x133a858e]
loope 0x1409e1ef1
jge 0x1409e1f86
movsb byte [rdi], byte [rsi]
scasd eax, dword [rdi]
stosb byte [rdi], al
add ebp, 0x743837cb
cmp dword [rdx - 0x69], esp
lea edi, [rsi + 0x39]
out 0xb1, eax
invalid
pop rdi
bnd jb 0x1409e1fb2
invalid
js 0x1409e1fc2
xor dword [rcx], esp
ror byte [rbp + 0x75916cc6], 0x87
invalid
mov esp, 0x1a522ef5
mov edx, 0x7f1bdbba
invalid
invalid

Function at 0x1409eeca0
Capabilities:
Encode data using xor

Disassembly:
jmp [rdx]
mov qword [rsp + 8], 0xffffffffb670b39f
lea rsp, [rsp + 8]
call fcn.140b920ec
pop rsp
add dword [rdx], ecx
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x1409eecbb
xor dword [rdi], eax
lodsd eax, dword [rsi]
jns 0x1409eec53
invalid
Function at 0x140c09c78
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
cbw
cdq
movsx edx, r11w
push rdi
setns ah
cmovno dx, bx
xadd dx, ax
push rbx
mov rax, qword gs:[0x30]
adc r8b, 0xab
mov rax, qword [rax + 0x60]
bt r8, r12
mov rdx, qword [rax + 0x18]
test sp, r8w
btr r8d, esi
add rdx, 0x20
or r8w, sp
adc r8b, 9
sub eax, eax
mov r8, rdx
jmp 0x140c09cc4
jmp 0x140c09cd8
test r11w, r11w
jmp 0x140c09cd2
je 0x140c09d8d
mov r8, qword [r8]
jmp 0x140c09ce0
cmp r8, rdx
jmp 0x140c09ce8
je 0x140c09d9b
test rcx, rcx
jmp 0x140c09cf6
je 0x140c09d8d
mov r9, qword [r8 + 0x50]
test r11d, r9d
xor r10d, r10d
btr r11w, 0xa1
movsxd r11, r9d
bsr rsi, rdi
nop word [rax + rax]
movzx edi, r12w
sbb bx, 0xa180
cmc
movsx esi, byte [rcx + r10]
sar edi, cl
lea edi, [rsi - 0x41]
mov r11d, esi
add r11d, 0x20
cmp dil, 0x1a
cmovae r11d, esi
movzx edi, word [r9 + r10*2]
rol bx, 0x2b
bswap si
lea ebx, [rdi - 0x41]
cmovp rsi, r13
lea esi, [rdi + 0x20]
stc
cmp bx, 0x1a
jmp 0x140c09d5c
cmovae esi, edi
test r9w, di
test r11w, r11w
jmp 0x140c09d6c
je 0x140c09cc9
inc r10
test ecx, r8d
stc
cmp r11w, si
jmp 0x140c09d82
je 0x140c09d23
jmp 0x140c09cc9
mov rax, qword [r8 + 0x20]
movsx rbx, ax
bswap di
movsx edi, cx
pop rbx
movzx edi, cx
pop rdi
pop rsi
jmp 0x140c09da6
ret
Function at 0x140c09da7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
cmovns r8d, r15d
btr r9, r14
push r14
rol r9w, cl
shr r8, 9
bswap r8
push rsi
ror r9b, 0x84
inc r8b
push rdi
shr r9d, cl
dec r8b
push rbp
rcr r8b, 0x91
add r8w, r12w
push rbx
xor r9d, 0x60394bb7
and r9b, r11b
movsxd r9, r13d
movsxd r9, dword [rcx + 0x3c]
btr r8, 0x8f
bsr r8d, eax
jmp 0x140c09df6
mov r8d, dword [r9 + rcx + 0x88]
cmp r15b, dil
sub eax, eax
test r8, r8
jmp 0x140c09e0b
je 0x140c09fbe
cmp dword [r9 + rcx + 0x8c], 0
jmp 0x140c09e1f
je 0x140c09fbe
mov r9d, dword [r8 + rcx + 0x18]
cmp r11b, 0x31
cmc
test r9, r9
jmp 0x140c09e37
je 0x140c09f6d
mov r11d, dword [rcx + r8 + 0x20]
movsx rbx, sp
add r11, rcx
inc r14d
xor eax, eax
setp bh
and r15, rcx
sub r10d, r10d
ror bpl, cl
movsxd rsi, edx
xor sil, r13b
nop word cs:[rax + rax]
xadd sil, bpl
mov esi, dword [r11 + r10*4]
add r15b, 0x8c
lea rsi, [rsi + rcx]
shr bp, cl
sbb r14b, r8b
inc r14
xor edi, edi
cmovno r14w, di
shl r15w, 0xa1
nop dword [rax]
sbb r15b, 0x19
bts r15w, r9w
shr r14d, cl
movsx r14d, byte [rdx + rdi]
rcl r15w, 0xac
movsx r15d, byte [rsi + rdi]
shr bpl, 0x3e
rcr bpl, 0x26
movzx rbp, r14w
lea ebp, [r14 - 0x41]
not bl
btc bx, 0x18
mov ebx, r14d
jmp 0x140c09ed8
add ebx, 0x20
cmc
cmp ecx, 0x76b95b15
jmp 0x140c09ee7
cmp bpl, 0x1a
movsxd rbp, eax
cmovae ebx, r14d
sar bp, cl
lea r14d, [r15 - 0x41]
dec bp
mov ebp, r15d
cmp edi, 0x771e4007
add ebp, 0x20
cmp r14b, 0x1a
cmovae ebp, r15d
sal r14b, cl
mov r14d, ebx
clc
jmp 0x140c09f1c
or r14w, bp
sete r14b
jmp 0x140c09f29
je 0x140c09f40
inc rdi
cmp bx, bp
jmp 0x140c09f3a
je 0x140c09ea3
test r14b, r14b
jmp 0x140c09f48
jne 0x140c09f79
inc r10
jmp 0x140c09f5a
cmp r10, r9
jmp 0x140c09f62
jne 0x140c09e6f
jmp 0x140c09fbe
sub eax, eax
jmp 0x140c09f74
jmp 0x140c09fbe
mov eax, dword [rcx + r8 + 0x1c]
sub edi, edx
shr si, 0x19
mov edx, dword [rcx + r8 + 0x24]
dec r8w
lea rdx, [rdx + rcx]
mov r8d, r10d
sub bpl, 0x2a
movzx edx, word [rdx + r8*2]
ror dil, cl
movsx si, r11b
bsr rsi, rdx
lea rax, [rax + rcx]
movsx di, r11b
ror ebx, 0x14
mov eax, dword [rax + rdx*4]
add rax, rcx
mov rdi, r11
pop rbx
pop rbp
mov r14b, r14b
movsx esi, r12w
mov r14b, 0x2b
pop rdi
movsx r15d, r13w
movsxd rsi, edx
pop rsi
mov r15b, 0xb1
movzx r14d, r13w
not r15b
pop r14
setp r15b
pop r15
ret