joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407bdcea
Capabilities:
Encode data using xor

Disassembly:
invalid
mov dword [rsp + 0x18], 0x57a7b630
and word [rsp + 0x18], 0x9a96
xchg qword [rsp + 0x20], rax
push rbx
jno 0x140968288
or ebp, 0xd3b6815f
cmpsb byte [rsi], byte [rdi]
movabs rcx, 0x57c5396cbbadf113
jnp 0x1407bdd97
invalid
int1
cmp eax, dword [rsi + rdx*2 - 0x34]
and al, 0x42
mov edi, 0x5a574ce9
fbld tbyte [rcx - 0x35]
pop rbx
mov ebp, 0xcd33997e
jbe 0x1407bdcd4
and eax, 0xf58cbd40
sub byte [rbp - 0x41], bh
mov cl, 0x27
lea eax, [rdx]
cmp r15b, byte [rdi + 0x36]
mov edi, 0x44e5b084
push rax
fdiv dword [rcx + riz + 0x41]
sbb dword [rdx], esp
fild word gs:[rdx]
sar dword [rbx - 0x552835a0], cl
scasd eax, dword [rdi]
jne 0x1407bdda6
jo 0x1407bdd6b
push rsi
loop 0x1407bddce
adc eax, 0x1b3ffd60
jge 0x1407bdd96
cmp ebp, edi
pushfq
pop rdi
cmpsb byte [rsi], byte [rdi]
invalid
imul edi, dword [rbx + rcx*4 + 6], 0x433920af
clc
cmc
stosb byte [rdi], al
idiv dword [rbp - 3]
call 0x10883a6bd
out 0x7c, al
insb byte [rdi], dx
sbb al, 0xb
shl byte [0x1747df020], cl
mov eax, 0x40ff0865
adc al, bl
jl 0x1407bdd24
invalid
leave
invalid
insb byte [rdi], dx
adc al, byte [rdx]
xor al, 0xb8
or bh, bh
adc al, bl
push rsp
dec byte [rbx - 0x48d7a58c]
out 0x3c, eax
cmp dword [rbx], 0x44a5d477
xor al, 0x65
loop 0x1407bddb0
invalid

Function at 0x140849cc6
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x18]
movabs rbp, 0x8e0f9d27be368ab6
sub ebp, 0xcd0becbe
js 0x14099e15c
mov rbp, qword [rsp + rbp - 0x604664f0]
jae 0x140006e03
shr dword [rsp + 0x28], 0x1a
setns byte [rsp + 0x28]
je 0x1409b2154
js 0x14060078d
add qword [rsp], 0xffffffffbf832842
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret 8
or rdx, qword [rsp + 0x18]

Function at 0x140884d6d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], 0xffffffffee17de12
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140b1c0db
pushfq
shl r12, 0x13
xor r12d, 0x6a9a8024
shr r12, 0xc3
jne 0x1407686c7
jbe 0x140609bed
call fcn.1409aab94
invalid
add qword [rsp + 8], 0xfffffffffff08f13
test r12, r12
call fcn.140795a85
retf
lea rbx, [rbx + 0x191c2f3f]
mov qword [rsp + 0x28], r8
jo 0x14061d87a
movsx r8, byte [rsp + 0x28]
movzx r11d, byte [rsp + 0x2c]
add r11, 0xffffffffacb5f731
mov word [rsp + r8*2 + 0xfe], 0x8391
test byte [rsp + r8*2 + 0xfe], 3
xchg qword [rsp + r8*4 + 0x1dc], rbx
mov r11, qword [rsp + r11 + 0x534a08ba]
mov rbp, r8
call fcn.1408e6b0f
cmp edx, eax
push 0x5e
jne 0x140884e16
invalid
sbb eax, 0xbf38dd45
mov ebx, 0x5d40c8cd
or al, 0x58
lea ecx, [rcx]
and ah, ch
invalid
Function at 0x140898adb
Capabilities:
Encode data using xor

Disassembly:
invalid
jge 0x140898a23
push rdi
out dx, eax
in al, dx
test dword [rbp - 0x3d], 0x1fafe148
pop rax
movsb byte [rdi], byte [rsi]
or dh, byte [rbx - 0x3f72d407]
invalid
cmpsb byte [rsi], byte [rdi]
invalid
jno 0x1407c6d2b
int 0x88
xor esp, 0xffffffed
adc dword [rbp + 0x3496d904], eax
test byte [rbx + rbx*8 - 0x7b79a3d3], al
jle 0x140898a81
add al, 0xd9
xchg esi, eax
xor al, 0x84
test bl, bl
sub eax, 0x7e84865c
mov ebx, dword [rax - 0x71]
test dl, bl
sar byte [0xe35b0f8e], cl
out 0x70, al
sti
fcmovu st(0), st(1)
push 0x70
pop rax
pop qword [rdx + rbx*8 - 0x7b71c22e]
shl dword [rdx - 0x25048f1a], 1
fldcw word [rdx + 0x70]
jnp 0x140898ae9
mul byte [rax]
test byte [rdx + rsi*4], al
movabs dword [0x7b713577e3fb780e], eax
sub al, 0x4a
jno 0x140898aa3
add al, 0x3e
fcmovnbe st(0), st(4)
fcmovnbe st(0), st(4)
ja 0x140898b1c
not dword [rax - 0x2684890f]
xor ebx, dword [rcx - 0x7a97848c]
popfq
jge 0x140898bab
clc
mov ah, 0xf8
jl 0x140898bb0
xchg ebx, eax
cld
and eax, dword [rdx - 0x50d82bfc]
invalid
invalid
fnstsw word [rdx - 0x1c]
int1
cld
insd dword [rdi], dx
add ch, byte [rdx + 0x3a4f20cb]
insd dword [rdi], dx
push rdi
ret 0x1013

Function at 0x1408c0508
Capabilities:
Encode data using xor

Disassembly:
shl edi, 0xb7
or r13w, 0x982d
movsx edi, word [rsp + 0x3a]
mov r10, qword [rsp + r13*4 - 0x26074]
add r13d, r13d
jl 0x140a9efd4
and qword [rsp + rdi - 0x1c08], r13
jb fcn.140007fb0
je 0x140a80649
call fcn.14060b7c8
xchg qword [rsp + r13 - 0x712ae5e7], rbp
mov r11, qword [rsp + r13 - 0x712ae5f7]
mov rdi, r10
and rdi, 0xffffffff953b978a
shr r13, 0x62
jbe 0x140001c8b

Function at 0x1408e5265
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax + 0x73200827]
call fcn.140a14bd3
mov qword [rsp + 0x20], rdi
push rdi
jbe 0x1405fb8dc
lea rdi, [rdi + rdi*8 - 0x765b397f]
jbe 0x140603ae1
out dx, al
imul eax, dword [rdi - 0x1a5238c4], 0xa49b5865
and al, 0x45
cmp edx, esi
loop 0x1408e52d2
test dword [rbx], esp
test byte [rcx - 0x1a], al
xchg edx, eax
push rbx
xor al, 0x65
sub al, 0x91
xor al, ah
or esi, ebx
invalid
mov dl, byte [rbx + 0x76904019]
invalid

Function at 0x14098a841
Capabilities:
Encode data using xor

Disassembly:
push r11
pushfq
add qword [rsp + 0x20], 0xffffffffbf9ff82b
movabs r11, 0x1d1975160f07300e
test r11b, 0xb2
mov qword [rsp + 0x20], 0xffffffffb31f7ac2
mov r11, qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140b5fa75
int1
xor dh, byte [rdx + rsi*4 + 0x53]
mov esp, 0x5a3140d1
movabs dword [0xa1be5d446b7f40c3], eax
pop rsi
cmpsd dword [rsi], dword [rdi]
and bh, byte [rsi - 0xba620e9]
push rdi
invalid
Function at 0x140a4d4ec
Capabilities:
Encode data using xor

Disassembly:
test qword [rsp + 0x10], 0xffffffffaa87bc9a
call int.14093dcc2
mov eax, 0xd83b2c4
sbb al, 0x37
stosb byte [rdi], al
add al, 0x28
push rax
or al, 0xa3
test byte [rbx - 0x53], ch
pop rdx
sti
xchg ecx, eax
lodsb al, byte [rsi]
in eax, dx
movsd dword [rdi], dword [rsi]
add al, 0x84
dec eax
movsb byte [rdi], byte [rsi]
test byte [rdx - 0x7b595fbc], dh
xor ebx, dword [rdx - 0x647b505c]
and eax, ecx
scasb al, byte [rdi]
test byte [rbx + rdi*8 + 0x1a], cl
push rax
sti
lahf
test al, 0x96
push rax
jnp 0x140a4d502
invalid

Function at 0x140aa8017
Capabilities:
Encode data using xor

Disassembly:
lea rsi, [rsi - 0x254f44da]
neg dword [rsp + r11 + 0x4161fc18]
add qword [rsp + r11 + 0x4161fc08], 0x1ce9c2
shr r15w, 0xc6
je 0x140aa4b79
add r10, 0xfffffffff50a43b7
xchg qword [rsp + 0x48], rsi
mov r10, qword [rsp + 0x40]
cmp r15w, word [rsp + r11 + 0x4161fc1b]
lea r15, [r15 + r11*4 - 0x5e7f5f4a]
lea rsp, [rsp + r11 + 0x4161fc08]
ret
js 0x140843f63
push r9
mov rsi, qword [rsp + r11*4 - 0x2efb09dc]
mov rsi, qword [rsi + r11*4 - 0x2efb09e4]
mov r9, r11
call fcn.140a796b9
mov byte [rbx + riz*8], dl
cmp byte [rdx - 0x40], ah
je 0x140aa4bc4
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
retf 0xb05f
stc
invalid
mov r14, qword [rsp + 0x10]
or dword [rsp + 0x40], 0xe93c4fb4
je 0x140a4db99
sub word [rsp + 0x40], 0x324
ja 0x1408fa076
shl dword [rdx], 5
xchg ebx, eax
sbb dword [rcx], eax
add byte [rax], al
add byte [rax], ah
outsb dx, byte [rsi]
xchg edi, eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbx], al
add byte [rax], al
add byte [rax], ch
outsb dx, byte [rsi]
xchg edi, eax
add byte [rax], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add dl, bl
int 0xef
pushfq
mov bl, 0xc6
xchg esi, eax
mov eax, 0xec5774a4
insd dword [rdi], dx
jg 0x140aa808f
xor al, 0x57
cwde
mov esi, dword [rsi + rbx*8]
mov cl, 0x94
adc dword [rbx], 0x4d
insb byte [rdi], dx
invalid
invalid
Function at 0x140c3aba2
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
adc rax, r9
movzx rax, si
jmp 0x140c3abaf
push rdi
seta dh
push rbx
shl ax, 0xa3
mov rax, qword gs:[0x30]
movzx r8d, r15w
mov rax, qword [rax + 0x60]
add r8b, 0x9c
sar dh, 0x15
mov rdx, qword [rax + 0x18]
movzx r8, r11w
dec r8w
rol r8b, 0xac
add rdx, 0x20
sub eax, eax
xchg r8b, r8b
movsx r8, bx
mov r8, rdx
jmp 0x140c3abf5
jmp 0x140c3ac09
test r11w, r11w
jmp 0x140c3ac03
je 0x140c3acc2
mov r8, qword [r8]
cmp r8, rdx
jmp 0x140c3ac14
je 0x140c3acc9
test rcx, rcx
je 0x140c3acc2
mov r9, qword [r8 + 0x50]
rol dil, cl
bt r11w, di
shl dil, 0xa6
xor r10d, r10d
btr edi, r14d
sbb sil, 0xa5
sal dil, 0x28
nop word [rax + rax]
movsx esi, byte [rcx + r10]
lea edi, [rsi - 0x41]
sbb r11w, 0x887
mov r11d, esi
stc
add r11d, 0x20
and bh, 0x8c
cmp dil, 0x1a
xchg dil, dil
movsxd rdi, r11d
cmovae r11d, esi
rcr bh, cl
bsr edi, edx
sal bh, 0xbd
movzx edi, word [r9 + r10*2]
bts bx, cx
shl bl, cl
lea ebx, [rdi - 0x41]
stc
bts rsi, rax
mov rsi, 0xffffffffd8bff38b
lea esi, [rdi + 0x20]
cmc
cmp bx, 0x1a
jmp 0x140c3ac9e
cmovae esi, edi
test r11w, r11w
je 0x140c3abfa
inc r10
cmp r11w, si
jmp 0x140c3acb7
je 0x140c3ac48
jmp 0x140c3abfa
mov rax, qword [r8 + 0x20]
mov dil, r11b
pop rbx
pop rdi
xchg si, si
movzx rsi, cx
pop rsi
jmp 0x140c3acd8
ret
Function at 0x140c3acd9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
shld r9, rcx, 0xba
push r14
push rsi
add r9b, r8b
neg r8b
push rdi
bsf r8d, ebx
push rbp
inc r8d
push rbx
test r13, rbx
movsxd r9, dword [rcx + 0x3c]
movsx r8d, r15w
shl r8w, 0xb8
mov r8d, dword [r9 + rcx + 0x88]
xor eax, eax
test r8, r8
jmp 0x140c3ad15
je 0x140c3ae8e
cmp dword [r9 + rcx + 0x8c], 0
jmp 0x140c3ad29
je 0x140c3ae8e
mov r9d, dword [r8 + rcx + 0x18]
test r9, r9
jmp 0x140c3ad3c
je 0x140c3ae2e
mov r11d, dword [rcx + r8 + 0x20]
clc
btr bp, si
lea r11, [r11 + rcx]
add bl, r15b
xor eax, eax
jmp 0x140c3ad5a
sub r10d, r10d
nop word cs:[rax + rax]
movzx si, r14b
mov esi, dword [r11 + r10*4]
lea rsi, [rsi + rcx]
sal r14w, 0
adc r15b, r13b
sub edi, edi
nop dword [rax]
movsx r14d, byte [rdx + rdi]
rcl r15, cl
xor rbx, 0xffffffffea99e9bc
movsx r15d, byte [rsi + rdi]
lea ebp, [r14 - 0x41]
mov ebx, r14d
clc
add ebx, 0x20
test spl, 0x81
cmp bpl, 0x1a
not rbp
cmovae ebx, r14d
lea r14d, [r15 - 0x41]
shrd rbp, r10, 0xb8
mov ebp, r15d
clc
cmp bp, r13w
add ebp, 0x20
cmp r8, r14
cmp r14b, 0x1a
movzx r14, r9w
mov r14w, 0xae
mov r14w, r14w
cmovae ebp, r15d
mov r14d, ebx
or r14w, bp
xchg r14b, r14b
sete r14b
je 0x140c3ae0a
inc rdi
clc
test r9b, 0x80
cmp bx, bp
jmp 0x140c3ae04
je 0x140c3ad86
test r14b, r14b
jmp 0x140c3ae12
jne 0x140c3ae3a
inc r10
cmp r10, r9
jmp 0x140c3ae23
jne 0x140c3ad6d
jmp 0x140c3ae8e
sub eax, eax
jmp 0x140c3ae35
jmp 0x140c3ae8e
mov eax, dword [rcx + r8 + 0x1c]
add r14w, r14w
rol bx, cl
xor dh, 0x33
mov edx, dword [rcx + r8 + 0x24]
btc r14, rax
lea rdx, [rdx + rcx]
mov r8d, r10d
rcl dil, 0x91
movzx edx, word [rdx + r8*2]
add rax, rcx
sal esi, cl
or bx, r12w
rcr r15b, 7
mov eax, dword [rax + rdx*4]
mov esi, 0x889c1e37
shld di, r13w, 0x25
rcr r15w, 0x92
add rax, rcx
movsx bp, dl
jmp 0x140c3ae8e
pop rbx
movzx ebp, r11w
pop rbp
mov sil, cl
movsxd rdi, r9d
movzx di, r15b
pop rdi
mov sil, r13b
movsxd rsi, esi
pop rsi
pop r14
movzx r15d, si
pop r15
jmp 0x140c3aeb4
ret
Function at 0x140c3b973
Capabilities:
Encode data using xor

Disassembly:
push rsi
cbw
btc rdx, 0xbf
xor dx, 0x9c27
sub rsp, 0x50
rdtsc
movsx rax, si
mov rsi, rcx
cmp r13d, 0xae30cd82
movabs rax, 0x9f2f5fef1fcd0dad
mov qword [rsp + 0x38], rax
bsr rcx, r8
mov rcx, qword [rsp + 0x38]
or dl, dil
bswap dx
sbb dh, 0x32
movabs rdx, 0x466c617574726956
xor rdx, rcx
sal cl, 0xbd
add cl, 0x9a
sbb cl, bpl
mov qword [rsp + 0x38], rdx
btc cx, bx
adc ecx, edi
bts ecx, edx
mov qword [rsp + 0x28], rax
sbb cl, r12b
inc cx
mov rcx, qword [rsp + 0x28]
stc
xor rcx, 0x656572
jmp 0x140c3b9fa
mov qword [rsp + 0x40], rcx
and cx, r15w
mov qword [rsp + 0x28], rax
shr cl, cl
mov qword [rsp + 0x20], 2
btr cx, 0x3c
cmovne cx, bx
rol cl, cl
mov rcx, qword [rsp + 0x20]
clc
test rcx, rcx
jmp 0x140c3ba2c
je 0x140c3ba6a
sub ecx, ecx
sar dl, 7
mov dx, r14w
nop
mov rdx, qword [rsp + 0x28]
test cl, r13b
cmc
xor qword [rsp + rcx*8 + 0x38], rdx
bswap rdx
inc rcx
sar dh, 0x32
xchg dx, dx
mov rdx, qword [rsp + 0x20]
cmp rcx, rdx
jmp 0x140c3ba64
jb 0x140c3ba3d
mov qword [rsp + 0x28], rax
test r9, 0xffffffffada84531
sub cx, 0x8ebc
mov rcx, qword [rsp + 0x28]
bts dx, r13w
shr edx, 0x39
xor rdx, 0xfffffffff9a01137
movabs rdx, 0x32336c656e72656b
jmp 0x140c3baa1
xor rdx, rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
test r11, r14
mov qword [rsp + 0x30], rcx
cmc
stc
cmp bx, 0x4f13
mov qword [rsp + 0x20], rax
cmp dl, r11b
movsx eax, dx
bts ax, r10w
mov qword [rsp + 0x48], 2
shr ax, cl
sub al, 0xa0
not al
mov rax, qword [rsp + 0x48]
clc
cmp bl, 0xad
test rax, rax
jmp 0x140c3baf3
je 0x140c3bb2e
sub eax, eax
ror cx, cl
nop dword [rax]
mov rcx, qword [rsp + 0x20]
cmc
xor qword [rsp + rax*8 + 0x28], rcx
xchg cx, cx
movzx ecx, bp
seto ch
inc rax
movsx ecx, dx
mov rcx, qword [rsp + 0x48]
test al, r15b
cmc
cmp rax, rcx
jb 0x140c3bb02
lea rcx, [rsp + 0x28]
call fcn.140c3aba2
lea rdx, [rsp + 0x38]
xchg ch, ch
mov rcx, rax
jmp 0x140c3bb47
call fcn.140c3acd9
mov rcx, rsi
jmp 0x140c3bb59
sub edx, edx
movsx r8d, r14w
mov r8d, 0x8000
jmp 0x140c3bb6a
call rax
nop
and si, 0xe3b3
adc si, r12w
or sil, bl
add rsp, 0x50
pop rsi
jmp 0x140c3bb83
ret
Function at 0x140c41c55
Capabilities:
Encode data using xor

Disassembly:
push rsi
not dx
or rax, rdi
sub rsp, 0x250
movabs rax, 0x9f2f5fef1fcd0dad
inc dh
bswap edx
bts cx, bp
mov qword [rsp + 0x50], rax
adc dl, r9b
test r12b, 0x29
or dh, 0xac
mov rcx, qword [rsp + 0x50]
bsf rdx, rsp
sub dl, r13b
movabs rdx, 0x6c75646f4d746547
xor rdx, rcx
mov qword [rsp + 0x38], rdx
shl cx, 0xba
test r14b, r14b
mov qword [rsp + 0x50], rax
cmc
xor rdx, r10
mov rcx, qword [rsp + 0x50]
rol dl, cl
add dl, spl
sar dl, 0x81
movabs rdx, 0x6d614e656c694665
test dh, 0x25
cmp sil, bl
test di, r13w
xor rdx, rcx
cmp r13b, al
sbb rcx, 0xffffffffbf3f93ad
shl ch, 0xf
mov qword [rsp + 0x40], rdx
bts rcx, r8
sub ecx, esi
dec cx
mov qword [rsp + 0x50], rax
inc cl
mov rcx, qword [rsp + 0x50]
test dx, 0x9c91
clc
xor rcx, 0x5765
clc
stc
mov qword [rsp + 0x48], rcx
rcr rcx, 0x2e
mov qword [rsp + 0x50], rax
rcr ecx, 0xb0
mov qword [rsp + 0x20], 3
test sp, dx
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140c41d6c
xor ecx, ecx
nop word [rax + rax]
mov rdx, qword [rsp + 0x50]
jmp 0x140c41d4f
xor qword [rsp + rcx*8 + 0x38], rdx
inc rcx
cwd
test r9b, r12b
cmc
mov rdx, qword [rsp + 0x20]
clc
cmp rcx, rdx
jb 0x140c41d3f
mov qword [rsp + 0x50], rax
adc rcx, r8
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x32336c656e72656b
cmp sil, cl
xor rdx, rcx
add rcx, r12
sub ch, 0x91
or cx, 0xa719
mov qword [rsp + 0x20], rdx
or rcx, rdx
neg cx
mov qword [rsp + 0x50], rax
sbb ch, 0xb
rcr ch, 0x82
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
stc
jmp 0x140c41dba
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 2
lahf
mov rax, qword [rsp + 0x30]
stc
test rax, r12
test rax, rax
jmp 0x140c41dda
je 0x140c41e1d
sub eax, eax
rol ecx, 0x9c
mov rcx, 0xffffffff9c02648c
nop dword [rax]
rcl cx, cl
movzx rcx, dx
mov rcx, qword [rsp + 0x50]
xor qword [rsp + rax*8 + 0x20], rcx
inc rax
xchg ecx, ecx
shrd rcx, rsp, 0xab
bt ecx, 0x9b
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jb 0x140c41df7
lea rcx, [rsp + 0x20]
jmp 0x140c41e27
call fcn.140c3aba2
lea rdx, [rsp + 0x38]
movzx cx, r12b
mov rcx, rax
call fcn.140c3acd9
lea rsi, [rsp + 0x50]
mov r8d, 0x200
sub ecx, ecx
bswap dx
movsx edx, di
mov rdx, rsi
jmp 0x140c41e59
call rax
mov rcx, rsi
jmp 0x140c41e63
call fcn.140c40ebe
nop
shld esi, esi, 0x38
add rsp, 0x250
movsx esi, sp
pop rsi
jmp 0x140c41e7d
ret
Function at 0x140c4689a
Capabilities:
Encode data using xor

Disassembly:
push rsi
inc rdx
shrd edx, r14d, 0x37
push rdi
sal rsi, 0x86
ror dx, cl
and dl, cl
sub rsp, 0x58
cqo
mov rsi, rcx
shr dx, cl
bt edx, esp
movabs rax, 0x9f2f5fef1fcd0dad
rol di, 0xbd
rcr rdx, 0x14
cmove di, bx
mov rdi, qword [rcx]
adc dh, bl
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movsx edx, di
stc
xchg dh, dh
movabs rdx, 0x666e49746553744e
clc
cmp ax, r14w
xor rdx, rcx
ror cl, cl
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x28], rax
ror dl, 0x84
cmp sil, r11b
btc rcx, 0x92
mov rcx, qword [rsp + 0x28]
bswap rdx
movabs rdx, 0x6e6f6974616d726f
test r10w, 0x5a07
xor rdx, rcx
ror ch, 0x2c
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x28], rax
bts rcx, r14
mov rcx, qword [rsp + 0x28]
xor rcx, 0x656c6946
jmp 0x140c46950
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x28], rax
xor rcx, 0x92ccba1
sub rcx, 0xfffffffff1acf53b
mov qword [rsp + 0x30], 3
shl cx, cl
bswap cx
bts rcx, r8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jmp 0x140c46988
je 0x140c469c8
xor ecx, ecx
xchg dx, dx
cdq
ror dx, cl
nop
xor dx, ax
shl dx, cl
mov rdx, qword [rsp + 0x28]
xor qword [rsp + rcx*8 + 0x40], rdx
inc rcx
adc dx, sp
mov rdx, qword [rsp + 0x30]
stc
jmp 0x140c469ba
cmp rcx, rdx
jmp 0x140c469c2
jb 0x140c4699f
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
xadd dx, dx
movabs rdx, 0x6c6c64746e
xor rdx, rcx
stc
cmc
mov qword [rsp + 0x38], rdx
jmp 0x140c469f0
mov qword [rsp + 0x28], rax
cmc
mov qword [rsp + 0x30], 1
sar ah, cl
movzx rax, r11w
cdqe
mov rax, qword [rsp + 0x30]
stc
jmp 0x140c46a12
test rax, rax
je 0x140c46a4f
xor eax, eax
sbb cx, r13w
nop dword [rax]
bts cx, r12w
mov rcx, qword [rsp + 0x28]
xor qword [rsp + 0x38], rcx
movsxd rcx, esi
mov ch, 0x84
movsx rcx, di
inc rax
mov rcx, qword [rsp + 0x30]
cmc
cmp rax, rcx
jb 0x140c46a29
lea rcx, [rsp + 0x38]
jmp 0x140c46a59
call fcn.140c3aba2
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140c3acd9
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
cmove r9w, r14w
bswap cx
xchg r9b, r9b
mov rcx, qword [rdi]
movsx r9d, r10w
xchg r9b, r9b
mov r9b, r12b
mov dword [rsp + 0x20], 4
mov r9d, 0x28
jmp 0x140c46a9e
call rax
nop
add rsp, 0x58
movsx rsi, ax
pop rdi
pop rsi
jmp 0x140c46ab0
ret
Function at 0x140c46ab1
Capabilities:
Encode data using xor

Disassembly:
push rsi
rol dl, 6
or al, 0
sub rsp, 0x50
mov rsi, rcx
test bpl, bl
btr cx, 0xbf
movabs rax, 0x9f2f5fef1fcd0dad
mov qword [rsp + 0x38], rax
rcl cx, 0x8d
sub dl, 0xa9
mov rcx, qword [rsp + 0x38]
shl edx, 0xbf
bts dx, r13w
movzx dx, sil
movabs rdx, 0x416c617574726956
cmp r10w, 0x80a7
test dh, 0xac
test r8, rsi
xor rdx, rcx
rol cx, 0x9f
mov qword [rsp + 0x38], rdx
btc cx, r10w
btr rcx, 0x91
bt ecx, 0xba
mov qword [rsp + 0x28], rax
inc ch
bts ecx, eax
mov rcx, qword [rsp + 0x28]
stc
cmc
xor rcx, 0x636f6c6c
cmp bx, 0xfd9e
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], rax
add cx, sp
shld ecx, ebx, 1
movsx cx, dl
mov qword [rsp + 0x20], 2
cmp sp, bx
rcl ecx, 0xbd
mov rcx, qword [rsp + 0x20]
clc
test rcx, rcx
jmp 0x140c46b6d
je 0x140c46bab
sub ecx, ecx
rcr dl, cl
btc dx, 0x83
cwd
nop
movzx edx, r9w
rcr dl, 0x8c
mov rdx, qword [rsp + 0x28]
cmp spl, 0x29
xor qword [rsp + rcx*8 + 0x38], rdx
dec dl
inc rcx
mov dl, r12b
mov rdx, qword [rsp + 0x20]
cmp rcx, rdx
jb 0x140c46b87
mov qword [rsp + 0x28], rax
cwd
mov rcx, qword [rsp + 0x28]
neg dl
movabs rdx, 0x32336c656e72656b
clc
xor rdx, rcx
bsr cx, cx
mov qword [rsp + 0x28], rdx
bsf cx, bx
sal ecx, cl
bt cx, 0x3b
mov qword [rsp + 0x20], rax
and cl, r14b
mov rcx, qword [rsp + 0x20]
stc
jmp 0x140c46bee
mov qword [rsp + 0x30], rcx
cmp sil, 0x1c
mov qword [rsp + 0x20], rax
rcl ax, 0xb5
mov qword [rsp + 0x48], 2
inc rax
cwde
ror ah, cl
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140c46c66
xor eax, eax
or ch, 0x2a
bt rcx, rax
test r9b, 0xa2
nop dword [rax]
bt rcx, 0xa5
mov rcx, qword [rsp + 0x20]
jmp 0x140c46c3e
xor qword [rsp + rax*8 + 0x28], rcx
dec cx
inc rax
rcr ch, cl
mov rcx, qword [rsp + 0x48]
test al, r9b
test bx, 0x711a
cmp rax, rcx
jmp 0x140c46c60
jb 0x140c46c33
lea rcx, [rsp + 0x28]
jmp 0x140c46c70
call fcn.140c3aba2
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140c3acd9
mov rcx, qword [rsi]
movsx r8d, bp
btr rdx, r14
movsxd r9, r8d
mov rdx, qword [rsi + 8]
mov edx, dword [rdx]
add edx, dword [rcx]
movzx r8d, r8w
shr r8d, cl
rcl r8b, 0x8f
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
jmp 0x140c46cb6
call rax
nop
shld si, di, 0xb0
shr sil, cl
add rsp, 0x50
cmovo rsi, rbx
mov sil, 0x97
pop rsi
jmp 0x140c46cd2
ret
Function at 0x140006650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x1400067e4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x1400067e4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x1400066eb
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14000680b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140006702
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140006702
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140006715
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140006762
mov r8d, eax
cmp eax, 0x800
jae 0x14000672f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140006762
cmp eax, 0x10000
jae 0x140006749
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140006762
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x1400067e4
add qword [r14], 2
test sil, sil
jne 0x140006783
cmp r10d, 3
jae 0x14000678f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x1400067c1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x1400067a0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14000669f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x1400067f2

Function at 0x140030694
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14001b78a
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14001b76d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14001b758

Function at 0x14004f670
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004f460
Function at 0x14005743c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14005746e
call fcn.1400462c4
mov dword [rax], 0x16
call fcn.14003fca8
jmp 0x14005758d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14005758d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14005758d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14005749d
lock or dword [rcx + 0x14], 0x10
jmp 0x14005758d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400574b1
call fcn.140058c68
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.140053778
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400583e4
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14005757b
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x140057546
mov rcx, rsi
call fcn.140053778
cmp eax, edi
je 0x140057531
mov rcx, rsi
call fcn.140053778
cmp eax, 0xfffffffe
je 0x140057531
mov rcx, rsi
call fcn.140053778
movsxd rbx, eax
lea r14, [0x1400883c0]
mov rcx, rsi
sar rbx, 6
call fcn.140053778
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140057538
lea rdx, [0x1400853c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140057546
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14005756a
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14005756a
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14005756a
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140057590
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret