joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c030
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14004c058
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14004c07e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004c080
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004c0d9
test ecx, ecx
jle 0x14004c0b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004c0d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004c0d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14004c100
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004c122
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004c138
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004c154
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004c156
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004c192
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004c22e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004c1cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14004c20e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14004c22e
cmp rbx, rax
ja 0x14004c1e0
test rbx, rbx
je 0x14004c22e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14004c660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004c68d
xor eax, eax
jmp 0x14004c7f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004c6c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004c6c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004c7f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004c7ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004c70a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004c735
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004c7f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004c7a4
sub eax, 1
je 0x14004c7a4
cmp eax, 2
jne 0x14004c7ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004c7f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004c7d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004c7ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004c7f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004f0f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004d460
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004d533
cmp byte [rcx + 0x71], 0
je 0x14004d533
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004d52f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004d4f4
sub eax, 1
je 0x14004d4f8
cmp eax, 2
jne 0x14004d52f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004f0f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004d526
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004d52f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004d4dc
xor al, al
jmp 0x14004d4dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004f0f0
add rsp, 0x60
pop rbx
ret

Function at 0x14004fe34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004fe7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004fe7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004fe7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004fe7e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004fe7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004fe80
xor al, al
add rsp, 0x28
ret
Function at 0x140006ec0
Capabilities:
Terminate process

Disassembly:
push r14
sub rsp, 0x20
mov r14d, ecx
mov rdx, qword [0x14004be00]
mov rcx, qword [rdx + 0x38]
movsx rax, byte [rcx + 0x1a0]
test eax, eax
je 0x140006eec
call fcn.14000be68
mov rdx, qword [0x14004be00]
mov rcx, qword [rdx + 0x40]
test rcx, rcx
je 0x140006f01
call fcn.14000b43c
mov rdx, qword [0x14004be00]
mov rcx, qword [rdx + 0x620]
test rcx, rcx
je 0x140006f19
call fcn.14000b43c
mov rdx, qword [0x14004be00]
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x140006f2e
call fcn.14000b43c
mov rdx, qword [0x14004be00]
mov rcx, qword [rdx + 0x38]
test rcx, rcx
je 0x140006f3c
call fcn.14000b43c
test r14d, r14d
jne 0x140006f54
mov ecx, 0x270f
lea rdx, str._nScanner_terminated_successfully._n
call fcn.14000ba0a
jmp 0x140006f65
mov ecx, 0x270f
lea rdx, str._nScanner_terminated_unsuccessfully._n
call fcn.14000ba0a
call fcn.14000b7c0
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0xdd0]
call sub.oracore11.dll_lrmtrm
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0xdc0]
mov rdx, qword [rax + 0xdc8]
xor r8d, r8d
call sub.oracore11.dll_lmmhpfree
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0xdb8]
call sub.oracore11.dll_lpmterm
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0x1490]
call sub.oranls11.dll_lmsatrm
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0x2e8]
call sub.oranls11.dll_lxlterm
mov rax, qword [0x14004be00]
mov rcx, qword [rax + 0x48]
call sub.oracore11.dll_sltster
xor ecx, ecx
call qword [sym.imp.MSVCR80.dll_exit]
add rsp, 0x20
pop r14
ret
Function at 0x140028db0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x140053410]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x140053508]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140028e31
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x140053508]
jmp 0x140028e4d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x140053508], r11
mov qword [0x1400534a8], rax
mov rax, qword [0x14004d4e8]
mov qword [0x140053380], r11
mov qword [0x140053490], rdi
mov dword [0x140053370], 0xc0000409
mov dword [0x140053374], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x14004d4e0]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400479f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x14004d4e8]
jne 0x140030f89
rol rcx, 0x10
test cx, 0xffff
jne 0x140030f85
ret
ror rcx, 0x10
jmp 0x140028db0
Function at 0x140028f40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
mov edi, esi
xor eax, eax
lock cmpxchg qword [0x140054068], rbx
je 0x140028f86
cmp rax, rbx
jne 0x140028f79
mov edi, 1
jmp 0x140028f86
mov ecx, 0x3e8
call qword [sym.imp.orauts.dll_Sleep]
jmp 0x140028f60
mov eax, dword [0x140054060]
cmp eax, 1
jne 0x140028f9b
lea ecx, [rax + 0x1e]
call fcn.1400e4000
jmp 0x140028fda
mov eax, dword [0x140054060]
test eax, eax
jne 0x140028fd0
mov dword [0x140054060], 1
lea rdx, [0x140031650]
lea rcx, [0x140031638]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x140028fda
mov eax, 0xff
jmp 0x1400290bb
mov dword [0x140053904], 1
mov eax, dword [0x140054060]
cmp eax, 1
jne 0x140029002
lea rdx, [0x140031630]
lea rcx, [0x140031618]
call sub.MSVCR80.dll__initterm
mov dword [0x140054060], 2
test edi, edi
jne 0x14002900d
xchg qword [0x140054068], rsi
cmp qword [0x140054080], 0
je 0x140029036
lea rcx, [0x140054080]
call fcn.140029490
test eax, eax
je 0x140029036
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x140054080]
mov rcx, qword [sym.imp.MSVCR80.dll___initenv]
mov rax, qword [0x1400538e8]
mov qword [rcx], rax
mov r8, qword [0x1400538e8]
mov rdx, qword [0x1400538f0]
mov ecx, dword [0x1400538e0]
call section..text
mov dword [0x140053900], eax
cmp dword [0x1400538e4], 0
jne 0x140029077
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x140053904], 0
jne 0x14002908c
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x140053900]
jmp 0x1400290bb
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x28
call fcn.140028cf0
add rsp, 0x28
jmp 0x140028f40
Function at 0x14000b85c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b8a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b8a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b8a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b8a6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b8a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b8a8
xor al, al
add rsp, 0x28
ret
Function at 0x140468fa0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140468fad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140468fbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140468fa5
lea eax, [rcx + 1]
jmp 0x140468fcb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140468fde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140468fc4
sub eax, 3
jb 0x140468ffe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14046904d
sar eax, 1
movsxd rbp, eax
jb 0x140469034
jmp 0x14046900c
add ebx, ebx
jne 0x14046900a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140469034
inc ecx
add ebx, ebx
jne 0x14046901a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140469034
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14046902d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14046901c
add ecx, 2
jmp 0x140469039
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140468f62
jmp 0x140468fad
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2e6600
mov dl, 0x86
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14046909d
cmp rsi, rcx
jae 0x1404690a5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140469084
cmp al, 0x8f
ja 0x140469084
cmp byte [rsi - 2], 0xf
je 0x14046908a
sub al, 0xe8
cmp al, 1
ja 0x14046906e
cmp rsi, rcx
jae 0x1404690a5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140469074
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1404690a5
lodsb al, byte [rsi]
jmp 0x140469084
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x460000]
mov eax, dword [rdi]
or eax, eax
je 0x14046910e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4695fc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1404690b2
jns 0x1404690e7
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1404690f1
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140469108
mov qword [rbx], rax
add rbx, 8
jmp 0x1404690d2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140469152
cmp al, 0xef
ja 0x14046913a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14046911a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140469129
mov eax, dword [rdi]
add rdi, 4
jmp 0x140469129
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x25f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1404691a6
sub rsp, 0xffffffffffffff80
jmp 0x1401640ac
Function at 0x14047c4ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x140978677
add byte [rax], al
add byte [rsi + 0x72], ah
add byte gs:[rsi - 0x7f], ah
and al, 0x70
and eax, 0x6c214c4c
and al, 0x78

Function at 0x140497c24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg dword [rsp + 0x28]
je 0x140961553
neg r14d
and dword [rsp + 0x38], 0x60c41d10
sub r8w, 0x4555
xor r14, qword [rsp + 0x28]
seto dil
mov qword [rsp + 0x28], 0x77c00604
lea r8, [r8*4 + 0x5fec7c34]
neg byte [rsp + 0x38]
not dil
mov byte [rsp + 0x60], 0x8c
ja 0x14049b72d
xor edi, 0x13205854
and word [rsp + 0x38], 0x5f7d
add qword [rsp + 8], 0x467337
lea r8, [rbp*8 + 0x65847d4]
and di, bp
test word [rsp + 0x60], r13w
setno r13b
neg r8b
setl r13b
call fcn.14049b701
lea r9, [r9 + r9*2 + 0x4cee0f72]
jns 0x1408cce0b
setle byte [rsp + 0x30]
movzx r13d, word [rsp + 0x68]
neg qword [rsp + 0x68]
neg dword [rsp + 0x68]
not di
mov r13w, word [rsp + 0x44]
neg bpl
add di, 0x49fb
not qword [rsp + 0x30]
mov edi, dword [rsp + 0x6b]
test dword [rsp + 0x68], 0x5798589c
mov rdi, qword [rsp + 0x78]
setns byte [rsp + 0x68]
sub byte [rsp + 0x30], bpl
add qword [rsp + 0x38], 0xbdb62
add dword [rsp + 0x30], 0x7fef07d1
sub byte [rsp + 0x40], 0x96
lea rbp, [r13*8 + 0x3f085f53]
mov qword [rsp + 0x68], r8
cmp r8, 0x157f287b
setl byte [rsp + 0x40]
cmp word [rsp + 0x30], bp
call fcn.1408a70d7
lodsb al, byte [rsi]
movsd dword [rdi], dword [rsi]
call [rdi + 0x3c]
invalid
neg r15d
setl sil
or r15, 0x2c042b1f
add qword [rsp + 8], 0xfffffffffff81f75
sub bx, si
jge 0x1408cce20
adc cl, byte [rbx - 0x13]
imul esp, dword [rdi + 0x77], 0xffffffec
movabs dword [0x8086a031e67a7a5f], eax
rcr dword [rcx - 0x60], 0x7a
adc al, 0xed
mov esp, 0x14800e5f
invalid
not r9d
sete r9b
test r9, r9
not r9d
pop r9
popfq
call fcn.1408ae385
movsx r15d, bl
pop r15
and si, si
jge 0x1408b1efa
jge 0x1408d43a5
neg bx
or si, 0x8b7
lea rsi, [rsi + rsi*4 + 0x3bfe652a]
not rsi
not si
or sil, sil
setg sil
movsx bx, si
ret 8

Function at 0x140499409
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 8], 0xffffffffbf694565
and r14, r15
lea rcx, [r15*4 + 0x144413b5]
mov rcx, qword [rsp + 0x10]
not dword [rsp + 0x20]
js 0x1408ef2a7
sub r13d, 0x59cb0fb6
je 0x1409741ca
call fcn.140994abc
xor r11, rcx
and r11b, r11b
or dword [rsp + 0x18], r11d
mov rdx, qword [rsp + 0x18]
test ecx, r11d
call fcn.140940b56
ror ch, 0xa9
jo 0x14097422b
adc eax, 0x468e00c3
test cl, al
sbb al, 0x8e
pop rcx
invalid
xlatb
xor esi, ecx
jo 0x140974299
hlt
push rdi
neg edi
push rcx
pop rbp
xor dword [rsp], eax
cmp esp, esp
sar dword [rax], 0xe8
invalid
std
pushfq
push rbp
insb byte [rdi], dx
or al, 0x76
jrcxz 0x14097423d
invalid

Function at 0x1404a4568
Capabilities:
Encode data using xor

Disassembly:
and al, 0x28
cmovno di, word [rsp + 0x21]
sub dword [rsp + 0x20], 0x6cb764a9
and edi, 0x293681f
xor qword [rsp + 8], 0x5f9d3bff
and qword [rsp + 0x20], 0x65d036ef
mov edi, r9d
movsx r9d, word [rsp + 0x24]
or r9w, 0x5d0f
lea rdi, [r9 + r9*8 + 0x5ea6e29]
and r9w, word [rsp + 0xa]
cmovne r9w, word [rsp + 0x23]
or word [rsp + 8], 0x7280
call fcn.1408d984d
jb 0x1404a4555
invalid
Function at 0x1404a9ec3
Capabilities:
Encode data using xor

Disassembly:
movabs r12, 0x3b1e729703b9329b
bswap r13
lea rbp, [r9*8 + 0x32780c22]

Function at 0x1404b08e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x1409a5afb
add byte [rcx], al
add byte [rax], al
add byte [rbp + 0x32], al
rol byte [rcx + 0xf], 0x9d
ror byte [rcx - 9], 0xd8
call fcn.140906969
mov r9d, 0x4e5d5bdf
mov rdx, qword [rsp + 0x28]
add qword [rsp], 0xffffffffbf722411
add qword [rsp + 0x10], 0xffffffffbf6ffa49
test r9, 0x80c6599
lea r9, [r9 + r9 + 0x26a776ac]
jge 0x14049ca1c

Function at 0x1404c6d71
Capabilities:
Encode data using xor

Disassembly:
movsx esi, byte [rsp + 0x3a]
lea rsi, [rsi + rsi + 0x2c502820]
push r15
not sil
push r11
push r12
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x30], 0x44f845ae
jno 0x1408edcef
xor byte [rsi + 0xf44f845], ch
or dword [rdx + 0x6f], 0x4d250042
hlt
and eax, 0x67e1f44d
sti
pop rbp
sti
int1
xor byte [rdx], dl
pop rsi
jge 0x1404c6d9a
invalid

Function at 0x140844d7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfq
or rdx, 0x3cbe6619
movabs r10, 0x23f16da252e421ce
jae 0x1409b4887
push r12
push r13
movabs r12, 0x170a31a161940e02
push r11
mov r11, r12
setb r12b
neg r11
push rdi
neg r12w
movabs rdi, 0x176d70d9146c0f1c
cmp r11b, 0x35
sets r11b
mov rdi, qword [rsp]
movabs r13, 0x29d1078727960dbe
lea r11, [r13*2 + 0x47855a64]
test r12w, 0x10ff
mov r12w, 0x32f0
not r13d
lea r13, [r12*4 + 0x2b471c4f]
not r11w
lea r13, [r12 + r12*8 + 0x2fad4fad]
mov r12d, 0x12962f68
setne r12b
bswap r12d
setne r13b
mov r11b, 0xf7
not r11w
test r12w, r12w
mov r12, qword [rsp + 0x18]
jae 0x1408428fa

Function at 0x140848246
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
mov r14, rbx
jle 0x1409a5687
push r8
movabs r8, 0x1a0941e9750d564c
movsx r14d, r14w
add qword [rsp + 0x10], 0xffffffffbf65a8a0
neg r14
je 0x140848248
mov bl, 0x82
setae r8b
not r14d
push r8
neg r14
neg rbx
movzx rbx, r14w
and qword [rsp], 0x6d45dfa
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0x693f9ee0
and dword [rsp], 0x653f3c64
and dword [rsp], r14d
setae r8b
neg r8d
cmp r14b, 1
not qword [rsp]
jno 0x1409a566a
xor cl, bl
pop rsi
invalid
xor r14d, dword [rsp + 2]
cmovns r14w, r8w
add qword [rsp + 0x20], 0xc013a
xor byte [rsp], 0x5d
movzx r14w, r8b
call fcn.14088669e
not r9d
movzx r9d, r9w
mov r9d, 0x56da70e2
push r15
call fcn.140925004
pop r8
lea rbp, [rbx + r11*2 + 0x28992e48]
not r11w
call fcn.1404c3f10

Function at 0x1408540b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 8], 0xfffffffffff84924
call fcn.1408ec2e4
Function at 0x140854102
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs r11, 0x2ef9257b3ea74a3c
lea r11, [r11 + 0x27e2641b]
push rdi
sub r11, 0x6ba3526c
mov rdi, r11
neg r11d
bswap r11
add r11b, 0x4d
jno 0x14097a19c
add r8, rdx
seto dl
xor di, 0x1637
add dil, dl
push rbx
test r15w, 0x3d40
sets r8b
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffffde000ad8
js 0x1404903e0
mov rdx, r15
movabs r8, 0x65a943536be248be
cmp r15d, 0x2d6d77b3
mov dx, 0x1b
not r15
lea r15, [rdx + rdi*2 + 0x780c719c]
jno 0x1404a9895
add dword [rsi - 0x16d0141c], esi
xor al, 0x2a
movabs al, byte [0x46ff27a05c4cba4d]
invalid

Function at 0x140888746
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdx
bswap r9d
mov rdx, qword [rsp + 0x10]
push r9