joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400273a0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x2a8
lea rcx, [rsp + 0x20]
call fcn.140008e80
mov rcx, rax
call fcn.140007b50
mov r8d, 0x104
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x21]
call fcn.140009330
mov rcx, rax
call fcn.140007b90
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.140004c10
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400016a0
nop
lea rcx, [rsp + 0x68]
call fcn.140006fe0
lea rcx, [rsp + 0x48]
call fcn.140029500
movzx eax, al
test eax, eax
je 0x14002744a
xor ecx, ecx
call fcn.140034f30
nop
lea rcx, [rsp + 0x48]
call fcn.140006fe0
add rsp, 0x2a8
ret

Function at 0x1400277f0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x2c8
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x14002791f
lea rcx, [rsp + 0x30]
call fcn.140008f70
mov rcx, rax
call fcn.140007670
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x80]
call fcn.1400048d0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140001580
nop
lea rcx, [rsp + 0x80]
call fcn.140006fb0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.140004400
nop
lea rcx, [rsp + 0xa0]
call fcn.14002a2b0
movzx eax, al
test eax, eax
je 0x140027907
lea rcx, [rsp + 0x31]
call fcn.1400096f0
mov rcx, rax
call fcn.1400076d0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140001180
mov qword [rsp + 0x58], rax
lea rdx, [0x1400026c0]
mov rcx, qword [rsp + 0x58]
call fcn.140007440
lea rcx, [rsp + 0xa0]
call fcn.140027670
nop
lea rcx, [rsp + 0xa0]
call fcn.14000baa0
nop
lea rcx, [rsp + 0x60]
call fcn.140006fb0
add rsp, 0x2c8
ret

Function at 0x1400297e0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x10
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14002982e
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.1400048d0
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x50]
jmp 0x14002985d
lea rcx, [rsp + 0x20]
call fcn.140008b40
mov rcx, rax
call fcn.140007870
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.1400048d0
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x14002e944
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e98e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e98e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e98e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e98e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e98e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e990
xor al, al
add rsp, 0x28
ret

Function at 0x140034f30
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140034d9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034d9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034d9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034d9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034d9b
cmp dword [rcx + 0x84], 0xe
jbe 0x140034d9b
cmp dword [rcx + 0xf8], 0
je 0x140034d9b
mov ecx, ebx
call fcn.140034e4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140034c28
nop
cmp dword [rbp + 0x20], 0
je 0x140034de9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140034df4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140034d2c
Function at 0x140041b14
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14002ded0
sub rsp, rax
mov rax, qword [0x140065100]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14003f5d0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140041b63
mov rax, rbp
jmp 0x140041c6b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x67300]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140042c34
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x67300]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140041c67
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140041c67
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140042c34
test rax, rax
js 0x140041c67
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140041c67
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140041c59
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140041c59
cmp byte [rcx], 0xd
jne 0x140041c3f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140041c4e
cmp byte [rcx + 1], 0xa
jne 0x140041c4e
inc rcx
jmp 0x140041c4e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x65530]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140041c21
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140041c6b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14002e490
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140041e8c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140041ea2
mov al, 1
jmp 0x140041f02
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140041eb3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140041f00
mov ecx, dword [rcx + 0x18]
nop
call fcn.140046fe0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140041f00
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140041f00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140041f00
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140041f02
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140041fd4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140067300]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14004202b
cmp word [rdx], r13w
jne 0x14004202b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140042030
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140042155
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140042176
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140042069
mov rdx, r9
mov word [rbx], cx
jmp 0x140042090
cmp r9, r8
jae 0x1400420a0
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14004204a
jmp 0x140042155
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004214a
cmp dword [rsp + 0x80], esi
je 0x14004214a
lea r8, [0x140067300]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140042122
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400420f2
mov word [rbx], r13w
jmp 0x140042152
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400420ff
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140042152
cmp word [rsp + 0x70], r13w
jne 0x14004212f
cmp rbx, r14
je 0x1400420ec
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140042c3c
cmp word [rsp + 0x70], r13w
je 0x140042155
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140067300]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14004214f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140042155
Function at 0x140046a24
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140046a54
xor eax, eax
jmp 0x140046b17
mov rbp, rbx
cmp word [rax], si
je 0x140046a79
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140046a60
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140046a5c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140044ffc
movsxd r14, eax
test eax, eax
jne 0x140046ab7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140046a4d
mov rcx, r14
call fcn.14003e524
mov rdi, rax
test rax, rax
jne 0x140046ad0
xor ecx, ecx
call fcn.14003e484
jmp 0x140046aac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140044ffc
test eax, eax
jne 0x140046b01
mov rcx, rdi
call fcn.14003e484
jmp 0x140046b0b
xor ecx, ecx
call fcn.14003e484
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140049534
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14003e124
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400495d5
cmp ebx, dword [rsp + 0x30]
je 0x1400495ce
test esi, esi
je 0x1400495ce
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400495a9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400495b6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140049593
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400495ba
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400495d7
mov eax, 1
jmp 0x1400495d7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004e0d0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140042c3c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140042c3c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14004e220
cmp rax, 0xffffffffffffffff
je 0x14004e220
xor edi, edi
test rbp, rbp
jle 0x14004e1cb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14003f9d8
mov rbx, rax
test rax, rax
jne 0x14004e158
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14004e1c1
mov edx, 0x8000
mov ecx, r14d
call fcn.14003b47c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14004138c
cmp eax, 0xffffffff
je 0x14004e1a1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14004e168
mov edx, r15d
mov ecx, r14d
call fcn.14003b47c
jmp 0x14004e1c1
cmp byte [rsi + 0x38], dil
je 0x14004e1b8
cmp dword [rsi + 0x34], 5
jne 0x14004e1b8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14004e1c1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14003e484
jmp 0x14004e234
jns 0x14004e234
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140042c3c
cmp rax, 0xffffffffffffffff
jne 0x14004e1ec
cmp byte [rsi + 0x30], dil
je 0x14004e234
mov edi, dword [rsi + 0x2c]
jmp 0x14004e234
mov ecx, r14d
call fcn.140046fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14004e234
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14004e234
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14004e22d
mov eax, dword [rsi + 0x2c]
jmp 0x14004e232
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140042c3c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14004ea40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14004ea68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14004ea68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14056f5fe
Capabilities:
Check http status code

Disassembly:
pop rbp
js 0x1405b7aab
mov ebx, 0x413fb20b
pop rcx
loope 0x14056f65b
rcr byte [rdi + rdx*2 + 0x4dc0429a], 0x18
adc dword [rbx - 0x261a53c1], ebp
scasd eax, dword [rdi]
jg 0x14056f5fd
xchg byte [rcx + riz*4], cl
mov edi, 0x53fdc2c3
shl dl, 0xa0
sar dil, 0x51
invalid
mov esp, 0x393ca63f
movsd dword [rdi], dword [rsi]
invalid

Function at 0x1405f147a
Capabilities:
Encode data using xor

Disassembly:
or edx, dword [rsp + 0x2c]
mov r11, qword [rsp + 0x28]
add qword [rsp], 0x9304d
mov byte [rsp + 0x28], 0x8e
add byte [rsp + 0x30], dh
or dl, dh
cmovo r11, qword [rsp + 0x28]
call fcn.140621a35
movabs dword [0x9f0f400875e6a78d], eax
setg dil
push rsi
setns r11b
test r11d, 0xe9c0c22
lea r11, [r9*8 + 0x27cb2ebf]
movabs rsi, 0x190e2cdf01a037b0
jo 0x140ac1722
xor esi, 0x4bb078a0
mov r14, r9
not rsi
add si, 0x6423
neg sil
neg r11w
push rbx
push r8
jle 0x140581ce7
or dword [rsp + 0x30], 0x692c1c13
jae 0x140b38dd0
movabs byte [0x507c586d68f6b184], al
pop rax
adc edi, dword [rax - 0x4384aa51]
invalid
invalid
mov word [rsp + 0x30], 0x22ab
mov rdx, qword [rsp + 0x50]
call fcn.140b407d7
push r9
pushfq
movabs r9, 0xc6c65f7096e00f5
test r9, r9
lea r9, [r9*4 + 0x257276b3]
push r11
movabs r11, 0x4e110ebb423d08a5
push r14
jg 0x1405ec4e8
test eax, 0x5e3e1ee5
adc byte [rbx + rcx + 0x454c25be], dh
stc
shr dword [rsi + rdi - 4], 0xe0
rol dword [rcx - 0x61], 0xa6
sbb dword [rsi + 0x67702da], edi
jle 0x140a9e2f8
scasd eax, dword [rdi]
invalid
xor word [rsp + 0x38], 0x2fd9
and byte [rsp + 0x38], 0xc6
test dl, 0xb5
sets dl
and qword [rsp + 0x30], 0x1a990a8d
xor word [rsp + 0x38], 0x11c
jge 0x140a9e31b
cmp byte [rsp + 0x38], 0xfe
not dx
jno 0x140b39391
or dword [rsp + 0x38], 0x10064f87
and byte [rsp + 0x30], dh
test qword [rsp + 0x30], 0x494e6ecd
jns 0x140a9e31b

Function at 0x1406184e4
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [rsp + 0x28], 0x26
not dword [rsp + 0x28]
and byte [rsp + 0x28], 0x7c
not dword [rsp + 0x28]
neg word [rsp + 0x18]
and byte [rsp + 0x18], 0x72
sub word [rsp + 0x28], 0x3ba4
seta byte [rsp + 0x18]
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.140b58c73
fadd dword [0x181322ed7]
invalid
Function at 0x14061ae73
Capabilities:
Encode data using xor

Disassembly:
push rbp
bswap r11
push 0x67c07b1c
push r8
push rcx
mov r14, r10
mov rbp, qword [rsp + 0x10]
and dword [rsp + 0x10], r10d
mov r10, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0xffffffffb8be7f32
movabs r8, 0x56d93d1156814217
sub r11, qword [rsp + 0x10]
push rdx
cmp r8w, word [rsp + 0x1c]
setno r11b
mov rcx, qword [rsp + 0x18]
lea r8, [r15 + rcx*8 + 0x6aae4e5d]
push r13
push rsi
and r14d, 0x7d90143b
push r9
neg r14b
setle byte [rsp + 0x30]
bswap r8d
movabs rsi, 0x561b6139346e788e
add qword [rsp + 0x58], 0xffffffffffe24da5
mov r11d, ecx
push r10
mov ebp, r8d
xor si, word [rsp + 0x3e]
lea rbp, [rcx + rbp*8 + 0x76aa043d]
jb 0x14061aef3
sub r15d, dword [rsp + 0x38]
jle 0x14061aec4
mov rbp, qword [rsp + 0x40]
neg r8w
sub word [rsp + 0x38], 0x1392
mov r13, qword [rsp + 0x38]
movabs rdx, 0x1cfb5dda749b586a
mov r9, rcx
add r14w, word [rsp + 0x38]
and r15d, 0x602574ee
test r9w, 0x177b
movzx r14, cx
mov r10, qword [rsp + 0x38]
pop r10
mov r9w, 0x6c1a
pop r9
mov r11, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov r13, qword [rsp + 8]
mov rsi, qword [rsp]
lea rsp, [rsp + 0x50]
ret

Function at 0x140a44dd2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dword [rsp + 0x38], 0x39743b80
seto byte [rsp + 0x38]
test word [rsp + 0x38], 0x36b4
mov dword [rsp + 0x38], 0xb8b79ea
mov byte [rsp + 0x38], 0xcf
not word [rsp + 0x38]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
call fcn.140c9c41f
sets r13b
add cx, 0x3769
movsx ecx, r13b
lea rcx, [rcx*4 + 0x2dfb10ad]
test r13w, 0x2dc6
call fcn.140b37251

Function at 0x140a90f53
Capabilities:
Encode data using xor

Disassembly:
ja 0x1405bc671
jno 0x140a90f95
movabs qword [0xe72a151def8329f4], rax
xor ah, byte [rax - 0x19]
invalid
sti
movabs dword [0x3c9fcdc718a6e210], eax
xor al, 0xf0
xchg edi, eax
push rdx
ror bh, 1
fsub dword [eax + 0x4d61af1b]
leave
or al, 0x67
mov byte [rbp + 0x2e], bl
xor eax, 0xb8b68305
cmpsb byte [rsi], byte [rdi]
jbe 0x140a90f9b
invalid
xor dword [rax + 0x5d3d350d], ebx
sar byte [rdi - 0x3f94caba], 0xf1
pop rdi
movabs ax, word [0xb2155288ee28ac]
push rsp
shl byte [rax + 0x2c94865b], 0xae
retf 0x152b

Function at 0x140ac8f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsi, [rsi + 0x1d662c6f]
bswap rsi
lea rsi, [rsi + 0x4d4c6c6c]
mov esi, 0x28130da1
sets sil
add di, 0x20ad
setle sil
test edi, 0x54044667
mov rsi, qword [rsp + 0x30]
movsx di, dil
sets dil
cmp rdi, 0xadd1f1c
jns 0x140b4439a
inc dword [rcx + 0xf]
xchg esp, eax
ror byte [rbx + 0xf0c2474], 0x8d
popfq
in eax, dx
movsd dword [rdi], dword [rsi]
inc dword [rcx + 0x55]
add qword [rsp + 0x28], 0xffffffffffac5d5d
add qword [rsp + 0x18], 0xffffffffffb9b6f7
lea rsp, [rsp + 0x18]
ret 8
add qword [rsp + 8], 0x26e4d
call fcn.140a47505
lea r10, [r10 + rbx*2 + 0x581c3a85]
mov rbx, qword [rsp + 0x20]
not word [rsp + 8]
not dword [rsp + 8]
lea rcx, [r10 + r10*4 + 0x57f2d2d]
pop r10
call fcn.140b4f23d
mov dh, 0x43
or al, cl
sbb al, 0x4f
cmp cl, cl
cmpsb byte fs:[rsi], byte [rdi]
jbe 0x140b443b6
loopne 0x140b4436f
lodsd eax, dword [rsi]
popfq
retfq
Function at 0x140ae6cbe
Capabilities:
Encode data using xor

Disassembly:
mov r13, qword [rsp + 0x20]
lea rdx, [rdx + rdx*8 + 0x1e4a489d]
neg rbp
call fcn.1406079aa
invalid
add bpl, 0x84
not ebp
movabs rsi, 0x53b345430ffd747b
not si
mov qword [rsp + 0x28], 0x1cbf4298
push r13
test si, 0x2415
movzx rsi, bpl
setae sil
not ebp
movabs r13, 0x78f301b0740e22a6
cmp r13b, 0x94
je 0x1405d26cb
movsx esi, bpl
add qword [rsp + 0x20], 0x4fa743
add r13w, 0x3598
lea rsi, [r13*4 + 0x55df1234]
test r13w, 0x19
movzx ebp, sil
not si

Function at 0x140ae8d01
Capabilities:
Encode data using xor

Disassembly:
mov r15b, 0x19
not dword [rsp + 0x18]
not r15
movsxd r15, r11d
not dword [rsp + 0x50]
lea r10, [r15*2 + 0x44282712]
mov r10, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
lea rsp, [rsp + 0x38]
ret 8
cmp r8b, byte [rsp + 0x15]
call fcn.140a501c9
not byte [rsp + 0x18]
bswap edx
lea r11, [rdx + rdx + 0x4c9e62fa]
push r10
mov r12, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0xffffffffd9ab6e73
jle 0x14062421b
test r11, 0x34b729cc
not byte [rsp + 0x20]
movabs r10, 0x18e57d606fe39b8
push r10
jo 0x140624225
neg r10
push r15
push rdx
mov r15, qword [rsp + 0x10]
and qword [rsp + 0x38], 0x55bd1d61
and word [rsp + 0x10], 0x1327
sub byte [rsp + 0x10], 0x4c
or r10w, word [rsp + 0x3c]
push r10
push r10
and dword [rsp + 0x10], 0x1b3835ea
xor rdx, r11
setg byte [rsp + 0x10]
mov rdx, qword [rsp + 0x38]
neg dword [rsp + 0x20]
cmp r10w, word [rsp + 0x4e]
seto r10b
xor r10d, dword [rsp + 8]
and word [rsp + 8], 0x52b
not r11w
or word [rsp + 8], 0x5c8
test r10, 0x58363ce9
call fcn.1405b0f67
cmovo r12d, dword [rsp + 9]
not byte [rsp + 8]
or r12, qword [rsp + 8]
test byte [rsp + 0xf], r12b
movsx r12d, byte [rsp + 0xc]
js 0x140ae427d
sub r12w, word [rsp + 0xd]
and qword [rsp + 8], r12
movsx r12d, word [rsp + 8]
neg r12w
xor byte [rsp + 8], 0xd2
or r12d, 0xbc25e14
mov r12w, word [rsp + 0xe]
setne byte [rsp + 8]
jbe 0x140ae8de3
bswap r12d
or r12, qword [rsp + 8]
xor dword [rsp + 8], r12d
mov byte [rsp + 8], 0xe7
test word [rsp + 0xb], r12w
mov r12b, byte [rsp + 0xc]
jns 0x140b148fd
scasd eax, dword [rdi]
xchg edx, eax
cmpsd dword [rsi], dword [rdi]
jmp 0x140ae8e86
invalid
cmp r12w, 0x1330
not r12b
not r12
cmovne r12d, dword [rsp + 9]
bswap r12d
not r12b
not dword [rsp + 8]
cmp r12, qword [rsp + 8]
mov r12, qword [rsp]
call fcn.140ad3f58
mov rbp, qword [rsp + 0x38]
or r13b, 0x26
setno cl
sets sil
cmp dx, 0x66da
lea r12, [r12 + rdx*2 + 0x78b53c7f]
movsx r13, word [rsp + 0x48]
setne cl
sub r13w, r13w
not dl
cmp dword [rsp + 0x48], edx
setge sil
call fcn.140b1ac2c
cld
xchg dword [rbp - 0x49], eax
jns 0x140b1494e
adc ecx, dword [rsi + 0x157f2a6d]
sbb eax, dword [rbx + rdx]
invalid