joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37fc7f170
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x37ffbcd70]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x37fc7f190
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x37fc7f198
ret
cmp word [r8 + 0x18], 0x20b
jne 0x37fc7f190
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x37fc7f1ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x37fc7f1e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x37fc7f190
add rax, 0x28
cmp rax, r9
jne 0x37fc7f1d0
xor eax, eax
ret

Function at 0x37fc7f1f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37ffbcd70]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x37fc7f20f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x37fc7f218
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x37fc7f20f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x37fc7f2b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x37ffbcd70]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x37fc7f2cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x37fc7f2d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000447c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x80
push rdi
call fcn.1400f9a87
mov ecx, dword [0x1400dc558]
xorps xmm0, xmm0
mov dword [rbp - 0x38], ecx
mov rdi, rax
mov cl, byte [0x1400dc55c]
mov byte [rbp - 0x34], cl
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movsd xmm0, qword [str.ubjk]
movsd qword [rbp - 0x40], xmm0
test cl, cl
je 0x1400044ff
xor r8d, r8d
lea r9, [rbp - 0x40]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1400044d8
and dword [rsp + 0x20], 0
lea rdx, [rbp - 0x40]
mov r9d, 3
lea rcx, [rbp - 0x30]
mov r8d, 0x401fffff
call fcn.140006d77
cmp al, 0x48
and dword [rbp - 0x40], 0
lea r9, [rbp + 0x10]
and dword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
and qword [rbp + 0x10], 0
xor r8d, r8d
mov byte [rbp - 0x34], 0
lea ecx, [r8 + 1]
call fcn.140316256
cld
mov rax, qword [rbp + 0x10]
xor r9d, r9d
and qword [rsp + 0x30], 0
mov rcx, rdi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea edx, [r9 + 6]
lea r8d, [r9 + 4]
push rax
call fcn.14031b92b
mov rcx, qword [rbp + 0x10]
mov ebx, eax
push rax
call fcn.1402da30d
mov rcx, rdi
call fcn.1402abd92
invalid
Function at 0x140004bcc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1358]
mov eax, 0x1430
call fcn.140086d40
sub rsp, rax
movsxd r12, edx
mov r13, rcx
movups xmm0, xmmword [0x1400dc900]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [0x1400dc910]
movups xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [0x1400dc920]
movups xmmword [rbp - 0x80], xmm0
movsd xmm1, qword [0x1400dc930]
movsd qword [rbp - 0x70], xmm1
mov eax, dword [0x1400dc938]
mov dword [rbp - 0x68], eax
movzx eax, word [0x1400dc93c]
mov word [rbp - 0x64], ax
mov al, byte [0x1400dc93e]
mov byte [rbp - 0x62], al
xor r8d, r8d
lea r9, [rsp + 0x60]
lea esi, [r8 + 1]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
add r8d, esi
add r9, rsi
cmp r8d, 0x3f
jl 0x140004c57
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140004c9b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140001c5c
nop
call fcn.140063cf0
mov r11d, 0xffffffff
mov dword [rbp + 0x1324], r11d
mov dword [rbp - 0x5c], eax
mov rdx, rsi
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x5c], eax
add rdx, rsi
cmp rdx, r8
jb 0x140004cd3
mov dword [rbp - 0x60], r8d
lea r14, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 0x10
cmovae r14, r9
mov rcx, qword [rsp + 0x30]
add r14, rcx
lea rdi, [rsp + 0x20]
cmp r10, 0x10
cmovae rdi, r9
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov eax, 0x40
sub rax, rsi
shr rbx, 1
cmp rbx, r11
ja 0x140004d2c
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
cmp rdi, r14
je 0x140004d86
lea rbx, [rdi + 1]
cmp rbx, r14
je 0x140004d86
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x48]
call fcn.14000dcdc
cmp rax, rsi
je 0x140004d6c
mov dl, byte [rbx]
mov cl, byte [rax + rdi]
mov byte [rbx], cl
mov byte [rax + rdi], dl
inc rbx
inc rsi
cmp rbx, r14
jne 0x140004d4f
mov r10, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
and qword [r13 + 0x10], 0
and qword [r13 + 0x18], 0
mov r8, r12
cmp rcx, r12
cmovb r8, rcx
lea rdx, [rsp + 0x20]
cmp r10, 0x10
cmovae rdx, r9
mov rcx, r13
call fcn.140001c5c
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140004df1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004dec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004e15
call fcn.140086660
mov rax, r13
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14008d444
int3
Function at 0x1400085e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000860e
xor eax, eax
jmp 0x1400086f4
cmp qword [rcx + 0x68], 0
je 0x14000861f
call fcn.1400092c8
jmp 0x1400086f4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140008636
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008638
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000866a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400886b0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400086ee
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400086a1
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400086ca
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140093aa0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400086ee
cmp rsi, rbx
ja 0x1400086a8
test rsi, rsi
je 0x1400086ee
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140093aa0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000dcdc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov r14, rdx
lea rdi, [rdx - 1]
mov rsi, rcx
mov r15d, 0x7fffffff
mov r12d, 0x9908b0df
xor r10d, r10d
xor r11d, r11d
test rdi, rdi
je 0x14000deaa
mov cl, byte [rsi + 8]
add cl, 0xff
shl r10, cl
add r10, r10
mov r9, qword [rsi]
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x14000dd77
lea r8, [r9 + 8]
mov ebx, ecx
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r15d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r12d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub rbx, 1
jne 0x14000dd3a
mov ecx, dword [r9]
jmp 0x14000de41
cmp ecx, 0x4e0
jb 0x14000de41
lea rbx, [r9 + 0x9c4]
mov ebp, 0xe3
mov eax, dword [rbx]
lea r8, [rbx + 4]
mov edx, dword [r8]
xor edx, eax
and edx, r15d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, r12d
xor ecx, dword [rbx + 0x634]
xor ecx, edx
mov dword [rbx - 0x9c0], ecx
lea rbx, [r8]
sub rbp, 1
jne 0x14000dd91
lea rbx, [r9 + 0xd50]
mov ebp, 0x18c
mov eax, dword [rbx]
mov edx, eax
lea r8, [rbx + 4]
xor edx, dword [r8]
and edx, r15d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, r12d
xor ecx, dword [rbx - 0xd4c]
xor ecx, edx
mov dword [rbx - 0x9c0], ecx
lea rbx, [r8]
sub rbp, 1
jne 0x14000ddd4
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, r15d
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r12d
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor ecx, ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, qword [rsi + 0x10]
ja 0x14000dd26
mov cl, byte [rsi + 8]
or r10, rax
add cl, 0xff
shl r11, cl
add r11, r11
or r11, qword [rsi + 0x10]
cmp r11, rdi
jb 0x14000dd1a
xor edx, edx
mov rax, r11
div r14
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, r10
div r14
cmp rax, rcx
jb 0x14000dece
cmp r8, rdi
jne 0x14000dd0b
mov rbx, qword [rsp + 0x20]
mov rax, rdx
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140017db0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x140017a4b
movzx ecx, byte [rbx]
call fcn.140028b30
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140017a30
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140017de6
call fcn.140029c30
test al, al
jne 0x140017de6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140018080
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140017a10
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140048570
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x1400485ac
lea rdx, str.Couldnt_set_desired_mode
call fcn.140022df0
lea eax, [rdi + 0x11]
jmp 0x140048604
cmp edx, 0xc8
je 0x1400485c3
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.140022ed0
cmp esi, 0x13
jne 0x1400485d5
mov rdx, rbp
mov rcx, rbx
call fcn.140048250
jmp 0x140048600
cmp esi, 0x14
jne 0x1400485e4
mov rcx, rbx
call fcn.1400471a0
jmp 0x140048600
cmp esi, 0x15
jne 0x1400485f3
mov rcx, rbx
call fcn.140048240
jmp 0x140048600
cmp esi, 0x16
jne 0x140048602
mov rcx, rbx
call fcn.140048450
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005cd30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14005cd72
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14005cdb9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14005ce12
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x14005cdd0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14005ce53
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400cc2bc]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400cc2bd]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14005ce20
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ae0b4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x1400ae10c
je 0x1400ae103
mov eax, 0xc433
cmp ecx, eax
ja 0x1400ae0e7
je 0x1400ae103
mov eax, ecx
sub eax, 0x2a
je 0x1400ae103
sub eax, 0xc402
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
cmp eax, 3
jmp 0x1400ae101
mov eax, ecx
sub eax, 0xc435
je 0x1400ae103
sub eax, 0x1263
je 0x1400ae13f
sub eax, 0x812
je 0x1400ae103
cmp eax, 1
jne 0x1400ae105
xor edx, edx
call fcn.140260608
std
mov eax, ecx
sub eax, 0xdead
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 1
je 0x1400ae103
sub eax, 0x1f35
je 0x1400ae103
cmp eax, 1
jne 0x1400ae105
and edx, 8
jmp 0x1400ae105

Function at 0x1400bb1e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400bb208
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400bb208
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140116870
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14011688d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401168e8
test al, 7
jne 0x140116880
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401168a1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140116912
test dh, dh
je 0x14011690c
shr rdx, 0x10
test dl, dl
je 0x140116906
test dh, dh
je 0x140116900
shr rdx, 0x10
test dl, dl
je 0x1401168fa
test dh, dh
je 0x1401168f4
shr edx, 0x10
test dl, dl
je 0x1401168ee
test dh, dh
jne 0x1401168a1
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x14017788f
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x495d51d3
movabs rbp, 0x7da46a4651d0504f
add ecx, 0x543a1f5c
je 0x140177894
neg cx
neg rbp
mov rbp, qword [rsp + 8]
insb byte [rdi], dx
and al, 8
add rcx, 0x5e0c3470
xor rcx, 0x798f034b
js 0x1405cfc3b
call fcn.1402937f4
cmpsb byte [rsi], byte [rdi]
sti
jl 0x1401778bb
in al, dx
mov cl, 0xaa
invalid
mov r9d, 0x219f1020
push rcx
mov rcx, r9
call fcn.1404574d9
fsub st(0), st(0)
enter 0xffffffffffffdec1, 0xffffffffffffffff
mov gs, eax
stc
invalid

Function at 0x1401a1f54
Capabilities:
Encode data using xor

Disassembly:
push 0x41c90f49
mov cl, 0x4f
push r15
pushfq
movabs r15, 0x36dc778c320f7ebb
xchg qword [rsp + 0x18], rdi
add qword [rsp + 0x10], 0xffffffffbfd4c433
not r15
call fcn.140381320
adc ebx, dword [rdx - 0x59]
fidivr word [rbp - 0x6f]
and byte [rax + 0xb], 0xd6
xor eax, 0x32749e7e
adc dword [rdi], ecx
popfq
je 0x1401a1f48
test eax, 0x30b60c6
fldl2t
invalid
Function at 0x140222d3e
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs rdi, 0x75d4025648f62952
mov rcx, rdi
call fcn.1400faf00
mov r11, qword [rsp]
test qword [rsp + 0x28], 0x472d29f9
call fcn.1402ea836
sub byte [rax], al
mov rbp, qword [rsp + 0x48]
cmp byte [rsp + 0x58], 0xeb
call fcn.14035b838
jb 0x1401741ab
xchg qword [rsp + 0x30], rcx
or dword [rsp + 0x20], 0x1da60eca
push r11
movabs r11, 0x6c9f542413072678
mov qword [rsp + 0x28], 0x43937752
jae 0x1401d6860
invalid
xchg esp, eax
sahf
in eax, dx
loop 0x140222d8d
jle 0x140222d4e
fsubr st(2), st(0)
push rbx
push 0x2e
invalid
loop 0x140222d28
movabs byte [0xcc1d26d1cde6e2c3], al
invalid

Function at 0x140228e53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
sub dword [rsp + 0x18], 0x6b0d40ac
mov qword [rsp + 8], 0x174338f3
test byte [rsp + 8], 0x76
push r12
movabs r12, 0x571a7c0b18e70135
push rdx
not byte [rsp + 0x28]
movzx r12d, word [rsp + 0x2c]
lea rbx, [rbx + r12 + 0x3d12514a]
not r12
jg 0x14034df11

Function at 0x140229587
Capabilities:
Encode data using xor

Disassembly:
sets dl
and edx, edx
xor edx, 0x69672763
mov rdx, qword [rsp + 0x18]
call fcn.1402b9e42
invalid

Function at 0x1402b42e2
Capabilities:
Encode data using xor

Disassembly:
cwde
ret 0x5741
push rcx
jle 0x1402b42e1
add bh, bh
je 0x1402b42f5
sub byte [rbp + 0x24648d48], bl
xor al, ch
mov al, 0xe7
sub dword [rax], eax
add bh, dh
pop rsp
and al, 0x68
neg dword [rsp + 0x68]
test word [rsp + 0x6a], r8w
mov r8, qword [rsp + 0x88]
movzx rcx, byte [rsp + 0x78]
movzx ecx, byte [rsp + 0x78]
call fcn.140185859
ja 0x1402b42ca
int 0x19
fdiv st(7), st(0)
jg 0x1402b42a7
sbb edi, edx
retf

Function at 0x1402ba4cc
Capabilities:
Encode data using xor

Disassembly:
jns 0x1402b589c
mov r8, qword [rsp + 0x50]
mov dword [rsp + 0x58], 0x2af50145
neg dword [rsp + 0x38]
test qword [rsp + 0x58], 0x4a59067e
call fcn.1402ece92

Function at 0x1402d3f0d
Capabilities:
Encode data using xor

Disassembly:
mov r15, qword [rsp + 0x20]
ja 0x140236f29

Function at 0x1402eb86a
Capabilities:
Encode data using xor

Disassembly:
sub r10w, 0x6160
setle byte [rsp + 0x58]
add qword [rsp + 0x58], 0x4df3584d
movzx r10, byte [rsp + 0x50]
push rsp
and al, 0x50
mov r10, qword [rsp + 0x20]
call fcn.1402fc8bd
movabs qword [0x7ad09ae63b1b9c8c], rax
mov ecx, 0xfc3347bc
xor ecx, dword [rcx - 0x33]
in al, dx
sub ebp, dword [rdi]
loop 0x1402eb881
sti
cmpsd dword [rsi], dword [rdi]
cwde
invalid

Function at 0x14034d879
Capabilities:
Encode data using xor

Disassembly:
call 0x1401b43bf
pop rdx
adc dword [rsi + 0x707bc995], 0xffffff8f
add eax, 0x69a28a8f
pop qword [0x1a9d7631b]
int1
scasb al, byte [rdi]
out 0x95, al
xchg edx, eax
xor dword [rbp + rbp + 0x40dfc58e], esi
ror byte [rdi + 0x17112bf3], 0x8e
ja 0x14034d886
in al, dx
mov ch, byte [rcx + 0x5a]
adc cl, dh
mov bh, 0x96
inc byte [rdi - 0x5e]
invalid
Function at 0x1403d4abb
Capabilities:
Encode data using xor

Disassembly:
xor byte [rsp + 0x10], r13b
mov r13, qword [rsp + 0x80]
test dword [rsp + 0x10], ebx
jo fcn.1403c893e
test ebx, 0x28f276c9
not byte [rsp + 0x58]
mov r9, qword [rsp + 0x38]
setb dl
call fcn.1403d93ff
mov rdx, qword [rsp + 0x58]
lea rdx, [r11 + 0x1eca751a]
mov qword [rsp + 0x28], 0x423e696b
jb 0x1401d06be

Function at 0x140411db0
Capabilities:
Encode data using xor

Disassembly:
add al, byte [rax]
mov qword [rsp + 0x78], r8
call fcn.1403a6554
sbb esp, dword [r9d]
xor al, 0x94
jl 0x140411d88
je 0x140411dec
push rsp
mov ch, 0x3b
or ebx, dword [rbp - 0x2c]
invalid
or edi, dword cs:[rdi]
or ebx, dword [rdx + 0x74c1f562]
invalid

Function at 0x14041d1bb
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
lea rbx, [rbx + 1]
movabs rdi, 0x76134b67ae77db8
push 0x7de49bb
pushfq
sub rdi, 0x1dde4438
add qword [rsp + 0x20], 0xfffffffffff2745b
movzx edi, byte [rsp + 9]
mov qword [rsp + rdi*4 - 0xe4], rbx
xor di, word [rsp + 0xe]
call fcn.1403c1cd5

Function at 0x14042a636
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor qword [rsp + 0xb0], 0x27116d6c
jg 0x14044bd9f
jle 0x140228e41
mov r15, qword [rsp + 0xb8]
test qword [rsp + 0x78], 0x5fc55aac
call fcn.140257d2c

Function at 0x14046879d
Capabilities:
Encode data using xor

Disassembly:
wait
adc eax, 0x87480b78
and al, 0x18
pushfq
neg r11b
call fcn.140299dde
call fcn.14022c919
push rcx
js 0x140468756
wait
jb 0x1404687f4
xchg byte [rdi + 0x5dceeed7], ah
push rdx
test al, 0xa2
in al, dx
xchg ebx, eax
pop rax
cmp byte [rdi - 0x385dc7c3], ah
movabs byte [0x58ec2e47b8546b80], al
clc
invalid
out dx, al
invalid
pop rax
mov eax, 0x54ec5435
clc
movsd dword [rdi], dword [rsi]
cli
jge 0x1404687ab
xbegin 0x137f28b91
cwde
add ebp, dword [rdi + rsi*8 - 0x687d3268]
int 0x82
xchg edi, eax
test eax, 0x4183b03a
mov esi, ebx
pop rsi
mov edi, 0x4f743c63
cmp dword [rbp + 0x306d3698], ecx
add byte [rbx - 0x69], cl
xor byte [rax], al
xchg r15, rax
xor dword [rbp + 0x64d51243], 0xffffff9d
jg 0x140468808
je 0x140468806
cwde
xlatb
xchg ebx, eax
ja 0x14046881b
out 0x8c, al
wait
jmp 0x140468852
jnp 0x140468859
jne 0x140468802
int 0xeb
sal byte [rdx], 1
lahf
mov ecx, gs
invalid
xor bl, byte [rdi - 0x71291674]
xor edi, dword [rbx - 5]
xchg esp, edi
or byte [rsi + 0x6ced1331], dh
xchg esi, eax
push rax
add eax, 0x95cfff37
add dword [rbp + 0x4f69d46], 0xffffffb9
cmpsb byte [rsi], byte [rdi]
test ebx, ecx
mov edx, 0x7118f3ef
mov bh, 0xde
adc eax, eax
invalid

Function at 0x140473bda
Capabilities:
Encode data using xor

Disassembly:
push r8
seto sil
jno 0x14038c010

Function at 0x14047ec10
Capabilities:
Encode data using xor

Disassembly:
push r10
lea rax, [rax + 0x5b584fe1]
mov r10, rcx
not r10
push rbp
mov rbp, qword [rsp + 0x18]
xchg qword [rsp + 0x30], rax
mov bp, word [rsp + 0x1d]
push rcx
jle 0x14044c2a7
push rcx
add qword [rsp + 0x20], 0xffffffffbfba7bd4
bswap r10d
xor qword [rsp], 0x1a5e153b
call fcn.1403be08c
call fcn.1401d9269
Function at 0x14052547e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
push rbp
push r12
xchg rdi, rdi
pushfq
rcl dil, cl
cmp r10d, 0x56a3184c
push r15
rcl dil, 0xdb
push r8
sub bl, 0xaa
mov r11, 0x3635475c
bswap edi
push r10
and r10b, 0xef
dec r11w
add r11w, 0x3981
push rcx
bt edi, ecx
adc bl, 0xbe
push rax
movsx r10d, r13w
push rdx
movabs rcx, 0
inc r11b
rol dil, 0x89
rcr bl, 0xd0
push rcx
rdtsc
shrd edx, r11d, 0xea
mov r11, qword [rsp + 0x90]
sub rdx, 0x6a8e47d3
shl bx, 0xd
xor r11d, 0x59635fde
rol r11d, 2
cqo
not r11d
rcl r10d, cl
rdtsc
btr rax, 0x81
ror r11d, 1
xor r11d, 0x21d902d9
adc eax, eax
sub bh, 6
add r11, rcx
stc
rcl edx, 0x19
rdtsc
movabs rax, 0x100000000
add r11, rax
mov r10, rsp
movzx dx, r10b
sub rsp, 0x180
bts bx, r8w
sal dil, cl
xadd di, di
and rsp, 0xfffffffffffffff0
mov rbx, r11
mov dh, bl
xor dh, 0x71
rcr dl, 0x7e
movabs rdx, 0
shl di, 0xb7
sub rbx, rdx
movsx edi, cx
lea rdi, [0x1404e56d7]
rcl dh, 0x45
adc rdx, r11
sub r11, 4
bt dx, r12w
shld dx, di, 0xdc
mov edx, dword [r11]
test rsi, 0x37074ecd
xor edx, ebx
neg edx
cmp r13, 0x426b4306
test dh, 0xcd
xor edx, 0x2ec94c2f
stc
not edx
cmp r14d, edx
test r10w, r11w
add edx, 0x26dc0de7
push rbx
xor dword [rsp], edx
movzx rbx, r10w
pop rbx
movsxd rdx, edx
test dl, r9b
cmp bh, cl
add rdi, rdx
jmp 0x14055dd62
push rbx
not bh
bswap ebx
mov bl, r12b
push r13
mov bx, r13w
movsxd rbx, r8d
push r14
not bl
mov bx, 0x3fb8
push rdi
jmp 0x140595091
jmp rdi
push r9
push r11
jmp 0x1404e55e5