joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f7f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14005f84d
lea rbx, [0x140180470]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14005f834
cmp r10, 2
jb 0x14005f834
cmp byte [r9], r8b
jne 0x14005f834
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14005f810
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14005f88f
lea rbx, [0x140180470]
cmp r8b, 0x23
jne 0x14005f873
cmp byte [r9], r8b
jne 0x14005f873
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14005f860
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140063d30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
xor eax, eax
lea r8, [0x140191b25]
mov dword [rsp + 0x2c], eax
lea r11, [0x140180470]
mov qword [rsp + 0x38], rax
mov r10d, 0xffffffff
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x140063d86
cmp byte [r8], r9b
jne 0x140063d86
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140063d73
mov ecx, dword [rbx + 0x302c]
lea rax, [0x140070940]
mov edi, dword [rbx + 0x3028]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1400709d0]
mov qword [rsp + 0x40], rax
lea rax, [0x140070ac0]
mov qword [rsp + 0x48], rax
lea rax, [0x140070ba0]
mov qword [rsp + 0x50], rax
lea rax, [0x140070cf0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x140063ea6
inc edi
test ecx, ecx
je 0x140063e0a
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140063e0f
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x140063ea6
mov rax, qword [0x1401bb440]
mov qword [rsp + 0x80], rsi
test rax, rax
je 0x140063e36
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*8]
shl rcx, 3
call qword [0x1400e88f0]
mov rdx, qword [rbx + 0x3030]
mov rsi, rax
test rdx, rdx
je 0x140063e91
movsxd rcx, dword [rbx + 0x3028]
lea r8, [rcx + rcx*8]
mov rcx, rax
shl r8, 3
call fcn.1400dff23
mov rcx, qword [rbx + 0x3030]
test rcx, rcx
je 0x140063e8b
mov rax, qword [0x1401bb440]
test rax, rax
je 0x140063e8b
dec dword [rax + 0x3bc]
call qword [0x1400e88d8]
mov qword [rbx + 0x3030], rsi
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x302c], edi
movsxd rax, dword [rbx + 0x3028]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*8]
mov rax, qword [rbx + 0x3030]
movups xmmword [rax + rcx*8], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + rcx*8 + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movups xmmword [rax + rcx*8 + 0x30], xmm1
movsd qword [rax + rcx*8 + 0x40], xmm0
inc dword [rbx + 0x3028]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140065690
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1400656e0
lea r11, [0x140180470]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400656c3
cmp byte [r8], r9b
jne 0x1400656c3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400656b0
mov rcx, qword [0x1401bb440]
not eax
movsxd rdx, dword [rcx + 0x1a68]
mov r9, qword [rcx + 0x1a70]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x140065741
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x140065739
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x14006573c
mov rdx, r8
test rdx, rdx
jne 0x140065710
cmp r9, r10
je 0x140065750
cmp dword [r9], eax
jne 0x140065750
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x14006ab60
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1401bb440]
lea rdx, [0x140180470]
mov r8, rcx
mov rbx, qword [rax + 0x1a80]
add rbx, 0xc0
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14006ac61
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14006ac4d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14006ac52
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140071b20
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007bab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14007bc41
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14007bb20
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14007b470
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14007aac0
mov dword [rbx + 0x80], 0
jmp 0x14007bc2d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.140079970
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008eeb0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [0x1400e8208]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x20]
call fcn.1400dff29
lea rcx, [rbp - 0x20]
call fcn.140034e30
nop
lea rdx, [rbp + 0xf0]
lea rax, [rbp + 0xf0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14008ef30
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x20]
call fcn.140010650
nop
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
mov r8d, 0x21
lea rcx, [rbp - 0x10]
call fcn.140034fb0
xor r8d, r8d
test rax, rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x20]
je 0x14008ef99
add rcx, rax
xor edx, edx
call qword [0x1400e84d8]
jmp 0x14008efa8
add rcx, rax
mov edx, 2
call qword [0x1400e83a8]
nop
lea rcx, [rsp + 0x20]
call fcn.14000cfc0
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp - 0x20]
call qword [0x1400e8500]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call qword [0x1400e8508]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [0x1400e8500]
mov rcx, qword [rsp + 0x58]
add rcx, qword [rsp + 0x50]
call fcn.1400de638
mov rbx, rax
mov r8, qword [rsp + 0x50]
add r8, qword [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [0x1400e84f0]
mov r8, qword [rsp + 0x50]
add r8, qword [rsp + 0x58]
mov byte [rsp + 0x70], 0
mov qword [rbp - 0x4c], rsi
mov dword [rbp - 0x44], 0x67452301
mov dword [rbp - 0x40], 0xefcdab89
mov dword [rbp - 0x3c], 0x98badcfe
mov dword [rbp - 0x38], 0x10325476
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14008c490
lea rcx, [rsp + 0x70]
call fcn.14008c560
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14008c7d0
mov rcx, rbx
call fcn.1400de0e0
nop
mov rcx, qword [rbp - 0x20]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rdx - 0x20], rax
mov rcx, qword [rbp - 0x20]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xb0]
mov dword [rbp + rdx - 0x24], r8d
lea rcx, [rbp - 0x10]
call fcn.14000a800
lea rcx, [rbp - 8]
call qword [0x1400e84e8]
lea rcx, [rbp + 0x90]
call qword [0x1400e83d0]
mov rax, rdi
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1400de0c0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009a210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r10, dword [rcx + 0x3c4]
mov rsi, rdx
xor edx, edx
mov rax, r9
div r10
xor r14d, r14d
mov r15, r9
mov rdi, r8
mov rbx, rcx
test rax, rax
je 0x14009a2ce
mov qword [rsp + 0x40], rbp
nop
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140099df0
mov ecx, dword [rbx + 0x3c4]
xor edx, edx
mov rax, rdi
test ecx, ecx
jle 0x14009a297
lea r8, [rbx + 0x3ec]
sub r8, rdi
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3c4]
cmp edx, ecx
jl 0x14009a280
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3ec]
call fcn.1400dff23
movsxd rcx, dword [rbx + 0x3c4]
xor edx, edx
mov rax, r15
inc r14d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r14d
cmp rcx, rax
jb 0x14009a250
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14009a930
Capabilities:
Access peb ldr_data
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.1400def00
sub rsp, rax
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0xf70], rax
mov r15, rcx
mov rbx, r8
lea rcx, [0x140192a10]
mov r14, rdx
jmp 0x140c3865e

Function at 0x14009ad60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15, rcx
xor r13d, r13d
lea rcx, [0x140192a60]
jmp 0x140c39576

Function at 0x14009feab
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [r13*4 + 0x471e313a]
mov r13, qword [rsp + 0x30]
add qword [rsp + 0x20], 0xffffffffbfe2cc14
movabs rdx, 0x26100f502acd040c
mov edx, 0x2acd040c
push rax
movups xmm4, xmmword [rsi]
add edx, 0x2a6021ef
add qword [rsp + 0x18], 0x8f4523
and cl, cl
sete dl
xor cl, 0xd8
mov rcx, qword [rsp + 8]
call fcn.1400be5a5
cdqe
leave
add al, 0x46
mov dl, cl
add al, 0x3d
js 0x14009fec2
add al, 0x35
push 0x742d04cc
movabs byte [0xa0342d09a1642d09], al
or dword [0x15813990e], ebp
invalid
Function at 0x1400bca90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rdx
mov r13, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rcx, [0x140193060]
jmp 0x140c4fc52

Function at 0x1400bf190
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
movaps xmmword [rsp + 0x1d0], xmm6
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rsi, rdx
mov qword [rsp + 0x58], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
lea rcx, [0x140193100]
jmp 0x140c5390c

Function at 0x1400bfab0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rsi, rdx
mov qword [rsp + 0x68], rdx
mov rbx, rcx
mov qword [rbp - 0x40], rdx
xor r15d, r15d
lea rcx, [0x1401930e0]
jmp 0x140c5482a

Function at 0x1400c0270
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0x10], rdx
xor r15d, r15d
lea rcx, [0x140193110]
jmp 0x140c5542e

Function at 0x1400ca940
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x15
syscall
ret

Function at 0x1400ca94b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x16
syscall
ret

Function at 0x1400ca956
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x17
syscall
ret

Function at 0x1400ca961
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x18
syscall
ret

Function at 0x1400ca970
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xc
syscall
ret

Function at 0x1400ca97b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xd
syscall
ret

Function at 0x1400ca986
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xe
syscall
ret

Function at 0x1400ca991
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xf
syscall
ret
Function at 0x1400cda30
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1b
syscall
ret

Function at 0x1400cda3b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1c
syscall
ret

Function at 0x1400cda46
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1d
syscall
ret

Function at 0x1400cda51
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1e
syscall
ret

Function at 0x1400cda60
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret

Function at 0x1400cda6b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x24
syscall
ret

Function at 0x1400cda76
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x25
syscall
ret

Function at 0x1400cda81
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x26
syscall
ret

Function at 0x1400cda90
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x16
syscall
ret

Function at 0x1400cda9b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x17
syscall
ret

Function at 0x1400cdaa6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x18
syscall
ret

Function at 0x1400cdab1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x19
syscall
ret

Function at 0x1400cdac0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3c
syscall
ret

Function at 0x1400cdacb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3d
syscall
ret

Function at 0x1400cdad6
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3e
syscall
ret

Function at 0x1400cdae1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x1400cdaf0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x37
syscall
ret

Function at 0x1400cdafb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x38
syscall
ret

Function at 0x1400cdb06
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x39
syscall
ret

Function at 0x1400cdb11
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x1400df110
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400e8050]
test rax, rax
je 0x1400df15a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400df15a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400df15a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400df15a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400df15a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400df15c
xor al, al
add rsp, 0x28
ret
Function at 0x1401cf550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401cf57c
xor al, al
jmp 0x1401cf6a0
movdqa xmm0, xmmword [0x1401efae0]
movdqa xmm1, xmmword [0x1401efaf0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1401efb00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1401efb10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1401cf692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401cf5f9
mov r11d, 2
jmp 0x1401cf61d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401cf613
mov r11d, 1
jmp 0x1401cf61d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1401cf6b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401cf65a
mov byte [rcx + 2], 0x3d
jmp 0x1401cf66a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1401cf67c
mov byte [rcx], 0x3d
jmp 0x1401cf683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1401cf5e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1401cf69b
Function at 0x140332d5e
Capabilities:
Encode data using xor

Disassembly:
and word [rsp + 0x10], 0x2b6b
ja 0x1401d33fd
int1
invalid

Function at 0x14047d808
Capabilities:
Encode data using xor

Disassembly:
and al, ch
xor al, 0x75
jno fcn.14047d808
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x30]
call fcn.140b92d06
cmpsd dword [rsi], dword [rdi]
jb 0x14047d802
js 0x14047d7f9
or dword [rcx + rcx*4], edx
xor al, 0xb6
adc esp, ebx
invalid

Function at 0x1404af9b0
Capabilities:
Encode data using xor

Disassembly:
or dl, 0xc5
mov r14, qword [rsp + 0x10]
add qword [rsp + 8], 0xffffffffbf6bfe65
and edx, 0x3d1333d7
jg 0x140a39125
add qword [rsp], 0xffffffffffdbb9d6
neg r12d
xor r12d, r12d
mov r12, qword [rsp + 0x10]
movabs r10, 0x204b356d6b8b5414
not r10d
xor r10b, r10b
neg r10
sete r10b
xor r10b, 0x28
mov r10, qword [rsp + 8]
jo 0x1404af9dc
call fcn.1400be621
call fcn.140ab5efc

Function at 0x1405c66c4
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.140ba5751
mov dl, 0xd3
in al, dx
je 0x1405c6707
invalid
invalid

Function at 0x14060c696
Capabilities:
Encode data using xor

Disassembly:
add r8d, r8d
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
cmp word [rsp + 0x18], 0x9a1
jae 0x14038dae2
push rsp
xor dword [rdi + 0x2cfc433f], ebx
invalid

Function at 0x14066b12c
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x10]
and al, 0x10
popfq
lea rsp, [rsp + 0x28]
call fcn.140b821d5
cmp cl, byte [rbp + 4]
cmp eax, 0x58943fbe
stosb byte [rdi], al
sahf
adc al, byte [rdi]
mov dl, 0x55
and eax, 0x558ef362
mov esi, 0xaa5fe355
pop rsi
enter 0x47ae, 0xffffffffffffffaa
push 0xffffffffaa5d8e5a
xor al, 0xa5
cmp bh, byte [rdi + 0x5f8ccc55]
pop rbp
stosb byte [rdi], al
cwde
out 0x57, al
stosb byte [rdi], al
mov ds, word [rdi - 0x19]
mov ecx, 0xbb474255
mov esi, 0x236d9c55
stosb byte [rdi], al
lodsb al, byte [rsi]
jo 0x14066b12e
test al, 0x55
invalid

Function at 0x1408d89a8
Capabilities:
Encode data using xor

Disassembly:
je 0x1408d89ae
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x48]
call fcn.140b92d06
sub eax, dword [rax]
and al, 0x1e
push rsp
xchg edx, eax
mov ah, 0x72
jae 0x1408d89bb
invalid

Function at 0x140909a66
Capabilities:
Encode data using xor

Disassembly:
call fcn.140909a66
jno 0x140793f80
invalid
out 0x73, al
iretd
xchg byte [rcx + 0x72], al
mov ah, 0x19
push rbp
fld qword [rdx + 0x45]
imul eax, dword [rbp - 0x5e], 0xd2b21cb7
clc
adc ebp, dword [rcx]
inc byte [rdx + rdx*2]
add eax, 0xf81c7183
sahf
out 0x78, eax
and dword [rax], esp
add byte [rsi + rcx*4 - 0x676df800], 0xaf
adc byte [rax + rbx], bl
xor dword [rcx], ecx
cmpsb byte [rsi], byte [rdi]
je 0x140793fae
xlatb
wait
loop 0x140793f40
add bl, byte [rdx - 0x284e0cd1]
mov cs, word [rax + 0xd]
cmc
invalid
test r10d, 0x31ec3328
setl r10b
test r10b, 0x4d
mov r10, qword [rsp + 0x18]
jo 0x140793f3d
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.140ba5751