joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c364
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rdx, rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
movzx eax, word [rax + 0x14]
movzx eax, ax
add rax, rdx
add rax, 0x18
mov qword [rbp - 0x10], rax
mov dword [rbp - 4], 0
jmp 0x14007c540
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x10]
test eax, eax
jne 0x14007c46c
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0x38]
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
jle 0x14007c536
mov rax, qword [rbp + 0x28]
mov r10, qword [rax + 0x28]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax + 0x58]
mov eax, dword [rbp - 0x24]
cdqe
mov rcx, qword [rbp - 0x10]
mov ecx, dword [rcx + 0xc]
mov r8d, ecx
mov rcx, qword [rbp - 0x18]
add rcx, r8
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
call r10
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x14007c42c
mov eax, 0
jmp 0x14007c55c
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov edx, eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 8], edx
mov eax, dword [rbp - 0x24]
movsxd rdx, eax
mov rax, qword [rbp - 0x20]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x14007c536
mov rax, qword [rbp - 0x10]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x10]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.CheckSize
test eax, eax
jne 0x14007c498
mov eax, 0
jmp 0x14007c55c
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x28]
mov rdx, qword [rbp + 0x28]
mov rdx, qword [rdx + 0x58]
mov rcx, qword [rbp - 0x10]
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
mov rcx, qword [rbp - 0x10]
mov ecx, dword [rcx + 0xc]
mov r8d, ecx
mov rcx, qword [rbp - 0x18]
add rcx, r8
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0x1000
mov rdx, r10
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x14007c4eb
mov eax, 0
jmp 0x14007c55c
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x10]
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rdx, rax
mov rax, qword [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 0x20]
mov edx, eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 8], edx
jmp 0x14007c537
nop
add dword [rbp - 4], 1
add qword [rbp - 0x10], 0x28
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 4], eax
jl 0x14007c3b7
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x140083560
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x1400835d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140200e94]
mov rbx, rcx
test esi, esi
jle 0x140083700
mov rax, qword [0x140200e98]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14008361b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400836a5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140083600
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140083722
mov rax, qword [0x140200e98]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140200e98]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140083707
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14008369e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400836b0
add dword [0x140200e94], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140200e98]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14008369e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x140083628
mov rax, qword [0x140200e98]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140083cb0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140200f00]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140200ee0]
test rbx, rbx
je 0x140083d0c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140083d03
test eax, eax
jne 0x140083d03
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140083ce8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140083f20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140083f38
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140083f40
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140083f50
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140083f9d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140083f94
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140083f9f
add rax, 0x28
cmp rax, r9
jne 0x140083f80
xor eax, eax
ret

Function at 0x140083fa0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140084030
mov rdx, qword [0x14016fba0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14008401e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14008401e
cmp word [rax + 0x18], 0x20b
jne 0x14008401e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140084030
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140084009
add rbx, 0x28
cmp rbx, rdi
je 0x140084030
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140084000
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140084040
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14016fba0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140084060
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140084068
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140084060
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400840bd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400840b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140084060
add rax, 0x28
cmp rax, r9
jne 0x1400840a0
xor eax, eax
ret

Function at 0x1400840c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14016fba0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400840df
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400840e8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400840df
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140084100
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14016fba0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140084120
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140084128
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140084120
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140084170
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140084167
test rcx, rcx
je 0x140084120
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140084158
xor eax, eax
ret

Function at 0x140084180
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14016fba0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14008419f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400841a8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400841c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14016fba0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400841e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400841e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400841e0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400841e0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140084234
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140084240
add rdx, 0x28
cmp rdx, r9
jne 0x140084220
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140084250
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14016fba0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140084272
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140084280
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140084272
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140084272
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140084272
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400842d5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400842e8
add rdx, 0x28
cmp r10, rdx
jne 0x1400842c0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400842f7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140084307
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400842de
test ecx, ecx
jg 0x1400842f0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140d71008
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x5f424c33
call fcn.1410da1cc
add eax, 0x3e99c557
pop rsi
or eax, 0xbdd39e9d
push rsi
scasb al, byte [rdi]
jle 0x140d71073
sbb ch, byte [rdx - 0x13]
xchg edx, eax
test dword [0x10583d9c0], edx
push rbx
vpunpcklwd xmm14, xmm15, xmmword [rax + rbx*2]
adc edi, eax
xor ah, byte [ecx - 0x1174c607]
or al, bl
invalid
push 0xffffffffc0cede5a
and dword [rcx], 0x8dcda526
or eax, 0xef31953d
invalid

Function at 0x140fa3a22
Capabilities:
Encode data using xor

Disassembly:
push rsi
pushfq
movabs rsi, 0x6106518f3d395785
mov rsi, qword [rsp + 8]
mov qword [rsp + 8], 0x5dc3ed42
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.140fe82d0
add byte [rax], al
add byte [rcx], ah
add byte [rax], al
add dl, dh
add eax, 0x5f40d00
add al, ah
mov edi, 0xcce800d4
call fcn.1406bf601
jmp 0xc51e0372
mov bh, 0xc4
sub ah, dl
push 0xffffffffd8a59162
movsxd rdx, edx
add rdi, rdx
lea rsp, [rsp + 8]
jmp 0x140e333f4

Function at 0x140fad53d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + rdx - 0xa60], r11
and byte [rsp + rdx - 0xa68], al
lea r11, [rdx*4 - 0x73d218de]
mov qword [rsp + rdx - 0xa80], rdx
xor dword [rsp + rdx - 0xa60], ebx

Function at 0x140fc0049
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
movsxd r10, r10d
mov qword [rsp + 0x10], rax
or dword [rsp + 9], eax
mov edx, eax
adc r9, r10
movsx ebx, dl
xor bl, 0x96
dec eax
mov rax, qword [rbx + r8 - 0xa8]
call fcn.14115d16d
rol r10d, 2
inc r11d
bswap r10d
mov esi, r8d
inc ax
jp 0x140faa0b4
xor r10d, 0x21a335b4
add r8d, edx
shl r8d, cl
bswap r10d
ror al, 0x85
push rbx
xor dword [rsp + r11 - 0x80], r10d
and rax, rax
setl al
pop rbx
jno 0x141166c57
and ecx, 0xdf0d38ba
sub r8, rcx
mov r11, qword [rbp + r11 - 0x80]
push rsi
setge cl
mov r8b, byte [rbp + rcx - 0x5f0d37f9]
lea rbp, [rcx + rbp - 0x5f0d37f7]
xchg si, cx
mov byte [r11 + rcx - 0x5f0d3000], r8b
lea r10, [rcx + rdx*2 + 0x701fafb5]
shl word [rsp + rcx - 0x5f0d3000], 0x4f
mov qword [rsp + rcx - 0x5f0d3000], rdi
ret
rol rsi, cl
movsxd r10, r10d
adc rdi, r10
jmp 0x14112494c
jne 0x14114267b

Function at 0x140fc0152
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rdi, qword [rsp + rsi*2 - 0x707e]
call fcn.140fb72f5

Function at 0x140fcbc9b
Capabilities:
Encode data using base64

Disassembly:
xor di, bp
mov qword [rsp + r8 - 0x12224795], rsi
movzx ecx, byte [rsp + r8*4 - 0x48891e41]
lea rbp, [rsp + rbp + 0x18]
mov byte [rbp + r8*4 - 0x48891e54], dl
lea rbx, [rbx + r8 - 0x12224799]
call fcn.14101a041

Function at 0x140fcbcc9
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x1d39772c
inc eax
bswap eax
push rbp
lea rdi, [rbp*2 + 0x7f158416]
and rbp, 0x673f141d
not eax
jae 0x141139b52

Function at 0x140fce611
Capabilities:
Parse pe header

Disassembly:
mov rsi, rbx
mov qword [rsp + rdi*2 - 0x2d179720], rdi
neg dil
mov rdi, r9
jno 0x14103abd5
jg 0x1411571e1

Function at 0x140fd5142
Capabilities:
Hash data using murmur3

Disassembly:
dec byte [rsp + rsi - 0x5a22a22f]
shrd rax, rdx, cl
call fcn.141145de1
Function at 0x140ff271c
Capabilities:
Encode data using base64

Disassembly:
neg esi
inc rcx
mov edx, 0x28b33f1b
lea esi, [rbx + rsi - 0xb187bf4]
sar bx, cl
sar rdi, 0x10
bswap ebp
rol esi, 1
sub esi, 0x9f2a123d
call fcn.1410df173

Function at 0x140ff48eb
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
add rbx, 8
push r8
sub r10, 1
sar r8w, 0x29
movzx eax, byte [r10]
xor al, r11b
neg al
ror word [rsp + 5], cl
lea rdx, [r8*8 - 0x4e7a5fd4]
sbb al, 0x39
call fcn.14110a317
neg eax
sal dword [rsp + rbx - 0x58a5427d], 0xe7
bswap eax
jne 0x14114113b
sal rbx, 0x7d
ror eax, 1
lea rcx, [r11 + rbx*8 - 0x52cebcc2]
call fcn.140fefd15
lea rbx, [rsp + rbx + 0x18]
mov byte [rbx + rax + 0x77582b49], r8b
inc al
mov qword [rsp + rsi*2 - 0x9c0], rbp
ret 0x10

Function at 0x140ff492f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rax, qword [rbp + 8]
jmp 0x14111d29c
add rbp, 0xc
xor r11d, r11d
mov qword [rsp], 0x720dc713
test rax, rax
push 0x4702f40f
lea rsp, [rsp + 0x10]
je 0x14111d315
mov r10d, 0xcd09b7b3
movsx ecx, r10b
lea r10, [0x141179798]
mov ecx, 0x63216796
sal cx, 0xe
movzx ecx, byte [r8 + rcx - 0x63218000]
push 0x6b86eb16
xor ecx, r11d
and ecx, 0xff
mov ecx, dword [r10 + rcx*4]
shr r11d, 8
xor r11d, ecx
inc r8
xor r11d, 0x4a8eac84
dec rax
lea rsp, [rsp + 8]
jne 0x14111d2d2
mov edx, 0x1abd5c3c
lea rsi, [rdx + 0x682c5110]
not r11d
movzx r10d, si
not sil
movsx eax, dx
mov dword [rbp + rdx*2 - 0x357ab878], r11d
movzx r11d, r10w
sal r11w, 0xac
lea r9, [r9 + rdx*4 - 0x6af570f4]
neg rsi
mov r11d, dword [rdx + r9 - 0x1abd5c3c]
movzx r8d, ax
xor r11d, ebx
movzx ecx, r8w
call fcn.141130b02

Function at 0x140ffc026
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd dl, r11b
shl ecx, 0x5f
mov qword [rsp + r9 - 0x6881a2b], r10
xor dword [rsp + r9 - 0x6881a2b], eax
mov qword [rsp + r9*4 - 0x1a2068cc], 0x502f220a
mov r10, qword [rsp + r9 - 0x6881a2b]
movsxd rax, eax
jmp 0x1410ca61d
add rsi, rax
jmp 0x1411b5fc3

Function at 0x141011624
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, esi
bswap r8d
mov qword [rsp + rsi - 0x6930da9c], 0xffffffffa60d4ead
lea r8d, [r8 + rcx - 0x72aac71f]
and dword [rsp + rsi - 0x6930da94], ebx
mov qword [rsp + rcx + 8], r10
add word [rsp + rcx*8], 0xac80
xadd sil, al
xor dword [rsp + rsi - 0x6930da30], r8d
add ecx, dword [rsp + rsi - 0x6930da34]
lea r9, [rcx + 0x67b25005]
mov r10, qword [rsp + rsi - 0x6930da30]
inc cl
movsxd r8, r8d
mov qword [rsp + rsi - 0x6930da30], rsi
adc rdi, r8
sal r9b, 2
jp 0x14115b28f
sub cx, si
movzx r9w, byte [rbp + rax - 0x6930da9c]
jns 0x1410aaead
neg qword [rsp + r8 - 0x12290]
not eax
dec eax
dec rbp
push rbp
not eax
jno 0x14101bd9e
mov eax, 0x6f1bfda6
lea r10, [r10 + rax - 0x6f1bfda7]
movzx eax, byte [r10 + rax - 0x6f1bfda6]
xor al, r11b
neg al
jmp 0x14105aac3
mov ebp, 0xb1aa4021
jmp 0x14103b22b
jno 0x1411bc9ec
Function at 0x14102ff7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb r10, 4
mov qword [rsp + 8], rdx
mov edi, dword [r10]
xor edi, r11d
sub edi, 0xeb33889c
ror edi, 3
mov qword [rsp], 0x279118b8
sub edi, 0xb136c835
sal bpl, 0xe1
adc qword [rsp + 8], rdx
ror edi, 1
shl byte [rsp + 6], 0x81
pop rax
mov qword [rsp + rax - 0x279118b8], r11
dec al
dec rbp
mov r11d, 0xf53f5c3b
xor dword [rsp + rax - 0x279118b7], edi
sal ax, 0xa2
pop r11
mov r8d, eax
movsxd rdi, edi
jns 0x14109fbc4

Function at 0x14102ffe4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop rcx
mov rsi, qword [r10 + 8]
add r10, 0x10
rol r8b, 0xc3
mov qword [rbp + riz], rsi
sbb rbx, 4
lea rdx, [r8 + r8*8 + 0x449215ba]
mov ebp, dword [rbx]
mov r9d, edx
movsx esi, dl
lea rax, [r9 + rsi*2 + 0x2710c605]
xor ebp, edi
ror ebp, 2
not sil
inc rdx
lea ebp, [rbp + r9 - 0x36679828]
xor ebp, 0xb7962504
movzx ecx, al
or r8d, r8d
bswap ebp
neg rax
push rdi
cmovl rsi, rdx
seto al
shr rdx, cl
xor dword [rsp + rdx], ebp
call fcn.141032cc6
xor ebp, esi
jmp 0x14117eab5
movsxd rbx, ebx
shl ecx, 0x33
rol r11w, 0xa9
neg eax
add r8, rbx
mov rbx, qword [r9 + rdx*2 + 0x76dfff3a]
jmp 0x140ff485f
add r11, qword [rsp + r11 - 0x43c54998]
neg ebp
push r11
xor ebp, 0xaa0a532d
sub ebp, 0x117ce11
bswap ebp
sar r11b, 2
mov qword [rsp + 8], rsi
xor dword [rsp + 8], ebp
mov rsi, qword [rsp + 8]
dec r11d
movsxd rbp, ebp
jno 0x1411bf107
lea rdx, [rdx*4 - 0x3b7dc841]
movsx edi, al
pop rdi
xor r10, rcx
jp 0x1410b89ea

Function at 0x141035206
Capabilities:
Parse pe header

Disassembly:
mov edx, ebx
xor ecx, ecx
cmp ebx, 4
lea rsp, [rsp + 0x18]
jbe 0x14114cc70
mov edx, 4
mov ecx, 0xb9b9a2ac
mov eax, ecx
call fcn.14114cc68

Function at 0x14104c1f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11d, dword [rbp + rax*8 - 0x300b0]
rol rax, 0x46
lea r8, [r8 + rax - 0x18057c]
mov edx, 0xad20b081
mov qword [rsp + rax*8 - 0xc02c00], rax
jae 0x14107ecb5
mov dword [r8 + rax*2 - 0x300b00], r11d
push rdx
add rax, rax
sub rax, rax
lea rdi, [rax + rdi - 4]
setns al
mov ebx, dword [rdi + rax*4 - 4]
and word [rsp + rax + 0xb], 0xf49f
xor ebx, esi
movzx ecx, al
add byte [rsp + rax + 0xc], dl
jae 0x1410c1d33

Function at 0x141065a09
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jmp 0x1411ba858
jmp 0x1410cafc9
push 0xffffffffcb0d852f
lea rsp, [rsp + 0x10]
jne 0x140ff281d
mov rcx, rax
jmp 0x140fade22
jmp 0x1410105f6
cmp ebx, 2
call fcn.141113d01
cmp ebx, 4
jne 0x140fbd7af
mov r9, rax
jmp 0x1410c0545

Function at 0x1410704c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0x63b17e17
lea rsp, [rsp + 8]
jmp 0x14118ad27

Function at 0x141075b4c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r10d
mov qword [rsp + rsi - 0x6930da9c], rsi
not r8d
inc bl
dec r8d
movsx ecx, byte [rsp + rsi - 0x6930da98]
call fcn.141011624
Function at 0x141084d39
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0xb48563ac
mov dword [rbx + rbp - 0x56], edx
jle fcn.14100b427
add r10, rax
sub r11d, r10d
movzx r11d, word [r9 + rcx - 2]
xor r11w, bx
xchg word [rsp + rcx + 2], ax
call fcn.1410e9ec9
lea r8, [r10 + rdx*2 - 0x50c54100]
not r11d
and dword [rsp + rcx - 0x3a23b0fd], r10d
rol r10, 0x35
xor r11d, 0x37020786
dec r11d
call fcn.14113707c
xor dword [rsp + r8 - 0x6d2e0856], edx
add r9w, di
pop r11
push rax
movsxd rdx, edx
jle 0x1410e409f
movzx ecx, r8b
adc rsi, rdx
push rcx
mov edx, r8d
pop rbp
rdtsc
lea rbx, [r8 + rbx - 0x6d2e085e]
pop r9
xchg rdi, r9
add ecx, 0xe399b3b0
mov dword [rbx + rdi - 0x7d8e31fb], eax
jp 0x1410541fb

Function at 0x14109495e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl rbp, 0x1b
movsxd rax, eax
pop rbp
sar rbx, 0xc4
movsx ebp, bx
add r9, rax
not edi
call fcn.1410822d6
movsxd rdi, edi
or cl, al
or cl, dh
adc r9, rdi
xchg dword [rsp + rbp - 0x81], edx
mov rbx, r8
sub r8, rax
and dl, dl
xadd cx, bp
add word [rsp + rdx*2 + 0xb], bp
mov dword [r8 + rdx], ebx
jp 0x1411ba358
call fcn.141062498
mov eax, 0x39721b6
push rax
movzx ecx, word [rsp + rax*2 - 0x72e436a]
lea rdi, [rax + rdi - 0x39721ba]
movzx r10d, byte [rsp + rax - 0x39721b4]
lea rbx, [r10*4 - 0x76c32a80]
shr rax, cl
mov ecx, dword [rdi + rax*4 - 0x1c]
lea rdx, [rbx + rbx*2 + 0x5e080a31]
ror bx, 0x8f
xor ecx, esi
lea rbp, [rdx + 0x41987e35]
xor ecx, 0x5191fb03
jmp 0x14102c138

Function at 0x1410a8085
Capabilities:
Encode data using xor

Disassembly:
lea r11, [rdi - 0x6d4ea45a]
movsxd rcx, ecx
xor al, r9b
and ebx, ebx
jge 0x14105b230
adc rsi, rcx
or rbx, rsi
jmp rbx
mov r9d, dword [rbp + r11 - 0xb091]
mov qword [rsp + rbp*8 - 0x58488], r8
sal r8w, 0x2a
xchg dword [rsp + rbp*2 - 0x1611e], r8d
mov ebp, dword [r8 + r11 + 4]
je 0x1411ab355
push 0x3f31fb33
mov qword [rsp], rsi
push r10
mov r10d, 0xb287fd35
lea rsi, [r10 + r10*4 + 0x20019c34]
lea rsi, [0x14119e300]
mov r10d, 0x91927ea5
add r10, r10
movzx r10d, byte [r11]
xor r10d, eax
and r10d, 0xff
push 0xffffffffe5224a3e
push 0xffffffffc28cee89
mov r10d, dword [rsi + r10*4]
xor word [rsp + 8], 0xd400
push 0x33b15f2b
shr eax, 8
xor eax, r10d
sal byte [rsp + 0x16], 0x23
inc r11
xor eax, 0x98185da4
dec rcx
lea rsp, [rsp + 0x18]
jne 0x1410a80cd
mov r10d, 0xa50067be
and r10w, r10w
pop r10
mov ebx, 0xb2821ebd
pop rsi
not eax
mov dword [r8], eax
mov ecx, 0xa1b79900
mov eax, 0x9c0fa00b
mov ecx, dword [rbp + riz]
lea rdi, [rax*4 + 0x3ba804]
or edi, edi
lea rbp, [rbp + rdi - 0x707a282c]
mov edx, 0x770a5980
xor ecx, r10d
movzx ebx, ax
mov r9d, 0xc2045c2a
inc ecx
not ecx
inc eax
xor ecx, 0x6992e295
sub ecx, 0xdcb34703
rol rax, 0xe1
push r10
shr ebx, 0x5e
sal rbx, 0xa
xor dword [rsp + rdx - 0x770a5980], ecx
bswap eax
not ax
movzx r10d, dx
pop r10
not ax
jmp 0x140fa8f58