joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d1c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, r9
mov r15, r8
mov r14, rcx
mov qword [rsp + 0x50], 0
mov esi, ILClone
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x40], 0
lea ebp, [rdx + 9]
cmp edx, ebp
jae 0x18000d3af
lea ebx, [rdx - 0xdd]
lea r13, [0x180000000]
nop dword [rax]
cmp ebx, 0x1b
ja case.0x18000d23d.9
movzx eax, byte [rbx + r13 + 0xd438]
mov ecx, dword [r13 + rax*4 + 0xd410]
add rcx, r13
jmp rcx
mov ecx, 0x20
call fcn.1800927dc
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18000d276
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rsi
mov byte [rax], 0
mov rcx, rax
call fcn.180018980
jmp 0x18000d278
xor edi, edi
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
jmp case.0x18000d23d.9
mov r9d, 0xc6
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.180048830
jmp case.0x18000d23d.9
mov r9, r14
xor edx, edx
mov r8d, 0x8b
mov rcx, r15
call fcn.18006d3c0
mov dword [r14 + 0x28], 1
jmp case.0x18000d23d.9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
mov r8d, 0xa3
call fcn.18000f300
jmp case.0x18000d23d.9
mov r8, r15
jmp 0x18000d38c
cmp dword [r15 + 0x28], 8
jle case.0x18000d23d.9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.bad_arguments_passed_to_dumpHeapComplete
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180096892]
lea rdx, str.:______
call fcn.180092630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov r9, r14
mov edx, 1
lea r8d, [rdx + 2]
lea rcx, [0x1800a4d0c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [r12]
mov qword [rsp + 0x30], rax
mov r9d, 0x79
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.180063850
jmp case.0x18000d23d.9
mov r8, qword [r12]
lea rdx, str.StereoResolution
mov rcx, r14
call fcn.180092630
jmp case.0x18000d23d.9
mov dword [r14 + 0x2c], 0
mov r8, r14
xor r9d, r9d
lea edx, [r9 + 0x5b]
xor ecx, ecx
call fcn.180013fd0
inc ebx
lea eax, [rbx + 0xdd]
cmp eax, ebp
jb 0x18000d220
mov rsi, qword [rsp + 0x58]
cmp rsi, 0x10
jb 0x18000d3eb
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d3e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180092818
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011220
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rsp + 0x250], rax
imul r15d, ecx, 0x1ec
mov r13, r8
mov rdi, rdx
mov esi, ecx
mov ebx, ecx
cmp ecx, r15d
ja 0x18001139b
mov r12, qword [rsp + 0x38]
mov ebp, dword [rsp + 0x38]
mov r14, qword [rsp + 0x38]
cmp ebx, 0xa1c7
ja 0x180011337
je 0x180011316
mov eax, ebx
sub eax, 0xdd
je 0x180011304
sub eax, 0x1e
je 0x1800112a4
cmp eax, 0x5066
jne 0x18001138d
xor r14d, r14d
jmp 0x18001138d
xor r12d, r12d
mov rdx, rdi
lea ecx, [r12 + 0x6b]
call fcn.180054150
test al, al
je 0x180011333
lea ebp, [r12 + 0x36]
cmp qword [rdi + 0x30], r12
jne 0x18001138d
mov ecx, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x10]
mov qword [rdi + 0x30], rdx
lea rax, [rcx + rcx*2]
lea r8d, [rcx + rcx*2]
shl rax, 4
add rax, rdx
shl r8d, 4
lea ecx, [rbp - 0x2e]
mov qword [rdi + 0x38], rax
call qword [rdi + 0x20]
test eax, eax
jne 0x180011333
lea ecx, [rbp + 0x2e]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001138d
mov r8, rdi
mov rdx, r13
mov ecx, 0x78
call fcn.18000ab70
jmp 0x18001138d
mov eax, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rdi + 0x20]
test eax, eax
je 0x18001138d
xor al, al
jmp 0x1800113a0
cmp ebx, 0xf22d
je 0x18001134b
cmp ebx, 0x14293
jne 0x18001138d
mov al, 1
jmp 0x1800113a0
mov r9, rdi
mov dword [rsp + 0x20], 0xb8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180010e50
mov rax, qword [rdi + 0x38]
xor r9d, r9d
mov rcx, qword [rdi + 0x30]
mov r8, r14
mov qword [rdi + 0x30], rax
mov edx, ebp
lea rax, [rsp + 0x40]
mov qword [rdi + 0x38], rcx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
imul eax, esi, 0x52
add ebx, eax
cmp ebx, r15d
jbe 0x180011271
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180029b30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rsp + 0xd0], rax
imul ebp, edx, 0x2cb
mov rdi, r8
mov esi, edx
mov r14, rcx
mov ebx, edx
cmp edx, ebp
ja 0x180029d86
xor r15d, r15d
nop dword [rax + rax]
cmp ebx, 0x3538
ja 0x180029c7a
je 0x180029c6c
cmp ebx, 0x68
je 0x180029c4c
cmp ebx, 0x6a
je 0x180029bf3
cmp ebx, 0x112
je 0x180029d66
cmp ebx, 0x1ad0
je 0x180029be2
cmp ebx, 0x1b54
jne 0x180029d66
mov r8d, 0x4a
mov dword [rsp + 0x38], 7
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.180075500
jmp 0x180029d66
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
jmp 0x180029d66
cmp dword [rdi + 0x60], r15d
jne 0x180029d75
lea r8, [rdi + 0x30]
xor r9d, r9d
mov edx, 0xef
lea rcx, [rsp + 0xa0]
call fcn.18000d1c0
xor r9d, r9d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov edx, 0xef
call fcn.18000d1c0
mov r9d, 0x105
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18004e3a0
jmp 0x180029d66
test rdi, rdi
je 0x180029d86
cmp byte [r14], r15b
je 0x180029d66
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180029d66
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180029d66
cmp ebx, 0x363e
je 0x180029d17
cmp ebx, 0x46a4
je 0x180029ccf
cmp ebx, 0x5128
je 0x180029d86
cmp ebx, 0x8c36
je 0x180029cf2
cmp ebx, 0xd1c8
jne 0x180029d66
mov ecx, ILClone
mov eax, ecx
sub eax, 0x11
je 0x180029cc8
sub eax, 1
je 0x180029cc8
cmp eax, 1
je 0x180029d7a
inc ecx
cmp ecx, 0x14
jb 0x180029cb3
mov qword [rsp + 0x28], r15
lea r8, [0x18000c8c0]
mov r9, rdi
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
jmp 0x180029d66
cmp qword [rdi], r15
je 0x180029d81
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov rdx, rdi
mov ecx, 0xf6
call fcn.18002a140
jmp 0x180029d66
mov r9d, 0x24
lea rdx, [rsp + 0x70]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180007b00
xor r9d, r9d
mov dword [rsp + 0x20], 0x24
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002bea0
mov r9d, 0xc1
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.180048830
mov dword [rsp + 0x30], eax
imul eax, esi, 0x41
add ebx, eax
cmp ebx, ebp
jbe 0x180029b80
jmp 0x180029d86
mov eax, r15d
jmp 0x180029d8a
mov byte [rsp + 0x30], 1
jmp 0x180029d86
mov byte [rsp + 0x30], r15b
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180092fc0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x18004dbd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2490
call fcn.180092f50
sub rsp, rax
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rsp + 0x2480], rax
mov rax, qword [rsp + 0x24f0]
mov rdi, r9
imul r13d, edx, 0x508
mov rsi, r8
mov qword [rsp + 0x48], rax
mov r12d, edx
mov ebx, dword [rsp + 0x48]
mov r14, rcx
mov ebp, edx
cmp edx, r13d
ja 0x18004dd94
mov r15d, dword [rsp + 0x48]
cmp ebp, 0xaf9b
ja 0x18004dd7c
je 0x18004dd1f
cmp ebp, 0x6d
je 0x18004dcd5
cmp ebp, 0xf3
je 0x18004dccd
cmp ebp, 0x4ec5
jne 0x18004dd64
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x4e20
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea r8, str.V877_WeightIdx
lea rcx, [0x18001bd30]
mov dword [rsp + 0x48], 0xa
mov qword [rsp + 0x28], rcx
lea rdx, [0x18001c8a0]
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov ecx, 0xcb
call fcn.18001a690
mov rdx, qword [rsp + 0x50]
mov ecx, 0xbc
call fcn.180072670
xor eax, eax
jmp 0x18004dd96
xor r15d, r15d
jmp 0x18004dd64
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov r9d, 0x10b
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 3
call fcn.180055790
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x2478], 1
jmp 0x18004dd64
movzx eax, byte [r14]
mov rcx, r14
test al, al
je 0x18004dd64
movzx edx, byte [rdi]
nop dword [rax]
cmp al, dl
je 0x18004dd59
cmp al, byte [rdi + 0x8c]
je 0x18004dd59
cmp al, byte [rdi + 0x98]
je 0x18004dd59
cmp al, 0xd
je 0x18004dd59
cmp al, 0xa
je 0x18004dd59
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x18004dd30
jmp 0x18004dd64
mov r15d, 1
mov ebp, 0x15e43
imul eax, r12d, 0xb8
add ebp, eax
cmp ebp, r13d
ja 0x18004dd94
mov rax, qword [rsp + 0x48]
jmp 0x18004dc33
cmp ebp, 0x15e43
je 0x18004dd5f
cmp ebp, 0x20ceb
je 0x18004ddc1
cmp ebp, 0x2bb93
jne 0x18004dd64
mov eax, ebx
mov rcx, qword [rsp + 0x2480]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0x24d8]
add rsp, 0x2490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r15d, r15d
je 0x18004de4f
movsx ecx, byte [rdi + 0x8c]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
movzx eax, byte [r14]
mov rbx, r14
test al, al
je 0x18004de38
movzx ecx, byte [rdi + 0x8c]
cmp al, byte [rdi]
je 0x18004de01
cmp al, cl
je 0x18004de05
movsx ecx, byte [rdi + 0x98]
cmp al, cl
jne 0x18004de21
jmp 0x18004de18
cmp al, cl
jne 0x18004de11
test byte [rdi + 0x80], 0x10
movsx ecx, al
jne 0x18004de18
movsx ecx, byte [rdi + 0x98]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
movsx ecx, byte [rbx]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x18004dde5
movsx ecx, byte [rdi + 0x8c]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
xor ebx, ebx
jmp 0x18004dd64
mov r8, qword [rax]
mov r9, rsi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor ebx, ebx
jmp 0x18004dd64
Function at 0x18004e010
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov edi, dword [rsp + 0x80]
lea r12d, [rcx + 0x38]
mov rbp, r9
mov rbx, r8
cmp ecx, r12d
jae case.0x18004e08e.3
mov r13, qword [rsp + 0x30]
lea r15d, [rcx - 0xc6]
mov esi, dword [rsp + 0x80]
lea r8, [0x180000000]
mov r14d, dword [rsp + 0x80]
nop word [rax + rax]
cmp r15d, 0x72
ja case.0x18004e08e.7
movzx eax, byte [r8 + r15 + 0x4e294]
mov ecx, dword [r8 + rax*4 + 0x4e274]
add rcx, r8
jmp rcx
mov r8, qword [0x1800ad908]
mov edx, 0xf0
xor ecx, ecx
call fcn.18001f570
test al, al
je 0x18004e254
mov r8, qword [0x1800ad908]
lea rcx, [rsp + 0x80]
mov edx, SHTestTokenMembership
mov byte [rsp + 0x80], 1
call fcn.180015af0
mov rdx, qword [rsp + 0x88]
lea r8, [0x180000000]
jmp case.0x18004e08e.7
mov r9d, 0xd9
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.180007b00
mov ecx, 1
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [r13]
lea rdx, str.CleanupWorkList
mov rcx, rax
mov r9d, ebx
call fcn.180092630
mov rdx, qword [rsp + 0x88]
lea r8, [0x180000000]
jmp case.0x18004e08e.7
mov edi, esi
jmp case.0x18004e08e.7
mov r9d, reloc.SHELL32.dll_ILClone
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
call fcn.1800139f0
test al, al
je 0x18004e23e
mov rcx, qword [rbp + 0x28]
xor esi, esi
call qword [rbp + 0x20]
test al, al
je 0x18004e1b7
mov ebx, 0xb5
mov eax, ebx
sub eax, 0xb5
je 0x18004e191
cmp eax, 1
jne 0x18004e1ad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, r14d
mul ecx
mov esi, edx
shr esi, 6
call qword [rbp + 0x50]
jmp 0x18004e1ad
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, 0x81
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov r14d, eax
call fcn.180034a60
inc ebx
cmp ebx, 0xb7
jb 0x18004e167
mov r8, qword [0x1800ad908]
xor r9d, r9d
xor edx, edx
mov ecx, 0x11f
call fcn.180043870
mov rdx, qword [rsp + 0x88]
lea r8, [0x180000000]
jmp case.0x18004e08e.7
mov rax, qword [rdx]
mov ecx, 1
mov qword [rsp + 0x30], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rcx, rax
mov edx, 0xe6
call fcn.18000d1c0
mov rdx, qword [rsp + 0x88]
lea r8, [0x180000000]
xor edi, edi
jmp case.0x18004e08e.7
mov r13, qword [rsp + 0xa0]
add r15d, 7
lea eax, [r15 + 0xc6]
cmp eax, r12d
jae case.0x18004e08e.3
mov rbx, qword [rsp + 0x90]
jmp 0x18004e070
mov r8, qword [0x1800ad908]
xor r9d, r9d
xor edx, edx
mov ecx, 0x11f
call fcn.180043870
xor eax, eax
jmp 0x18004e25a
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007c1e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
imul ebp, ecx, 0x11f
mov rdi, rdx
mov ebx, ecx
cmp ecx, ebp
ja 0x18007c2e2
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x48], r14
imul r14d, ebx, 0x29
mov qword [rsp + 0x58], r15
xor r15d, r15d
cmp ebx, 0x292e
ja 0x18007c279
je 0x18007c267
mov eax, ebx
sub eax, 0x61
je 0x18007c252
sub eax, 0x9a
je 0x18007c24d
cmp eax, 0x29
jne 0x18007c2c8
mov dword [rdi], 0x6a09e667
mov dword [rdi + 4], 0xbb67ae85
mov dword [rdi + 8], 0x3c6ef372
jmp 0x18007c2c8
mov rsi, rdi
jmp 0x18007c2c8
lea rdx, [rdi + 0x2c]
mov r8d, 0xb9
lea rcx, [rdi + 0x4c]
call fcn.18002b270
jmp 0x18007c2c8
mov r8d, 0x8d
mov rdx, rsi
xor ecx, ecx
call fcn.18007c790
jmp 0x18007c2c8
cmp ebx, 0x2fe8
je 0x18007c2b3
cmp ebx, 0x5161
je 0x18007c2a8
cmp ebx, 0x5eac
jne 0x18007c2c8
mov dword [rdi + 0x18], 0x1f83d9ab
mov dword [rdi + 0x1c], 0x5be0cd19
mov qword [rdi + 0xc0], r15
jmp 0x18007c2c8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18007c2c8
mov dword [rdi + 0xc], 0xa54ff53a
mov dword [rdi + 0x10], 0x510e527f
mov dword [rdi + 0x14], 0x9b05688c
add ebx, r14d
cmp ebx, ebp
jbe 0x18007c216
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14044523e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fisttp word [rax]
push r10
movabs r10, 0x81458f04ba94206
pushfq
xor r10b, 0x62
push rsi
cmp r10, 0x1c255d3c
lea r10, [r10*4 + 0x76b25f7b]
call fcn.140879a3a
push rcx
pushfq
movabs rcx, 0x4417280d11a45fa5
sub cl, 0x11
xor ecx, 0x693f2b1f
je 0x1408b8b4c
test cl, 0xcd
mov cx, 0x574d
mov cx, 0x1e91
setl cl
bswap ecx
call fcn.1407bbd9f
sbb byte [rbx + 0x158b0764], al
xchg edx, eax
nop
cmp ah, bh
pop rsi
mov ah, 0x90
js 0x140435887
jge 0x140435971
invalid
out 0x49, eax
adc al, 0xa1
invalid
movsxd rbx, r9d
jl 0x1404358c5
add qword [rsp + 0x90], 0x3bca3b
and r8, 0x87f0165
xor bx, r9w
add qword [rsp + 8], 0xffffffffbf7b2228
not bpl
add qword [rsp + 0x50], 0xffffffffbf81b78d
mov r11b, byte [rsp + 0x26]
add r8, rbp
mov rbp, qword [rsp + 0x48]
call fcn.1408f8a52

Function at 0x140450aaf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x14084ddbf
mov qword [rsp + 8], 0x6ad20ae7
mov byte [rsp + 8], 0xba
mov r15, qword [rsp]
jge 0x140844749
xor r15b, 0x90
neg r11b
or r11d, 0x6f2162cf
push r8
and r15b, r11b
and r11w, r11w
and r15, 0x6e8a15cd
or r15w, r15w
movabs r8, 0x77ee6a1440ee47b0
movzx r11w, r8w
xor r15d, 0x12f2773a
neg r8w
add r15w, r15w
jge 0x140861215
lodsb al, byte [rsi]
pop rax
xchg esi, eax
invalid
push r10
push r13
jle 0x1407d595e
test dword [rsp + 0x21], r14d
call fcn.1407d5958
jb 0x140442d34
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140a4c329
invalid
xor dword [rsp + 8], 0x61f84128
or word [rsp + 8], 0xcaa
mov byte [rsp + 8], 0x4c
jb 0x1408d570f
or dword [rsp + 8], 0x4ffc1a7d
xor qword [rsp + 8], 0x39a20c46
call fcn.1408d56fb
mov r15, qword [rsp + 8]
not r8
and r8, 0x4fa94203
setg r11b
pop r8
xor r11w, 0x145c
jno 0x1408c370b
in eax, 0x3c
invalid
xor r11d, 0x4ceb3b70
not r11w
add r11d, r11d
add r11, 0x695601b2
xor r11b, r11b
not r11b
neg r11w
and r11w, 0x99
lea r11, [r11 + r11*4 + 0x61581014]
mov r11, qword [rsp + 8]
jae 0x1407bfe0e
mov qword [rsp + 0x10], 0x49121db5
setl byte [rsp + 0x10]

Function at 0x1404521cf
Capabilities:
Encode data using xor

Disassembly:
not esi
movabs r15, 0x2e7d79c06cc45502
mov ecx, 0xae13813
mov rcx, qword [rsp + 0x50]
mov esi, 0x18d23759
mov sil, 1
lea rsi, [rsi + rsi*2 + 0x5afd22ae]
call fcn.1407c91ec

Function at 0x1407bdb2e
Capabilities:
Encode data using xor

Disassembly:
movabs al, byte [0x7c04dd148072ecb8]
adc dh, 0xac
int1
cld
add rsi, rsi
setle sil
not sil
mov rsi, qword [rsp + 8]
add qword [rsp], 0xffffffffffb86b9a
call fcn.1407c2bca
fisubr dword [rax + 0x7996e125]
pop rbx
jns 0x1407bdbad
popfq
loopne 0x1407bdb1f
mov eax, 0x531f6314
jns 0x1407bdb60
invalid
pop rax
lahf
loopne 0x1407bdb50
sub cl, byte [rbp - 0x6c]
loopne fcn.1407bdb2e
scasb al, byte [rdi]
outsd dx, dword [rsi]
invalid
loopne 0x1407bdc0f
call 0x1c03c3fd6
std
cmp ebp, dword [rcx]
invalid
invalid
Function at 0x1407cd473
Capabilities:
Encode data using xor

Disassembly:
setae r14b
jns 0x14085a2ee
and r14d, 0xb8b443d
push r10
xor r10b, 0xdf
js 0x1407cd484
xor r12b, 0xa7
mov byte [rsp], r10b
add r10b, r9b
mov r12, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
push qword [rsp + 0x30]
popfq
mov r9, qword [rsp + 0x20]
mov r14, qword [rsp + 0x18]
lea rsp, [rsp + 0x48]
ret

Function at 0x1407e008f
Capabilities:
Encode data using xor

Disassembly:
cmp r10b, 0xcf
je 0x1407e00a7
setle r15b
add dil, r15b
or r10, 0x5a1977eb
not r15w
jle 0x1408b8ae3
xor cl, byte [rdx + 0xf49000d]
mov bh, 0xfc
movzx rdi, r12w
not r10b
or r12d, 0x5a631c41
neg edi
mov r10, qword [rsp + 0x78]
call fcn.14088dcfc
ja 0x1407e00ad
push 0x115d7585
mov edi, dword [rsp + rdx*2 - 0x5b7dcdff]
test cl, al
xchg ecx, eax
sahf
invalid
mov rdi, r10
movzx di, cx
cmp r13d, ecx
movabs r12, 0x215529c841b82abb
push r11
movabs r11, 0x6bb63a2241d917ef
lea r13, [r10*8 + 0x4cf302c1]
movabs r15, 0x2a183f6d26532c60
jl 0x140790db2
mov r13, qword [rsp + 0x30]
or r12b, 0x4e
mov r12, r10
movzx ecx, r11w
mov cl, dil
lea r10, [r12*2 + 0x721009ef]
sub cl, 0x3e
jl 0x14087f584

Function at 0x1407ecd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx r12d, r14w
push r14
not r14d
mov byte [rsp], 0x81
setno byte [rsp + 0x30]
mov dword [rsp], 0x428538d0
xor byte [rsp + 0x30], 0xc7
add qword [rsp], 0x56eb6418
xor dword [rsp], 0x3e3c65eb
xor r10d, r14d
or r10, 0x6a4a6182
push rdx
test word [rsp + 8], 0x4df1
setle r14b
xor r12, r10
push r14
or byte [rsp + 0x10], 0x8e
xor dword [rsp + 0x10], r12d
bswap r12
mov rdx, qword [rsp + 0x40]
add byte [rsp], dh
mov r10, qword [rsp + 0x38]
and dx, 0x366f
add qword [rsp + 0x10], rdx
mov r12b, byte [rsp + 0x46]
not edx
bswap rdx
jae 0x1407ecdd9
movzx r14w, word [rsp + 5]
sub r12d, 0x452f0877
jno 0x14088455e
xor edx, edx
add qword [rsp], 0x226c2844
test dword [rsp + 0x11], r14d
not r12d
not qword [rsp]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
lea rsp, [rsp + 0x50]
ret
Function at 0x1408080b3
Capabilities:
Encode data using xor

Disassembly:
push r8
movabs r8, 0x7eef74d646fa31b7
jg 0x1408fdd71
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.140a4c329
std
sbb eax, edi
loope 0x1408080d8
jmp [rbx + 0x27]
imul esp, dword [rdi], 0xffffff9d
invalid
and r8, r8
add qword [rsp + 0x10], 0xffffffffbf72a90f
mov rsi, qword [rsp + 0x20]
movsxd r8, r8d
xor dword [rsp + 0x20], 0x7fe7303c
sub r8d, 0x2d307885
add qword [rsp + 8], 0x4b4341
cmp sil, r8b
push r15
js 0x1408979ad
push rbp
push rbx
push r10
xor esi, dword [rdx]
insb byte [rdi], dx
insb byte [rdi], dx
add al, ch
call 0x1409020f1
call 0x1407c8dab
adc byte [rsi], dh
pop rsp
adc ch, bh
mov ch, 0x37
imul edi
push rax
jge 0x1408fddec
adc byte [rax], bl
pop rax
retf 0x1040
fucompi st(7)
push rax
mov ebx, 0x15100dc3
add byte [rax - 0x7ad2efe4], dh
out 0xf7, al
out dx, eax
movabs al, byte [0x401b08881022acae]
adc byte [0x13067bd43], cl
xor dword [rbx + 0x79], esp
mov dl, 0xef
cmc
nop
imul esi, dword [rbp - 0xbe54211], 0x10
adc bh, al
test dword [rbx + 0x51c3ef9e], ebp
add al, 0xbe
jg 0x1408fde0c
outsd dx, dword [rsi]
mov ebp, 0x7007bf7b
out dx, al
lahf
pop rsi
or ah, bh
stosd dword [rdi], eax
out dx, eax
jbe 0x1408fde4c
sub esi, ecx
jne 0x1408fde99
adc byte [rcx - 0x490b0e8d], cl
push rdx
mov esi, 0x69939d03
fstp dword [rdx + 0x1c88bdee]
sbb edx, dword [rax]
invalid
mov bh, 0x68
invalid

Function at 0x14080f19e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
mov qword [rsp + 0x28], 0x593783e2
push rcx
pushfq
cmp r14, 0x496f31e4
mov rcx, r14
push rdx
push rdi
movzx r14d, r14b
mov rsi, rcx
mov rdx, r14
mov rdi, r14
setb cl
push r8
xor cx, r14w
setl dil
and dx, si
sub esi, 0x33e5330f
movabs r8, 0x4f405c1b0a4b7725
add qword [rsp + 0x48], 0xfffffffffffac300
not r8w
cmp edi, 0x44843b92
jg 0x14080f1ae
movzx edi, dx
setge dl
test esi, 0x33bb41d7
mov rsi, qword [rsp + 0x30]
movsx r14d, r8b
call fcn.1407f09ff
Function at 0x14081733d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r14, [r14 + 0x2783473a]
mov r15, r14
movsx r15w, r15b
lea r15, [r15 + r9*2 + 0x4b03372]
push r10
push r11
lea r9, [r14 + r15*2 + 0x18e9268d]
movabs r10, 0x1f12268587d7482
push r9
push rbp
mov r15, qword [rsp + 8]
and r14w, 0x5c1a
neg r14b
push r13
mov r13, qword [rsp + 0x10]
mov r11, r10
not r14d
mov r14, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0xffffffffe2c4a6a3
lea r13, [r10*2 + 0x5e626476]
push rdx
xor r13b, byte [rsp + 0x1e]
cmp r11, 0x7f5c653c
push r9
not r10w
setbe r11b
neg r15d
cmovle r13w, word [rsp + 0x26]
jb 0x1408da4d1
add qword [rsp + 0x20], r10
call fcn.1408947ec
or r10b, r13b
lea r15, [r9 + r15*8 + 0x41a37927]
lea r11, [r11 + r10 + 0x3fce0cc8]
neg r11
movabs rdx, 0x58e74bd504296108
not rdx
add qword [rsp + 0x48], 0xfffffffffff5d951
mov rbp, qword [rsp + 0x20]
mov r15, qword [rsp + 0x40]
sub r9d, edx
and r10d, dword [rsp + 0x20]
jae 0x140826520
add qword [rsp + 0x20], 0x2e9a6cb6
mov byte [rsp + 0x20], 0x49
test dword [rsp + 0x20], 0xbd03903
not byte [rsp + 0x20]
setg byte [rsp + 0x20]
cmp qword [rsp + 0x20], 0x1db93d06
seta byte [rsp + 0x20]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1409afe5c
add qword [rsp], 0x48b63b
add r9w, r9w
setle r11b
neg r11b
neg r11w
neg r9
movzx r9, r11w
neg r9b
jne 0x1408da551
and r9d, 0x6cf82579
and r11w, r9w
ret