joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140206c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov r8, rdx
xor r8, 0xffffffffffffffff
mov rax, rcx
and rax, r8
mov r9, rcx
xor r9, 0xffffffffffffffff
mov r8, rdx
and r8, r9
imul r8, rax
mov r9, rdx
and r9, rcx
mov rax, rdx
or rax, rcx
imul rax, r9
add rax, r8
mov qword [rsp + 0x40], rax
cvtsi2sd xmm0, rcx
cvtsi2sd xmm1, rdx
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x140206c93
jp 0x140206c93
jmp 0x140206cde
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.14024ac10
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.14024ac10
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x140264130]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x37], al
jb 0x140206df2
mov r8d, dword [0x140259098]
mov edx, dword [0x14025909c]
mov ecx, r8d
xor ecx, 0xffffffff
and ecx, 0x2dcdc486
mov r9d, 0xd8196264
xor r9d, 0xf5d4a6e2
mov eax, 0x68c95dff
xor eax, 0x9736a200
xor r9d, eax
and r8d, r9d
mov eax, edx
xor eax, 0xffffffff
mov r10d, 0x34cffcdf
xor r10d, 0x19023859
and eax, r10d
and edx, r9d
or ecx, r8d
or eax, edx
xor ecx, eax
add ecx, 0xcbebc13f
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x8c339c30
xor edx, 0xc4c7d15d
mov r8d, 0x72aff270
xor r8d, 0x8d500d8f
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x48f44d6d
and ecx, edx
or eax, ecx
mov ecx, 0x34b730d2
xor ecx, 0xcb48cf2d
xor eax, ecx
sub eax, 0xa3ffd82a
cmp eax, 0xa39692b1
je 0x140206e00
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1402590a0]
or eax, dword [0x1402590a4]
mov edx, 0x575ad9c6
xor edx, 0x5b971a2a
imul eax, edx
mov r8d, eax
and r8d, 0xffb1254b
mov edx, 0xa4f8588e
xor edx, 0xa4f8588c
imul edx, r8d
add eax, 0xffb1254b
sub eax, edx
mov r8d, 0xb6bb70a7
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
mov qword [rcx], rdx
cmp eax, 0x66b38552
je 0x140206d8a
xor eax, eax
mov byte [rsp + 0x37], al
jmp 0x140206df2
mov al, byte [rsp + 0x37]
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub eax, 0xe9c2a32c
cmp edi, 0x1f0fffff
add byte [rax], 0
add byte [rax], al
Function at 0x140207ec0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x14020803e
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x14020803e
mov rdx, qword [rsp + 0x40]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0xcaddbe63b1a141ac
movabs r8, 0x3522419c4e5ebe53
xor rcx, r8
cmp rax, rcx
setg al
or al, al
xor al, 0xff
mov cl, dl
xor cl, 0xff
xor r8d, r8d
xor r8b, 1
xor dl, r8b
and cl, dl
or al, cl
xor al, 0xff
test al, 1
jne 0x140207f64
jmp 0x14020802b
mov ecx, dword [0x140259160]
mov eax, dword [0x140259164]
xor eax, 0x4ef6a840
mov edx, 0xb743e138
xor edx, 0x48bc1ec7
xor eax, edx
add ecx, eax
add ecx, 1
mov eax, 0xa651789e
xor eax, 0x3483aa2f
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0x526b6917
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0xedd1d792
mov ecx, 0x1c8a7faa
xor ecx, 0x17c78a87
cmp eax, ecx
jbe 0x14020804c
mov eax, dword [0x140259168]
xor edx, edx
div dword [0x14025916c]
mov ecx, eax
mov eax, ecx
and eax, 0xa3b06189
xor ecx, 0xa3b06189
or eax, ecx
or eax, 0xc0639e2e
mov edx, 0x2c0190c3
xor edx, 0xc41eb10a
mov ecx, 0x8beffbdd
xor ecx, 0x74100422
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xe81f21c9
add eax, edx
sub eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.140008c92
mov eax, dword [rsp + 0x2c]
cmp eax, 0x83cc0dfc
jb 0x140207fbc
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x14020803e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
movabs eax, dword [0xffffff67e9a03b7c]
Function at 0x14020bca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
call fcn.14021a9cb
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
add rax, 0x50
mov rax, qword [rdx]
mov qword [rsp + 0x68], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.14021a9d9
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
mov al, byte [rax + 0x50]
mov cl, 0x78
xor cl, 0x78
cmp al, cl
jne 0x14020be68
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov ecx, 2
cqo
idiv rcx
mov r8, rax
mov rax, qword [rsp + 0x30]
mov rdx, r8
and rdx, 0xffffffffffffffff
movabs r9, 0xb488b8f8a3b048b7
movabs rcx, 0x4b7747075c4fb748
xor r9, rcx
mov rcx, r8
or rcx, r9
add rdx, rcx
mov qword [rsp + 0x38], rdx
mov r9, rdx
xor r9, 0xffffffffffffffff
mov rcx, r8
and rcx, r9
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, rdx
movabs rdx, 0x795c2545367ff585
movabs r8, 0x795c2545367ff585
xor rdx, r8
cmp rcx, rdx
setl dl
movabs rcx, 0xceff79d13152b812
movabs r8, 0xceff79d13152b813
xor rcx, r8
cmp rax, rcx
setg cl
mov al, cl
and al, dl
xor al, 0xff
and cl, dl
mov dl, 1
xor dl, 0
xor cl, dl
xor al, 0xff
xor cl, 0xff
or al, cl
test al, 1
jne 0x14020be63
mov eax, dword [0x140259308]
xor eax, 0xcff9f923
mov ecx, dword [0x14025930c]
mov edx, 0x55d37b4f
xor edx, 0xc0153a7
xor ecx, edx
xor edx, edx
div ecx
or eax, 0x9e4f6175
mov ecx, 0x2ea185c3
xor ecx, 0xebac34b4
add eax, ecx
mov ecx, 0xbe7dbc8f
xor edx, edx
div ecx
cmp eax, 0x9daee912
je 0x14020be72
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140259310]
add eax, dword [0x140259314]
xor eax, 0x76aad4d6
mov edx, 0x8f77b2f6
xor edx, 0x12061ada
sub eax, edx
mov r8d, 0x50bba70d
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x60]
mov r8d, eax
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x2c], r8d
xor r8d, r8d
test rax, rax
cmovg r8, rax
call fcn.1400a2240
mov eax, dword [rsp + 0x2c]
cmp eax, 0xdcbd0616
je 0x14020be00
jmp 0x14020be68
call fcn.140008c92
mov rax, qword [rsp + 0x48]
add rsp, 0x78
ret
out 0x63, eax
imul ebp, ecx, 0xffffff85
Function at 0x140210bb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], r8
mov qword [rbp - 8], rdx
mov qword [rbp], rcx
mov eax, 0x10
mov qword [rbp + 8], rax
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x40], rax
mov eax, 0x20
mov qword [rbp + 0x28], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 0x28]
mov rcx, rsp
mov qword [rbp + 0x18], rcx

Function at 0x1402117e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x190
lea rbp, [rsp + 0x80]
Function at 0x14021a760
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.14021a9cb
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14021a9bc
mov rax, qword [rsp + 0x40]
movabs rcx, 0x87a279ffce827edf
movabs rdx, 0x785d8600317d812f
xor rcx, rdx
movabs rdx, 0x3120127d2942acf7
movabs r8, 0xcedfed82d6bd5308
xor rdx, r8
xor rcx, rdx
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14021a99b
mov r8, qword [rsp + 0x38]
movabs rcx, 0x33cf848ed433aa0c
movabs rax, 0xcc307b712bcc55fc
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
and rcx, r8
movabs rdx, 0x68e7f16f4d2967cd
movabs r9, 0x68e7f16f4d2967cf
xor rdx, r9
imul rdx, rcx
mov rcx, rax
add rcx, r8
sub rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
xor al, 0xff
xor dl, 0xff
mov cl, 1
xor cl, 0
or al, dl
or cl, 0
xor al, 0xff
and al, cl
test al, 1
jne 0x14021a855
jmp 0x14021a97a
mov eax, dword [0x140259758]
xor eax, 0x1addfa4f
mov edx, dword [0x14025975c]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, 0x8e960483
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x2acea76d
xor eax, 0xffffffff
add ecx, 0x2acea76d
add ecx, 1
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xd5f78ef7
mov edx, 0xffffffff
xor edx, 0xd5f78ef7
or ecx, edx
mov edx, 0x20bc1c7c
xor edx, 0xdf43e383
xor eax, edx
mov edx, 0x634a7674
xor edx, 0x9cb5898b
xor ecx, edx
or eax, ecx
cmp eax, 0xb683d756
jb 0x14021a9c2
mov eax, dword [0x140259760]
mov ecx, 0x20abbcb6
xor ecx, 0xafda1a36
xor eax, ecx
or eax, dword [0x140259764]
add eax, 0x3d3a066b
sub eax, 0x82e5243
mov ecx, 0x8f0c9ecd
xor ecx, 0xb23698a6
sub eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x512f9f59
mov ecx, 0xffffffff
xor ecx, 0xb9d90f17
or eax, edx
or ecx, 0xb9d90f17
xor eax, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xb737eea5
mov edx, 0xffffffff
xor edx, 0x2dcdc486
or eax, ecx
mov ecx, 0xb545b9ee
xor ecx, 0x98887d68
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov dword [rsp + 0x24], eax
call fcn.140008c92
mov eax, dword [rsp + 0x24]
cmp eax, 0xa88ae4ba
je 0x14021a8da
jmp 0x14021a9bc
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14000fe77
jmp 0x14021a9bc
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14000fe77
mov rcx, qword [rsp + 0x40]
call fcn.14000ff4b
nop
add rsp, 0x48
ret
movabs eax, dword [0xffffff0fe9a80c6a]
Function at 0x14021b020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140259798]
mov edx, dword [0x14025979c]
mov r8d, ecx
xor r8d, edx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
shl eax, 1
sub eax, edx
sub ecx, eax
mov eax, 0x8d640ee6
xor eax, 0xcd7ca84a
imul ecx, eax
mov eax, 0x49159b34
xor eax, 0x87b7c7b0
imul ecx, eax
mov edx, 0xffffffff
xor edx, 0xb47f161a
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xe7f28db
jb 0x14021b2da
mov eax, dword [0x1402597a0]
mov ecx, dword [0x1402597a4]
xor ecx, 0x59ed91db
sub eax, ecx
mov ecx, 0x59f811ad
xor edx, edx
div ecx
mov ecx, 0x455328e2
xor ecx, 0xb357b860
xor edx, edx
div ecx
or eax, 0xaa3607fb
mov dword [rsp + 0x38], eax
call fcn.14021abec
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax]
call fcn.14021ac07
mov cl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], cl
cmp eax, 0xfa1e4eec
ja 0x14021b081
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14021b0f6
jmp 0x14021b123
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1400874eb
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14021b2d4
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000ef30
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14021b2d4
mov eax, dword [0x1402597a8]
mov edx, dword [0x1402597ac]
mov ecx, 0x2d47417
xor ecx, 0xfd2b8be8
xor eax, ecx
mov ecx, 0xb9857ca6
xor ecx, 0x467a8359
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0xe005c942
or eax, edx
or ecx, 0xe005c942
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x73ec3216
xor ecx, 0x3552cd43
and eax, ecx
mov ecx, 0xe8637936
xor ecx, 0x5ee30fa
add eax, ecx
mov ecx, 0xe24daf75
xor edx, edx
div ecx
cmp eax, 0x334b993
ja 0x14021b2e3
mov rdx, qword [rsp + 0x28]
mov r8d, dword [str.se__]
mov eax, dword [0x1402597b4]
mov ecx, r8d
xor ecx, 0xffffffff
xor r8d, 0xffffffff
and ecx, r8d
or eax, eax
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov r8d, 0xffffffff
xor r8d, 0xbb5d8591
mov eax, ecx
xor eax, r8d
and eax, ecx
mov ecx, 0x74090593
xor ecx, 0x26b44226
add eax, ecx
mov ecx, 0x3420c664
xor ecx, 0x3e77436f
add eax, ecx
sub eax, 0x52bd47b5
mov r9d, 0x21fed363
xor r9d, 0x60af4f90
mov ecx, 0x4fec4c89
xor ecx, 0xb013b376
xor r9d, ecx
mov r8d, eax
and r8d, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, r8d
mov r8d, eax
and r8d, 0x41519cf3
or eax, 0x41519cf3
imul eax, r8d
add eax, ecx
mov ecx, 0x443d50bb
xor ecx, 0xe2ca2a4c
mov r8, qword [rdx]
movabs r9, 0x6191fcb75fbaf39c
movabs rdx, 0x2191fcb75fbaf39c
xor r9, rdx
movabs rdx, 0xb8186fd7b759ac9f
movabs r10, 0x47e7902848a65360
xor rdx, r10
xor r9, rdx
mov rdx, r8
xor rdx, r9
and rdx, r8
movabs r8, 0x25714e5ccf9697cd
movabs r9, 0x25714e5ccf9697cd
xor r8, r9
cmp rdx, r8
sete dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
jb 0x14021b1a7
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14021b2ca
jmp 0x14021b2d4
mov rcx, qword [rsp + 0x28]
call fcn.14000eec9
nop
add rsp, 0x48
ret
jg 0x14021b345
lahf
invalid
invalid
test cl, ah
invalid
Function at 0x14021b930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x14021bad6
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
movabs rdx, 0xf49626198631a3a4
movabs rax, 0xf49626198631a3b4
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x47], al
jb 0x14021bad6
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14021b9bd
jmp 0x14021b9cd
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14021bad6
mov ecx, dword [0x140259820]
mov edx, dword [0x140259824]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0xe0c6d858
xor edx, 0x1f3927a7
xor eax, edx
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0x9c2c6684
xor edx, 0xb67440b9
mov r8d, 0xf1d96ab6
xor r8d, 0xe269549
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x14021bae4
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140259828]
mov r8d, dword [0x14025982c]
mov edx, 0x4c47d30a
xor edx, 0x9febc859
xor r8d, edx
xor edx, edx
sub edx, eax
mov eax, 0x666b15f6
xor eax, 0x666b15f6
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0x863a21fa
xor r8d, 0xf216a143
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x14021ba64
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14021bad6
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff77e9a03b7c]
nop dword [rax]
Function at 0x140225fc3
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x8dd45459
mov ecx, 0x5b715425
xor ecx, 0x46d22e07
xor eax, ecx
cmp eax, 0xebf53dc4
je 0x1402260ac
mov eax, dword [0x140259cd8]
xor eax, 0xb43613c9
mov edx, dword [0x140259cdc]
mov r8d, eax
xor r8d, edx
mov ecx, 0x72317a0f
xor ecx, 0x8dce85f0
xor r8d, ecx
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x8d640ee6
xor ecx, 0xecd2b1c9
imul eax, ecx
mov ecx, 0x49159b34
xor ecx, 0x9e3d4cc7
imul eax, ecx
sub eax, 0x1d7e9954
mov dword [rsp + 0x38], eax
mov eax, 0x14005009
xor eax, 0xdc56f84d
mov dword [rsp + 0x34], eax
call fcn.140225852
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.1402259c7
mov ecx, dword [rsp + 0x34]
mov dl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jbe 0x140225fe0
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14022607f
jmp 0x1402260a6
mov rcx, qword [rsp + 0x40]
call fcn.140225d70
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1402260a6
mov rcx, qword [rsp + 0x40]
mov edx, 8
call fcn.14000ef30
nop
add rsp, 0x48
ret
jg 0x140226117
lahf
invalid
mov dword [rdx - 0x173dceb8], esi
jle 0x188b36101
add esp, 0x38
ret
Function at 0x1402265c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x140226782
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x140226782
mov rdx, qword [rsp + 0x30]
movabs rcx, 0xd9d49f802ba64d87
movabs rax, 0x262b607fd459b277
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14022664d
jmp 0x14022665d
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x140226782
mov ecx, dword [0x140259d48]
mov edx, dword [0x140259d4c]
xor edx, 0xfb871714
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
mov ecx, 0x7126fd37
xor ecx, 0x8ed902c8
xor eax, ecx
or eax, eax
mov ecx, 0xe442447d
xor ecx, 0x1bbdbb82
xor eax, ecx
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xfc6e7d1e
xor ecx, 0x39182e1
xor eax, ecx
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
mov ecx, 0x8221acab
xor ecx, 0x6bba2339
cmp eax, ecx
jae 0x140226790
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140259d50]
mov r8d, dword [0x140259d54]
xor r8d, 0x6f8a078b
mov edx, 0xbbd5c474
xor edx, 0xbbd5c474
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
mov eax, 0xaaa77b85
xor eax, 0xaaa77b85
sub eax, edx
xor eax, 0xf24baeab
mov edx, 0xcb957e92
xor edx, 0x47167947
imul eax, edx
mov r8d, 0xfce87371
xor r8d, 0x88c4f3c8
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x140226706
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x140226782
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff6de9a03b7c]
nop dword [rax]
Function at 0x140233bc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x398
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x310], rcx
mov eax, dword [0x14025a2a8]
xor eax, 0x90e0e9d
xor edx, edx
div dword [0x14025a2ac]
sub eax, 0xce9199b5
add eax, 0x1f57be54
add eax, 0xce9199b5
and eax, 0x7bfda1b4
mov ecx, 0x3baebf59
xor ecx, 0xfc44c5e5
sub eax, ecx
mov ecx, 0xee48fa58
xor ecx, 0x1ab983fa
cmp eax, ecx
ja 0x140236030
Function at 0x14023ae40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], rcx
mov eax, dword [0x14025a538]
mov ecx, dword [0x14025a53c]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
add eax, 0x7ca8b9d1
mov ecx, eax
xor ecx, 0x116bebb7
mov edx, 0x32b33637
xor edx, 0xcd4cc9c8
xor ecx, edx
or eax, 0x116bebb7
Function at 0x14023e4d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x140248078
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.14024809e
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140011b10

Function at 0x1402484af
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
call fcn.1401b1bf0
mov qword [rsp + 0x28], rax
movabs rcx, 0x191bffd9ae6fe06b
movabs rax, 0x191bffd9ae6fe04b
xor rcx, rax
call fcn.14004b93e
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
mov al, byte [rax + 0x50]
mov cl, 0x3e
xor cl, 0x3e
cmp al, cl
jne 0x1401b1be6
mov rax, qword [rsp + 0x30]
mov qword [0x1402d7fb0], rax
add rsp, 0x38
jmp fcn.140030a10
sub rsp, 0x28
call fcn.14005f2f4
call fcn.14005faf8
call fcn.1400613a3
call fcn.140066630
call fcn.14009c840
call fcn.1400a4e9e
call fcn.1400d0bee
call fcn.14012bbd0
call fcn.14012d4b5
call fcn.14013fcc1
call fcn.140141430
call fcn.140158310
call fcn.14019ba30
nop
add rsp, 0x28
jmp 0x1401b1b93
sub rsp, 0x28
call fcn.14000354d
call fcn.140003970
call fcn.140005ac4
call fcn.1400312aa
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1402649d0]
mov dword [rax], ecx
mov rdx, qword [0x1402649f0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.140031289
call fcn.14009ef38
call fcn.14009efe8
call fcn.14009f164
call fcn.1400b5c2c
call fcn.14013fcf4
call fcn.14023e7f0
call fcn.140240ed0
nop
add rsp, 0x28
jmp 0x140248460
Function at 0x14024a720
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14024a748
mov eax, 0
jmp 0x14024a796
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14024a771
mov eax, 0
jmp 0x14024a796
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14024a791
mov eax, 0
jmp 0x14024a796
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14024a79c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14024a81a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14024a811
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14024a811
mov rax, qword [rbp - 8]
jmp 0x14024a82f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14024a7e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x412c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412d8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431e20
xorps xmm15, xmm15
mov r14, qword [0x006805a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412c65
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412c74
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412c93
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412ca3
cmp rbx, 0x1000
jae 0x412c6b
jmp 0x412d0d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412cb5
xor edx, edx
jmp 0x412d04
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431e20
xorps xmm15, xmm15
mov r14, qword [0x006805a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412c99
jmp 0x412c88
call fcn.0046ec20
xorps xmm15, xmm15
mov r14, qword [0x006805a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004365e0
lea rax, [0x00501807]
mov ebx, 0x18
nop dword [rax]
call fcn.00436e60
mov rax, qword [rsp + 0x38]
call fcn.00436ba0
lea rax, [0x00501eb0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436e60
mov rax, qword [rsp + 0x30]
call fcn.00436ba0
call fcn.00436820
call fcn.00436640
lea rax, [0x005048b4]
mov ebx, 0x21
call fcn.00465f80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00412c00