joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801dd5c4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1801ce1d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1801ce1d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1801dd714
cmp rax, 0xffffffffffffffff
je 0x1801dd714
xor edi, edi
test rbp, rbp
jle 0x1801dd6bf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1801caef4
mov rbx, rax
test rax, rax
jne 0x1801dd64c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1801dd6b5
mov edx, 0x8000
mov ecx, r14d
call fcn.1801dd448
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1801ccebc
cmp eax, 0xffffffff
je 0x1801dd695
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1801dd65c
mov edx, r15d
mov ecx, r14d
call fcn.1801dd448
jmp 0x1801dd6b5
cmp byte [rsi + 0x38], dil
je 0x1801dd6ac
cmp dword [rsi + 0x34], 5
jne 0x1801dd6ac
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1801dd6b5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1801ca8e4
jmp 0x1801dd728
jns 0x1801dd728
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1801ce1d4
cmp rax, 0xffffffffffffffff
jne 0x1801dd6e0
cmp byte [rsi + 0x30], dil
je 0x1801dd728
mov edi, dword [rsi + 0x2c]
jmp 0x1801dd728
mov ecx, r14d
call fcn.1801c3bb4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1801dd728
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1801dd728
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1801dd721
mov eax, dword [rsi + 0x2c]
jmp 0x1801dd726
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1801ce1d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1801ddd30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801ddd58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1801ddd58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1405216a0
Capabilities:
Encode data using xor

Disassembly:
pushfq
xor r15, 0xbe8508a
mov r15, qword [rsp + 0x20]
movabs rsi, 0x519214d015331b2a
add sil, 0x4d
jl fcn.1405216a0
not rsi
popfq
movsxd rsi, esi
mov rsi, qword [rsp + 8]
call fcn.14181cdfb

Function at 0x140553419
Capabilities:
Packed with generic packer

Disassembly:
jne 0x141022a7a
je fcn.141955854
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
call fcn.141cad165

Function at 0x14056d36f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [rsp + 0x28]
add edi, edi
je 0x14056d396
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.141bea05e
adc dword gs:[rax], eax
xchg dword [rbx + 0x405457e5], edi
stosd dword [rdi], eax
sbb byte [rbp + 0x24648d48], bl
xor al, ch
loopne 0x14056d348
add dword [ebp + 0x11], esp
add byte [rdi + 0x5457e5bb], al
stosd dword [rdi], eax
loope 0x14056d36e
jb 0x14056d3cc
imul eax, dword [rsi], 0xffffff9a
invalid
or dl, byte [rbx + rdi*4 - 0x118c4007]
movsb byte [rdi], byte [rsi]
int 0xbf
sbb eax, 0x4077ccc3
cli
out 0x32, eax
jge 0x14056d3ea
invalid
enter 0x1836, 0xfffffffffffffff9
mov edi, 0xcd0764b9
mov edi, 0x776fe937
cwde
invalid
jne 0x14056d3cc
and dh, dl
stosb byte [rdi], al
mov edx, 0x906f7005
movsb byte [rdi], byte [rsi]
adc dword [rdi - 0x157e8f], ecx
adc byte [rbp + 0x36ffdd23], bl
mov bl, byte [rax]
jrcxz 0x14056d42d
invalid
cmp ebx, esp
fdivr st(7)
stc
mov bh, 5
add byte [rdi - 0x78], bl
retf

Function at 0x1405a4ad0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x270
mov qword [rsp + 0x20], rax
jne 0x1405a4afe
mov rcx, qword [rsp + 0x20]
call fcn.1405a4ba0
jmp 0x1405a4b1f
mov eax, 0x4e0
mov rcx, qword [rsp + 0x20]
cmp eax, dword [rcx]
ja 0x1405a4b1a
mov rcx, qword [rsp + 0x20]
call fcn.1405a4c70
jmp 0x1405a4b1f
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
mov edx, ecx
add edx, 1
mov dword [rax], edx
mov ecx, ecx
mov r8d, ecx
mov ecx, dword [rax + r8*4 + 4]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x2c]
shr ecx, 0xb
and ecx, dword [rax + 0x1384]
xor ecx, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x2c]
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x2c]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x2c]
shr ecx, 0x12
xor ecx, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [rsp + 0x2c]
mov eax, ecx
add rsp, 0x38
ret
Function at 0x1405a4ba0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], 0x270
mov qword [rsp], rax
cmp qword [rsp + 0x10], 0x4e0
jae 0x1405a4c5e
xor eax, eax
mov rcx, qword [rsp + 0x10]
sub rcx, 0x270
mov rdx, qword [rsp]
mov r8d, dword [rdx + rcx*4 + 4]
and r8d, 0x80000000
mov rcx, qword [rsp + 0x10]
sub rcx, 0x270
mov r9d, dword [rdx + rcx*4 + 8]
and r9d, 0x7fffffff
or r8d, r9d
mov dword [rsp + 0xc], r8d
mov r8d, dword [rsp + 0xc]
shr r8d, 1
mov r9d, dword [rsp + 0xc]
and r9d, 1
cmp r9d, 0
mov r9d, 0x9908b0df
cmovne eax, r9d
xor r8d, eax
mov rcx, qword [rsp + 0x10]
sub rcx, 0x270
xor r8d, dword [rdx + rcx*4 + 0x638]
mov rcx, qword [rsp + 0x10]
mov dword [rdx + rcx*4 + 4], r8d
mov rax, qword [rsp + 0x10]
add rax, 1
mov qword [rsp + 0x10], rax
jmp 0x1405a4bbb
add rsp, 0x20
ret

Function at 0x1405a4c70
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x18], 0
mov qword [rsp], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x1405a4d1f
xor eax, eax
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp]
mov r8d, dword [rdx + rcx*4 + 0x9c4]
and r8d, 0x80000000
mov rcx, qword [rsp + 0x18]
mov r9d, dword [rdx + rcx*4 + 0x9c8]
and r9d, 0x7fffffff
or r8d, r9d
mov dword [rsp + 0x14], r8d
mov r8d, dword [rsp + 0x14]
shr r8d, 1
mov r9d, dword [rsp + 0x14]
and r9d, 1
cmp r9d, 0
mov r9d, 0x9908b0df
cmovne eax, r9d
xor r8d, eax
mov rcx, qword [rsp + 0x18]
xor r8d, dword [rdx + rcx*4 + 0xff8]
mov rcx, qword [rsp + 0x18]
mov dword [rdx + rcx*4 + 4], r8d
mov rax, qword [rsp + 0x18]
add rax, 1
mov qword [rsp + 0x18], rax
jmp 0x1405a4c8b
jmp 0x1405a4d24
cmp qword [rsp + 0x18], 0x26f
jae 0x1405a4dbf
xor eax, eax
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp]
mov r8d, dword [rdx + rcx*4 + 0x9c4]
and r8d, 0x80000000
mov rcx, qword [rsp + 0x18]
mov r9d, dword [rdx + rcx*4 + 0x9c8]
and r9d, 0x7fffffff
or r8d, r9d
mov dword [rsp + 0x10], r8d
mov r8d, dword [rsp + 0x10]
shr r8d, 1
mov r9d, dword [rsp + 0x10]
and r9d, 1
cmp r9d, 0
mov r9d, 0x9908b0df
cmovne eax, r9d
xor r8d, eax
mov rcx, qword [rsp + 0x18]
sub rcx, 0x270
xor r8d, dword [rdx + rcx*4 + 0x638]
mov rcx, qword [rsp + 0x18]
mov dword [rdx + rcx*4 + 4], r8d
mov rax, qword [rsp + 0x18]
add rax, 1
mov qword [rsp + 0x18], rax
jmp 0x1405a4d24
xor eax, eax
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp]
mov r8d, dword [rdx + rcx*4 + 0x9c4]
and r8d, 0x80000000
mov r9d, dword [rdx + 4]
and r9d, 0x7fffffff
or r8d, r9d
mov dword [rsp + 0xc], r8d
mov r8d, dword [rsp + 0xc]
shr r8d, 1
mov r9d, dword [rsp + 0xc]
and r9d, 1
cmp r9d, 0
mov r9d, 0x9908b0df
cmovne eax, r9d
xor r8d, eax
xor r8d, dword [rdx + 0x634]
mov rcx, qword [rsp + 0x18]
mov dword [rdx + rcx*4 + 4], r8d
mov dword [rdx], 0
add rsp, 0x28
ret
Function at 0x1407e74e0
Capabilities:
Install driver
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x60
mov qword [rsp + 0x58], rsp
mov rcx, rdx
mov ebx, 1
mov dword [rsp + 0x50], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140ff0490]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test eax, eax
js 0x1407e7682
mov dword [rsp + 0x80], ebx
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [0x140eea488]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesEvilDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1407e7682
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
xor r8d, r8d
lea rdx, [0x140818a0c]
mov rcx, qword [0x140eea488]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1407e75a6
lea rdx, [0x1407e7682]
mov rcx, rsp
call fcn.140805508
movzx eax, word [0x140ff0490]
mov dword [rsp + 0x28], eax
mov rax, qword [0x140ff0498]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140818a18]
mov rcx, qword [0x140eea488]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1407e75ef
lea rdx, [0x1407e7682]
mov rcx, qword [rsp + 0x58]
call fcn.140805508
mov dword [rsp + 0x80], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140818a2c]
mov rcx, qword [0x140eea488]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1407e7641
lea rdx, [0x1407e7682]
mov rcx, qword [rsp + 0x58]
call fcn.140805508
mov rcx, qword [0x140eea488]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
jne 0x1407e7681
lea rdx, str.RegistryMachineSystemCurrentControlSetServicesEvilDriver
lea rcx, [0x140ff0490]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [0x140ff0490]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov ecx, 0x64
test eax, eax
cmovns ebx, ecx
mov dword [rsp + 0x50], ebx
nop
mov eax, dword [rsp + 0x50]
add rsp, 0x60
pop rbx
ret
Function at 0x1407e78c0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
xor esi, esi
mov ecx, 0x104
mov qword [rsp + 0x70], rsi
call fcn.1407e9630
mov rbx, rax
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov dword [rsp + 0x68], 0x104
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1407e799c
lea rax, [rsp + 0x70]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1407e7964
mov rcx, qword [rsp + 0x70]
call fcn.1407e78c0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x68], 0x104
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1407e7920
mov qword [rsp + 0x38], rsi
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x68], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1407e7a0f
nop
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov qword [rsp + 0x38], rsi
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x68], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x1407e79d0
mov edx, 1
mov rcx, rbx
call fcn.1407e92f4
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1407e7ca0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
xor edi, edi
call fcn.1407eaf20
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
jne 0x1407e7ced
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1407e7d3f
nop
lea rdx, [0x1408187e0]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1407e7d3b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1407e7d00
mov eax, edi
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov edi, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
mov eax, edi
add rsp, 0x260
pop rdi
ret
Function at 0x1407f7860
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1407f768c

Function at 0x1407fcfa0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1407fcfc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1407f8f94
or eax, 0xffffffff
jmp 0x1407fcfc2
xor eax, eax
add rsp, 0x28
ret

Function at 0x1410425fb
Capabilities:
Encode data using xor

Disassembly:
jno 0x1417e5295
sbb edi, dword [rbp - 0x61]
inc byte [rdx]
add ah, byte [rax + 0x61]
ret 0x8854
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
call fcn.141c8460d
cmp ah, bh
push rcx
stosd dword [rdi], eax
cmp dword [rdx + rsi*2], edx
invalid
jae 0x1410f28f9

Function at 0x14115115d
Capabilities:
Encode data using xor

Disassembly:
and r9d, 0x6f1a14d6
lea r9, [r9 + r9*4 + 0x455724e7]
test r9w, 0x2dce
jge 0x141aa28c8
scasb al, byte [rdi]
fucomp st(3)
mov esi, 0x6e983a8c
jg 0x1411511c6
and al, 0xcf
jp 0x141151204
push rbx
pop rax
mov word [r9 + 0x6612db57], es
jg 0x1411511e6
invalid
test byte [rbx], bh
cli
jae 0x141151232
movsd dword [rdi], dword [rsi]
xchg esp, eax
push 0x7f
jge 0x14115120c
sbb dword [rsi + 0x7e], edi
pop rsi
cdq
mov byte [rcx + 0x62c4cdb1], al
jg 0x14115122c
js 0x14115120c
jns 0x14115124a
adc eax, 0x8186bc99
mov dh, 0x32
pop rdx
jg 0x1411511d2
xor bl, byte [rdx + 0x65]
jg 0x1411511d2
xchg ecx, eax
invalid
sub dl, dh
add byte [rcx - 0x3c31b2eb], bl
retf 0x6043
lodsb al, byte [rsi]
xchg ebx, eax
sub dword [rdi], edi
xchg edx, eax
add byte [r8 + rax - 0x52a5b6b0], dil
jae 0x14115125b
and edx, dword es:[rax + rax*2]
enter 0x650f, 2
pcmpgtw mm0, qword [rdx]
jl 0x1411511ae
fistp qword [rdi + 0x33]
push rbp
lahf
mov es, word [rax - 0x4b7fd02c]
out 3, eax
adc eax, 0x562d7294
mov esi, 0xcae2733
js 0x141151283
js 0x141151283
rcl dword [rdx + 0x7a], cl
std
invalid
push 0x6a
mov byte [rax + 0x3a987d06], ah
xchg ebp, eax
mov dh, 0xbd
jg 0x14115129b
add byte [rax + rax - 0x120db6b0], bh
push rax
in eax, dx
jl 0x1411511f6
sbb eax, 0x17c03e4d
pop rdx
xor al, 3
add al, 0x49
cdq
xor bh, 0xed
int 0x31
clc
invalid
mov al, 0xae
xor esp, dword [r15]
scasb al, byte [rdi]
pop rsp
mov cl, 0xeb
sub dword [rdx + 0x2dbe821], 0xfffffff2
rol byte [rbp - 0x244e813b], cl
push rcx
mov esi, 0x31076f04
movabs eax, dword [0x4f46607b9e51faf6]
jnp 0x14115128a
add al, 0x6f
invalid
jo 0x1411512ff
movabs eax, dword [0xc43604b001ef8f0c]
jle 0x1411512f2
or esi, dword [rdx + rdx]
invalid
invalid
cmpsb byte [rsi], byte [rdi]
mov dl, 0x5e
mov dh, 0x79
invalid
mov r9, qword [rsp + 0x10]
add qword [rsp], 0xffffffffbeded6a3
add qword [rsp + 0x28], 0xffffffffbe33e99b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x30]
call fcn.141bea05e
out 0xef, eax
stosb byte [rdi], al
xchg byte [r13 + 0x548021de], cl
xor byte [rax + 0x3a], bl
sub dword [0x1c06fcf3e], 0x26401211
or byte [rbx + rdi], 0x46
adc ch, 0x53
sar dword [rsi], 0x81
outsd dx, dword [rsi]
mov word [rsi + 0x5427ec9], fs
xor al, 0x80
jnp 0x141aa2996
invalid
fisubr dword ds:[rsi - 0x6d]
adc byte [rdx + 5], ah
mov eax, 0x27c168be
movabs al, byte [0xd7c7a95000bc00f7]
retf
Function at 0x14120dbc4
Capabilities:
Encode data using xor

Disassembly:
movzx r11, byte [rsp + 0x28]
mov r11, qword [rsp + 0x10]
add byte [rsp + 0x28], 0xcf
xor qword [rsp + 0x28], 0x281e7cf9
neg dword [rsp + 0x28]
jns 0x14120dbca
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
call fcn.141c30e2d

Function at 0x14126bc63
Capabilities:
Encode data using xor

Disassembly:
mov r14, qword [rsp + 0x38]
add esi, 0x5bb54e3a
call fcn.1413a1f91
xchg ebx, eax
std
dec dword [rbp + 0x33]
xor r11, r11
neg r11d
xor r9, 0x283c1929
push rsp
and al, 8
xor al, ch
xchg esp, eax
jrcxz 0x14126bc60
add al, ch
add qword [r8 + rax], r9
jg 0x14105c333
jo 0x14126bd20
jle 0x14126bcc4
pop rbp
mov edx, 0xd4d2818d
js 0x14126bc95
adc esi, 0x7e76d9f0
add cl, byte [rdx + 0x69]
jle 0x14126bd5d
invalid
mov byte [rax], al
mov dword [rcx + 0x742909f1], eax
jle 0x14126bd5a
add cl, byte [rcx + 0x1c8d0581]
mov al, 0x81
adc byte [rdi], 0xe4
mov bh, 0x81
test al, 0xaf
xchg ebp, eax
jo 0x14126bd89
fistp word [rcx - 5]
jle 0x14126bd0e
xor eax, 0x8b818d3e
cld
mov bl, 0x81
out dx, al
pop rbp
jbe 0x14126bd9d
mov ah, 0x42
in eax, dx
in eax, dx
jle 0x14126bd3b
push rbp
scasb al, byte [rdi]
jmp 0x14126bce3
invalid
mov ebx, cs
mov ch, 0x22
invalid
and ch, dl
outsd dx, dword [rsi]
xor dword [rdx - 0x62], ecx
pop qword [rsi + 0x302e4a34]
imul dword [rdi + 0x612d1879]
mov esi, 0x4a3238ae
jg 0x14126bd70
scasb al, byte [rdi]
cmp byte [rdx], dh
jg 0x14126bd70
push rsi
in eax, 0x98
invalid
invalid
rcl byte [rax + 0x393e5f6d], cl
and byte [rcx], 0x2c
invalid

Function at 0x141376af1
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
add byte [rax - 0x7f], cl
add qword [rsp], 0xffffffffbe342b34
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.141c79c57
push rdx
loope 0x141376ad2
movabs byte [0xb8eb4b896e01f045], al
or dword [rsi], ebp
and ebp, ebp
enter 0x41ef, 0x1d
invalid

Function at 0x14146c515
Capabilities:
Execute anti-debugging instructions

Disassembly:
not esp
call fcn.14191bca6
call fcn.14165c426
push r8
call fcn.14109e929
cmp r12b, 0x82
push rdi
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x3fe914ef
movabs rdi, 0x63f7755557f56398
push r15
push rdx
jne 0x14155cdc2
invalid
stc
outsb dx, byte [rsi]
mov ebp, 0xf37eb7be
jle 0x14146c527
jno 0x14146c4db
fld dword [rcx + 0x24045878]
jg 0x14146c585
fbstp tbyte [rax + 0x49567f3d]
out 0x29, eax
jg 0x14146c5aa
out 0x29, eax
jle 0x14146c592
mov ch, 0x67
fild word [rcx + 0x353a66da]
jg 0x14146c552
ret
push 0x7f396609
rdtsc
cmp dword [rdi + 0x67], edi
rdtsc
sub eax, 0xb16b687e
fild dword [rcx + 0x31ecf0b4]
jg 0x14146c608
rcr byte [rdi + 0x2a], cl
jle 0x14146c588
mov r13b, 0xbf
mov dl, 0x4c
add ebp, dword [rbx]
stc
scasd eax, dword [rdi]
xor ch, byte [rdx]
invalid
movabs al, byte [0x343cf93aa553c847]
cmp bh, cl
cmp al, 0x34
scasd eax, dword [rdi]
pop rdx
jae 0x14146c603
xchg dl, dl
cmp byte [rax - 0xd], al
mov cl, 0xed
invalid
mov rdx, rdi
movabs r15, 0x7a6779a71613223d
add dx, dx
mov rdx, qword [rsp]
test edi, 0x32ba7edb
js 0x1411e5395
and r15d, 0x4ef33685
call fcn.141a261ad
movsd dword [rdi], dword [rsi]
or al, 0xce
invalid
Function at 0x14153616e
Capabilities:
Encode data using xor

Disassembly:
or qword [rsp + 8], 0x40034e41
seto byte [rsp + 8]
test qword [rsp + 8], 0x7afb0926
not word [rsp + 8]
or ebx, edi
jp 0x1415361ec
not dword [rsp + 8]
sets byte [rsp + 8]
mov dword [rsp + 8], 0x1de40e99
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.141bea05e
cmp eax, 0x190b0ddc
out dx, eax
cmpsb byte [rsi], byte [rdi]
xor dword [rbp + rax - 0x4086a66b], 0xa5abebae
stosd dword [rdi], eax
fbstp tbyte ss:[rbp + 0x78]
mov dh, 0xd3
push rcx
test al, 0xd4
stc
clc
imul edi, dword [rbp - 0x12], 0xa11a38d0
or al, 0x62
call 0x114da60fa
sbb dh, byte [rbp - 0x5585335e]
loope 0x141536181
invalid
or al, 0xe0
stosd dword [rdi], eax
in eax, 0x33
xchg esp, eax
invalid

Function at 0x14161b59c
Capabilities:
Access peb ldr_data

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.141cb0616

Function at 0x14163bea0
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x18], 0xffffffffbe7a6471
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.141cb0616
mov bh, 0x37
movabs eax, dword [0x76d3db5e8972c024]
mov ch, 0x52
fcmovnu st(0), st(3)
stc
sbb bl, byte [rcx - 0x25]
and al, byte [rsp + 0x4c]
fcmovnu st(0), st(2)
and al, 0xf
scasd eax, dword [rdi]
and al, 0x73
mov edx, 0xfddb53fb
sti
push r10
fisttp dword [rax + 0x79]
cmpsb byte [rsi], byte [rdi]
push rdi
fcmovne st(0), st(5)
pushfq
pop rbx
test eax, 0x7f591824
scasd eax, dword [rdi]
and al, 0x1e
and esi, dword [rdx]
test al, 0x24
mov dh, 0x64
pushfq
push rbp
fistp dword [rax + rbp*8 - 0x60]
pop rcx
fistp dword [rdi + rbp*4]
rsqrtps xmm3, xmm3
xor dword [rdi - 0x25], eax
test dword [rbx], ecx
push rdi
fild qword [rcx + 0x2e5eddd1]
jge 0x14163bed6
invalid

Function at 0x141685369
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbe4e1e0d
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.141bea05e
invalid

Function at 0x141738c4a
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.141cad165
xchg esp, eax
iretd
adc al, byte [rbx - 0x53]
movabs dword [0xd5a0b0d093cfb8c5], eax
cmpsd dword [rsi], dword [rdi]
mul byte [rcx + 0x41b1bfab]
ror byte [rcx - 0x22], 0x41
cmc
leave
scasd eax, dword [rdi]
fnsave dword [0x106bfd722]
cwde
pavgw mm1, qword [rsi - 0x192f128]
sbb r11d, dword [r10]
movabs dword [0x56944e4bb2c8250e], eax
mov esp, 0xbcee1a2e
jmp 0x171b793a9
mov ch, 0x21
in al, dx
fisubr dword [r8 - 0x67]
mov r11, qword [rsp + 0x20]
jge 0x140501eb1
pop rsp
jae 0x141738c9a
jge 0x141738c71
jge 0x141738c71
jp 0x141738c55
or bh, 0xab
cld
jrcxz 0x141738be4
xor edx, esp
add bl, byte [rsi + rdi*2]
lodsd eax, dword [rsi]
cmp esp, esp
inc dword [rax - 0x181db790]
loop 0x141738c58
xor byte [rcx - 0x68], 0x65
out 0x81, eax
je 0x141738cf8
add dl, byte [rax]
jle 0x141738c6e
invalid
push 0x7e18d404
cld
div dword [rdx]
sti
sbb byte [rcx - 0x7f1ccbea], 0x4f
mov dh, 0xb3
jrcxz 0x141738c2f
mov ebp, 0x7e14d4c1
pop rdi
retf 0xed93
invalid

Function at 0x141772c87
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x30]
call fcn.141cb0616