joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006760
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400067bd
lea rbx, [0x14003dce0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400067a4
cmp r10, 2
jb 0x1400067a4
cmp byte [r9], r8b
jne 0x1400067a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140006780
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400067ff
lea rbx, [0x14003dce0]
cmp r8b, 0x23
jne 0x1400067e3
cmp byte [r9], r8b
jne 0x1400067e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400067d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140006950
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000696a
mov qword [r8], 0
lea rdx, [0x140043560]
call fcn.140006810
mov rbx, rax
test rax, rax
jne 0x14000698a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140006a61
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006a61
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140006a61
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006a61
cmp rdi, 0xffffffffffffffff
je 0x140006a61
mov rax, qword [0x14004aab8]
test rax, rax
je 0x1400069fe
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140006a61
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140006a4e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004aab8]
test rax, rax
je 0x140006a43
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140006a6a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140006a5c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140006a6c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140009e70
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14003dce0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f10], ebx
jne 0x140009f06
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001ce60
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400167a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14004a010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14004aab8]
mov edi, ecx
cmp byte [rbx + 0x4a4d], 0
jne 0x140016801
cmp byte [rbx + 0x4a4e], 0
jne 0x140016801
movsx r9d, word [rbx + 0x5b72]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400065c0
test dil, 1
je 0x14001692f
jmp 0x14001688a
movss xmm1, dword [rbx + 0x38bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b72]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140043aac]
mulss xmm1, dword [0x140043aa0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47b8], rax
mov dword [rbx + 0x47a4], 1
movss dword [rbx + 0x47b0], xmm0
movss dword [rbx + 0x47b4], xmm1
movss xmm0, dword [rbx + 0x3918]
mulss xmm0, dword [0x140043a30]
or dword [rbx + 0x47a0], 0x41
movss dword [rbx + 0x4800], xmm0
call fcn.1400065c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400168e0
lea r11, [0x14003dce0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400168c3
cmp byte [r8], r9b
jne 0x1400168c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400168b0
not ecx
call fcn.14000da20
test rax, rax
je 0x14001692f
cmp byte [rax + 0xb6], 0
je 0x14001692f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b72]
movsx r9d, word [rbx + 0x5b72]
call fcn.1400065c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400101b0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003b600
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001b7b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c58], 0
lea rbx, [rcx + 0x5c60]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001b857
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001b80a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001da90
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140006de0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c58]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c68]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14004aab0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001b85f
mov rcx, rbx
call fcn.140006de0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001bce0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14004aab8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001bd43
mov qword [rsp], rbx
lea rbx, [0x14003dce0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001bd23
cmp byte [r8], r9b
jne 0x14001bd23
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001bd10
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bd0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001bd77
mov r10, qword [r10 + 0x5bd8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001bd7e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001bd64
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14003c0ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003c136
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003c136
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003c136
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003c136
cmp dword [rcx + 0x84], 0xe
jbe 0x14003c136
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003c138
xor al, al
add rsp, 0x28
ret
Function at 0x140004ae0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140004b14
cmp word [rcx], 0x5a4d
jne 0x140004b14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140004b14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140004a20
test eax, eax
jne 0x140004b30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140004a90
test rax, rax
je 0x140004b25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400052e8
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400051e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005180
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005644
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1406c8c78]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1406c8c74]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140005692
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000568a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140005779
inc ebx
add rax, 0x28
jmp 0x14000566a
mov rcx, r12
call fcn.140005e71
mov rbp, rax
test rax, rax
jne 0x1400056b1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400055e0
movsxd rbx, ebx
mov rax, qword [0x1406c8c78]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140005f1f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1406c8c78]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140005713
mov rax, qword [0x1406c8c78]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400055e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140005773
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140005773
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1406c8c78]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140005773
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400055e0
inc dword [0x1406c8c74]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140005da0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005dc3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005dc3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005dc4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140005dfe
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005df5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005e00
inc r8d
add rax, 0x28
jmp 0x140005ddc
xor eax, eax
ret

Function at 0x140005e71
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1406bdb50]
mov r8, rcx
mov rcx, r9
call fcn.140005da0
test eax, eax
je 0x140005e9d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005dc4
xor eax, eax
add rsp, 0x28
ret

Function at 0x1406d42c0
Capabilities:
Packed with generic packer

Disassembly:
not r12d
mov rbx, qword [rsp + 0x50]
mov rbx, qword [rbx]
movabs r14, 0xa5804491c4a5dbba
lea r12, [r12 + r14*8 - 0x72c194e3]
mov r9, r12
and r9, 0x2903f68a
js 0x1407829c6
jbe 0x1407dc46d
seto r10b
shr r12, 0xf
sub r9b, 0x92
lea rbx, [rbx + 0x6bb0fa9]
and r9w, 0xee0a
movsx r9w, r14b
xor r10, 0xffffffffbb8efb3a
mov qword [rsp + 0x38], r12
xor r9d, 0x599304be
mov qword [rsp + 0x50], r9
push r15
xchg qword [rsp + r9 - 0x7893fa9c], rbx
mov r9, qword [rsp + 0x48]
or dword [rsp + 0x40], 0x7620eb2b
mov r15, r12
js 0x1406e945d
sete byte [rsp + 0x58]
movsx r15w, r15b
mov r12, qword [rsp + 0x50]
bswap r14d
jl 0x1406d96d2
test dword [rsp + 0x40], 0x2a1f1c81
call fcn.140803d9c
xchg qword [rsp + 0x28], rbx
mov r15, qword [rsp + r15 + 0x10]
not word [rsp + 8]
cmp r10w, 0x6709
movsxd r10, r10d
jl 0x14079b45b
Function at 0x1406df870
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + r13 + 0x38]
mov rdx, qword [rdx + r13]
movabs r9, 0xa136c28ff512851f
movabs rbx, 0x8833f49d841a9dab
jl fcn.1406e8e13
xor ebx, 0x610d01a6
shr ebx, 0xf5
lea rdx, [rdx + rbx + 0x17b7b85a]
jae 0x1407c472f
test rbx, rbx
not rbx
not rbx
xchg qword [rsp + r13 + 0x50], rdx
mov r9, qword [rsp + 0x30]
call fcn.1406d40f0
jl 0x14080123b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
ret
push r12
lea rdx, [rdx + 1]
call fcn.1407733f1

Function at 0x1406e0850
Capabilities:
Packed with generic packer

Disassembly:
test qword [rsp + rbp + 0x18], 0x7a88f338
jg fcn.1407e2741
setne byte [rsp + rbp*8 + 0x18]
lea rdi, [rdi + rbp - 0x4f42315e]
mov dword [rsp + rbp*2 + 8], 0x9022b38
add qword [rsp + rbp], 0xa23f0
test bpl, 0xbb
ret 0x10
add qword [rsp + 0x18], 0x10a6c
movabs rdi, 0x718ffe8fc636101b
lea rdi, [rdi + rbp*2 + 0x43b635ab]
neg word [rsp + 8]
shl dil, 0xe2
sub rdi, 0x55bd7f9f
mov rdi, qword [rsp + rbp + 0x18]
mov rdi, qword [rdi + rbp]
mov qword [rsp + rbp*4 + 0x18], rbp
sub byte [rsp + rbp + 8], bpl
jge 0x1406e0850

Function at 0x1406e0d47
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1407fb9b4
cmpsd dword [rsi], dword [rdi]
invalid
or r11, 0xffffffff81012b25
jge 0x14074909e
sub edi, dword [rsp + 0x43]
mov qword [rsp + r11*2 + 0x54b9aa06], r14
setne byte [rsp + rdi - 0x5dc5ae41]
xchg qword [rsp + 0x60], rbx
mov r14, qword [rsp + r11 + 0x2a5cd4fb]
jns 0x1407d907a
call fcn.1406d4e71
sets dl
lea r8, [r12 + r8 - 0x141e5c50]
lea rax, [rax + 0x2dbc379e]
test byte [rsp + 0x2b], r8b
jl 0x14076b21f
setno dl
or r8w, dx
jbe 0x1407f7070
add r8w, word [rsp + 0x2a]
xchg qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x30]
call fcn.1407a5be8
shl sil, 0x32
neg si
shl dword [rsp + 0x50], 0xa6
call fcn.140787898
test word [rsp + 0x10], di
xchg qword [rsp + 0x30], rax
mov r11, qword [rsp]
jo 0x1407a55fe
and word [rsp + 0x18], bp
mov rbp, qword [rsp + 0x28]
js 0x1406de91c
not byte [rsp + 0x10]
je 0x1406e7d9a
or dil, byte [rsp + 0x15]
mov qword [rsp + 0x18], rdi
call fcn.1407d1780
xchg qword [rsp + 0x20], rdi
neg r8
or r8, 0xffffffffc00a11a4
test r11b, r8b
jo 0x14074d490
mov r11, qword [rsp + r8 + 0x29a04234]
mov qword [rsp + 0x18], rdi
sub r8b, 0x3b
call fcn.140001313
shr qword [rsp + 0x28], 1
jge 0x1406da379
shl r10, 0x65
neg r10b
jno 0x1407c66c1
sete r11b
neg word [rsp + 0x50]
call fcn.14075a0c0
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbp
call fcn.1406df328
in al, 0xe7
retf 0xf7e
push r11
js 0x1407b7cb7
add bl, 0x11
call fcn.1406e08fa
cmovno r11w, word [rsp + r15 + 0x7c337835]
add qword [rsp + 0x28], 0xffffffffbf83de96
mov r15, qword [rsp + 8]
pop rdx
sub byte [rsp + 0x60], r11b
jo 0x1407d2605
shr word [rsp + 0x28], 0xb8
mov r11, qword [rsp + 0x30]
je 0x1407ab909
ja fcn.14075c464
call fcn.1406d4bbf

Function at 0x14074f93d
Capabilities:
Packed with generic packer

Disassembly:
mov dword [rsp + 0x50], 0x51054981
call fcn.140807d2d

Function at 0x1407584a8
Capabilities:
Packed with generic packer

Disassembly:
neg byte [rsp + 0x38]
xor byte [rsp + 0x38], 0x89
setle bl
call fcn.1406eff25
Function at 0x1407584b9
Capabilities:
Packed with generic packer

Disassembly:
push r10
pushfq
or r12b, 0xb4
xchg qword [rsp + 0x28], rdx
jge 0x140801201
push rdx
movabs r10, 0x69a788082f3e6433
push rbp
movabs rdx, 0x691e52052c065db5
movabs rbp, 0x178c21a02cb637a1
mov rdx, qword [rsp + 8]
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdx
or r10d, 0x78b4a23a
sub ebp, ebp
shl r10b, 0x7e
add rbp, rbp
add qword [rsp + 0x20], 0x8e3f3
movabs rdx, 0x3921b9b89019922
not bp
call fcn.1407ecd6f

Function at 0x14076e457
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x60], rbp
mov r8, qword [rsp + 0x40]
add qword [rsp + r12*2 - 0x10fe0], 0xffffffffbf86c392
mov dword [rsp + 0x58], 0xcc10caa4
cmp r12w, 0x7809
jo 0x14078f067
js 0x14079e4c0
test di, 0xa406
mov r12, qword [rsp + r12 - 0x87c8]
call fcn.1407834c0
and al, 0xb5
rol esp, 0xab
invalid

Function at 0x140779b94
Capabilities:
Authenticate hmac

Disassembly:
shl r8d, 0xaa
add r8d, dword [rsp + 0x5c]
add dword [rsp + 0x58], 0x9f87b91d
test r8d, 0x60044735
jno 0x1407bf692
sub word [rsp + 0x58], r8w
call fcn.1406d5ea6

Function at 0x14077d2f1
Capabilities:
Get thread local storage value

Disassembly:
and r11b, 0x84
mov word [rsp + 0x10], cx
xchg qword [rsp + 0x38], rbp
mov r10, qword [rsp + r10*2 - 0x584f7c2a]
jle 0x1407dc3f5
bswap r11
or dword [rsp + 0x10], ecx
add qword [rsp], 0xffffffffffffefbb
call fcn.1406dda78

Function at 0x14077d30d
Capabilities:
Get thread local storage value

Disassembly:
add dword [rax - 0x75], ecx
sbb eax, 0x6c3102
test rbx, rbx
je 0x140005bec
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140005be6
test eax, eax
jne 0x140005be6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140005bbe
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add qword [rsp + r15 - 0x88f99f1], 0x53533
xor r14d, 0xf91270ae
mov qword [rsp + r14 - 0xe621668], rcx
movabs r11, 0x33223a1f6297083d
jno 0x140005bb6
invalid

Function at 0x14078294c
Capabilities:
Packed with generic packer

Disassembly:
test bl, r12b
setb r12b
jo 0x1407b2ac5
add qword [rsp + 0x10], 0xffffffffbf80c237
mov rbx, qword [rsp + r14 - 0xbd2031a]
add qword [rsp + 0x18], 0xffffffffbf817309
mov r10, qword [rsp + 0x30]
bswap r12
not r8
call fcn.1406eecbb
push r14
pushfq
add qword [rsp + 0x10], 0xffffffffbf7eef70
movabs r14, 0xe28611884b3f5a25
sub r14, 0x3d9315ae
lea r14, [r14*4 - 0xc2e473]
xor r14w, 0x8001
shl r14d, 0xe5
mov qword [rsp + 0x10], 0xffffffffcc43e5cf
mov r14, qword [rsp + 8]
je 0x1406d9c4a
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14080de8f
bswap r14d
mov qword [rsp + 0x28], rbx
lea rsi, [rsi - 0x11e290c8]
shr r12w, 0x87
mov r8, qword [rsp + rdi*2 - 0x7ee829d8]
push r10
add word [rsp + 0x30], r14w
xor edi, dword [rsp + 0x34]
bswap rdi
xchg qword [rsp + 0x58], rsi
mov rdi, qword [rsp + 0x38]
xor byte [rsp + 0x30], 0x3f
xor r12w, word [rsp + r14 - 0xbd20325]
jne 0x1406d9bf6
Function at 0x1407936b5
Capabilities:
Packed with generic packer

Disassembly:
lea rdx, [rdx + rdx - 0x4aca2154]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rdx
not word [rsp + r15 - 0x3c6f2d48]
push rsi
jae 0x1406e0cff
cmp r15b, byte [rsp + r15 - 0x3c6f2d39]
push rdx
movabs rdx, 0x2922d7278f9ed8af
push rbx
shr r15d, 0xe2
not r15b
push qword [rsp + r15 - 0x3c6f2d9e]
popfq
mov qword [rsp + 0x38], rbx
movabs rbx, 0x6ea6d496611ca13b
mov bl, 0xb8
pushfq
shl bl, 0x2b
add r15b, 0x82
push r13
jne 0x14078026c

Function at 0x14079a804
Capabilities:
Packed with generic packer

Disassembly:
or word [rsp + 0x10], 0x7310
setg byte [rsp + 0x10]

Function at 0x1407a2324
Capabilities:
Encode data using xor

Disassembly:
test byte [rsp + r12 + 0x5fcefc53], 0x99
call fcn.1407bd9fa
lea r14, [r14 + r14*8 - 0xb6eadeb]
lea r14, [r14 + r14*2 - 0x176acf50]
jbe 0x140773487
lea rbp, [rbp - 0x71e56d68]
jo 0x14074b00d
jns 0x140801759
mov es, word [rcx + 0x6c]
fcomp qword [rsi]
out dx, al
sahf
scasd eax, dword [rdi]
cld
mov bl, 0x1e
xor byte [rbx + rbp*2 - 0x52c348da], ah
mov eax, 0xc679bfcc
xor al, 0x25
movabs al, byte [0x9ece3c8c0fbe9484]
pop rsp
cmp esp, dword [rbx + 0x4c]
and byte [rdx + rax*4], bl
jns 0x1407a2358
movsd dword [rdi], dword [rsi]
push rcx
rcr dword [rax], 1
retf 0x91b9
not r14w
and word [rsp + 0x10], 0x1d21
neg r14d
not r14w
push rsi
mov rsi, qword [rsp + 0x20]
mov esi, 0x851473ae
xchg qword [rsp + 0x38], rbp
mov rsi, qword [rsp]
or dword [rsp + 0x20], r14d
xor byte [rsp + 0x20], 0xa6
call fcn.1407d3a34
or eax, 0x9ee60d6e
fdivr dword [rax]
and al, byte [rcx - 9]
neg r10d
push r15
mov r10, qword [rsp + r10 - 0x6bcda5c4]
mov qword [rsp + 0x18], 0xffffffffc0ee7acf
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14080de8f

Function at 0x1407a266a
Capabilities:
Get thread local storage value

Disassembly:
movabs r15, 0x5e9d8a861d297fb4
setg r15b
add r14, qword [rsp + 0x40]
cmp r13d, dword [rsp + 0x20]
lea r13, [r13 + r13*2 + 0x758e072b]
mov rbp, qword [rsp + 0x28]
not qword [rsp + 0x20]
jg 0x140005bc5

Function at 0x1407a57cb
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs r8, 0x5acf2badeb73d25
movabs rbx, 0x6ea922bddf3f5427
add qword [rsp + 8], 0x10cbb2
and bx, 0x6b34
mov rbp, qword [rsp + 0x28]
add r8, rbx
not r8d
setae bl
lea r8, [rbx*2 - 0x5cea12f2]
test r8w, 0x3f1e
lea rbp, [rbp + 1]
jbe 0x1407dcddf
neg ebx
setl bl
ja 0x1406d54a6
test rbx, 0xffffffffcb8716bf
sete r8b
shr ebx, 0xb8
call fcn.1406e85d0
Function at 0x1407b0892
Capabilities:
Packed with generic packer

Disassembly:
lea r9, [r9*2 - 0x4dd6db59]
setl r9b
call fcn.140769663
push rdi
call fcn.1407be39e
jae 0x1406df816
cmp dx, r11w
call fcn.14076b328
sub dword [rsp + 0x68], 0x9fb5bfa6
jg 0x1407b8ecc
movsxd rbx, dword [rsp + 0x40]
not r10b
ja 0x14076b303
sub r14b, byte [rsp + 3]
setae byte [rsp + rbx + 0x68c00000]
xchg qword [rsp + 0x50], rdi
mov r10, qword [rsp + 0x18]
cmp qword [rsp + rbx + 0x68c00000], 0xffffffffec80e38b
call fcn.1407cf0a8
or byte [rcx - 0x8e7c4f6], bh
cmp eax, 0xb45aa070
nop
and dl, dl
cld
or byte [rdi - 0x36], al
sbb dl, byte [rax + 0x5865ea81]
xlatb
retf 0x2885
test qword [rsp + 0x70], rdx
jle 0x1406edf41
sub word [rsp + 0x28], 0x28b3
jns 0x1407a5bf8
test word [rsp + 0x60], 0x2c16
mov r13, qword [rsp + 0x50]
call fcn.1407f25af
jle 0x1407e1595
cmp word [rsp + 0x30], r9w
je 0x14077bbce
mov r9, qword [rsp + 0x60]
jl 0x1407c5015
sub cl, ch
jbe 0x1406dcf20
test qword [rsp + 0x50], 0xffffffffbd878913
mov rcx, qword [rsp + 0x58]
mov byte [rsp + 0x50], 0x9b
call fcn.1406dd0e9
and bh, dh
movsd dword [rdi], dword [rsi]
invalid
add word [rsp + 0x70], 0xcf14
mov r12, qword [rsp + rdi*4 - 0x76992578]
test r11w, 0x509d
js 0x1407ec7cf
jne 0x140760f7e
pushfq
movabs r9, 0x99b9c98288fb7b3
xor r9d, 0xd9863128
jns fcn.1407a6366
mov qword [rsp + 0x10], rax
not r9w
test r9, 0x72900227
jns 0x1406d4970
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.14080de8f
or esi, 0xee1fe80d
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov qword [rsp + rbx*2 + 0x7ecda1e], rbx
add rbx, qword [rsp + 0x20]
mov dword [rsp + rbx*2 + 0xfd9b41c], 0x512fa5ba
lea rdx, [rdx + rbx + 0x1523a726]
mov bx, word [rsp + rbx*8 + 0x3f66d016]
setne sil
je 0x1407740ca
test esi, ebx
push r8
call fcn.1407bcaa5
push rbp
xchg edx, eax
sub al, 0x5c
invalid

Function at 0x1407b08af
Capabilities:
Packed with generic packer

Disassembly:
neg r8
neg r12
sub r8d, 0xce037ca6
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r12, r8
call fcn.1407637b7

Function at 0x1407c72b2
Capabilities:
Packed with generic packer

Disassembly:
push rcx
push r14
push r11
pushfq
movabs r11, 0x2baa31a4338ce69b
mov r14, r11
test r14b, 0x89
jle 0x1407e277b
xor ecx, dword [rsp + 0x22]
push qword [rsp + 0x50]
popfq
mov r10, qword [rsp + 0x40]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x18]
mov r8, qword [rsp + rcx - 0x9b8f403]
lea rsp, [rsp + rcx*2 - 0x1371e7ce]
ret 8
push r13
mov rcx, qword [rsp + 0x28]
setne r11b
push rdx
push rcx
movabs r14, 0xcfb51c249e28688b
sub r14b, 0x87
test r11w, r14w
mov rcx, r14
mov rcx, qword [rsp]
lea rcx, [rcx + 1]
jge 0x14078a7e1

Function at 0x1407dcde4
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x24d68
push 0xffffffff8eb438a7
add byte [rsp + rcx], ch
cmovno esi, ebx
jo 0x140789dc0

Function at 0x1407ffc78
Capabilities:
Encode data using xor

Disassembly:
setge r10b
movabs r9, 0x4b449133022163b
jno 0x1407a898b