joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a1e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x5be0cd19
ret

Function at 0x14004c050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x60], 0
je 0x14004c06e
cmp qword [rsp + 0x68], 0
jne 0x14004c075
xor eax, eax
jmp 0x14004c1a1
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp], 0
jmp 0x14004c116
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x14004c19f
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14004c15e
inc rax
test dl, dl
jne 0x14004c14b
xor eax, eax
jmp 0x14004c163
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14004c19a
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax*2]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
jmp 0x14004c1a1
jmp 0x14004c10e
xor eax, eax
add rsp, 0x58
ret
Function at 0x14004c440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400cad28]
mov qword [rsp + 0x98], rax
mov eax, 3
mov word [rsp + 0x42], ax
mov eax, 0x32
mov word [rsp + 0x44], ax
mov eax, 0xb
mov word [rsp + 0x46], ax
mov eax, 0x14
mov word [rsp + 0x48], ax
mov eax, 0x18
mov word [rsp + 0x4a], ax
mov eax, 0x5b
mov word [rsp + 0x4c], ax
mov eax, 0x7e
mov word [rsp + 0x4e], ax
mov eax, 0x5d
mov word [rsp + 0x50], ax
mov eax, 0xa
mov word [rsp + 0x52], ax
mov eax, 0x22
mov word [rsp + 0x54], ax
mov eax, 2
mov word [rsp + 0x56], ax
mov eax, 0x54
mov word [rsp + 0x58], ax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x42]
call fcn.140020040
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call qword [rsp + 0x98]
mov qword [0x1400cad10], rax
lea rcx, [rsp + 0x100]
call fcn.140014190
mov byte [rsp + 0x2e], 0x13
mov byte [rsp + 0x2f], 0x35
mov byte [rsp + 0x30], 3
mov byte [rsp + 0x31], 0x15
mov byte [rsp + 0x32], 0x15
mov byte [rsp + 0x33], 6
mov byte [rsp + 0x34], 0x28
mov byte [rsp + 0x35], 0x3f
mov byte [rsp + 0x36], 7
mov byte [rsp + 0x37], 0x20
mov byte [rsp + 0x38], 0xb
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x3a], 6
mov byte [rsp + 0x3b], 0
mov byte [rsp + 0x3c], 0x2b
mov byte [rsp + 0x3d], 0x2d
mov byte [rsp + 0x3e], 0x1b
mov byte [rsp + 0x3f], 3
mov byte [rsp + 0x40], 0x74
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x2e]
call fcn.1400202e0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400cad10]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
call fcn.14004c050
mov qword [0x1400cad38], rax
lea rcx, [rsp + 0x118]
call fcn.140002640
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x32
mov byte [rsp + 0x22], 0xb
mov byte [rsp + 0x23], 0x14
mov byte [rsp + 0x24], 0x18
mov byte [rsp + 0x25], 0x2d
mov byte [rsp + 0x26], 0x34
mov byte [rsp + 0x27], 0x16
mov byte [rsp + 0x28], 0xd
mov byte [rsp + 0x29], 0x3b
mov byte [rsp + 0x2a], 0x1a
mov byte [rsp + 0x2b], 0x31
mov byte [rsp + 0x2c], 0x3e
mov byte [rsp + 0x2d], 0x41
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
call fcn.14001fef0
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400cad10]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xe8]
call fcn.14004c050
mov qword [0x1400cacf8], rax
lea rcx, [rsp + 0x130]
call fcn.140002640
add rsp, 0x158
ret
Function at 0x180002d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
sub eax, 0x297d
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x21d2
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
add eax, 0x104f
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x8a4
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x8b
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
sub eax, 0xab
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
add eax, 0x1362
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x19b1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0xc34
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x3460
cmp dword [rsp + 0x28], eax
je 0x180002e34
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0x2540
mov dword [rsp + 0x24], eax
jmp 0x180002ed3
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e50
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ed3
mov eax, dword [rsp + 0x38]
sub eax, 0x1c5f
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x15b2
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e45
mov eax, dword [rsp + 0x2c]
sub eax, 0x65c
add rsp, 0x68
ret
Function at 0x180004680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0x28d2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
add eax, 0x331
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x297d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x297d
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x2d13
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0xc9c
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xdbc
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
add eax, 0x2f2
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0x3177
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
sub eax, 0x3f3
cmp dword [rsp + 0x2c], eax
jle 0x180004817
mov eax, dword [rsp + 0x24]
add eax, 0x1d1
cmp dword [rsp + 0x2c], eax
jge 0x180004765
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b0020]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x2d13
mov dword [rsp + 0x20], eax
jmp 0x180004817
mov eax, dword [rsp + 0x30]
or eax, 0x192e
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x180004817
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004795
mov eax, dword [rsp + 0x28]
add eax, 4
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x180004817
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x16b3
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x18000478a
mov eax, dword [rsp + 0x3c]
sub eax, 0x149
add rsp, 0x68
ret
Function at 0x180008250
Capabilities:
Get file attributes
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
sub eax, 0x27d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
xor eax, 0x3435
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
add eax, 0x136e
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x10b4
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
add eax, 0xc9
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xc20
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x78]
add eax, 0x12ca
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xb1f
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x9ed
cmp dword [rsp + 0x20], eax
je 0x1800082f2
mov eax, dword [rsp + 0x20]
xor eax, 0x7c6
mov dword [rsp + 0x20], eax
jmp 0x180008345
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x180008307
mov eax, dword [rsp + 0x24]
add eax, 2
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
and eax, 0x2d13
mov rcx, qword [rsp + 0x70]
or eax, dword [rcx + 0x90]
cmp dword [rsp + 0x24], eax
jb 0x180008345
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1800082fc
mov eax, dword [rsp + 0x28]
sub eax, 0x101
add rsp, 0x58
ret
Function at 0x1800215b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0xa8]
sub eax, 0x2540
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa8]
xor eax, 0x3ce5
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x90]
sub eax, 0xfa2
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x2286
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
sub eax, 0xcd4
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x19b1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
sub eax, 0xfa2
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
xor eax, 0x3869
cmp dword [rsp + 0x2c], eax
jg 0x1800217fd
mov eax, dword [rsp + 0x20]
xor eax, 0x2d13
cmp dword [rsp + 0x34], eax
jg 0x1800216cc
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0x88]
xor eax, 0x1663b7
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
imul ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x20]
add eax, 0x26d3
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
mov dword [rax + 0x64], ecx
jmp 0x1800217fd
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
imul eax, dword [rcx + 0x48]
add eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jb 0x1800217fd
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x180021706
mov eax, dword [rsp + 0x24]
add eax, 4
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x2c]
add eax, 0x32d3
cmp dword [rsp + 0x24], eax
jae 0x1800217fd
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0xb8]
mov dword [rsp + 0x28], eax
jmp 0x180021749
mov eax, dword [rsp + 0x28]
add eax, 3
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x90]
sub eax, 0x2286
cmp dword [rsp + 0x28], eax
jae 0x1800217f8
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x50], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0x18]
mov eax, dword [rcx + rax + 0xb8]
xor eax, edx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [rsp + 0x2c]
xor eax, 0x192e
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x88]
add eax, dword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xb4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xb4], eax
jmp 0x18002173e
jmp 0x1800216fb
mov eax, dword [rsp + 0x30]
add eax, 0x2540
add rsp, 0x68
ret
Function at 0x1404fc3f3
Capabilities:
Encode data using xor

Disassembly:
jne 0x140a73349
call 0x1405abaca

Function at 0x140551d1c
Capabilities:
Encode data using xor

Disassembly:
and qword [rsp + 0x18], 0x29ec4ae9
or bpl, 0xa6
mov rbp, qword [rsp + 0x30]
xor word [rsp + 0x18], 0x66e7
test qword [rsp + 0x18], 0xd16e3
not qword [rsp + 0x18]
setns byte [rsp + 0x18]
test qword [rsp + 0x38], 0x3f0814af
jle 0x140551d29
add word [rsp + 0x38], 0x6ff0
mov qword [rsp + 0x18], 0x67da73c8
call fcn.14056209b
adc byte [rax], bh
invalid

Function at 0x1409a6c5d
Capabilities:
Encode data using add xor sub operations

Disassembly:
not r8
cmovne r8d, r9d
or qword [rsp + 0x38], 0x592c4be2
not byte [rsp + 0x38]
not r8d
sub dword [rsp + 0x38], 0x4c7c79f8
test r8, 0x6d255773
jge 0x1409bb547
add qword [rsp], 0x45644
lea r8, [r8 + r9 + 0x35b56328]
bswap r9d
test r8d, 0x4bf5592f
cmova r8, qword [rsp + 0x38]
xor r8b, byte [rsp + 0x1d]
mov r14, qword [rsp + 0x48]
or si, 0x8aa
call fcn.1405407c8

Function at 0x1409a6c89
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r13, qword [rsp + 0x18]
not bl
lea rcx, [r10*2 + 0x76fe4c04]
lea r15, [r15*2 + 0x6ea374d8]
setge bl
setl byte [rsp + 0x18]
mov rsi, qword [rsp + 0x78]
or word [rsp + 0x18], 0x64d3
not rbx
xor ebx, 0x740b1d00
bswap r11
bswap r11d
sub ebp, ebx
and bl, 0x4f
seta byte [rsp + 0x18]
and al, 0x18
and r10, qword [rsp + 0x18]
add qword [rsp + 0x70], 0x4a2b95
sub ebp, 0x3c5022be
or r13b, 0x43
or rbp, r10
or r15, r13
xor cx, 0x7c51
neg r10w
mov r10b, r11b
test qword [rsp + 0x18], r14
setne cl
call fcn.140a4870a
loop 0x1409a6ccb
invalid

Function at 0x1409ae0df
Capabilities:
Encode data using xor

Disassembly:
bswap r9d
js 0x14051280e
test r9d, r9d
mov r9d, 0x285f35d9
js 0x1409ae0eb
not r9d
or r9d, 0x47a50c1a
sub r9b, 0xbe
test r9b, r9b
jg 0x1405127f5
test r9d, 0x61223920
call fcn.140999d3f
call fcn.140557310

Function at 0x1409d3585
Capabilities:
Encode data using xor

Disassembly:
jno 0x140a55042
mov rcx, r10
neg rcx
test byte [rsp + 0x20], r10b
movzx cx, bp
mov rcx, qword [rsp + 0x20]
call fcn.140a16a01
cmovbe ebp, r12d
cmp r9b, 0x58
not bpl
push r11
bswap ebp
mov r11, r12
lea r11, [rbp + r9*8 + 0x19d94373]
setge bpl
mov r9b, 0xa4
movzx ebp, bp
cmp r12b, r9b
setne bpl
push r12
push 0x37122201
call fcn.1404ee799
cmp ah, ch
jl 0x140a017a4
mov r13, rdi
xor r12b, r13b
test r13w, 0x2d4b
jle 0x1409a87cc
mov r11, qword [rsp + 0x20]
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0x145ec1e8
mov rbp, qword [rsp + 0x20]
xor bp, word [rsp + 0x20]
push r10
and byte [rcx + 0x52], al
mov r10, r11
add qword [rsp + 8], 0x501623
xor r13d, ebp
mov r11d, dword [rsp + 0x29]
call fcn.1409b6889
sbb ch, byte [rax]
xor esp, dword [rbp - 0x6b324972]
push rcx
js 0x140a5503a
je 0x140a55070
xlatb
wait
jb 0x140a550ca
clc
sar dword [rdi - 0x3b205d9b], cl
invalid
mov edx, dword [rcx + 6]
jbe 0x140a55098
wait
mov byte [rax - 0x28403306], al
add al, 0xdd
fisttp dword [rsi]
and eax, 0x921fb771
fsub qword [rbx + 0x3e]
push rsp
invalid
Function at 0x1409df4b4
Capabilities:
Authenticate hmac

Disassembly:
js fcn.140a18233
mov r11, r8
lea r11, [rcx*8 + 0x19eb284d]
mov r8, qword [rsp + 0x68]
call fcn.140990ceb

Function at 0x140a1f4ea
Capabilities:
Encode data using xor

Disassembly:
test byte [rsp + 0x20], bl
call int.1409d771b
invalid

Function at 0x140a4cec5
Capabilities:
Encode data using xor

Disassembly:
setne r12b
movzx r12, sil
cmp r12, 0x18ae3d0f
not rsi
mov rsi, qword [rsp + 0x30]
setbe r12b
neg r12w
test r12w, 0x7538
setle r12b
add r12w, 0x125e
test r12, r12
movzx r12, r12b
jl 0x140595cff
neg r12
test r12, 0x77530ce2
setbe r12b
xor r12w, 0x372b

Function at 0x140a6a09a
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x300b4a2e
invalid
ror dword [rbp + rdx*8 + 0x50d113e0], 1
and dword [rsi + 0x25], 0x460f44d1
and al, 8
push 0x60a87d01
bswap r9
add qword [rsp + 8], 0x177c2
add r9w, dx
lea rsp, [rsp + 8]
ret 8
and r9b, r8b
jns 0x14099f294
jge 0x140500350
stosb byte [rdi], al
mov esi, 0xc741ff47
jl 0x14050028b
push rbp
mov esp, edi
jl 0x1405002c4
invalid
push rbx
invalid
movabs rdi, 0x3f7e18c20cf2231a
movabs rbp, 0x8582f2a3f5151b6
movsx bx, bl
push rcx
not bp
call fcn.14098665c
adc al, byte [rbx + 0x784ebd25]
int3
not rbx
mov cl, 0x31
sub rbp, 0x1e5614a
test cl, bl
push r11
lea rcx, [rcx + rbx + 0x423d487f]
call fcn.140981d56
not bp
lea rbp, [rbp + rsi*4 + 0x7f960d41]
lea rsi, [rsi + rbp*4 + 0x658f5266]
call fcn.1405407cd
pop r13
not dword [rsp + 8]
jg 0x1409b214f
add r8, r9
cmp r8b, 0xfe
lea r9, [r9*2 + 0x4e902c16]
mov dword [rsp + 0x18], 0x726e1102
not byte [rsp + 0x18]
jge 0x1405002f7
add qword [rsp + 0x30], 0xfffffffffffc8c22
and word [rsp + 8], 0x3b65
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x30]
ret
mov rdi, qword [rsp + 0x18]
not r11w
lea r11, [r11*4 + 0x1cf31bfb]
setns r11b
seto r11b
jb fcn.1409c62da
add qword [rsp + 8], 0xfffffffffff0bbd5
movzx r11, r11b
call fcn.1409ac4b5
add byte [rsp + 0x60], 0x44
js 0x140991ed1
and dword [rsp + 0x60], 0x54de32c6
test word [rsp + 0x78], 0x78be
not byte [rsp + 0x78]
jbe 0x140981d62
setb byte [rsp + 0x60]
add qword [rsp + 0x48], 0xffffffffbf5dcdc7
cmp byte [rsp + 0x60], 0xd1
call fcn.1409ce99f
jge 0x1409a868c
mov r12, qword [rsp + 0x18]
movsx edi, r11b
test di, di
mov r11d, 0x456b7eed
setae r11b
movzx edi, r11w
sub r11w, 0x647c
not r11b
test r11d, 0x5964095a
mov r11, rdi
bswap r11
not dil
lea rdi, [rdi + 0x38373388]
js 0x140a2cbda
bswap rdi
not di
neg di
xor r11, 0x70797025
add qword [rsp + 0x10], 0xfffffffffffcfa77
call fcn.140525070

Function at 0x140a6ba69
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 0x30]
push rcx
mov r8, qword [rsp + 0x38]
sub edi, 0x7d2d43c7
lea rdi, [r11 + r9*8 + 0x105f70c4]
push rbx
cmovno r8, rdi
cmp r11d, r8d
push rsi
not di
Function at 0x140a7754c
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [rsp + 8]
add qword [rsp + 8], r11
xor r13d, r12d
xor word [rsp + 8], r12w
bswap r13
push 0x17da5202
setns r13b
bswap r10d
mov r10, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0x25cece62
push rbp
cmp r13d, dword [rsp + 0x19]
push r8
movzx edx, r13b
setae r11b
push r9
and dx, word [rsp + 0x36]
movabs r9, 0x25cd058622721e95
test byte [rsp + 0x28], 0xa3
push r10
setne byte [rsp + 0x38]
cmp word [rsp + 0x30], 0x19d3
movzx r11w, byte [rsp + 0x21]
lea r11, [r12*8 + 0x287d736f]
call fcn.1409df38f

Function at 0x140a79606
Capabilities:
Encode data using xor

Disassembly:
jns 0x140524feb
push 0x5c9523b
neg bp
xor qword [rsp], 0x24fb41a5
sub r13b, 0x9d
mov r13, qword [rsp + 0x28]

Function at 0x140b9e88c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
mov rdx, rdi
mov bx, 0x3dcd
push r13
lahf
rdtsc
cbw
push rbp
cwd
movzx rax, cx
movabs rdi, 0
push rdi
setne r9b
movzx bx, spl
mov r9, qword [rsp + 0x90]
movsxd r11, edi
dec r9d
bswap r9d
xchg r11, rax
rol r9d, 1
and bx, sp
xor r9d, 0x5cf92f46
rcl ebp, cl
lahf
add r9d, 0x7fad0615
movzx dx, dil
rcr rbp, cl
xor r9d, 0x5cdb1ce6
inc r9d
rdtsc
shl bl, cl
xor r9d, 0x208f4558
rcr r11w, cl
rol rbp, 0xc8
clc
rol r9d, 1
sub dl, 7
sar r11b, 0xd
cbw
add r9, rdi
not di
movabs rdi, 0x100000000
add r9, rdi
shrd bp, r9w, 0x62
movzx rax, si
mov r11, rsp
sub rsp, 0x180
cmp rax, 0x7448299c
ror dx, 0x77
rol ebp, 0x65
and rsp, 0xfffffffffffffff0
cmovb bx, r11w
mov rbx, r9
cdqe
shl rax, 0x97
movabs rax, 0
movsx rbp, r9w
sub rbx, rax
add rdx, rcx
rcl dx, cl
lea rbp, [0x140a8e557]
btc rdx, 0x48
cmp r13w, 0x70e9
sub r9, 4
cmc
dec dx
mov edx, dword [r9]
jmp 0x140ab24f0
dec edx
jmp 0x140b3fcf9
xor edx, ebx
rol edx, 2
jmp 0x140a9ee80
jmp rbp
inc edx
jmp 0x140b828d3
push rdx
cqo
push rdi
movsx dx, dil
push r8
bswap edx
cmovle dx, r14w
not dh
push r10
push r12
mov edi, 0x365c7885
bswap edx
push r15
cdq
movsxd rdx, esp
pushfq
push r9
push rbx
push r11
push r14
push rcx
jmp 0x140a8e470
bswap edx
jmp 0x140b2c2e2
ror edx, 3
cmc
test rax, 0x205c4298
push rbx
clc
sar bx, cl
xor dword [rsp], edx
pop rbx
movsxd rdx, edx
clc
add rbp, rdx
jmp 0x140ac7b14
push rsi
jmp 0x140b3dd60