joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002670
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
push r15
mov r14d, ecx
nop dword [rax]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
cmp edx, 0x811c9dc5
jne 0x14000274e
mov rdi, qword [r15 + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov rcx, qword [rax + rdi + 0x88]
mov r12, rcx
mov ebp, ecx
shr r12, 0x20
add rbp, rdi
cmp rbp, rdi
je 0x14000274e
mov esi, dword [rbp + 0x18]
xor ebx, ebx
test esi, esi
je 0x14000274e
mov r11d, dword [rbp + 0x20]
add r11, rdi
nop dword [rax]
mov eax, dword [r11]
mov r10d, 0x811c9dc5
add rax, rdi
movzx r9d, byte [rax]
inc rax
test r9b, r9b
je 0x14000273f
nop dword [rax + rax]
movsx ecx, r9b
lea rax, [rax + 1]
sub r9b, 0x41
mov r8d, ecx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rax - 1]
cmova r8d, ecx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140002710
cmp r10d, r14d
je 0x140002756
inc ebx
add r11, 4
cmp ebx, esi
jb 0x1400026f0
mov r15, qword [r15]
jmp 0x1400026b0
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x1c]
add rax, rdi
add rcx, rdi
movzx edx, word [rax + rbx*2]
mov r8d, dword [rcx + rdx*4]
add r8, rdi
cmp r8, rbp
jbe 0x140002788
lea rax, [r12 + rbp]
cmp r8, rax
jae 0x140002788
mov edx, 0x811c9dc5
mov r14d, edx
jmp 0x140002690
mov rbx, qword [rsp + 0x28]
mov rax, r8
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r12
pop rdi
ret

Function at 0x14000616f
Capabilities:
Encode data using xor

Disassembly:
pushfq
push r11
movabs r11, 0x49b619ad918f310
xor r11d, 0xe2295e07
mov qword [rsp + 0x18], 0xffffffffa6c79753
mov r11, qword [rsp + r11*2 - 0x76635a2e]
jo 0x140006170
jne 0x1406d6faa

Function at 0x14000d710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14009b010]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [rbp - 0x58], r9
mov r15, r8
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x78], rdx
xor r13d, r13d
mov dword [rsp + 0x34], r13d
mov dword [rbp - 0x20], r13d
xor r8d, r8d
lea r9, [rbp - 0x20]
mov dl, 1
mov rcx, r15

Function at 0x1400147c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400147f4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400147e0
ret
Function at 0x1400252d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x14008f1f0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140025349
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400252f0
test r8, r8
je 0x14002536d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140025350
not ecx
mov eax, ecx
ret
Function at 0x14002b1d0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x140090290]
jmp 0x14088e304
Function at 0x140358a94
Capabilities:
Encode data using xor

Disassembly:
not r12
not r15b
jne 0x1403dfd5e

Function at 0x140363aa4
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r15, 0xf80701833403f5a7
xchg qword [rsp + 0x18], rax
shl r15b, 0xee
mov r15d, 0xe3ae9b9d
or r15, 0xffffffff8dbb1d30
sub r15, 0xffffffffea184137
push rdi
jb 0x14057b269
mov rdi, r15
mov r15, qword [rsp + rdi*2 - 0xb4ebcf4]
mov qword [rsp + 0x18], rax
sub edi, 0x6291af2a
add qword [rsp + 0x10], 0xffffffffff9b428a

Function at 0x1403703b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1403703cd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140370428
test al, 7
jne 0x1403703c0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1403703e1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140370452
test dh, dh
je 0x14037044c
shr rdx, 0x10
test dl, dl
je 0x140370446
test dh, dh
je 0x140370440
shr rdx, 0x10
test dl, dl
je 0x14037043a
test dh, dh
je 0x140370434
shr edx, 0x10
test dl, dl
je 0x14037042e
test dh, dh
jne 0x1403703e1
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x1403cfa54
Capabilities:
Encode data using xor

Disassembly:
movsb byte [rdi], byte [rsi]
xor esi, dword [rax + rax]
call fcn.140466b0c
call fcn.1405f0497
insd dword [rdi], dx
out 0xa8, eax
mov ebx, 0x7b28a886
fld xword [rbp + 0x42]
xchg byte es:[rdx + rax], ah
insd dword [rdi], dx
jbe 0x1403cfa46
neg sil
insb byte [rdi], dx
fisttp dword [rsi + 0x7266fbee]
invalid
Function at 0x1403e4fb4
Capabilities:
Encode data using xor

Disassembly:
or byte [rdi], cl
mov cs, word [rcx + 0x66000693]
cmp word [rsp + 0x10], r9w
cmp word [rsp + 0x10], r9w
setbe r12b
sub byte [rsp + r12 - 0xef90df1], 0x25
neg sil
add qword [rsp + 0x28], 0xffffffffffed6487
and r12d, 0x22f708
xor rsi, 0xfffffffffb8e2a25
add qword [rsp], 0xffffffffbfcac1c2
sub r9, r12
mov rax, r9
jb fcn.14072501f
not rax
mov rax, qword [rsp + r12*8 - 0x1002fd8]
mov rax, qword [rax + rsi + 0x471dbc6]
jl 0x14064b81f
jle 0x1403e4fad
invalid

Function at 0x1403ed1a8
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax + rsi*2 - 0xffee3d8]
bswap rbx
jns 0x1405caa6d
cmp r14, qword [rsp + 8]
xchg qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x40]
jno 0x140712f7c
invalid
lea rbx, [rbx - 0x37445e63]
add r8w, r8w
call fcn.14050b2b0
shr r8d, 0x48
mov r10w, r14w
call fcn.1405c3e11

Function at 0x1404108ad
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x40], 0x26a3e81e
test word [rsp + 0x40], 0x3a1
push r9
call fcn.1406d8da9

Function at 0x1404108c4
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, byte [rsp + 0x1c]
jg 0x1405c3835
sub qword [rsp + 0x40], 0xffffffffce8deeb3
mov rbx, qword [rsp + 0x68]
jne 0x1406647e1
cmovae rbx, qword [rsp + 8]
test rbx, rbx
jb 0x140896e8a
shr dword [rsp + 8], 6
shl word [rsp + 8], 0xd6
mov rbx, qword [rsp]
call fcn.14054a737
sub eax, 0xe49995bb
invalid
call fcn.1405618f5
mov qword [rsp + 0x20], 0xffffffffe5159353
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 8]
jge 0x1405c3849
push rdx
call fcn.1405ca559
adc eax, 0xbe48569c
or dl, byte [rcx]
add ebx, dword [rdx]
cmp al, 0x5d
and esp, eax
xor si, 0x252c
sub esi, esi
push qword [rsp + rsi + 8]
popfq
mov qword [rsp + 8], 0xffffffffb8f30f87
mov rsi, qword [rsp + rsi]
call fcn.140418bca
movdqa xmm0, xmmword [rbp + 0x2710]
push r15
call fcn.140375da0
pxor xmm0, xmmword [rsp + 0x50]
push rbx
pushfq
movabs rbx, 0xd2a58f1063a94723
shl bx, 0x2c
call fcn.1405f67e5
movdqa xmmword [rsp + 0x50], xmm0
call fcn.14067035a
invalid

Function at 0x14043b030
Capabilities:
Encode data using base64

Disassembly:
setae r9b
xchg qword [rsp + rdx*2 - 0x38a67b2], rax
mov rdx, qword [rsp + r9 + 0x261f]
jle 0x14041083d
sub byte [rsp + r9*2 + 0x4c2e], 7
call fcn.1406b1a75
mov r12d, 0xd71469f9
fdivr dword [rdi + 0x16]
mov edx, esp
mov esi, 0x348a7b74
xchg edi, eax
mov edx, 0xd23abd07
xchg ebx, eax
mov edx, dword [rsi]
mov byte [rdi], bl
mov bh, 0x84
jns 0x14043b0d5
invalid
and ch, bl
push rdi
loopne 0x14043b150
sub rax, 0x4cb17006
or eax, 0xffffffd4
push rsi
cli
invalid
push rsi
ja 0x14043b13c
sub al, 0x78
invalid
jne 0x14043b0f7
ret
push rdx
test al, 0xa7
sbb ebx, ecx
test eax, 0xf0dea534
mov byte [rbp - 0x1a], ah
sti
sub al, byte [rbx - 0xf]
invalid
jge 0x14043b110
ror byte [rbx], 1
or bh, byte [rdx - 0x20]
sub ah, byte [rsi - 0x2ae1b058]
add byte [rax - 0x2af0f204], cl
push qword [rcx + rsi*4 + 0x27]
pop rbx
invalid
Function at 0x140450d55
Capabilities:
Packed with generic packer

Disassembly:
shl r9d, 0x51
jb 0x1403cb0d1
neg r15w
xor byte [rsp + 0x28], 0x17
xchg qword [rsp + 0x58], rcx
mov r15, qword [rsp + 0x48]
cmp r9b, bl
jne 0x140583b53
xor rbx, qword [rsp + 0x28]
call fcn.140481c68

Function at 0x14045727f
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
call fcn.140614d84
test eax, 0x72bdf795
jo fcn.14055472d
push rcx
call fcn.1404a7b61
push rdi
movabs rdi, 0x49dd29a1e9043bd
pushfq
cmp edi, 0x8438b417
jl 0x140614d8d
test edi, 0xbb8a7e95
mov qword [rsp + 0x10], 0x6b569053
mov rdi, qword [rsp + 8]
jne 0x1403ebd77
mov qword [rsp], 0xffffffffa438a353
call fcn.140885c22
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140885c22

Function at 0x14046c532
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setns byte [rsp + 0x10]
push rdx
cmp r15w, word [rsp + 0x1e]
mov qword [rsp + 0x40], rax
jne 0x14050fa45
and eax, 0xbdf84a64
add bh, al
enter 0x3425, 0xffffffffffffff89
invalid
movzx rsi, word [rsp + 0x88]
jae 0x1404b1e67
and edx, dword [rbx]
and cl, dl
adc al, byte [rdx]
or eax, 0x8383e72f
invalid
not r15b
lea rax, [rax + 1]
lea r12, [r12 + r12*8 + 0x292ed730]
lea r15, [r12 + r15*4 + 0x1c2dad01]
jl 0x1404058bd
push rsi
jle 0x1404e0eea
lahf
invalid
or al, 0xb5
and ax, 0xa336
mov rax, qword [rsp + 8]
mov rax, qword [rax]
sub word [rsp + 0x18], dx
cmp r15b, 0x9e
mov qword [rsp + r15 - 0xf47], r15
push r11
setbe byte [rsp + 0x10]
je 0x140419dd9
jo 0x140583060
pop rbp
adc ebp, dword [rcx + rdx*4]
clc
jns 0x1404e0e6a
invalid
invalid
setg r12b
shl r12b, 0xe
shr r15, 0x33
add qword [rsp + 8], 0x71d2f
movabs rax, 0x1ba13fb82fa00a06
and rax, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x18]
neg r12b
jno 0x1404e0e8e

Function at 0x140488bbe
Capabilities:
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
invalid
add qword [rsp + 0x10], 0xfffffffffff99326
push rdi
neg rbx
movabs rdi, 0xeeb93b01e496df87
movzx di, bl
mov edi, 0xe496df87
add dword [rbx], edi
mov ecx, 0xb60f66ee
sti
mov rcx, qword [rsp + rbp*4 - 0x48]
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + rbp - 0x20]
shl bp, 0x67
movzx rbp, dil
jb 0x14056b3c1
mov qword [rsp + 0x18], rbx
jne 0x1406fe4c2
add cl, byte [rax + 0x67]
jo 0x140488bcc
xlatb
scasb al, byte [rdi]
and al, 0xe7
fsubrp st(5)
jrcxz 0x140488c35
xchg esi, eax
in al, 0x25
cmp edx, dword [rsp + rdi - 0x2ce2b475]
loope 0x140488ba5
mov ch, 0x99
fisttp dword [rax - 0x58b3f0c0]
jno 0x140488ca4
mov al, 0xfa
mov r12b, 0x81
or eax, 0xe9fb35a9
push rdi
xchg dword [rcx - 0x6e5e9ab2], ecx
invalid
invalid
insd dword [rdi], dx
jnp 0x140488c71
invalid
lea rbp, [rdi + rbp*2 - 0x334c9b27]
call fcn.1404226d6
invalid

Function at 0x1404b27b8
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [rbx + 1]
push r10
je 0x1407077cf
mov r10, r14
movabs rbp, 0xabaacf04d014b5b6
jne 0x14063e8d9
call int.1404dd742
sti
xor al, byte [rdi]
xor eax, 0x6f09b95d
invalid
Function at 0x1404c2386
Capabilities:
Encode data using base64

Disassembly:
mov r14, qword [rsp + 8]
sub word [rsp + 0x10], 0x84b9
cmp byte [rsp + 0x10], 0x83
jle 0x14055b285
shr qword [rsp + 0x10], 0x14
ja 0x1406d0e86
test byte [rsp + 0x10], 0x29
je 0x1406fa75a
call fcn.14042f0d8
call fcn.140703921
invalid
or dword [rsp + 0x10], 0x8022cd85
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x1404c3318
Capabilities:
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jg 0x1404e3bb5
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
call fcn.14080f9a2
invalid

Function at 0x1404c331e
Capabilities:
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
shr r10d, 0xa9
or r14w, r11w
mov qword [rsp + r10 - 0x6c3a2e], r10
lea rcx, [rcx - 0x45e0b2d0]
setae byte [rsp + r10 - 0x6c3a2e]
and r10b, r11b
push r10
shl r11d, 0xfb
jne 0x1403f2c53

Function at 0x1404cb5f1
Capabilities:
Encode data using xor

Disassembly:
ret
setle r12b
not cl
lea r12, [rcx*4 - 0x1684769]
cmova cx, r13w
ror dword [rbp + rcx*4 + 0x24], 1
lea edx, [rdi + 0x66fe97b8]
cmova ecx, r13d
invalid
lea rax, [rax + 0x230e19b8]
and r12d, 0xce337402
mov qword [rsp + 0x28], rcx
call fcn.14064ffda
jae 0x1404cb5b6
cwde
sbb bh, byte [rdi + 0x48]
xor cl, byte [rdi + 0x1ecf80ec]
sub cl, ah
out dx, al
add cl, 0x96
sbb byte [rsi], 0x9e
mov esp, 0x81d580f4
sub eax, 0x10e7a67f
push rdi
sbb edi, dword [rdi - 0x4a]
adc byte [rdi + 0x1b], dl
jg 0x1404cb5f6
in eax, dx
cmp ah, cl
and byte [rdx + rdx - 0x33], 0x1f
jg 0x1404cb61d
in al, 0xd
jg 0x1404cb64b
or eax, 0xbcf6fd7f
int3
idiv byte [rsp + rcx*8 + 0x3b5c8680]
inc dword [rax + 0x3799238]
jg 0x1404cb63b
pop rdi
enter 0x117, 0x7f
and dword [rax + 0x1c], esp
jg 0x1404cb5fe
jle 0x1404cb699
sbb rdi, qword [rdi + 0x5e]
sub ebp, ecx
jle 0x1404cb6ad
mov ebp, 0xef8d69ed
or eax, 0xe4f37a7f
invalid
invalid
sbb al, 0x87
insd dword [rdi], dx
push rsi
mov ecx, 0xeb1c69de
pop rdi
movabs dword [0x81d63526c6b31b96], eax
push 0xffffffffffffffa0
pop rcx
push rax
jb 0x1404cb67d
xor dword [rdi + 0x62c3a5e9], edi
invalid

Function at 0x1404e201c
Capabilities:
Packed with generic packer

Disassembly:
jb 0x1406bdb98
setno r14b
add qword [rsp], 0xffffffffffef1f9a
mov rbp, r15
movabs r14, 0x23054b0ab832df08
test rbp, r15
setg r14b
sub r14w, r14w
push rdx
shr ebp, 0xb5
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
ja 0x140450d47
jbe 0x1404bc483
movabs rdx, 0xadae721cd791388b
neg dx
call fcn.1404d1773
invalid
Function at 0x1404fb98e
Capabilities:
Encode data using xor

Disassembly:
in al, 0x65
jnp 0x1404fb961
clc
in eax, dx
or ah, byte [rax - 0x2f733a1e]
mov esp, 0xcd161641
jo 0x1404fb9cb
outsb dx, byte [rsi]
invalid
xchg esi, eax
push 0x1945a94d
or dword [rdx + rcx*4], edi
and byte [rdx], dl
push r8
jrcxz 0x1404fb9d9
adc eax, 0x64edf422
xchg ch, ah
leave
invalid
push rcx
js 0x1404fb9b0
mov r13, qword [rsp + r13 + 0x20]
mov qword [rsp + 0x20], 0x365e7aff
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.140813e28
jae 0x1404fb937
xor dword [rax], eax
add al, 0x10
pop rbp
xlatb
cmp dword [rdx + 0x5fffa781], edi
out 0x2f, al
sbb eax, 0xecb720ff
loop 0x1404fb9b1
mov edi, 0xfc188eba
mov ds, word [rax]
cld
invalid
pop rdi
int3

Function at 0x140525259
Capabilities:
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
shl dword [rsp + 0x10], 0x32
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
test byte [rsp + 0x28], bl
mov qword [rsp + 0x48], rbx
not qword [rsp + 0x48]
push r11
movabs r11, 0xf5144709c00b91ba
lea rdi, [rdi + 0x13167410]
jne 0x1405b6043

Function at 0x14052529b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x28]
call fcn.140810228

Function at 0x140530bdd
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
cmp r11w, word [rsp + rbp*2 + 0x34]
push rdi
mov rbx, qword [rsp + rsi - 0x669fb146]
mov rbx, qword [rbx + r14 - 0x669fb133]
not byte [rsp + r11 - 0x669f622e]
mov qword [rsp + rsi - 0x669fb146], r11
ja 0x1406d20aa
or rsi, qword [rsp + r11 - 0x669f6236]
not qword [rsp + rsi - 0x669fb156]
ja 0x140488b8e
sub si, word [rsp + r11*8 - 0x646]
call fcn.140468c15
jg 0x14067c97e
movzx si, byte [rsp + rsi - 0x669fb142]
mov rdi, qword [rsp + r14 - 0x669fb0fb]
add word [rsp + rdi*2 - 0xfa], 0x479a
shr r11, 0xd7
shr word [rsp + r14 - 0x669fb0eb], 0x33
lea rbx, [rbx - 0x37445e63]
or rbp, rsi
jne 0x14068c3e2
Function at 0x140545618
Capabilities:
Packed with generic packer

Disassembly:
push rbp
call fcn.140558fee
mov ebx, eax
jmp 0x140373452
test ebx, ebx
je 0x14037346b
call fcn.14036c424
mov dword [rax], ebx
call fcn.14036c404
mov dword [rax], 9
or ebx, 0xffffffff
mov ecx, edi
call fcn.140372aa8
mov eax, ebx
jmp 0x140373499
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
jno 0x1405b247d
xchg ecx, eax
and dword [rax], edx
add al, 0
adc byte [rsp + rdx], ah
or byte [rbx + rdx], dl
shr byte [rbp - 0x51f00000], 0
invalid
invalid
pop rbx
cmp eax, dword [rax]
movabs rbp, 0xd03275b16d3499a6
neg byte [rsp + 0x38]
add ebp, ecx
or ecx, 0xdd13a1a7
movabs rbp, 0x4f988e0117926993
jg 0x140373446
sub word [rsp + 0x38], 0xbd2b
mov rcx, qword [rsp + 8]
cmovns bp, word [rsp + 0x3a]
bswap ebp
call int.14001f24f
ja 0x14061c5a8
imul ecx, dword [rcx + 8], 0xbe4b6efd
adc eax, 0xe42c96db
and al, 0xe8
outsb dx, byte [rsi]
movabs r14, 0x6ee824e42c96db15
fucompi st(6)
and al, 0x3a
test al, 0x40
adc ebx, ebx
in al, 5
jb 0x140545662
and al, 0x46
mov al, 0xb
invalid
setns r12b
jo 0x1405334dd
lea rsi, [rsi + 1]
lea esi, [rsi + 1]
setbe cl
shr ecx, 0xfe
call fcn.1406024f8
shl dword [rdx], cl
insd dword [rdi], dx
sub byte [rdi], bh
jae 0x140568dce
int 6
cmp bh, ah
pop rdi
mov dword [rsi], 0x912eec11
xlatb
movsb byte [rdi], byte [rsi]
je 0x140568e00
stc
sub bl, byte [rdx]
add byte [rax + 0x68], bh
sub byte [rdx - 0x75], ch
mov eax, 0xc334d79e
jge 0x140568e14
enter 0x64f0, 0x66
cmp byte [rsi], al
sahf
sub ah, 0xd7
or ah, byte [rdx]
add eax, 0xaff92287
add ch, byte [rbp + 0x28]
jrcxz 0x140568df2
int3
jb 0x140568db7
xchg ebp, eax
imul ebp, dword [rax], 0x9f5573fa
xlatb
int3
test rdx, 0xffffffffc705d903
call fcn.1403f7f47
mov qword [rsp], 0x331377b
call fcn.1407fcbd5
setae dl
setns dl
mov r15, rdx
js 0x140568dac
xchg qword [rsp + 0x28], rbx
mov r15, qword [rsp]
test edx, 0x3fb38184
jae 0x1405cf9b7

Function at 0x14055b217
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jge 0x14060008a
or r9, 0x89188b6
neg r9d
setge byte [rsp + r8 + 0x18]
neg r9w
call fcn.14054f72b

Function at 0x14055f733
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 0x38], 0x35
add byte [rsp + 0x38], 0x91
shl qword [rsp + 0x38], 0x22
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret
test dx, bp
je 0x1404b4f88
xchg qword [rsp + rbp - 0x4a6db4b1], rbx
mov r12, qword [rsp + r12*4 + 8]
add bp, 0x3d2e
sub edx, 0x21207e38
test dl, bpl
lea rbp, [rbp*2 - 0x764f97ed]
bswap ebp
jbe fcn.140680e62
mov rdx, qword [rsp + rdx - 0x771378f5]
xor ebp, 0xc81c918c
test word [rsp + 0x18], bp
call fcn.1405ddf1c
hlt
jno 0x140505512

Function at 0x140577d90
Capabilities:
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp], 0xffffffffbf7e0720
call fcn.14073959f

Function at 0x1405a10ff
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.140869779
sets sil
mov qword [rsp + 0x20], rbp
lea rsi, [rsi + riz + 0x4909ee3a]
movabs rsi, 0xdfa67c2f0c189b3a
je 0x1406912ca
call fcn.140431f1c
Function at 0x1405a8c04
Capabilities:
Encode data using xor

Disassembly:
setg r13b
add qword [rsp], 0xffffffffffe9cffe
shr r14w, 0x10
jne 0x1406f4b00
mov rsi, qword [rsp]
mov rsi, qword [rsi]
lea r13, [r12 + 0x1031dea6]
or word [rsp + 0x28], r14w
setg r13b
xor r13, qword [rsp + 0x28]
call fcn.1403f2a05

Function at 0x1405caa7d
Capabilities:
Encode data using base64

Disassembly:
push rdx
out dx, eax
cmp eax, 0x22a7e800
call fcn.14066b6ce
int3
not dword [rsp + 0x10]
js 0x1405d6e33
dec dword [rsi]
jge 0x14035941e
int3
js 0x140359444
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407c60c4
jbe 0x1404c55f0
push r8
pushfq
movabs r8, 0x483fb9e4118a71f
not r8b
not r8d
cmp r8b, 0x8d
mov qword [rsp + 0x10], 0xffffffffae837db6
mov r8, qword [rsp + 8]
jo 0x14053d02b
cmp qword [rsp + 0x10], 0x609ca20f
jb 0x14055b21d
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x1405d827a
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
or dword [rsp + 0x38], 0x3a19ba27
jno 0x140597896
call fcn.1405af9f2
call fcn.1403ea0ed
invalid
mov r8w, word [rsp + r10 - 0x77bfdef2]
mov r10, qword [rsp + r10 - 0x77bfdee8]
or r8w, r8w
shr word [rsp + 0x10], 0x33
neg r8d
or byte [rsp + r8 - 0x2aeffd8], 3
mov r8, qword [rsp + r8 - 0x2aeffa8]
jns 0x1404c234c
add qword [rsp + 0x18], 0xffffffffbf9995c0
not word [rsp + 0x10]
neg byte [rsp + 0x10]
not dword [rsp + 0x10]
jbe 0x1405d2d38

Function at 0x1405ecc7f
Capabilities:
Encode data using base64

Disassembly:
insb byte [rdi], dx
sub eax, 0x46660022
test dword [rsp + rcx*4 + 0x32], ecx
inc dword [rcx - 0x7539d64d]
invalid
jb 0x14050d4bf
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.140813e28
jns 0x1405ecc5e
mov cl, 0xf9
in al, dx
jno 0x1405ecc32
movabs dword [0xfe25b89729c98174], eax
invalid

Function at 0x140632bb4
Capabilities:
Encode data using xor

Disassembly:
or byte [rsp], 0x9e
mov byte [rsp], 0x22
or dword [rsp], 0xfe8d792c
jb 0x140632bca
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140869779
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
jno 0x1406b3eff
jle 0x1406310ae
lea r15, [r15*4 + 0x253e3b37]
lea r15, [r15*4 - 0xa7a06d0]
lea r15, [r15 + r15 - 0x3872a3d8]
mov r15, qword [rsp + 8]
sub qword [rsp], 0xffffffffb01cb83c
jge 0x14046f0c7
shr dl, 0x15
movabs r9, 0x5eb05428ea1c9a96
call fcn.1405aa3c7

Function at 0x14063584f
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x58]
call fcn.140810228
lea rbx, [rbx - 0x196c256d]
call fcn.1405af050

Function at 0x140639f1f
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x28], r12
test byte [rsp + 0x28], bh
lea r12, [rbx + riz + 0x49a54516]
lea rsi, [rsi + 0x59262696]
mov ebx, 0x4f872c32
call fcn.14054bf64

Function at 0x14064ee61
Capabilities:
Encode data using xor

Disassembly:
push r13
je 0x1405c9508
mov r13, r9
lea rdi, [rdi - 0x78caf2df]
jae 0x1404bc908