joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a6620
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400a6662
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a66a9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a6702
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a66c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a6743
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400b92a2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400b92a3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a6710
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400a77c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a780e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a780e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a780e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a780e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a780e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a7810
xor al, al
add rsp, 0x28
ret
Function at 0x140040da0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14004dd08], rbx
je 0x140040e07
cmp rax, rbx
jne 0x140040dfa
mov ebx, 1
mov esi, ebx
jmp 0x140040e0c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140040ddf
mov ebx, 1
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040e24
mov edi, 0x1f
mov ecx, edi
call fcn.1400e0000
jmp 0x140040e90
mov eax, dword [0x14004dd10]
test eax, eax
jne 0x140040e85
mov dword [0x14004dd10], ebx
lea r15, [0x140044330]
lea rdi, [0x140044318]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140040e77
test eax, eax
jne 0x140040e7b
cmp qword [rdi], r14
je 0x140040e6c
mov rax, qword [rdi]
mov rcx, qword [0x1400442d8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140040e4e
test eax, eax
je 0x140040e8b
mov eax, 0xff
jmp 0x140040fe6
mov dword [0x14004d384], ebx
mov edi, 0x1f
mov eax, dword [0x14004dd10]
cmp eax, ebx
jne 0x140040eb7
lea rdx, [0x140044310]
lea rcx, [0x1400442e0]
call sub.msvcrt.dll__initterm
mov dword [0x14004dd10], 2
test esi, esi
jne 0x140040ec5
mov rax, r14
xchg qword [0x14004dd08], rax
cmp qword [0x14004dd28], r14
je 0x140040ef8
lea rcx, [0x14004dd28]
call fcn.140041400
test eax, eax
je 0x140040ef8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004dd28]
mov r9, qword [0x1400442d8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140040f11
mov eax, 0xff
jmp 0x140040fe6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140040f97
test ax, ax
je 0x140040f2c
test edx, edx
jne 0x140040f97
sub ax, bx
cmp ax, di
ja 0x140040f42
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140040f2c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400024cc
mov dword [0x14004d380], eax
cmp dword [0x14004d3a0], r14d
jne 0x140040f80
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004d384], r14d
jne 0x140040f95
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004d380]
jmp 0x140040fe6
cmp ax, 0x22
jne 0x140040fab
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140040f1a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140041494
add rsp, 0x28
jmp 0x140040da0
Function at 0x140005938
Capabilities:
Execute anti-debugging instructions

Disassembly:
add qword [rsp + 0x10], 0xffffffffbf977295
call fcn.14044917e
add byte [rax], al
add byte [rax], al
jmp loc.14066a6c1
Function at 0x140009868
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x58], 0x41
mov byte [rsp + 0x59], 0x88
mov byte [rsp + 0x5a], 0x5d
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5c], 0xf
mov byte [rsp + 0x5d], 0x4f
mov byte [rsp + 0x5e], 0xc1
mov byte [rsp + 0x5f], 0x48
mov byte [rsp + 0x60], 0x83
mov byte [rsp + 0x61], 0x44
mov byte [rsp + 0x62], 0x24
mov byte [rsp + 0x63], 0x58
mov byte [rsp + 0x64], 8
mov byte [rsp + 0x65], 0x41
mov byte [rsp + 0x66], 0x88
mov byte [rsp + 0x67], 0x45
mov byte [rsp + 0x68], 0xde
mov byte [rsp + 0x69], 0x41
mov byte [rsp + 0x6a], 0xff
mov byte [rsp + 0x6b], 0xc6
mov byte [rsp + 0x6c], 0x49
mov byte [rsp + 0x6d], 0xff
mov byte [rsp + 0x6e], 0xc5
mov byte [rsp + 0x6f], 0x89
mov byte [rsp + 0x70], 0x44
mov byte [rsp + 0x71], 0x24
mov byte [rsp + 0x72], 0x60
mov byte [rsp + 0x38], 0xb3
mov byte [rsp + 0x39], 0x63
mov byte [rsp + 0x3a], 0x41
mov byte [rsp + 0x3b], 0x88
mov byte [rsp + 0x3c], 0x5d
mov byte [rsp + 0x3d], 0
mov byte [rsp + 0x3e], 0xf
mov byte [rsp + 0x3f], 0x4f
mov byte [rsp + 0x40], 0xc1
mov byte [rsp + 0x41], 0x48
mov byte [rsp + 0x42], 0x83
mov byte [rsp + 0x43], 0x44
mov byte [rsp + 0x44], 0x24
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 8
mov byte [rsp + 0x47], 0xb0
mov byte [rsp + 0x48], 0x63
mov byte [rsp + 0x49], 0x41
mov byte [rsp + 0x4a], 0x88
mov byte [rsp + 0x4b], 0x45
mov byte [rsp + 0x4c], 0xde
mov byte [rsp + 0x4d], 0x41
mov byte [rsp + 0x4e], 0xff
mov byte [rsp + 0x4f], 0xc6
mov byte [rsp + 0x50], 0x49
mov byte [rsp + 0x51], 0xff
mov byte [rsp + 0x52], 0xc5
mov r9d, 0x100
mov r8, qword [0x1400cac18]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008db50
cmp dword [rsp + 0x98], 0
je 0x1400099e5
mov qword [rsp + 0x20], 0x1b
lea r9, [rsp + 0x38]
mov r8, qword [0x1400cac18]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008d9c0
jmp 0x140009a31
mov qword [rsp + 0x20], 0x1b
lea r9, [rsp + 0x58]
mov r8, qword [0x1400cac18]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008d9c0
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r9d, 4
mov r8, qword [0x1400cac18]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008da98
mov eax, 1
add rsp, 0x88
ret
Function at 0x14000b174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
movabs rax, 0x149b0c671
mov qword [rsp + 0x58], rax
movabs rax, 0x143606a16
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x38], 0xf
mov byte [rsp + 0x39], 0x10
mov byte [rsp + 0x3a], 0x4f
mov byte [rsp + 0x3b], 0x10
mov byte [rsp + 0x3c], 0xf
mov byte [rsp + 0x3d], 0x11
mov byte [rsp + 0x3e], 0x49
mov byte [rsp + 0x3f], 0x10
mov byte [rsp + 0x40], 0x8b
mov byte [rsp + 0x41], 0x47
mov byte [rsp + 0x42], 0x10
mov byte [rsp + 0x43], 0x48
mov byte [rsp + 0x44], 0x8b
mov byte [rsp + 0x45], 0x4f
mov byte [rsp + 0x46], 0x90
mov byte [rsp + 0x47], 0xa3
mov byte [rsp + 0x48], 0x60
mov byte [rsp + 0x49], 0xc2
mov byte [rsp + 0x4a], 0x7d
mov byte [rsp + 0x4b], 0x49
mov byte [rsp + 0x4c], 1
mov byte [rsp + 0x4d], 0
mov byte [rsp + 0x4e], 0
mov byte [rsp + 0x4f], 0
mov byte [rsp + 0x50], 0x48
mov byte [rsp + 0x51], 0x89
mov byte [rsp + 0x52], 0xd
mov byte [rsp + 0x53], 0x76
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 0
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 3
lea r8, [rsp + 0x80]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140008460
mov rax, qword [rsp + 0x58]
add rax, 0x1f
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call fcn.140008460
mov r9d, 0x100
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008db50
mov r9d, 0x100
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008db50
mov qword [rsp + 0x20], 0x1f
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008d9c0
mov rax, qword [rsp + 0x58]
add rax, 0x1f
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x70]
mov r8, rax
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008d9c0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008d9c0
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r9d, 4
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008da98
mov dword [rsp + 0x20], pe_nt_image_headers64
mov r9d, 4
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14008da98
mov eax, 1
add rsp, 0x98
ret
Function at 0x14002adc3
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + r14 - 0xd5a9], 0xffffffffbffb2b84
lea r14, [r14 + r14*2 - 0x1067a0c4]
xor r14b, r14b
js 0x1404d40d9
shl r14b, 0x68
lea rbx, [rbx + r14*4 - 0x33b2fdf0]
js 0x140466f3a
add qword [rsp + r14*2 + 0x20ca4000], 0xffffffffbfffa14b
mov r14d, 0xdb83f48a
shl r14d, 0x44
jns 0x140058cbb
xchg qword [rsp + 0x40], rbx
mov r14, qword [rsp + 0x18]
call fcn.140411545
call fcn.140055d33
js 0x1404f0bfb
push r14
lea rbp, [rbp + 0x80c899c]
and si, r15w
lea r15, [rsi + riz - 0x347511d5]
call fcn.1404e0f17

Function at 0x14002e7a8
Capabilities:
Authenticate hmac
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xor dword [rsi - 0x1b243b8c], ebx
ret
jne 0x1404a77f3
jae 0x14002e748
jmp fcn.14068d79e
call fcn.140033fad

Function at 0x14002e7b0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xor dword [rsi - 0x1b243b8c], ebx
ret
jne 0x1404a77f3
jae 0x14002e748
jmp fcn.14068d79e
call fcn.140033fad

Function at 0x14003051e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.140347c0a
lea r12, [r12 + r12*2 - 0x53472552]
jge 0x14009c7c1
movabs r12, 0x8700fc3d201e062d
test r12b, 0xbf
push r14
push r12
call 0x14003051e
iretd
mov qword [rsp + 0x28], 0x5ba890
mov r12, qword [rsp + 0x20]
jo 0x14008ef60
shr byte [rsp + 8], 0x17
xor qword [rsp + 8], 0xffffffffd796f2a9
cmp word [rsp + 8], 0xc00
jge 0x14009c7ca
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.14053eec6

Function at 0x140034040
Capabilities:
Hash data with crc32

Disassembly:
call fcn.1400d5251
jmp fcn.140696df5
nop
and ecx, 0xbea8bc07
shr cl, 9
sub rcx, 0xffffffffb0a62735
mov rax, rcx
call fcn.1400ea8a0
push rcx
push r14
pushfq
movabs r14, 0x40b828a9a03946a9
and r14w, 0xb138
je 0x1400a59f0
ja 0x14003403b
add dword [rbx], edx
add dword [rax], eax
adc eax, dword [rdx]
add byte [rcx], ah
or byte [rdx], al
add byte [rax], cl
push rsp
sub dword [rax], eax
xor byte [rdx + 0xd], dh
add byte [rdi], al
jae 0x1400a60d8
invalid
lodsb al, byte [rsi]
mov al, byte [rdi]

Function at 0x140035360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1400eda40
jmp fcn.1406988b5

Function at 0x14003eb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], 0x6b70c9e6
lea rsp, [rsp + 8]
call fcn.140542625
add dword [rax], eax
add byte [rax], al
jmp fcn.1406a6f66
Function at 0x140050b1c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add r14w, 0x5da7
mov rbp, r14
shr r14w, 0xa3
xor r14, rbp
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + r14*4 - 0x2cd4c]
jbe 0x140050b0d
test r14, r14
jae 0x1403da50f
xchg ebp, eax
int3
or cl, r12b
call fcn.14031ad4c
call fcn.14003d7ff
movabs dword [0x1e0500673647e972], eax
invalid
jno 0x1404978c5
invalid
mov qword [rsp + r14*8 - 0x59a90], r14
lea rbp, [rbp + r14*2 - 0x48e14f79]
push r8
mov r8, r14
movzx r8, word [rsp + r14*4 - 0x2cd3c]
sub r8b, byte [rsp + r8 - 0xb33f]
not r14
xchg qword [rsp + r8 - 0xb32b], rbp
mov r8, qword [rsp + r14*4 + 0x2cd50]
shl r14d, 0x41
or qword [rsp + 0x10], 0xffffffff8a056e34
jb fcn.1400a0025
cmp dword [rsp + 0x10], r14d
jg 0x140402f0b
add qword [rsp + 0x10], r14
mov r14b, byte [rsp + 0x11]
mov r14, qword [rsp + 0x20]
shr dword [rsp + 0x10], 0xa4
test dword [rsp + 0x10], 0xc32b493e
jg 0x14009e649
xchg esp, eax
sub eax, 0x7111bfc9
mov esp, 0x89a8403f
outsd dx, dword [rsi]
xor dword [rax - 0x3c], eax
push rdx
enter 0xffffffffffffedbf, 0xffffffffffffffc0
call 0xe693e5df
and al, 0xa8
invalid

Function at 0x1400547fa
Capabilities:
Encode data using xor

Disassembly:
shl bpl, 0x8a
mov bp, 0x3e01
mov qword [rsp + 0x18], 0xffffffffd58db5c8
mov rbp, qword [rsp + 0x10]
call fcn.1400678d5
add bl, 1
add qword [rsp + 0x20], 0xffffffffffc18e23
movabs rbx, 0xd2be4e1f83343e8f
mov qword [rsp + 0x10], rbx
lea rbx, [rbx*4 - 0x1cfa3e7e]
xor dword [rsp + 0x10], ebx
call fcn.140314ce9
jne 0x1400547df
add dword [rdi], ecx
invalid

Function at 0x14005787e
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 0x20], 0xffffffffbff71661
shl word [rsp + 0x18], 0x52
call fcn.140482dec

Function at 0x1400578a4
Capabilities:
Encode data using base64

Disassembly:
push 0xfffffffff4357092
pushfq
shl qword [rsp + 8], 0x53
js 0x1400a3590
jmp fcn.1406d03fc
mov qword [rsp + 0x10], 0xffffffffcfde4925

Function at 0x14005a800
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
pushfq
add qword [rsp + 8], 0x351a6e
call fcn.1403b67f3
mov edi, 0xadbae950
add ah, ah
iretd

Function at 0x14005f6f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r9
pushfq
movabs r9, 0xe5858915613acb1d
bswap r9d
push 0x7c8758ba
xor r9, qword [rsp + r9 - 0x1dcb3a61]
shl r9d, 0x85
call fcn.14039bbd4
sti
jmp fcn.1406ddb87

Function at 0x140064621
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and r10d, 0xebb2cab1
or r10, 0xfffffffff49f4d30
lea r10, [r13*8 - 0x4968c5d6]
not r10
neg r10
not r10
mov r13, qword [rsp + r13 + 0x55fbb01e]
test r10, 0x791bd638
lea r10, [r10 + r10*2 - 0x67f0dbed]
call fcn.1403c5f5f

Function at 0x14006466c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp], 0x40fe0841
call fcn.14052c430
test al, dl
jmp fcn.1406e6b19

Function at 0x14006c12c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x140027c2d
sbb ebp, ecx
add al, byte [rbx - 0x943ff98]
xor eax, 0x4560dfa
cwde
ror dword [rbx - 0x2f], cl
invalid
Function at 0x14006e6c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0x28f150
call fcn.14053eec6
cmp rsi, 0xfffffffffa91ff09

Function at 0x14006eba8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [rsi + riz - 0x11000a10]
movabs r11, 0xf518b2ad502cb02d
shl r12b, 0x7b
lea r12, [r11 + r12*4 - 0x37dec6c1]
lea rsi, [rsi + 0x7c97a68c]
sub r12w, r11w
cmp r12d, 0x5e0132b8
lea r12, [r11*4 + 0x3e923d14]
xchg qword [rsp + 0x40], rsi
mov r11, qword [rsp + 8]
call fcn.140053c05
call fcn.1403c85f0
ja 0x14006eb5a
jmp fcn.1406f92a6

Function at 0x1400700ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
call fcn.140036b2b
pop rax
lahf
movabs dword [0x68b685e9cccccc], eax
cmp dword [rax - 0x72], edi
invalid

Function at 0x1400750c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call int.1404537bb
jmp fcn.140703c19
Function at 0x1400846f8
Capabilities:
Encode data using base64

Disassembly:
push r8
push r15
call fcn.140022c1d
or cl, ah
jmp fcn.14070962d
Function at 0x14008d1a8
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rdi, r8
xor r8d, r8d
js 0x1404ae72d
jb fcn.1400d4957
and di, di
add qword [rsp], 0xffffffffffffc93e
call fcn.14036c8f6
pop rsp
enter 0xffffffffffffccf1, 0xffffffffffffffcc
jge 0x1400e22d1
movabs rdi, 0x8ca917317f979a0f
add qword [rsp + 0x28], 0xffffffffbfceac67
mov rdi, qword [rsp]
xchg qword [rsp + 0x48], rdi
mov r12, qword [rsp + 0x30]
add byte [rsp + 0x40], 0xb7
call fcn.1400e7c85
Function at 0x140091160
Capabilities:
Encode data using xor

Disassembly:
movabs r10, 0x701cf4bf95bba91b
pushfq
xor r10, 0xffffffffea08ccb1
mov qword [rsp + 0x20], 0x2e1359c6
mov r10, qword [rsp + 0x18]
jb 0x14009116a
popfq
call fcn.14004aee4

Function at 0x1400975ed
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0x2bfd3076
lea rsp, [rsp + 8]
call fcn.1405da64e
add dword [rcx], ecx
add dword [rax], eax
or dword [rdx], eax
add byte [rcx], al
or al, byte [rax + rax]
xor byte [rax + rax + 1], dl
or dword [rcx], eax
add byte [rcx], cl
add byte [rax], al
add dword [rdx], ecx
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x1400975fd
invalid
test al, 0xfb
invalid

Function at 0x1400a21ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0x40fae727
call fcn.14052c430

Function at 0x1400b1c65
Capabilities:
Encrypt data using rc4 prga

Disassembly:
setbe byte [rsp + 0x18]
and word [rsp + 0x18], 0xdea6
call fcn.1403f2f6b
jne 0x140431452

Function at 0x14035b151
Capabilities:
Encode data using xor

Disassembly:
push r13
xchg qword [rsp + r10 + 0x48], rax
mov rbp, qword [rsp + rbp*2 - 0xa2]
shr r10w, 0x16
movabs rsi, 0x8e8b10a22381069a
call fcn.1403dc4bd
popfq
add dword [rdx], ecx
add al, 0
and esp, dword [rdx - 0x177174f0]
cmpsb byte [rsi], byte [rdi]
call 0x141abdc47
or al, byte [rax + rax]
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x1400edc0d
invalid
sar byte [rbp + 0x6a4b0032], 0x48
mov ecx, dword [rsp + 0x60]
push rsi
call fcn.1403b6696
mov eax, 0xc0000005
jmp 0x1400edc6a
invalid
je 0x1400edbf1
ret

Function at 0x140363666
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
shl word [rsp + r12 - 0x4c7f8], 0x84
sub edx, edx
jno 0x14049c9c0
push rdx
mov dl, byte [rsp + rdx*4 - 0x139000]
and sil, byte [rsp + 7]
shl word [rsp + rdx*2 - 0x9c800], 0x21
push r12
mov rsi, qword [rsp + rdx*8 - 0x271fe0]
mov rsi, qword [rsi + rdx - 0x4e400]
mov r12, qword [rsp + rdx - 0x4e3f8]
jbe 0x140005914
adc al, 0xed
invalid
not byte [rsp + rdx*2 + 8]
add qword [rsp + r12*4 - 0x131ff0], 0xffffffffbff6ec88
mov qword [rsp + rdx*4 + 0x20], rdx
sub r12d, 0x2b7289b
lea rsi, [rsi + rdx - 0x4fefcfdb]
sub qword [rsp + rdx*4 + 0x20], rdx

Function at 0x140374160
Capabilities:
Packed with generic packer

Disassembly:
push rsi
test byte [rsp + 0x35], r13b
xchg qword [rsp + 0x60], rax
mov r14, qword [rsp + r13 - 0x5abf934c]
lea rdx, [r13 + r13 - 0x4a992460]
pop rax
push rdi
pushfq
movabs rdi, 0x8fad87372f8bd89f
sub edi, edi
push rdi
test dword [rsp + rdi*4], 0x1698eda1
lea rdi, [rdi + rdi + 0x6c076fa2]
push r11
xchg qword [rsp + rdi - 0x6c076f82], rax
mov r11, rdi
jge 0x14042d50a
jge 0x14002a83f
cmp dil, 0x16
jae 0x14044aacc

Function at 0x140374166
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x28], 0x35e27
or r8d, 0x7b0092ae
jle 0x1404772d4
Function at 0x1403c8969
Capabilities:
Encode data using xor

Disassembly:
call fcn.1404eee76
sbb edx, dword [rbx + rbp*8]
pop rbp
cmp qword [rsp + 0x28], 0xb27e6ac
push r11
not qword [rsp + 0x38]
push r9
add qword [rsp + 0x10], 0xffffffffffcfb940
mov r11, qword [rsp + 0x28]
movabs r9, 0x4808e5b12e2be725
add qword [rsp + 0x20], 0xfffffffffffaadf9
add r9d, 0x9e9a52a0
setbe byte [rsp + 0x38]
push rdx
push r8
and r9b, r9b
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
jbe 0x1404fce58
mov r14, r11
mov rdx, qword [rsp + 0x50]
jo 0x14002a521
add qword [rsp + 0x48], 0x5f2c0719
lea rcx, [rcx + rdx - 0x69a59fe4]
call fcn.1404e0f1c

Function at 0x1403d1e43
Capabilities:
Encode data using xor

Disassembly:
movsx r10d, byte [rsp + 0x23]
movsx r10d, byte [rsp + 0x24]
call fcn.140035211
add dword [rax], eax
add byte [rax], al
inc byte [rdx]
in al, dx
int3
cmp ebp, 0x1680a2b3
jb 0x1400e9ce9
std
mov bl, 0xa2
adc byte [rsi], 0xf
invalid
movabs r10, 0x23864526152bc81a
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
sub r10, 0x663f1ea2
shl r10b, 0x34
shl bpl, 2
je fcn.140056e41
setne r10b
lea rax, [rax - 0x42f17efb]
and r10d, 0xcd8ea1bc
mov qword [rsp + 0x18], r10
push r15
jb 0x14047f90a
movabs r15, 0x2e327ab60b1c7d09
jge 0x1400e7fb0
shr bpl, 0xfe
xchg qword [rsp + 0x28], rax
mov r15, qword [rsp]
and word [rsp + 0x20], r10w
jae 0x140053c77
cmc
jae 0x14033f36a
add dword [rsi], eax
add al, byte [rax]
invalid
movabs r13, 0xbe83c993b40de63a
add qword [rsp + rbp*2 - 0x3fffff0], 0xffffffffbfb6bf5d
lea rcx, [rcx + rbp + 0x623fadb6]
shl r13d, 0x4a
call fcn.1403fce1e
mov r11, qword [rsp + r12 - 0x1c]
movabs rbx, 0x7723b605068e7d39
add qword [rsp + 0x28], 0x15a01c
or r11w, word [rsp + 0x1e]
sets byte [rsp + r11 + 0x64f20019]
and r11w, 0x8a04
bswap rbx
add edi, r12d
movabs rax, 0xc3ad71b219e3a14
movsx r12w, byte [rsp + r12 - 0x1c]
mov rax, qword [rsp + r11 + 0x64f27624]
mov rax, qword [rax + r11 + 0x64f275fc]
mov r12b, r11b
movsx di, r12b
lea rdi, [r11*2 - 0x4a58626a]
or byte [rsp + r11 + 0x64f27614], 0x9b
jb 0x1404898b0
add rbx, qword [rsp + 0x18]
pop rsp
and al, 0x18
ja 0x1404d5db4
lea rax, [rax + 0x4eb45b8d]
setne r12b
call fcn.14003745e
ja 0x1403b9c91
add dword [rcx + rax], eax
add byte [rdx + rax*2], al
add byte [rax], al
push rbx
js 0x14033f369
setae byte [rsp + 0x10]
shr di, 0x7c
mov qword [rsp + 0x40], rax
push r11
mov word [rsp + 0x18], di
je 0x1403b9c16
mov dword [rsp + 0x38], 0xbc25de09
sub word [rsp + 0x38], 0x5b0a
not dword [rsp + 0x38]
shr byte [rsp + 0x38], 0x74
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
ret 8
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
mov rdx, r13
not r13b
movzx r13, r13b
xor r13b, 0xb0
add qword [rsp], 0xffffffffffc314bb
call fcn.1403cdc1e
test bpl, 0x9b
jle 0x1403734ba