joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d9069
Capabilities:
Packed with generic packer

Disassembly:
out dx, eax
dec bh
outsb dx, byte [rsi]
jg 0x1402b8e75
jle 0x1402b8e91
push 0xffffffffffffffd1
movabs eax, dword fs:[0xd179f706f6162eb4]
push 0x1e
mov dword [rsi], ebp
mov eax, 0xd133dd7d
add edi, dword [rbx + 0x39d1d0f7]
jl 0x1402b8e1f
cmp edx, dword cs:[rbx + 0x71]
test eax, 0x3a032f79
or al, byte [rax - 0x2f]
movabs al, byte [0xd099a5c5d1697ce8]
invalid
cdq
rcr byte [rdi], 1
pop rdi
or dl, byte [rsi + 0x6d]
sar dword [rax], 1
movsd dword [rdi], dword [rsi]
mov dl, 0x2e
mov edx, 0x7ff302d2
rol dword [rax + 0x5e], 1
sbb cl, byte [rdi - 0x26be03d2]
xor eax, 0xf1bf3fd1
rcr ch, 1
popfq
mov edi, 0x9dddd0f1
js 0x1402b8e58
lahf
invalid
lodsd eax, dword [rsi]
jg 0x1402b8eb2
int3
add qword [rsp], 0x15846
pop rax
add dword [rax], eax
call fcn.1402a2db4
wait
jge 0x1402b8e80
invalid
xchg dword [rdi - 0x49], edi
loopne 0x1402b8e43
cwde
adc dword [rbx + 0x71], 0xfffffff6
jno 0x1402b8eaa
int3
push rdx
jb 0x1402b8e8c
lea r11, [r11*4 - 0x26de3eff]
shr r11b, 0xad
jne 0x14055de3b
add qword [rsp + 0x10], 0xffffffffffa68eca
call fcn.140211169
pushfq
and al, 0xf5
fsubr dword [rdi]
scasb al, byte [rdi]
rcl ecx, cl
push rdx
jne 0x1402ce794
jae 0x1402ce7c4
push rsp
sbb esi, dword [rbx - 0x41f92df0]
cdq
jbe 0x1402ce7e1
push rbp
mov ch, 0x4b
movsd dword [rdi], dword [rsi]
invalid
invalid
mov dl, reloc.WS2_32.dll_WSAGetLastError
mov ss, word [rcx + 0x53777e66]
jp 0x1402ce7f7
invalid
invalid
jrcxz 0x1402ce7a6
lodsb al, byte [rsi]
sub bpl, byte [r14 + 0x6c890bb5]
idiv byte [rbx - 0x24]
stc
invalid
invalid
add r11d, 0xf9804cac
not r11d
jle fcn.140206caa
add qword [rsp], 0xffffffffffddea72
movabs rbp, 0xa1839fba07919524
movzx r11w, r11b
test ebp, r11d
jo 0x14047abc7
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
jl 0x14021686a
jle 0x1402f941d
lea rbp, [rbp - 0x2eeb22e1]
call fcn.1402c4632
setb sil
mov rsi, qword [rsp]
mov rsi, qword [rsi]
shr byte [rsp + r10 + 0x10], 0x81
add r10, r11
cmp dword [rsp + 0x10], 0xb0179eb5
mov qword [rsp], r10
jge 0x1403c4940
cmp dword [rsp], 0xeb0ccb0e
mov r10b, byte [rsp + 7]
lea rsi, [rsi - 0xcf31af9]
mov qword [rsp], 0xffffffff9cae8b16
lea r11, [r10 + r11*8 - 0xcdacde5]
push r10
js 0x14055e83b
add byte [rdi], cl
invalid
movabs rbp, 0x63adf73041af5f95
jae 0x1402ce735
jne 0x14037db1e
call fcn.140432662
mov word [rsp + r10 + 0x2b541a13], 0x8a92
setle byte [rsp + r11 - 0x2b5419eb]
lea rax, [rax + r11 - 0x3617c961]
movabs r11, 0x990dcd0c7ea6e0ac
xchg qword [rsp + 0x30], rsi
mov r11, qword [rsp + 0x10]
setge byte [rsp]
call fcn.1404dfc38
xchg esp, eax
mov eax, 0xa1678f2a
rep movsd dword [rdi], dword [rsi]
adc byte [rbp - 0x47], ah
mov esp, dword [rbp - 0x443b4384]
or byte [rdx - 0x49], bl
ror byte [rcx], cl
pop rdx
cwde
invalid

Function at 0x1402f10bf
Capabilities:
Packed with generic packer

Disassembly:
push r10
lea rbp, [rbp + rbp*4 - 0x46e27678]
jbe 0x14042a39f
jle 0x1405603c9
mov qword [rsp + 0x28], rcx
movabs r10, 0xa015a41512bd6eba
xor bp, r10w
jge 0x1403a237f
jge 0x1403c2d2e
add qword [rsp + 8], 0xffffffffffeae9ea
call fcn.14034361d
Function at 0x1402f1102
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x28], 0x40585287
mov r10, qword [rsp + rcx - 0xceb2067]
add qword [rsp + rcx - 0xceb2077], 0xffffffffbfc543cc
add qword [rsp + rcx - 0xceb206f], 0xffffffffbfc275a2
shl ecx, 0x6a
xor cl, 0x85
add rcx, 0x3394c499
and cx, 0xc20a
not cx
jle 0x1405b1b7c
xchg esi, eax
int3

Function at 0x1402fc42a
Capabilities:
Authenticate hmac

Disassembly:
cmovae r11d, dword [rsp + 0x43]
mov r11, qword [rsp + 0x28]
mov r8b, 0xb8
jo 0x14043ae58
js 0x140341f47
mov r8d, dword [rsp + 0x43]
call fcn.140593dd2
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
mov qword [rsp + 8], rbp
neg dword [rsp + 8]
or dword [rsp + 8], 0xb2a96b4
test word [rsp + 8], 0xd7bc
call fcn.1403d5d0b

Function at 0x140311d88
Capabilities:
Packed with generic packer

Disassembly:
movabs r14, 0xa3b7fdb3a9809c33
push rbx
lea rax, [rax + 1]
and r14w, 0x6c1b
push r8
jns 0x140533416
xchg ebp, eax
cmp dh, byte [rbx]
cmp eax, 0xbd2a67ac
or r14w, r14w
movabs r8, 0x9dbf949680180b03
call fcn.140489e5d
xor r8b, byte [rax]
xchg edi, eax
popfq
jp 0x140533447
xor r14d, dword [rdi + 0x6cbadc67]
loope 0x1405334a6
and ebx, edx
test al, 0x32
retf 0xa177
xchg edi, eax
invalid
invalid

Function at 0x140317396
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
add r14, 0xffffffffb319bca4
shl word [rsp + 8], 0x3e
lea rcx, [rcx - 0x64420bf9]
call fcn.14053580e
bswap edi
not di
or rdi, rdi
shl di, 0xb3
mov rdi, qword [rsp + rdi - 0x146afff8]
xchg qword [rsp + 0x10], rdi
jne 0x140506be2
je 0x140300a4a
mov qword [rsp + 8], rdi
push r13
movabs r13, 0x760fd987a8980405
call fcn.140415263
adc eax, 0x15553e17
stosd dword [rdi], eax
mov rbx, qword es:[rsp + rbx*8 - 0x7a42afb8]
mov rbx, qword [rsp + rbx*8 - 0x7a42afb8]
js 0x140550c36
mov rcx, r14
setl cl
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
or sil, 0x39
jbe 0x1402bf314
mov qword [rsp + 8], r14
jge 0x140289908
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406b29c3
jrcxz 0x1403173d6
invalid
invalid
and r15w, word [rsp + r15 + 0x4bd60eba]
cmp byte [rsp + r15 + 0x4bd6ff08], r15b
add qword [rsp], 0x16c39a
movabs rbp, 0x6f0253bb6735ea8a
sub dword [rsp + 8], 0x332fde05
push r9
call fcn.14056b296
cmpsd dword [rsi], dword [rdi]
sbb ebx, esi
pop rax
invalid
call fcn.140537481
adc dword es:[rdx + 0x27130fbf], esi
iretd

Function at 0x140318983
Capabilities:
Authenticate hmac

Disassembly:
mov rax, qword [rsp + r8 - 0x522f]
mov rax, qword [rax + r9 + 0x7145ad51]
call 0x1403189c8
and byte [rdx], 0x9b
fldcw word [rax]
xchg esp, eax
mov esi, 0xc3f74876
test rbx, 0x1a96cab4
jo 0x1404cf9f3
add qword [rsp + 0x18], 0x282259
movabs rdi, 0xb0a32a9f4908f9b5
xor bx, bx
Function at 0x1403189c8
Capabilities:
Authenticate hmac

Disassembly:
jg 0x1404d7b66
test word [rsp + 0x30], 0x8092
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x58]
ret
test rbx, 0x1a96cab4
jo 0x1404cf9f3
add qword [rsp + 0x18], 0x282259
movabs rdi, 0xb0a32a9f4908f9b5
xor bx, bx
call fcn.1402733d2
shr r13b, 0x9f
js 0x140500aa6
movsxd r9, ebp
xor edx, 0x628d8d38
lea rax, [rax + 0x11abc5ab]
jno 0x140339c0d
not byte [rsp + 0x20]
jl 0x1404c1d74
invalid
ja 0x14000ade4
xchg qword [rsp + 0x58], rbx
mov r11, qword [rsp + 0x50]
js 0x14042d43c
invalid

Function at 0x140328775
Capabilities:
Packed with generic packer

Disassembly:
setne r10b
setne byte [rsp + r10*4 + 8]
add r10d, dword [rsp + r10 + 0xc]
shl byte [rsp + r10 + 8], 0xd9
shr qword [rsp + r10 + 8], 0xcb
mov rdi, qword [rsp + r10 + 0x20]
mov rdi, qword [rdi + r10*2]
cmp r10b, 0x34
mov dword [rsp + r10 + 8], 0x1d2006b8
mov qword [rsp + r10*2 + 0x20], r10
ja 0x1403c9735
push r13
lea rdi, [rdi + r10*8 + 0x63144d04]
shl qword [rsp + r10 + 0x28], 0xfb
movabs r13, 0xd99005831a9a810c
mov r10d, dword [rsp + r10*4 + 0x14]
or byte [rsp + 0x10], r10b
mov qword [rsp + r10*2 + 0x28], r13
xchg qword [rsp + 0x30], rdi
mov r13, qword [rsp]
call fcn.14036037b
call fcn.14004df9d
mov rdx, qword [rsp + rsi - 0x5565e9be]
mov rdx, qword [rdx + r11 - 0x3292d000]
setne r11b
or rsi, 0x6205f117
shr si, 0xa2
lea r11, [r11 + rsi*4 + 0xa05ff29]
test r11d, 0x8d37f71e
jne 0x140413934
scasd eax, dword [rdi]
xchg edi, esi
cmp ah, byte [0x193cfee89]
invalid
movzx r11, r8w
xchg qword [rsp + r11*8 + 0x60], rbp
mov r8, qword [rsp + rsi + 0x50]
call fcn.14038cae0

Function at 0x1403322dd
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rax + 1]
push rdx
movabs rdx, 0xe130014d2a6a598
push rdx
shl word [rsp], 8
add qword [rsp + 0x20], 0xffffffffffb7e195
sub dl, 6
mov qword [rsp + 0x40], rax
or word [rsp], 0xdba0
jl 0x14057b7c0
rcr ebp, cl
xor dword [rdx - 0x30], ebx
out 0xd4, eax
insb byte [rdi], dx
cmp al, byte [rdi - 0x459ddbfb]
movabs byte [0x3a6781a4c59a6099], al
pop rsi
sbb cl, al
cmp bh, byte fs:[rdx + 0x632ea672]
mov edx, 0x9e0538b3
invalid
sete dl
shl dx, 0x45

Function at 0x140341ea2
Capabilities:
Read file on windows

Disassembly:
add qword [rsp + r14*2], 0xffffffffbfc6a0e5
sub word [rsp + r14*2 + 0x28], 0x84
je 0x140341edc
add byte [rax], al
add byte [rax + rax + 0x34b43a46], al
sub dword [rax], eax
add byte [rax], al
jle 0x140371c64

Function at 0x1403572a4
Capabilities:
Authenticate hmac

Disassembly:
mov rbx, qword [rsp + rbx - 0x518d2fd1]
mov r9, qword [rsp + rbx - 0x518d2f99]
not qword [rsp + rbx - 0x518d2fa9]
jl 0x140294da1

Function at 0x140360e67
Capabilities:
Authenticate hmac

Disassembly:
mov r11, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x629545d3
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406b72db
Function at 0x14036fca4
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov qword [rsp + rdx*4 + 0x18], rdx
add qword [rsp + rdx*4], 0xffffffffbfbcc4e9
sub dl, 0xa1
mov dx, word [rsp + rdx*8 - 0x2da]
lea rbx, [rbx + rdx*8 - 0x4bcfcc44]
mov r10, qword [rsp + rdx*4 + 0x18]
shl qword [rsp + r10 + 0x18], 0xc6
or r10, qword [rsp + r10 + 0x18]
bswap r10d
xchg qword [rsp + r10 + 0x30], rbx
mov r10, qword [rsp + r10*2 + 8]

Function at 0x140370c3c
Capabilities:
Enumerate processes

Disassembly:
movsx cx, byte [rsp + rdi*2 - 0x31393f5b]
test byte [rsp + rdi*2 - 0x31393f60], cl
add qword [rsp + 0x20], 0xc1cff
movsx cx, cl
sub qword [rsp + rdi*4 - 0x62727f00], 0x46371da0
add qword [rsp + rdi*2 - 0x31393f70], 0xffffffffbfcd594c
and dil, byte [rsp + rdi*2 - 0x31393f5f]

Function at 0x140370caa
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
jbe 0x1404b4510
add dword [rsp + 0x30], 0x6bb91bab
push r11
lea rcx, [rcx - 0x41f3156a]
add qword [rsp + 0x20], 0xffffffffbfade5e0
bswap esi
lea rsi, [rsi + rsi*4 - 0x62f3c34a]
and si, 0xc388
call fcn.1403b0452

Function at 0x14037c665
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x18], rdi
pushfq
shl r13b, 0x94
je 0x1403961a9
mov ch, 5
out dx, al
fcomp dword [rcx + 0x52caf24f]
xchg esp, eax
or al, 0x68
pop rbx
sub bl, ch
push 0x31
leave
invalid
sub r13, 0x12a83205
shl r13d, 0xe8
lea r13, [r13 + r13*2 + 0x64964618]
not r13
Function at 0x14037fb11
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
test rcx, rcx
jmp fcn.14050a411
push r12
add qword [rsp + 0x20], 0xffffffffbfd537f6
mov r12, qword [rsp + 0x40]
cmp r12b, byte [rsp + 0x46]
setg r12b
xchg qword [rsp + 0x50], rcx
mov r12, qword [rsp]
cmp dword [rsp + 0x40], 0xb119d420
call fcn.1402f3bdb
jmp 0x1405988e1
add dword [rsp + 0x48], 0xe5b22082
jns 0x1404e2aa1
mov r10, rdx
jg 0x140370cca
mov r10, qword [rsp + rdx - 0x50210188]
movsx dx, byte [rsp + rdx - 0x5021015a]
jb 0x140540f0e
jbe 0x1404d41bc
test qword [rsp + rdx - 0x5021ffc6], 0xffffffffc336dbaf
call fcn.14042fcde
bswap rcx
lea rcx, [rcx + rcx*4 - 0x33d3ddc9]
cmp ecx, 0xd39deda3
push rbp
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x10], rsi
push rsi
movabs rbp, 0x16a0dd91a1186c32
jo fcn.1403ac69b
mov rsi, rbp
neg rbp
shl bpl, 0x35
bswap esi
call fcn.1405296f9
sal dword [rsi - 0x50df70cc], cl
in eax, dx
movsd dword [rdi], dword [rsi]
invalid
add qword [rsp + rdi - 0x7abd1960], 0xffffffffbfd5787a
movabs rsi, 0x94a375a7d2b2cf1f
shl dil, 0x4a
call fcn.14045de5a
shl cl, 0xe
xchg qword [rsp + 0x10], rsi
shr ecx, 0x6b
setbe cl
jae 0x1404be5e0
sbb ebp, dword [rbx + 0x19befe94]
adc al, 0xc2
loope 0x1404e2b1d
ja 0x1404e2b3a
sahf
sbb eax, 0xcda6b587
pop rsp
mov ch, 0xa6
int 0x5c
clc
ret
mov dl, 0x43
push rbp
add byte [rsi - 2], bl
ja 0x1404e2ac6
and eax, 0x95b85e01
push rbp
sbb eax, 0x52c1f8f2
xchg edi, eax
hlt
outsd dx, dword [rsi]
movabs dword [0x654538fd933243c4], eax
invalid
cmp r15d, 0x130faa3a
sets r11b
lea rax, [rax - 0x64420bf9]
setbe r9b
call fcn.1404355ea
mov rax, qword [0x1402347c8]
mov r10, rcx
mov rcx, qword [rax + 0x58]
jmp 0x1402ea024

Function at 0x140384b1e
Capabilities:
Read file on windows

Disassembly:
mov r13, qword [rsp + 0x48]
jns fcn.140410966
lea rbx, [rbx + rcx + 0x752134e8]
push r8
js 0x14020bdf3
sub byte [rcx - 0x3d98016a], dh
mov ecx, 0xdff6ace4
ror qword [r11], 0x18
int1
add cl, dh
invalid

Function at 0x14039e8c1
Capabilities:
Packed with generic packer

Disassembly:
lea rcx, [rcx + 0x179965a0]
jbe 0x140441061
call fcn.1403d8a5e

Function at 0x1403a7d58
Capabilities:
Encrypt data using speck

Disassembly:
mov qword [rsp + 0x38], rbp
and r10b, 1
jo 0x1403d3471
jb 0x1404b74ce

Function at 0x1403ad924
Capabilities:
Read file on windows

Disassembly:
shr dil, 0x81
bswap rdi
jbe 0x140514b55
xchg qword [rsp + 0x28], rbp
mov rdi, qword [rsp + 0x20]
call fcn.14035d60d

Function at 0x1403c8fbd
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x1404139d4
call fcn.140560878

Function at 0x1403d25e0
Capabilities:
Packed with generic packer

Disassembly:
shr byte [rsp + 0x10], 1
js fcn.14056b686
mov r9, rbx
lea rax, [rax - 0x51c3c180]
and qword [rsp + 0x10], r9
and qword [rsp + 0x10], 0x61b3282e
cmp rbx, 0xffffffffbf8dde98
mov qword [rsp + 0x50], r9
xchg qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x38]
not r9w
setne byte [rsp + 0x10]
or byte [rsp + 0x28], 0x10
jl 0x140351c16
call fcn.14058ffd2
Function at 0x1403d2631
Capabilities:
Packed with generic packer

Disassembly:
shl r14w, 0x7d
setns r13b
mov r13, qword [rsp + 0x10]
add r14b, 0x26
jl 0x1405597fc
shl r14d, 0xdd
add qword [rsp + 8], 0xffffffffbfbbcc9d
mov r14, qword [rsp + 0x28]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.1406a3b86
push r15
xchg qword [rsp + r11 - 0x770], rbx
mov r8, qword [rsp + r9*2 + 0x5d2a0042]
mov rbp, r9
or ebp, 0x200636b6
movsx r11d, byte [rsp + r9 + 0x2e950061]
mov r15, qword [rsp + r9*2 + 0x5d2a0062]
add r9d, 0x35337714
setne r9b
xor r9b, byte [rsp + r9*2 - 0xd3ced9c]
lea rbp, [r11*8 - 0x70d660eb]
mov r11, qword [rsp + r9 - 0x69e7786]
setns r9b
call fcn.14035e1ff
mov r13, r14
add r13, 0xfffffffffc83f2b7
add r14w, r13w
add r14w, 0x6930
jae 0x1405597fc
call fcn.1403d2631
fistp dword [rbx - 0x74]
fsubr dword [rax]
leave
lodsb al, byte [rsi]
test al, 0x52
adc dl, byte [rdx + 0xa]
pop rbx
in al, dx
invalid

Function at 0x1403d26c2
Capabilities:
Packed with generic packer

Disassembly:
pushfq
and byte [rsp + 0x10], 0x2d
jae 0x1402bfd1a

Function at 0x1403d8a87
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
xor bl, 0xb8
add word [rsp + 0x18], 0x7e93
xchg qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x20]
call fcn.1402a3997
movabs rax, 0xa6a6edb9ae91c323
mov rbx, rax
add si, 0xe63c
xor rax, rsi
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
shr rsi, 0xc1
mov qword [rsp + 0x18], rsi
mov rbx, rsi
shr qword [rsp + 0x18], 0xe4
not sil
test dh, bl
lea rax, [rax + 0x289da820]
jae 0x14037faf8

Function at 0x1403e7f18
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1406fa391
push 0x24
xor dword [rax], eax
movabs byte [0x8d9dcf4f92772da7], al
out dx, eax
test byte [rbx - 0x1dbf468b], bl
std
adc byte [rbx - 0x14], ah
fidivr dword [rdx + riz*8 - 0x6e]
loope 0x1403e7f23
movabs dword [0x779d3c32e3ac97ac], eax
or byte [rdx - 0x17488563], 0xbf
add esp, dword [rax]
movabs rax, qword [0xc80a983fcd06410b]
pop rsi
mov r15b, byte [r8 + 0x47623e92]
mov ch, 0x59
push 0xffffffffffffff8a
cmp dl, byte [rax]
and cl, ah
pushfq
invalid

Function at 0x1403f0a04
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 8], 0x1ff813aa
lea rsp, [rsp + 8]
call fcn.1406b29c3

Function at 0x1403f0a17
Capabilities:
Authenticate hmac

Disassembly:
and qword [rsp + 0x58], 0x1d156f9c
jae 0x1402cbe2d

Function at 0x1403f6f64
Capabilities:
Encode data using base64

Disassembly:
setno dl
xchg qword [rsp + 0x78], rdi
mov rbp, qword [rsp + rbp*8 + 0x10]
js 0x1404bb84b
bswap r10d
movabs r9, 0x8f3ea9329d101311
je 0x140441024
xor dword [rsp + r11 - 0x41c2fffb], 0x5915f52a
test qword [rsp + 0x70], r11
jne 0x14050dbb0

Function at 0x1403f8e94
Capabilities:
Authenticate hmac

Disassembly:
shr r14, 0xa4
neg r14w
jo 0x1404f6fc7
jl 0x140500ab0
mov rdx, qword [rsp + r14*4 + 0x18]
mov rdx, qword [rdx + r14*2]
test r14d, 0x8d2b9a01
call fcn.14029734c

Function at 0x1403f8f8a
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffa9bd4d0d
mov qword [rsp + 0x10], 0xffffffff98f3b46e
lea rsp, [rsp + 0x10]
call fcn.1405eef85
Function at 0x1403f8fad
Capabilities:
Packed with generic packer

Disassembly:
push rsi
pushfq
movabs rsi, 0x59335f089b2d750d
add qword [rsp + 0x10], 0xffffffffffdd8dba
movabs rdx, 0xc738ce1efbab0db2
cmp rdx, 0x118d8fa7
push 0xffffffffdba41207
not dx
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
jg 0x1404dfc5e
cmp qword [rsp], rsi
bswap rsi
mov rsi, qword [rsp]
sets sil
lea rsi, [rsi*4 - 0x78693944]
lea rdx, [rdx + 0x75282234]
shr si, 0xf9
sub qword [rsp], 0xfffffffff98ba01e
jo 0x14053a3b2
cmp rsi, qword [rsp]
mov qword [rsp + 0x18], rsi
xchg qword [rsp + 0x28], rdx
mov rsi, qword [rsp + 0x10]
call fcn.1402d47ef
cmc
push rbx
out 0xd8, al
invalid

Function at 0x1404046fd
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + 0x20], 0x48bd1199
shl rbp, 0x14
add ebp, 0xb78eab1d
and r14b, r14b
lea r14, [r14 + rbp*4 - 0xce345c5]
mov r14, qword [rsp + 0x68]
shr bp, 0xac
movzx ebp, byte [rsp + 0x4c]
test byte [rsp + rbp - 0x38], bpl
call fcn.14028435f
lea rbx, [rbx + 0xd166408]
or dword [rsp + 0x38], r14d
shl r11, 0x5c
shl qword [rsp + 0x48], 0xa7
movsx bp, bpl
neg qword [rsp + 0x30]
not byte [rsp + 0x30]
xchg qword [rsp + 0x70], rbx
mov r11, qword [rsp + 0x40]
neg dword [rsp + 0x38]
jle 0x140593756
jno 0x1402e2f00
neg bl
xchg qword [rsp + rdi*2 - 0x149fb7da], rax
mov rdi, qword [rsp + 0x38]
neg dword [rsp + 0x48]
call fcn.1405b0d3e

Function at 0x14040d72a
Capabilities:
Encode data using xor

Disassembly:
movzx r13d, r13b
mov r13, qword [rsp + r13 + 0x18]
call fcn.14046acc5
pop rsi

Function at 0x140414496
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xchg qword [rsp + 0x18], rax
call fcn.14057e69b

Function at 0x1404144c4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.1406b29c3

Function at 0x1404144f7
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
xchg qword [rsp + rbp - 0xff06], rbx
mov rdx, qword [rsp + 0x38]
jo 0x140304d63
mov qword [rsp + r13*2 - 0x1feec], r12
mov qword [rsp + 0x70], 0xffffffff9826feaa
lea rbx, [rbx + 0x5899c1bc]
mov byte [rsp + 0x70], reloc.WS2_32.dll_setsockopt
test byte [rsp + 0x70], 0xb
mov rbp, r13
jno 0x1403d5810
and byte [rax - 0x41], al
invalid

Function at 0x14041c2e7
Capabilities:
Read file on windows

Disassembly:
xchg qword [rsp + 0x60], rbp
mov r9, qword [rsp + 0x18]
mov rdx, r12
jle 0x140464a08
pushfq
call fcn.1404fea15

Function at 0x140426a40
Capabilities:
Authenticate hmac

Disassembly:
call fcn.14059be36
mov qword [rsp + 0x18], 0xffffffff9907fbe0
mov r13, qword [rsp + r13*4 - 0x11a5a7f4]
jb 0x140303d32
shr r13d, 0x84
setne r13b
jbe 0x1404046e1
push rbx
pushfq
add qword [rsp + 0x10], 0xffffffffbf8d2be0
mov qword [rsp + 0x10], 0xe19bdc0
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14065ba29
Function at 0x140428e68
Capabilities:
Encode data using base64

Disassembly:
or word [rsp + 0x40], 0x3c20
movzx r12w, r12b
xchg qword [rsp + r10 - 0xff22], rbx
mov r13, qword [rsp + r10 - 0xff62]
add qword [rsp + r12 - 0x752d007d], 0xffffffffbfab8c2d
and qword [rsp + r12 - 0x752d003d], 0xffffffff93bc13ae
seta byte [rsp + r12 - 0x752d003d]
jae 0x1405096dd
pushfq
test r13w, 0x4d19
push r10
movabs r10, 0xce14bc82858d551f
push r10
push 0xffffffffe0398185
xchg qword [rsp + r13 - 0x54], rdi
mov r13, qword [rsp + r13 - 0x5c]
call fcn.1403c8fbd
Function at 0x140434697
Capabilities:
Authenticate hmac

Disassembly:
shl r13b, 0x4e
lea r13, [r13 + r13 - 0x7bdf69fc]
call fcn.1402fa584
neg r8b
call fcn.14038f752
push r15
neg r11d
jns 0x14032ac06
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
jge 0x140447402
call fcn.14044c5b0
mov rbx, qword [rsp + 0x48]
shr bx, 0xa9
mov rbx, qword [rsp + 0x18]
test word [rsp + 0x48], 0xedbd
je 0x14026ad29
call fcn.1405ae1e7
xchg qword [rsp + 0x28], rax
mov r14, qword [rsp + rsi - 0x2395]
xor si, 0xaf8d
or si, si
jno 0x1405adfd4
and al, 0x30
popfq
mov r9, qword [rsp + 0x18]
lea rsp, [rsp + 0x38]
ret
neg qword [rsp + 0x30]
jl 0x1402a1099
push rdx
call fcn.140450210
fisub word [0xf4e8313e]
loope 0x1404473c0
movsb byte [rdi], byte [rsi]
xor al, 0xf
xor byte [rsi + 0x1d9d6ea5], bl
pop rdx
add dword [rcx + 0x5a64efb5], esp
invalid
cmp dword [rsp + 0x20], 0x3dbde597
call fcn.14034ed3f
jb 0x140475bea
cmp r11, 0x520e12ba
jne 0x140434659
sub dh, byte [rdx + 0x40c090d2]
int 0x1f
mov dh, 0xb0
and dword [rsi], ecx
call 0xffc426e4
mov ebp, 0x1f41a352
pop rbx
popfq
adc eax, 0x6be7cc5
enter 0x1af5, 0x6e
push rbx
test byte [rbp - 0x32471137], bh
invalid
add dword [rsp + rsi*8 - 0x46060], 0x88241cb6
xor sil, sil
sub byte [rsp + rsi - 0x8be0], 0xa8
mov rsi, qword [rsp + rsi - 0x8bf0]
jne 0x1404a4ebf

Function at 0x14043931f
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
neg r14
push r9
add qword [rsp + 0x28], 0x4a8ca6
cmp r14d, 0xefad4025
jns 0x140370cba
not r14w
push rbx
js 0x140599789

Function at 0x140446b00
Capabilities:
Packed with generic packer

Disassembly:
insb byte [rdi], dx
invalid
push rsi
jo 0x140446ad0
invalid
or r9w, word [rsp + 0x23]
jo 0x1403d269d
mov qword [rsp + 0x18], r13
sub dword [rsp + 0x18], 0x59bad12
lea rax, [rax - 0x65c8fdff]
je 0x1404950c3
push r13
call fcn.140264e03
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14067e4be
call fcn.1404d1756
js 0x140446af1
push rdi
xlatb
adc eax, dword [rdi - 0x6250a339]
leave
int 6
out dx, al
invalid

Function at 0x14044c558
Capabilities:
Packed with generic packer

Disassembly:
neg word [rsp + rbx + 0x10]
shr r15d, 0xb6
mov qword [rsp + r15*2 - 0x258], r15
push r13
lea rsp, [rsp + rbx + 8]
ret 8
add qword [rsp], 0x12535f
sub ebx, ebx
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx + r15 - 0x4c12e601]
jns 0x14035fb1c

Function at 0x14044c599
Capabilities:
Packed with generic packer

Disassembly:
shl edi, 0x79
jb 0x14044a236

Function at 0x14044c5b0
Capabilities:
Packed with generic packer

Disassembly:
movabs r15, 0x493f4da2b78bf33c
cmp r15w, 0x4394
bswap r15d
call fcn.1402bba81

Function at 0x140464a68
Capabilities:
Read file on windows

Disassembly:
and al, 0x20
xlatb
push rbx
fdivr dword [rdi + 0x24548b48]
adc byte [rbx + rdi + 0x64], cl
and al, 0x40
mov qword [rsp + 0x10], 0x7af5fec
lea rsp, [rsp + 0x10]
call fcn.14067e4be
jp 0x140464a2a
xchg r8d, eax
test eax, 0x9a583631
adc ch, byte [rdi - 0x18]
std
add ebp, dword [r11 + 0x62673426]
jb 0x140464ab4
invalid
push rdx
mov gs, word [rcx + 0x65b01311]
invalid