joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a75a9
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
test byte [rsp + 0x20], r11b
mov qword [rsp + 0x20], r11
xchg qword [rsp + 0x40], rsi
mov r10, qword [rsp + 0x18]
js 0x1404da156
jb 0x14056dc58
mov r11, qword [rsp + 0x38]
add qword [rsp], 0xffffffffbfa76096
call fcn.14055c1f1
mov rcx, qword [rsp + 0x60]
call fcn.140521536
invalid
setl byte [rsp + r10 - 0x52dc279d]
shr r10b, 0x9a
add qword [rsp + r10 - 0x52dc26f8], 0xffffffffbf915504
or byte [rsp + r10 - 0x52dc26e8], r10b
shl r10, 0xde
xchg qword [rsp + 0x60], rax
mov r10, qword [rsp + 0x40]
and word [rsp + 0x18], 0x371a
shr byte [rsp + 0x18], 0x7b
call fcn.1404526fa
cmp qword [r14 + r8*4 + 0x60], 0xffffffffffffffde
shl dword [rcx + 0x5e994bd7], 0x28
mul byte [rsi + 0x28586c7a]
mov byte [rax + 0x6e2bd7a0], dl
cmc
movabs byte [0xe6c92859880931d7], al
pop rsp
sub byte [rdx + 0x46], dl
invalid
lea rax, [rax + r10 - 0x5f54b220]
jne 0x1404544b3
jg 0x140369bf8

Function at 0x1404a98b7
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x18]
call fcn.140790593
lea rsi, [rsi + rsi*8 + 0x4d9d1829]
jb 0x1405ab439
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + rcx - 0x6fb700ee]
or qword [rsp + 0x10], 0x551b8c2e
add qword [rsp + rcx - 0x6fb700a6], 0xffffffffffd7c736
mov qword [rsp + rcx - 0x6fb7008e], rcx
mov cl, 0x19
push rbp
push r13
not word [rsp + rcx - 0x6fb6fff9]
mov rcx, qword [rsp + rcx - 0x6fb6ffd9]
mov rsi, qword [rsp + 0x38]
lea rsp, [rsp + 0x58]
ret
test byte [rax + 0x43], dh
out 0x52, eax
mov dword [rsi - 0x73], ecx
and al, 0x75
popfq
invalid
push rsi
movzx r14d, r12w
push r11
sub word [rsp + r12*2 + 0x2443152], 0x16b0
mov r11, r12
lea r14, [r11 + r14*2 - 0x2d636732]
setno r12b
mov qword [rsp + r12 + 0x1221940], rax
cmovg r12d, dword [rsp + r12 + 0x1221908]
or r11d, r11d
test r14w, r11w
cmove r11w, word [rsp + 0xa]
and r11d, dword [rsp + 0xc]
shr r14w, 0x96
je 0x140601689
cmp word [rsp + 8], 0x351c
setne byte [rsp + 8]
call fcn.140722226
mov ah, send
test byte [rax], ah
jg 0x1405ab410
movsb byte [rdi], byte [rsi]
xlatb
outsd dx, dword [rsi]
scasb al, byte [rdi]
loop 0x1405ab401
invalid
add qword [rsp + 0x10], 0xfffffffffff779d6
call fcn.140723299
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407cbc27
cmp si, 0x3e38
mov esi, 0x162a479a
mov rsi, qword [rsp + rsi - 0x162a4792]
mov qword [rsp + 8], 0xfffffffffa9e269c
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1407ad61e
Function at 0x1404b2db4
Capabilities:
Set registry value

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407ad61e
jno 0x140438fd8
movabs rcx, 0x934829062aa6d05b
mov qword [rbp + 0x1b0], rcx
movabs r12, 0xd8e1a29bb0c069c8
mov qword [rbp + 0x1b8], r12
movabs rax, 0x937b29562aefd01f
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x1c8], r12
movabs rax, 0xc782101462158b35
mov qword [rbp + 0x1d0], rax
movabs rax, 0x2bcc0298ad12a4a
mov qword [rbp + 0x1d8], rax
movabs rax, 0x2cd8222a3a3f9b1f
mov qword [rbp + 0x1e0], rax
movabs rax, 0xcc05c17f4e0347bc
mov qword [rbp + 0x1e8], rax
movabs rcx, 0x931c29402ae9d008
mov qword [rsp + 0x50], rcx
movabs rcx, 0xd8a4a2c9b081699f
mov qword [rsp + 0x58], rcx
movabs rcx, 0xc7e1107d62588b69
mov qword [rsp + 0x60], rcx
movabs rcx, 0x2d3c05a8abe2a38
mov qword [rsp + 0x68], rcx
movabs rcx, 0x2cd8222a3a4b9b79
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp + 0x1b0], 0
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
and bl, bh
jl 0x140700a01
test byte [rsp + rbx - 0x76537ff0], 0x15
mov byte [rsp + rbx - 0x76537ff0], 9
not qword [rsp + rbx - 0x76537ff0]
mov rbx, qword [rsp + rbx - 0x76537fe0]
call fcn.1403cde07
movabs rax, 0x70ef71bab88149c
sub eax, 0x1c05000d
lea rax, [rdx*4 + 0x612089f]
jge 0x14058aebb
call fcn.14072afac
mov r12, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffa1249295
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1407cbc27
sub dl, byte [rbx]
int 0x7a
std
ret
xor word [rsp + 8], 0xf436
setae byte [rsp + 8]
xor dword [rsp + 8], 0x930ff436
and al, 8
jno 0x140045735
jp 0x1404b2db5
nop
loopne 0x1404b2dc9
ret
xor al, 0x2d
adc eax, dword [rdi]
cmpsd dword [rsi], dword [rdi]
pop rsp
mov byte [rbx + 0x1c843a46], bh
invalid
neg byte [rsp + 0x70]
ja 0x14036a3fd
jo 0x14047eb8a
xor dword [rsp + 0x48], 0x80a33fb1
or qword [rsp + 0x48], 0xffffffffeb07cd86
push qword [rsp + 0xa8]
popfq
lea rsp, [rsp + 0xb8]
ret

Function at 0x1404b55e9
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
and r9b, r9b
add qword [rsp + 0x10], 0xffffffffffe305c1
push r13
xor r9b, 0
jns 0x1404da13d
Function at 0x1404b63a2
Capabilities:
Packed with generic packer

Disassembly:
movabs rcx, 0xab8b4ca299257c88
add rcx, 0xffffffff9fade982
jge fcn.14053b65b
add cl, ch
call fcn.1404378b8
add word [rsp + 0x18], 0xb204
mov r15b, byte [rsp + 0x1d]
mov r9, qword [rsp + 0x18]
add qword [rsp + 0x28], 0xffffffffffe2ce69
neg r15d
setne r9b
jae 0x1406844b3
je 0x1404f85cc
ja 0x1403eb2ed
call fcn.1404c4a0e
jb 0x1403c890c
loop 0x1404b6419
cld
jrcxz 0x1404b634e
add bh, byte [rdi + riz + 0x2a]
invalid
invalid
and al, 0x29
jmp 0x1404b63e2
lea rsp, [rsp + 0x60]
ret 8
mov qword [rsp + 0x38], rsi
add qword [rsp + 0x18], 0xffffffffbf96ee68
xchg qword [rsp + 0x68], rdx
mov r13, qword [rsp + 0x30]
neg sil
cmp r14w, 0x650e
call fcn.1403fbe28
push r9
pushfq
movabs r9, 0x4399da0df733e63f
or r9b, 0x16
js fcn.1406e411d
xchg qword [rsp + 0x18], rbx
call fcn.14052a831

Function at 0x1404c390f
Capabilities:
Packed with generic packer

Disassembly:
setne byte [rsp + 8]
jo 0x1406790cd
test word [rsp + 0x28], r12w
not dword [rsp + 8]
mov r12, qword [rsp + 0x30]
call fcn.140631b81
pop rcx
call fcn.14071ade3
xlatb
invalid

Function at 0x1404c4c76
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jo fcn.140676141
sub word [rsp + 0x48], 0x4a3e
ja 0x1406c00c7
mov qword [rsp + 0x18], 0x62766ae
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x1404cdbcf
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
call fcn.14047f8ef

Function at 0x1404dd5dd
Capabilities:
Packed with generic packer

Disassembly:
push rcx
add qword [rsp + 8], 0x2fa2f2
mov rax, rdi
neg dil
jbe 0x1406b017a

Function at 0x1404dd5f3
Capabilities:
Packed with generic packer

Disassembly:
cmp ecx, 0x3b84633c
xchg qword [rsp + 0x18], rdx
ja 0x1404e5ea0
or cl, 0x1c
push rbp
jb 0x1405b4ee9
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rdx
movabs rbp, 0xd29ed091ca0a2236
call fcn.14067910d
movzx r11d, r11b
test r11d, 0x3693198a
mov r11, qword [rsp + r11 - 0x49]
jne 0x1406ce030
jg 0x140686aa1

Function at 0x1404e2334
Capabilities:
Packed with generic packer

Disassembly:
movabs rsi, 0xa3935a277c2f8c2e
add bl, 0x14
or esi, 0x412c343a
or sil, sil
push r15
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
movabs r15, 0xf5bcb610e60d052c
setbe r15b
neg rbx
and r15d, ebx
sub r15w, r15w
lea rsi, [rsi - 0x65f23f7b]
movsx r15w, bl
mov qword [rsp + 0x10], rbx
lea rbx, [r15 + rbx*8 - 0xa7f6654]
sete r15b
xchg qword [rsp + 0x28], rsi
mov r15, qword [rsp]
add bl, 0xbd
call fcn.14056ef8c

Function at 0x1404e5bbc
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
call fcn.1406a65b1
jne 0x1403bd4f5
Function at 0x1404e5bc2
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
call fcn.14059b884
xor al, 0x56
jp 0x1404e5bff
and byte [rdx + 0x2671b5b7], bh
jno 0x1404e5bf7
invalid
movabs eax, dword [0x210ffe2e6cb0a28f]
mov esi, 0x4d203615
and dword [rsi + 0x4d203615], edi
jns 0x1404e5c2e
and eax, 0x5e90b555
jbe 0x1404e5c21
rol byte [rdi - 0x33], 4
loopne 0x1404e5bcf
je 0x1404e5c3e
mov dword [rdx], 0xa0af4543
fisttp dword [rsi]
stosb byte [rdi], al
orps xmm6, xmmword [rbp - 0x799665a]
xor al, 0
add byte [rax + 0x32ce75a], al
neg byte [rax - 0x39]
invalid
out 0x2c, eax
add esi, esi
pop rax
invalid
cld
invalid

Function at 0x1404e5ce4
Capabilities:
Packed with generic packer

Disassembly:
jb 0x14050554c
xchg qword [rsp + rbp + 0x4f8ab918], rbx
mov rdi, qword [rsp + r15 + 0x4f8ab8e8]
cmp bpl, 0xb0
jl 0x14041adae
sub r15w, 0x9b26
not r15d
mov rdx, qword [rsp + 0x30]
jae 0x140578f44
jge 0x1406b71b5
sub byte [rdi], ah
pop rbp
add byte [rdx + 0x5d], r11b
add byte [rdx], r10b
invalid
shr r11, 0x20
neg rbp
shr bp, 0x82
neg rbp
sub r15d, r15d
neg rbp
sub bp, bp
mov r15, qword [rsp + r15*4 + 0x10]
add qword [rsp + rbp - 0x4f89ffc0], 0x3a2d9690
seta byte [rsp + rbp - 0x4f89ffc0]
call fcn.140498f92

Function at 0x1404f55db
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
ret
mov rbp, qword [rsp + 0x60]
je 0x14040fbeb
setge byte [rsp + 0x38]
jl fcn.1405a0c75
mov qword [rsp + 0x40], 0x5237f31
mov r9, qword [rsp + 0x38]
mov r9, qword [rsp + r9*2 + 0x1fe06]
seta byte [rsp + 0x38]
neg dword [rsp + 0x38]
sub byte [rsp + 0x40], 0x93
mov qword [rsp + 0x40], 0xfffffffffc3118b6
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x1404fe6bb
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jns 0x14060a2ca
call 0x1406b9a6f
bswap r13
jbe 0x14058bc9f

Function at 0x140502c7c
Capabilities:
Encode data using base64
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push rcx
push 0x6f2ee917
call fcn.1405ef8c6
add qword [rsp + r15 + 8], 0xfffffffffffd9910
and byte [rsp + r15 + 0x18], r15b
lea rbx, [rbx + r15 + 0x4f2ab78e]
push r15
and word [rsp + r15*2], 0xd83a
cmp r15d, dword [rsp + r15*2 + 3]
ja 0x1403f1b39
call fcn.1404dc46f
setae r15b
bswap r15
sub r15d, r15d
jns 0x1404360e0

Function at 0x140511e70
Capabilities:
Terminate process

Disassembly:
jbe fcn.140453c3d
shl qword [rsp + r10 - 0x50908003], 0xa
test r10d, r10d
mov r10, qword [rsp + r10 - 0x50907feb]
mov byte [rsp + 0x10], 0xab
setns byte [rsp + 0x10]
lea rsp, [rsp + 0x38]
ret

Function at 0x140512290
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbfc0df5a
movabs rdi, 0xb32fae34963bee21
call fcn.140633560
and cx, 0xae35
jb 0x1404035be
test ecx, 0x583a4c39
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rdx
push rbp
add qword [rsp + 0x20], 0x101bab
movabs rbp, 0xbb2de6216528de1d
movabs rdx, 0x899050a5770c8594
shl edx, 0xac
xor bp, 0x663e
cmp rdx, rbp
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
call fcn.14000a6ad
Function at 0x14052092e
Capabilities:
Packed with generic packer

Disassembly:
xor r8w, 0xe735
mov rcx, qword [rsp + r8*2 - 0x170da]
or r8d, r8d
jl 0x14065716a
xor r8b, 0xbf
or r8d, r8d
lea rcx, [rcx + r8 - 0xb83d]
neg r8b
lea r8, [r8*8 - 0x3d7d1be6]
xor r8b, 0xc
je 0x14054900e
shl r8b, 0x2a
not r8d
mov r8w, 0xa897
shl r8d, 0x1f
mov qword [rsp + r8 - 0x7fffffd8], rcx
xor r8d, 0xb8187a8f
bswap r8
jg 0x14053ee34
lea rcx, [rcx + 0x7495bdba]
call fcn.14059693d
ror byte [rax - 0x17af3bbc], 1
pop rbp
cld
ja 0x14054901f
call 0x13bcc8c81
popfq
nop
invalid

Function at 0x14052131f
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
movsxd rbx, ebx
jbe fcn.1406a659d
mov rbx, qword [rsp + rbx - 0x67b1abe5]
mov qword [rsp + 0x20], rax
or r11, r11
add r11b, r11b
call fcn.14067bdec

Function at 0x140521527
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax + 1]
jno 0x14052995c

Function at 0x14052d533
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
call fcn.14069caf5
push r8
push r8
push r11
js 0x1403e2b63
xchg qword [rsp + r10 + 0x5fae975f], rax
mov r10, qword [rsp + r10 + 0x5fae974f]
jbe 0x1404f6626
mov r11, qword [rsp + 0x38]
je 0x1404f0e73
movsxd r11, r11d
not word [rsp + r11 + 0x5fae970f]
pop r11
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1405380ee
Capabilities:
Packed with generic packer

Disassembly:
sub qword [rsp + r12*2 - 0xba], 0xffffffffb40f8fb4
call fcn.1405e1dbe
shl byte [rsp + 0x40], 0x79
xchg qword [rsp + 0x80], rbp
mov rbx, qword [rsp + 0x58]
js 0x140664d45
call fcn.1405b0ace

Function at 0x1405380ff
Capabilities:
Packed with generic packer

Disassembly:
sub qword [rsp + r12*2 - 0xba], 0xffffffffb40f8fb4
call fcn.1405e1dbe
shl byte [rsp + 0x40], 0x79
xchg qword [rsp + 0x80], rbp
mov rbx, qword [rsp + 0x58]
js 0x140664d45
call fcn.1405b0ace

Function at 0x140538144
Capabilities:
Packed with generic packer

Disassembly:
mov rcx, qword [rsp + 8]
je 0x140591f19
jbe 0x140623b40
call fcn.14056a52b

Function at 0x14054783a
Capabilities:
Packed with generic packer

Disassembly:
push r11
movabs r11, 0xe3988a8b09b48003
movabs rax, 0x9b044f95a8bc8816
or eax, eax
and rax, 0xffffffffc41e469b
jg 0x1405a5b90
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
add r11w, r11w
call fcn.1406ae40e

Function at 0x140550c19
Capabilities:
Encode data using xor

Disassembly:
or qword [rsp + 0x28], 0x5843b9b
mov r15, qword [rsp + 0x10]
cmp byte [rsp + 0x28], 0xba
call fcn.14042c72f
fisubr word [r15 - 0x4ebf812b]
sbb eax, dword [rdi - 0x49]
in eax, dx
fisub dword [rcx - 0x726e9edc]
test byte [rsi], ah
sbb al, 0x2a
jge 0x140550c71
invalid
jbe 0x140550c6c
jne 0x140550c76
out 0x68, eax
ror dword [rdi - 0x2e86d039], cl
push rsi
xor eax, 0x835dda2b
movsb byte [rdi], byte [rsi]
xor eax, 0xf5a633c7
inc ecx
jl 0x140550c3f
outsb dx, byte [rsi]
cmp byte [rsi + 0xf3181ee], al
leave
sbb dl, dh
stc
mov eax, 0x4399958f
fist dword [rsi - 0x3b38aaf7]
jrcxz 0x140550c6f
invalid
xchg esi, eax
or dword [rbp - 0x39], edx
invalid
retf
Function at 0x140558252
Capabilities:
Encode data using xor

Disassembly:
and dword [rsi + rbp*4 + 7], esi
or al, 0x12
shl qword [rsp + r9*4 - 0x28074], 0x30
add qword [rsp + r11*4 - 0x1c], 0xffffffffffec45ee
add r9d, r10d
add ecx, edx
mov r10, qword [rsp + r11 + 1]
call fcn.1406e519c
xor byte [rsp + 8], 0xba
mov qword [rsp + 0x18], 0xffffffffee908b20
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140839356
shr dword [rbx + 0x16], cl
push rax
or dword [rdx], ecx
jo 0x140558227
xlatb
push rbp
in al, 0x15
mov dl, 0xd7
stosd dword [rdi], eax
movabs dword [0xd4284c0663284968], eax
mov esp, 0x284e751c
mov ch, 0xa3
movabs eax, dword [0xb3284694a0fed7b4]
mov ebx, 0x1e3e2845
movabs al, byte [0xa8d7b05435284f0c]
jl 0x140558243
movabs eax, dword [0x69284e5dc6c9d7b6]
enter 0x4c38, 0x28
ja 0x140558325
sub byte [rdi + 0x6f], r14b
mov r15b, 0xd7
scasd eax, dword [rdi]
sub esi, dword [rdx - 0x4793f729]
pop rax
mov al, 0xd7
add dword [rdi], esp
mov word [rdx + 0x28], cs
or al, 0xb9
mov eax, 0xb7050dd7
xlatb
cwde
stosb byte [rdi], al
call 0x113a2d498
adc al, 0x16
jge 0x1405582b2
mov bl, 0xe1
sahf
invalid
wait
invalid

Function at 0x140565bba
Capabilities:
Packed with generic packer

Disassembly:
ja 0x140648474
sub word [rsp + 0x50], 0xf42b

Function at 0x140565bcc
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
setae dl
or dl, 0x13
setne dl
jb 0x1406f2186
sub r15, 0xffffffffd63d6023
cmp dx, 0xdbb2
setne r15b
mov r15, qword [rsp + 8]
jb 0x14040b2e2
push rbp
call fcn.14044c4c2
jg 0x1404e28b0
neg byte [rsp + 0x68]
push qword [rsp + 0x98]
popfq
lea rsp, [rsp + 0xa8]
ret
mov r14, qword [rsp + 0x40]
movzx ecx, cx
lea rcx, [r13 + rcx*4 - 0x697e7100]
call fcn.1406220ed

Function at 0x14057f1ab
Capabilities:
Terminate process

Disassembly:
shr bx, 0xfa
test byte [rsp + 0x50], 0x34
mov r8, qword [rsp + r15 - 0x73397608]
jb 0x14061f881
mov rdi, qword [rsp + 0x40]
neg qword [rsp + 0x58]
add qword [rsp + r15 - 0x73397628], 0xffffffffbfb1a22f
or r15, 0xfffffffffc81d21d
and qword [rsp + r15 + 0x4609db], r8
test ebx, r15d
jle 0x14071fc8f
call fcn.1404fc0f7
mov r10, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffff94c1998e
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407f3663
mov r9, qword [rsp + r9 - 0x826]
lea rsp, [rsp + r8 - 0x7f6]
ret
invalid
call fcn.1404496ba
jno 0x1405b115d
nop
inc dword [rdx - 0xe]
jg 0x14061f858
or al, bh
xchg esi, eax
invalid
mov r15, qword [rsp + r8 + 0x440000cd]
or r8, r8
shl byte [rsp + 0x58], 0x4c
xor bl, byte [rsp + 0x75]
jg 0x1404ba581
seto byte [rsp + 0x70]
mov r8, qword [rsp + 0x28]
and qword [rsp + 0x58], rbx
cmp qword [rsp + 0x50], 0xffffffffe00ebe31
push qword [rsp + 0x78]
popfq
mov rbx, qword [rsp + 0x20]
lea rsp, [rsp + 0x88]
ret
Function at 0x14057f1f0
Capabilities:
Terminate process

Disassembly:
neg word [rsp + 0x48]
neg word [rsp + 0x48]
jo 0x14005eebe
call fcn.14071e15b
jne 0x14063fdcd
mov qword [rsp + r13*2 + 0x3a], r13
lea rsi, [rsi + r13 - 0x68e2784a]
add r12, r13
jl 0x140464dab
or r12w, r13w
push r8
or qword [rsp + r12*4 - 0x3ffbc], 0x6226333f
movabs r8, 0x1a3ecc38db9bac2f
xchg qword [rsp + r13*2 + 0x62], rsi
mov r13, qword [rsp + r12 - 0xffcf]
and r8d, 0xd232182
sub r12w, 0x9e92
add qword [rsp + r12*2 - 0xc2a2], 0xffffffffbf9ea5f7
not r8

Function at 0x140587408
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push rsi
pushfq
movabs rsi, 0x36100503c51b5a15
or si, 0xed16
push r8
mov qword [rsp + 0x20], 0x73971f0d
mov rsi, qword [rsp + 0x10]
movabs r8, 0xb828f3112104381d
add qword [rsp + 0x18], 0xffffffffbf95f3ca
shl r8b, 0xfa
jns 0x1405f1629
mov r8, qword [rsp]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1408521c5

Function at 0x14058bbc1
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + r10 - 0x6fdfab42]
mov rbp, qword [rbp + r10 - 0x6fdfab62]
mov r13, qword [rsp + r10 - 0x6fdfab4a]
mov qword [rsp + r13 + 0x71fffe1f], r10
sete byte [rsp + r13 + 0x71fffe17]
call fcn.14058463e
movabs rbx, 0xfa2c279105358204
movsx r13, r13w
add qword [rsp + 0x28], 0xa4160
neg r13d
neg bx
nop
push r14
movabs rbp, 0x22846e1ce919c79b
movabs r14, 0x1f060e0801277e91
and rbp, rbp
push rsi
mov rbp, qword [rsp + 0x38]
mov rbp, qword [rbp + riz]
movsxd r14, r13d
jae 0x14054410f

Function at 0x14058bc3a
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
mov r8w, 0xa8ac
mov r8, qword [rsp + 0x20]
shl r12d, 1
jne 0x14062d388
neg r12
not r12
js 0x1406da51e
jae 0x1403e178e
bswap r12d
sub r12b, 0xa4
mov r12, qword [rsp + 0x28]
call fcn.14069e328

Function at 0x1405924e4
Capabilities:
Encode data using xor

Disassembly:
bswap r12
mov r12, qword [rsp + 8]
lea rsp, [rsp + 0x20]
call fcn.140768a4f
xor bh, byte [rax - 0x3b80558f]
insb byte [rdi], dx
or dword [rbp + rsi - 0x72], eax
movabs eax, dword [0xa3830015c256e925]
sbb byte [0x178dc539b], bl
sub ah, byte [rdx + 0x12]
adc esp, dword [rdx - 0x61]
lea ecx, ss:[rbp - 0x2b]
and eax, 0x66265122
jbe 0x1405924f1
retf

Function at 0x1405a0c4a
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
mov bl, 0x92
call 0x13f3e7410
dec dword [rax - 0x79]
invalid
invalid
jl 0x140362851
sub byte [rcx + 0x56], al
call fcn.1405e1e2c
call fcn.1405960d1
nop word [rax + rax]
movabs eax, dword [0x8fe2e0f290421dc9]
out 0xc8, eax
loop 0x140362821
out dx, eax
invalid
invalid
movsxd rbp, edi
mov bpl, 0x82
cmp r13w, 0x1410
push r8
movzx r13w, r13b
jo 0x140362835
ja 0x140681e4e
lea rcx, [rcx + rbp + 0x5f48717f]
sub r13, rdi

Function at 0x1405a9b99
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + rbp - 0xa3904a6], rbx
mov rbp, qword [rsp + rbp - 0xa3904be]
test qword [rsp + 0x28], 0x1db5951c
call fcn.1406db5f0
jg 0x140504f6c
Function at 0x1405b32fc
Capabilities:
Encode data using base64

Disassembly:
js 0x1405e1e4e
mov rsi, qword [rsp + rsi + 0x5f7f534b]
or dword [rsp + 0x38], 0x8d2bf526
mov word [rsp + 0x48], 0x2f03
jo 0x140651e08
add qword [rsp], 0xffffffffbfc9a1b8
add word [rsp + 0x40], 0x39b1
add qword [rsp + 0x10], 0xffffffffbfa177ee
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x70]
ret

Function at 0x1405b3582
Capabilities:
Terminate process

Disassembly:
adc eax, 0xab4186
mov ecx, ebx
call fcn.140063c00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor byte [rsp + 0x38], 9
sub word [rsp + 0x38], r9w
and byte [rsp + 0x38], r9b
neg r9w
movsx r9w, r9b
ja 0x140063be9
mov r9, qword [rsp + 0x60]
setno byte [rsp + 0x40]
mov dword [rsp + 0x40], 0x463e5683
call fcn.14043c011
jns 0x140559410
jae 0x1405d273f
sbb al, 0xd8
rcr byte [rcx + 0x63], 0x22
or eax, 0x5dc38b6c
lea ax, [rbx - 0x5d]
sub dword [rdx - 0x1788d064], esp
invalid
setbe byte [rsp + 0x18]
xchg qword [rsp + 0x30], rbx
mov r13, qword [rsp + rsi - 0x8898449]
or esi, 0x6eb6a81f
jne 0x140647fc5
jnp 0x1405d2717
mov edx, 0x3c3209a9
pop rdx
lahf
cmp al, 0x5c
mov esp, 0xa467293
invalid
neg si
sets byte [rsp + rsi - 0x6ebf5389]
jno 0x14066e6ff

Function at 0x1405b4f16
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + r14*2 + 0x492e014e], 0xffffffffbf925b4a
mov r14, qword [rsp + r14 + 0x249700a3]
sub word [rsp + 0x50], 0x738c
not byte [rsp + 0x50]
call fcn.1406e95d5
add al, 0xfc
sbb ch, byte [rbx + rdx]
loopne 0x1403d98e0
invalid
pushfq
or r8b, 0x98
jb 0x140701369
setl r8b
xor r8, 0x73ac2606
xchg qword [rsp + 0x10], rbx
bswap r8d
shl r8, 0x9d
shr r8w, 0x3d
je 0x14049a638
shl byte [rsi - 0x3a], 0x9e
stosb byte [rdi], al
call 0x1ae431580
popfq
pop rbx
jl 0x1403d98e2
or al, 0x21
test al, 0x83
pop rax
invalid
jg 0x14049749f
push r15
movabs r15, 0xc3aaebb280c7c18
call fcn.1404535a5
sar edx, cl
invalid
add dword [rsp + 0x28], 0x5f952fb2
jl fcn.14050e94c
test dword [rsp + 0x10], 0xf29940ad
lea rbx, [rbx - 0x4965d3c1]
mov rdi, qword [rsp + rbp - 0x650d0028]
mov r15, qword [rsp + 0x28]
call fcn.140693dc7
push rcx
mov qword [rsp], 0x27787c95
call fcn.1407cbc27
setl r13b
js 0x1403d98f6
and r13d, r13d
js 0x14000aaf2
neg r13d
lea rax, [rax + 1]
jl 0x14042fe6c
mov qword [rsp + 0x40], rdi

Function at 0x1405b5433
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + r8*2 - 0x224f8dc8], 0xffffffffffecccd3
xchg qword [rsp + 0x70], rax
mov rdx, qword [rsp + r11*2 - 0x45006dc0]
call fcn.140352171
or r14d, r12d
lea rdi, [rdi + r14 - 0x779ec77b]
call fcn.140661a39
jne 0x140489566
not edx
lea r8, [r11*4 - 0x78d91554]
not dx
je 0x1403c34a6

Function at 0x1405b56dd
Capabilities:
Packed with generic packer

Disassembly:
mov r9w, 0x3591
jns 0x1406a7a0e

Function at 0x1405b6ef8
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
xor r13w, 0x3a86
shl word [rsp + 0x48], 0x9e
test dword [rsp + 0x48], r13d
mov r13, qword [rsp + 0x30]
call fcn.1403526f1