joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022750
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140057410
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400227e1
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022858
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14002282e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022858
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x30]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140004a70
mov rax, rdi
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x888]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022f40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov ecx, 0xf75db66e
call fcn.1400024e0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400230f6
mov qword [rsp + 0x50], rsi
mov ecx, 0xc309a0d
call fcn.1400024e0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x1400230e7
mov ecx, 0x700da41
call fcn.1400024e0
lea r9d, [rsi + 4]
mov r8d, 0x3000
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x1400230f6
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023029
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
jmp 0x1400230e7
mov ecx, 0x8285aca5
call fcn.1400024e0
mov rcx, rdi
call rax
mov dword [rsp + 0x4c], esi
mov ecx, 0xd30e846a
call fcn.1400024e0
mov r8d, 6
lea r9, [rsp + 0x4c]
xor edx, edx
mov rcx, rbx
call rax
test rax, rax
jne 0x14002307b
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x1400230fc
mov ecx, dword [rax + 0x18]
add rcx, rbx
mov rdx, rcx
mov qword [rsp + 0x40], rcx
movabs r8, 0x6c616e416f747541
lea rax, [rcx + 0xa0]
cmp rdx, rax
jae 0x1400230cc
cmp qword [rdx], r8
jne 0x1400230c2
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
mov eax, 1
jmp 0x1400230fc
inc rdx
mov qword [rsp + 0x40], rdx
jmp 0x140023093
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x1400230fc
mov ecx, 0x8285aca5
call fcn.1400024e0
mov rcx, rdi
call rax
xor eax, eax
jmp 0x1400230fc
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140025460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140091200]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1400254d9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140025480
test r8, r8
je 0x1400254fd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400254e0
not ecx
mov eax, ecx
ret
Function at 0x14002b440
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x140092300]
jmp 0x140892456

Function at 0x1400440b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rdi, rcx
lea rcx, [0x1400925f0]
push rdx
movabs rdx, 0x45126732c3a2ce1b
push rdx
add byte [rdx + 0x48], dl
mov edx, 0xc3a2ce1b
xor ah, byte [rdi + 0x12]
push r10
pushfq
and rdx, rdx
shl word [rsp + 8], 0xfa
add word [rsp + 8], 0x6487
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x13167e8e
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407f3663
mov bl, 0xa0
in al, 0x8a
rol byte [rdx], cl
insd dword [rdi], dx
out 0xd7, eax
jge 0x1400440d4
sbb eax, 0x8c86d428
out dx, eax
xlatb
xchg ebp, eax
movabs dword [0xd7e61426d808d7ec], eax
mov bl, 0x4c
sbb dword [rax], ebp
add dh, byte [rdx - 0x4e]
mov ecx, 0x403b281f
out 0xd7, eax
jmp [rsi + 0x20]

Function at 0x1400456b0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, qword [rbp + 0x260]
lea rcx, [0x140092670]
push r12
pushfq
movabs r12, 0x20b6519250086d23
not r12w
mov r12, qword [rsp + 8]
mov qword [rsp + 8], 0x1a6519ac
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.140790593

Function at 0x140045720
Capabilities:
Set registry value

Disassembly:
lea rbp, [rbp + 0x439ac1f]
neg dword [rsp + 8]
test word [rsp + 8], cx
call fcn.1404bf840
Function at 0x140063ccc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140063af8
Function at 0x140350345
Capabilities:
Encode data using base64

Disassembly:
shl r13b, 0x78
mov r13, qword [rsp + r13 - 0x1de0]

Function at 0x140352ffb
Capabilities:
Packed with generic packer

Disassembly:
or di, 0xe83
mov rbp, qword [rsp + rdi*8 - 0x7fc08]
and edi, edi
call fcn.1405689a9

Function at 0x1403644d0
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add dl, dl
add qword [rsp], 0xfffffffffff4aa47
test rdx, 0xffffffffb59bbb24
mov rbx, rdx
mov bl, 0xa9
mov rbx, qword [rsp]
mov rbx, qword [rbx]
mov rcx, rdx
seta cl
cmp cl, 0x29
mov qword [rsp], rcx
lea rbx, [rbx + 0x4da9a68b]
bswap ecx
je 0x1406fb9c2
mov cx, word [rsp + rcx*4 - 0x55c62aa]
jo 0x140521c1d
or qword [rsp], 0xffffffff8c355d2d
add cx, word [rsp + rcx*8 - 0xabd58be]
call fcn.1404de5de

Function at 0x14036545d
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
jb 0x1403d98ea
xor byte [rsp + rbx*4 + 0x28], 0x3f
mov rbx, qword [rsp + r8 - 0x18860200]
sub r8, r8
movabs r8, 0x4aabe8995fb09ab1
sub r8w, r8w
call fcn.1403cdf65
push r8
movabs r8, 0x86939a9a143866ba

Function at 0x140369bee
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
call fcn.140474f89
call fcn.1405fc5ff

Function at 0x1403cb33d
Capabilities:
Encode data using xor

Disassembly:
add byte [rbx - 0x171184b5], bl
sbb eax, esp
add byte [rcx - 0x7f], r8b
xor r11d, 0xe53c6930
mov r11, qword [rsp + 0x20]
xor r11d, 0xe53c6930
mov r11, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xfffffffff8eb690c
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407ad61e
lea edi, [rax]
nop
fidiv dword [rbp + 0x640c3b54]
out 0x34, eax
and r15b, bl
cmp al, byte [rdx + 0x4a]
out dx, al
or byte [rsi], al
cld
je 0x1403cb333
invalid

Function at 0x1403d02d4
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
add r10w, r10w
not bx
add qword [rsp + 8], 0x17737b
cmp r10w, 0x210d
js 0x14068a65d
or ebx, ebx
movabs rcx, 0x359e953b5f0eb736
shl r10b, cl
shl rcx, cl
add qword [rsp], 0xffffffffffd7e328
sub bx, r10w
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
lea r10, [r10*8 + 0x7c3aa99a]
jl 0x1405d9604

Function at 0x1403d1392
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 0x18], 0xffffffffbfa6eb72
shr r10b, 0xbc
je 0x14063d4f2

Function at 0x1403d4b03
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
jne 0x1404b5592
mov qword [rsp + r12 - 0x70874cdf], r12
and r12w, word [rsp + r12 - 0x70874cda]
xchg qword [rsp + r12 - 0x7086ffc8], rcx
mov r12, qword [rsp + r12 - 0x7086ffd0]
shr word [rsp + 0x28], 0x9f
shr qword [rsp + 0x28], 0xd4
or byte [rsp + 0x28], 0x18
and qword [rsp + 0x28], 0x7b032414
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
ret
add qword [rsp + 0x28], 0xffffffffffee0da9
mov qword [rsp + 0x10], r14
cmp r14b, 0x21
movzx bp, byte [rsp + 0x14]
not rbp
jl 0x14063709e
mov rdx, qword [rsp + 0x10]
jne 0x14051a601
xchg qword [rsp + 0x10], rsi
push r9
mov r9, r12
call fcn.1405860ae
mul dword [rcx + 0x60]
add dword [rdx], ecx
add al, 0
or dh, byte [rax + rcx]
add byte [rdx], cl
push rdx
invalid
Function at 0x1403e1222
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
ja 0x140728baa
lahf
push rsp
invalid
lea rbp, [rbp + 0x7c9d838b]
push r13
add qword [rsp + 8], 0xffffffffbfa4cc4f

Function at 0x1403e319f
Capabilities:
Packed with generic packer

Disassembly:
shl dword [rsp + 0x10], 0xdd
jb 0x140690a62

Function at 0x1403f0f0a
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
lea rbx, [r11 + r11 + 0x3d9f201d]
mov qword [rsp + 0x40], rdx
jae 0x1405a0c1e
sub al, 0x40
add al, al
cmp al, 0x59
cli
jg 0x1403f0f52
insb byte [rdi], dx
sar ah, 0x7f
rcl dl, 1
or dword ds:[rax - 0x2b], eax
or eax, dword es:[rax + 0x742cdf06]
add eax, dword [rax]
std
invalid
or al, 0x40
cld
sub ebx, dword [rdx - 0x10a50008]
invalid

Function at 0x1403f5010
Capabilities:
Set registry value

Disassembly:
jo 0x1405f8813
mov qword [rsp + r9 - 0xbfffd0], rsi
call fcn.14043e376
jae 0x14049a31b
mov dword [rsp + 0x18], 0xaf399897
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
ret

Function at 0x1403f6d61
Capabilities:
Authenticate hmac

Disassembly:
lea r15, [r15 + r15*2 - 0x27570472]
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffe3ea97b4
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14086187c

Function at 0x140403606
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 8], rdx
call fcn.1405c0158

Function at 0x14040e88b
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xfffffffffff552ca
call fcn.14069baea
cmc
mov fs, word [rbx]
fistp word [rax + rdi*8]
push rcx
xchg ebx, eax
pop rdx
invalid

Function at 0x14041195a
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x10], 0xfffffffffff1a747
test qword [rsp + 0x20], 0xffffffffbfa9112d
push r9
jle 0x14052c025
mov eax, dword [rcx]
rcl r10, cl
mov r8, rdx
lea r10, [rcx + 0x10]
and r9, rbx
shr r8, 0x20
cmc
cmovnp r9w, bx
or r9b, dil
mov r11d, 3
movzx r9d, dx
sbb r9d, ebx
dec r9w
lea r9d, [rdx + rax]
xor dl, 7
cwd
clc
add r8d, dword [rcx + 4]
rcr cl, 6
adc eax, esp
cdq
nop

Function at 0x14041ada7
Capabilities:
Packed with generic packer

Disassembly:
add word [rsp + 0x60], 0x4d06
test dword [rsp + 0x68], 0xdb3d6817
jno 0x1404446eb
push qword [rsp + 0x88]
popfq
lea rsp, [rsp + 0x98]
ret

Function at 0x1404324c7
Capabilities:
Authenticate hmac

Disassembly:
lea r14, [r14 + r12*8 + 0x4ba74a9e]
cmovg rcx, r14
jb fcn.140666310
invalid
movabs rsi, 0xd23a4fbea4085501
sub qword [rsp + 0x28], rbp
bswap r12d
xchg qword [rsp + rbp - 0x7fffffa8], rax
mov rsi, qword [rsp]
cmp r14b, byte [rsp + rbp - 0x7fffffd8]
lea r14, [r14*2 + 0x4f3251b8]
not r8w
ja 0x140483ade
jl 0x140425210
invalid
cmovg r12d, dword [rsp + 0x22]
lea rax, [rax + 0x5032108f]
push rsi
ja 0x140425205
add qword [rsp + 0x20], 0xfffffffffff3569f
mov r8d, dword [rsp + 0x2a]
test r8w, r8w
mov rcx, qword [rsp + rbp - 0x7fffffb0]
jno 0x1404f9647
Function at 0x140436956
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [rdx + rcx - 0x1dc44cfd]
mov ecx, 0x28bc0083
lea rcx, [rcx + rcx*2 + 0x20888a89]
setl cl
xor cl, 0x39
not ecx
jns 0x14067113e
mov esi, 0x54a464c4
fcomp dword [rdx]
in al, dx
xchg ebp, eax
cli
jo 0x1404369ac
add al, 0xcf
xor cl, byte [rbp - 0x689b9137]
sbb al, 0x1b
push rbp
js 0x140436987
iretd
std
add ebx, esp
xchg bp, ax
push 0x54ad010
mov r12b, pe_nt_image_headers64
cmp dword [rcx], edx
lodsb al, byte [rsi]
jb 0x1404369ea
clc
invalid
adc al, 0xa3
wait
jbe 0x140436a01
xchg esi, eax
invalid
stosb byte [rdi], al
mov bl, 0xd0
hlt
add esi, 0x61de1012
movabs al, byte [0x1e516f3c764fd950]
not al
mov edx, 0xb1bb571
invalid
cmp dword [rdi + 0x731a4d90], esp
xor eax, 0x878c0f1b
wait
cli
dec dword [rax - 0x7f]
and al, 0x18
xor al, 0xd9
invalid
mov cl, 0xb1
call fcn.14070f28a
pop rbp
xchg ebp, eax
mov ch, 0xdd
imul esp, edi, 0xffffffc8
out dx, eax
cld
mov cl, ah
movabs byte [0x1bbc4bdd795bade7], al
loopne 0x140671114
out 0xad, eax
pop rbx
jns 0x140671133
movabs r12, 0x93a5099fcdb9e01b
out dx, eax
sub dword [rbx + riz*4 + 0x6fa839fc], esp
push 0x55
jmp 0x1406711a1
int 0x9f
or dword [rbp - 0x5bd6106d], esp
movabs dword [0x35eb556a6fa839fc], eax
loopne 0x140671151
invalid
sar byte [rsi - 0x3890e09], cl
add dword [rax], eax
add byte [rax], al
and al, 0xc1
movabs dword [0x7f9dc1718d8bca11], eax
sbb ebx, edi
mov ah, 0x43
pop rdx
and al, 0x25
invalid

Function at 0x14043f423
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + r15 - 0x22]
mov qword [rsp + 0x10], r15
setge r8b
neg r15d
push rsi
jne 0x1405538f7
or dword [rsp + 0x18], r15d
lea rdx, [rdx + 0x72322abc]
setg r15b
shr r15d, 0x8e
sub r15b, byte [rsp + r15*2 - 0x7ffe4]
sub bh, byte [rsp + rdi*2 - 0x7ffe4]
neg r8w
xor dword [rsp + r15 - 0x3fee8], 0x879d5d3b
sub r15d, 0x2628b701
xchg qword [rsp + 0x30], rdx
mov r15, qword [rsp + 0x28]
or byte [rsp + 0x18], 0xa6
jb fcn.14070a34a
ja 0x1405848fa
in eax, 0x42
cwde
xchg ebp, eax
jo 0x14055390c
adc esp, dword [rbx]
retf 0x20d7

Function at 0x140453c21
Capabilities:
Terminate process

Disassembly:
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret
or dword [rsp + 0x48], 0x9e86ab30
add byte [rsp + 0x48], 0xbc
and qword [rsp + 0x48], 0xfffffffff31d6d17
jno 0x1403ff82a

Function at 0x140453c42
Capabilities:
Terminate process

Disassembly:
call fcn.1404125d8
jae 0x140453c6c
sti
invalid
adc al, 0x1e
add byte [rax], al
add byte [rax], cl
mov ah, setsockopt
sbb byte [rax], al
Function at 0x140466a85
Capabilities:
Terminate process

Disassembly:
not r11
jb 0x1403feba2
neg r8d
sub byte [rsp + 0x18], 0xa4
or r8b, byte [rsp + r11*2 + 0x3f3]
sub r8w, 0x5330
lea rax, [rax + 0x2eabd58a]
setg sil
setbe r11b
shr sil, 0x1f
and dl, r11b
add r11d, esi
xchg qword [rsp + r11 - 0x3c3801a9], rax
mov rsi, qword [rsp + 0x10]
cmp r11d, edx
lea rdx, [rdx*2 + 0x3513e60a]
mov byte [rsp + 0x18], dl
mov r11, qword [rsp + 0x50]
lea rdx, [rdx + r8 - 0x6f5bb04b]
not r8d
lea r8, [rdx + r8*4 + 0x59e608f]
not r8b
mov r8, qword [rsp + 0x40]
setge byte [rsp + 0x18]
add qword [rsp], 0xffffffffbfb19dab
shr byte [rsp + 0x18], 0x51
movzx rdx, dx
jne 0x14063f93a
mov rdx, qword [rsp + rdx - 0x6816]
neg qword [rsp + 0x18]
call fcn.1404576cb

Function at 0x140466b28
Capabilities:
Terminate process

Disassembly:
push qword [rsp + 0x10]
popfq
mov qword [rsp + 0x10], rcx
push rbx
pushfq
add qword [rsp + 0x10], 0x36703
movabs r14, 0xb032bb3092afcf08

Function at 0x14046744f
Capabilities:
Set registry value

Disassembly:
jne 0x140728689
call fcn.1406c0af9
invalid

Function at 0x14046cbd9
Capabilities:
Packed with generic packer

Disassembly:
or r11b, r11b
shr r12b, 0x21
movabs r11, 0x520c0d0b2f06e1be
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
jae fcn.1405c1d6d
lea r12, [r12 + r13*8 + 0x618d019e]
add r12d, 0x67a98eb0
sets r12b
test r11, 0x40aa61b1
call fcn.1404dd8a6

Function at 0x140471c6a
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0x72103bb65a0fb991
movzx r9d, r9w
jne 0x1405da2fc
xor dl, byte [rbx - 0x61]
lahf
insd dword [rdi], dx
or al, 0xaf
sbb dword cs:[rax + rax*8 - 0x42], edi
movabs byte [0x6e9ffc0f9f1b8dfd], al
invalid

Function at 0x140472fe7
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp], 0x735babdb
call fcn.1408521c5
push rax
push r11
pushfq
movabs r11, 0xa9f9093529a09c
not r11d

Function at 0x140485888
Capabilities:
Get geographical location

Disassembly:
lea rcx, [rcx - 0x29663e6b]
jbe 0x140546449
js 0x1400780d1
xchg qword [rsp + 0x30], rcx
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x14048956b
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
or edi, r9d
movabs rdx, 0x6a288ac7689d931
neg rdx
xchg qword [rsp + 0x38], rbp
mov rdx, qword [rsp + r9*8 - 0x70]
setb dil
and di, di
je 0x1406fc69b
jl 0x1405214d1
shl r9, 0xfd
call fcn.1406148e5
add dword [rdx], ebx
or al, byte [rax]
sbb dh, byte [rcx + rcx]
sbb ah, byte [rax + rcx]
sbb dl, byte [rdi + rax]
sbb dh, byte [rsi + rax]
add byte [rdx], bl
xor dl, byte [rsi]
ror byte [rax - 0x7f], 0x44
add qword [rsp + 0x10], 0xffffffffbf9c208e
not word [rsp + 0x18]
call 0x1406d3b7d
call fcn.140715f48
Function at 0x140493010
Capabilities:
Encode data using xor

Disassembly:
cmp r13w, r10w
call fcn.1405706a7
xor byte [rcx + 0x1ca91fe3], dh
adc byte [rcx - 0x6fba1176], bl
loop 0x1403c3755
iretd
imul esp, dword [rbx + 0x67], 0x5f
push 0xfffffffffffffffc
jb 0x1403c3701
ret
and byte [rdi], 4
lodsq rax, qword [rsi]
fisubr word [rdx + 0x3437378e]
movabs byte [0xc6a4ce0e7bc7e4df], al
popfq
cmc
retf
add qword [rsp + 0x28], 0xffffffffffda1bf9
mov r10, rdi
add qword [rsp + r8*2 - 0x7c87e2ce], 0xffffffffbfbcab8d
movabs rdx, 0x9c0c51086a3c6a3e
movabs r13, 0x92904a3ea03c2524
lea r13, [r13*8 - 0x644c40d4]
and r13, 0x5b328932
movsx edi, di
and r13b, 0x11
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
jne 0x1403640e0
je 0x1403c36fb

Function at 0x1404936d8
Capabilities:
Encode data using xor

Disassembly:
push r12
movabs r12, 0x3394fa32682d5399
add qword [rsp + 8], 0x27f248
movabs rax, 0xd79f3919e5a9d5b5
sub rax, 0x5e9104bd
sub cx, 0x420a
neg cl
shl ax, 0x26
xor al, 2
call fcn.1405dec7e

Function at 0x140496e86
Capabilities:
Terminate process

Disassembly:
movzx rdx, dx
js fcn.1405a0c75
setge dl
add qword [rsp], 0xffffffffffee6de6
sub dl, 0x9b
shr dx, 0xeb
xor edx, 0x12ba4cb8
jle 0x140466b78
movabs rbp, 0x1a2736a47a9992bb
mov rbp, qword [rsp]
mov rbp, qword [rbp + rdx - 0x12ba4cb2]
setb dl
shr rdx, 0x98
or rdx, 0xffffffffe60cec19
add dx, dx
lea rbp, [rbp + rdx + 0x51a6d76f]
shl edx, 0x58
add qword [rsp + rdx - 0x35ffffe8], 0xffffffffbfa779e2
shr dx, 0x82
not dx
mov qword [rsp + rdx - 0x3600ffff], rdx
neg rdx
call fcn.140591f0e

Function at 0x14049a52e
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jl 0x1404a7a38
not dword [rsp + 0x18]
Function at 0x1404a4526
Capabilities:
Connect socket
Set socket configuration

Disassembly:
test rdi, rdi
je 0x14001c0b7
mov r8d, dword [rdi + 0xc]
mov edx, dword [rdi + 8]
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001c0a0
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 0x20]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14001c097
mov dword [rbp - 0x38], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x38]
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14001bff3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], send
mov byte [rbp - 0x20], 0
mov dword [rbp - 0x28], eax
xor r8d, r8d
lea rdx, [0x140090948]
lea rcx, [rbp - 0x20]
call fcn.140001f50
nop
mov byte [rsp + 0x38], 1
mov eax, dword [rbp - 0x28]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rsp + 0x58], xmm1
or ebx, 0x40
or ebx, 0x30
mov al, 1
jmp 0x14001bffd
mov byte [rsp + 0x38], 0
or ebx, 0x10
xor al, al
or ebx, 2
mov dword [rsp + 0x30], ebx
test al, al
jne 0x14001c06a
mov dword [rbp - 0x30], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x30]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14001c053
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14001bb50
or ebx, 0x180
movzx eax, byte [rsp + 0x68]
jmp 0x14001c05e
mov byte [rsp + 0x68], 0
bts ebx, 7
xor al, al
or ebx, 4
test al, al
jne 0x14001c06a
mov r14b, 1
jmp 0x14001c06d
xor r14b, r14b
test bl, 4
je 0x14001c080
and ebx, 0xfffffffb
lea rcx, [rsp + 0x68]
call fcn.140013d60
nop
test bl, 2
je 0x14001c092
and ebx, 0xfffffffd
lea rcx, [rsp + 0x38]
call fcn.140013d60
test r14b, r14b
jne 0x14001c0a9
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdi, qword [rdi + 0x28]
jmp 0x14001bf2e
mov rax, qword [r12]
mov qword [rax + 0x28], rsi
mov byte [r15], 0
jmp 0x14001c0c8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, r15
call fcn.14001bb50
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001c0d7
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, r15
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
not ebp
mov rax, qword [rsp + rbx*2 + 0x38]
mov rax, qword [rax + rbx]
not rbp
add qword [rsp + rbx*2 + 0x28], 0xffffffffffdab69a
not rbp
lea rax, [rax + r13 + 0x5495f398]
lea rbx, [rbp + rbx*4 - 0x38ee11fb]
add bp, 0x73e
js 0x14001c09a
cmp r13d, 0x9618c520
jne 0x1404afbbc
xor ebx, ebx
not bl
xchg qword [rsp + rbx*4 - 0x3a4], rax
mov rbx, qword [rsp + rbx*2 - 0x1ce]
jno 0x1404c2bf7
call fcn.1403f62ab
enter 0x692f, 7
jl 0x1404c2c3d
movabs byte [0xdbfe065f024376da], al
xor eax, 0x5528bbd7
xor eax, 0x8de05c59
mov sil, 0xa8
xchg esp, eax
invalid
pop rax
add edi, edx
add dword [rbx + rbp*2], esp
invalid