joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18027af09
Capabilities:
Packed with generic packer

Disassembly:
mov r8d, r10d
add r9d, 0x42d1557a
mov r8, qword [rsp + r9 - 0x42fba423]
mov rbp, qword [rsp + r12 - 0x2a4eb1]
mov r9, qword [rsp + r9 - 0x42fba433]
lea rsp, [rsp + r10 + 0x20]
ret
sub r15, r15
shl r15w, 0xf9
add qword [rsp], 0xffffffffffe588ee
movabs rcx, 0x661b22ef1bdf7775
xor rcx, 0x4d996cb9
cmovns r15d, ecx
not cx
call fcn.180a41d2e
sub word [rsp + 0x70], 0x11d3
mov r15w, 0x52fe
mov r15, qword [rsp + 0x48]
or word [rsp + 0x70], 0x550e
call fcn.180004b8c
ja 0x18084f530
add r9w, 0x59a9
mov rsi, qword [rsp + rcx*2 - 0x60a6]
mov rsi, qword [rsi + rdx*2]
add edx, 0x5f344d66
and dx, cx
shl dl, cl
mov dx, 0x532c
add r9w, 0x3fc1
shl rdx, 0x21
movabs r9, 0x7b8c3b63438d3b2e
movsx r9, dl
cmp cl, 0xf5
lea rsi, [rsi + r9 + 0x628a36ab]
mov edx, ecx
mov qword [rsp + rcx*2 - 0x60a6], r9
setbe byte [rsp + rdx - 0x304b]
push rcx
jae 0x18052f5fa
push r12
jg 0x1805fb606
or r15w, word [rsp + 0x2e]
or word [rsp + 0x28], 0x191b
add dword [rsp + 0x28], r15d
add r15d, r15d
jl 0x1801df34d
mov r15, qword [rsp + r15 + 0x40]
mov qword [rsp + 0x28], 0x2eb33df4
cmp byte [rsp + 0x28], 0x92
jno 0x18042070f
add qword [rsp + 0x48], 0x7ffb84e1
and r11, 0x3ba31e5f
jne 0x180457ed6
and byte [rsp + 0x28], 0xb
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret
shr r11w, 0xd7
mov rdi, qword [rsp + r9 - 0x38d2acc6]
call fcn.18022ec2b
add r14, 0x70df36a2
test r14b, r14b
movsx r14w, r14b
push r15
push r11
not r14b
mov qword [rsp + 0x30], rdx
jb 0x1807c9e30
add qword [rsp + 0x20], 0xffffffffffa7a79f
movabs r15, 0xab6252b77dc22c9
push r13
movabs r13, 0x776f1c4650d67a9a
nop
add r14d, r13d
movabs rdx, 0xf795f865f8e155b
movabs r11, 0x69d4528442e96ece
not r14b
sub r14d, r14d
not r13d
setle r15b
movsx r15d, dx
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
test r11, 0x640279c7
jl 0x180a45acb
mov qword [rsp + 0x28], r14
shl r15, 0xdc
mov r11b, byte [rsp + 0x2a]
cmp r15w, word [rsp + 0x29]
not r14b
lea rdx, [rdx + 0x1e0a7cc5]
push r14
js 0x18098c8b4
cmp r13d, r14d
push r12
xchg qword [rsp + r14*2 - 0x1be], rdx
mov r15, qword [rsp + 0x20]
setns byte [rsp + 8]
shl r13, 0x29
shl r14b, 0xb4
call fcn.18058037f
push rcx
push r14
push rbx
movabs r14, 0x387d29886ce27bcf
push r12
pushfq
push r15
push rcx
movabs r12, 0x37df1a7f3cb813f2
call fcn.18053c66a
movabs rbx, 0x48e126b069986b94
xor word [rsp + 0x30], 0x2e47
call fcn.1807cbdcd
int1
and esp, ecx
hlt
xchg qword [rsp + rdx*4 - 0xc134], rsi
mov r9, qword [rsp + rcx*2 - 0x60a6]
mov r12, qword [rsp + rdx - 0x303b]
shr edx, cl
shr cx, 0x4c
pop r12
call fcn.1808a61ea
mov r15, qword [rsp + 0x10]
setge byte [rsp + 0x30]
lea rsp, [rsp + 0x40]
ret
js 0x18061327f
push 0x5fc91b1a
call fcn.180a31aae
invalid
call fcn.1800846e7
xchg esp, eax
popfq
sub bh, byte [rdi + 9]
stc
adc cl, byte [rdi]
jg 0x18098c90a
mul edi
jbe 0x18098c917
test eax, 0xc0e27e7a
invalid
insd dword [rdi], dx
jne 0x18098c8a4
adc eax, 0x909483b4
cmp cl, byte [rcx]
pop rsi
pop rdx
invalid
push rsp
jmp 0x1d7c480b4
mov r12, qword [rsp + 0x78]
not r15b
shr r14d, 0x3c
setns r10b
call fcn.1802742b6
Function at 0x1802ac5ab
Capabilities:
Query or enumerate registry value

Disassembly:
mov r15, rdx
add qword [rsp + 8], 0xfffffffffffc2ef9
movabs r13, 0x75782d315b5b4849
mov rax, rdx
movabs rax, 0x2116ce478aa3486
call fcn.18078abdd
add bx, 0x4ca2
not rbx
add qword [rsp + 8], 0xffffffffff72d9ce
xor bx, 0x6ff3
movabs rbp, 0x5c20569f2d68736d
xor bx, bp
je 0x1807830d4
sub rbx, rbp
jge 0x18001ffde
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
movsxd rbx, ebx
add qword [rsp + rbx - 0x55ff21d9], 0xffffffffff97c977
mov qword [rsp + rbx - 0x55ff21f1], rbx
test ebx, ebx
setle bl
push r11
lea rbp, [rbp + rbx*2 - 0x4229e68e]
mov r11, qword [rsp + rbx - 0x55ff20f0]
add bx, 0x1d1b
mov rbx, qword [rsp + r11 - 0x55ff21d9]
push qword [rsp + r11 - 0x55ff21e1]
popfq
mov r11, qword [rsp + r11 - 0x55ff21f9]
lea rsp, [rsp + 0x28]
ret

Function at 0x1802cb312
Capabilities:
Packed with generic packer

Disassembly:
push r15
mov qword [rsp + 0x18], 0x7b94870f
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.180b8a82a

Function at 0x1802cc9d8
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
mov rsi, qword [rsp + 0x20]
cmp dword [rsp + rsi - 0x7d127921], esi
lea rcx, [rcx + rsi - 0x30734c86]
push rdx
jns 0x18051d795
movabs r10, 0x57bd3e7f115331fe
add bpl, bpl
mov qword [rsp + 0x18], rbp
je fcn.1809d51c1
mov word [rsp + rbp*2 - 0x21a8a08c], 0x66ad
lea rbx, [rbx + rbp + 0x58e4fe44]
xor dword [rsp + rbp*2 - 0x21a8a08c], ebp
not r10d
sets r10b
jae 0x1805762e8
neg dword [rsp + rsi - 0x7d127919]
add dword [rsp + rsi - 0x7d127919], 0x5ba13bcc
movabs rdx, 0x7889780f1f6a2b84
xchg qword [rsp + 0x38], rcx
mov rdx, qword [rsp + rsi - 0x7d127941]
test qword [rsp + rsi - 0x7d127919], rsi
jo 0x1808cded5
add word [rsp + rsi - 0x7d127919], 0x4b79
mov rsi, qword [rsp + rsi - 0x7d127939]
call fcn.180861888
neg byte [rsp + 0x18]
and word [rsp + 0x18], 0x2b64
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x48]
ret

Function at 0x18032839e
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], 0xffffffffab040a0a
lea rsp, [rsp + 0x10]
call fcn.180b6509e

Function at 0x18034fd34
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x20], 0xffffffff96abe031
mov r15, qword [rsp + 0x18]
Function at 0x18035a8cb
Capabilities:
Query environment variable

Disassembly:
or word [rsp + 0x10], 0x1d0a
add qword [rsp + 8], 0xffffffffffa5ed9e
mov qword [rsp + 0x50], rbp
or byte [rsp + 0x10], 0x6a
jbe 0x18003ea48
push r15
jne 0x180309b9e
int3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x18003eabb
mov rsi, rbx
cmp word [rax], bp
je 0x18003ea7a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x18003ea64
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x18003ea60
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.180034c00
mov rdi, rax
test rax, rax
je 0x18003eaa8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.180023690
mov rbp, rdi
xor ecx, ecx
call fcn.180034bc4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movabs rbx, 0x490d7da575221349
nop
mov rbp, qword [rsp + 8]
test byte [rsp + rbp - 0x48fb0f30], bpl
push rbx
call fcn.1803803f5
in al, dx
mov edi, 0x92b82197
test al, 0x33
jnp 0x180309bc2
sar byte [rdx], 0x8c
sub dword [rbp + rcx*8 + 0x3a], edx
mov word [rdi + 2], ss
hlt
push r9
lea r15, [r15 + rsi*8 + 0x6f5e7078]
jbe 0x1808cfa6f
mov qword [rsp + rsi*8 - 0x1acab458], rcx
test r15w, 0x33b2
js 0x1809fa274
movabs r9, 0x424275261ea43a98
movabs r10, 0x5eda483e793743cd
shr sil, 0xc6
add qword [rsp + 8], 0x56478
add r15w, r9w
movabs rcx, 0x2bd72fc522ad44d1
mov cl, r9b
mov r9d, esi
not r10b
shl r9b, cl
add qword [rsp + rsi*2 - 0x6b2abf4], 0x7fac23be
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
call fcn.1807cbddd
pop rsp
or byte [rdx + riz*2 - 0x2e], cl
wait
out 0xb8, eax
push r13
invalid
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
ret
shr dword [rsp + r13*2 + 0x2030e48e], 0x63
test r13b, r13b
jg 0x180015777
mov r13, qword [rsp + r13 + 0x1018724f]
cmp byte [rsp + 0x58], 0xc5
setae byte [rsp + 0x60]
or word [rsp + 0x70], 0x74df
js 0x18067b342

Function at 0x18035d9aa
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
xor qword [rsp + 0x28], 0x4913d05
mov word [rsp + 0x28], 0x3334
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
or byte [rsp + 8], 0xdf
add qword [rsp + 8], 0x13bf5962
neg dword [rsp + 8]
js 0x180736060
sub dword [rsp + 0x28], 0x21634a5a
add qword [rsp], 0x7f831eae
call fcn.18007c150
invalid

Function at 0x18035fcf5
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r8, 0x2827e3e710e1882
neg r8b
je 0x1802be60b
and r8d, 0x65574a4a
mov r8w, 0x4eff
call fcn.18046f2f6

Function at 0x18039ec76
Capabilities:
Packed with generic packer

Disassembly:
add r8w, r15w
xor r15b, r8b
lea rsi, [rsi + r8*2 - 0x629003d9]
sub r8d, 0x4167f2e
jo 0x1803d504c
je 0x18027af32
add r12d, 0x71d212b
xchg qword [rsp + 0x68], rsi
mov r12, qword [rsp + 0x38]
mov r15w, 0x2704
add r15, 0x17d13648
test r8d, 0x73ef53f8
not r8w
bswap r8d
mov r15, qword [rsp + r8 - 0x2dcecb31]
bswap r8
bswap r8d
not r8d
call fcn.1809a01f3
adc edx, 0x1ef1a573
pushfq
push rsp
pop rdx
invalid
Function at 0x1803af3eb
Capabilities:
Packed with generic packer

Disassembly:
movabs r14, 0x37421184522a15e4
shr r14w, 0xd7
mov qword [rsp + 0x30], 0xffffffff964c850d
mov r14, qword [rsp + 0x20]
add r10d, 0x1534ad0
js 0x1808c9136
xor r10w, 0x680a
jne 0x18063fe13
call fcn.180bb2243
out dx, eax
imul esp, dword [rcx - 0x3a17ada2], 0x41
fidivr dword [rcx]
invalid

Function at 0x1803ba9a9
Capabilities:
Encode data using xor

Disassembly:
and al, 8
retf 0x444a
jbe 0x18096309e
popfq
sub dword [rax + 0x46856305], edx
enter 0xfffffffffffffbc3, 0xffffffffffffffb6
jrcxz 0x1802fdcf6
sbb dword [rdi - 0x1cfa85a0], esi
invalid
or edi, 0x8f8103c
lea rbp, [rbp + rdi*8 - 0x268d7dd1]
neg edi
neg r13b
ja 0x1802fdd40
xor rdi, 0x7d21a1d
jle 0x1803dfda0
xchg qword [rsp + 0x30], rbp
mov r13, qword [rsp + 8]
cmp r9b, 0x65
call int.18082078d
popfq
fisttp word [rbx + rbx]
xchg esp, eax
or ah, dl
pop rsi
or byte [rdi], 0xbd
call 0x18b289ea4
outsb dx, byte [rsi]
iretd
xor word [rsp + r11 - 0xb20e], 0x2c71
jo 0x180867e80
shl r11d, 0xd8
sub dl, byte [rsp + r11 - 0x15fffff3]
mov qword [rsp + rdx - 0xe9b7ec8], r11
lea rsi, [rsi + r11*2 + 0x41bd24e4]
push r9
mov r11b, byte [rsp + rdx - 0xe9b7eba]
mov r9, rdx
shl dword [rsp + rdx - 0xe9b7ec0], 0xab
jb 0x180537d7d
shr r9b, 0xf2
sete r11b
neg word [rsp + r9 - 0xe9b7ef0]
xchg qword [rsp + rdx - 0xe9b7eb8], rsi
mov rdx, qword [rsp + rdx - 0xe9b7ed0]
sub r9d, 0x52ed7f0f
add qword [rsp + 0x28], 0x1da9b
test qword [rsp + r11 - 0x15ffffc1], r9
mov r9d, 0x6ccb5cab
pop r9
mov r11, qword [rsp + r11*2 - 0x2bffffea]
lea rsp, [rsp + 0x20]
ret 8
add qword [rsp + 0x18], 0x7ff7ac56
xchg qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x30]
call fcn.1800715cd
popfq
lea rsp, [rsp + 0x48]
ret
sub r10d, r10d
or r10d, r15d
neg r15b
je 0x180a27237

Function at 0x1803bd3f5
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
lea r10, [r10*4 + 0x1c8e3a9a]
mov r12, qword [rsp + r14 + 0x5f]
je 0x180a27219
vaesdec xmm8, xmm2, xmmword [rbp - 3]
in eax, 0x77
cld
add esp, dword [rbp - 0x24ff7689]
shl dl, cl
fidiv dword [rdi]
sub byte [rbx + 0x44], cl
and byte [rsi - 0x60], dl
or r9b, byte [r15 + 0x22817b5e]
add eax, 0xb201c685
fld dword [rdi + 0x19]
mov bl, 0xd6
xor byte [rdi + 0x61], ah
invalid

Function at 0x1803d4712
Capabilities:
Query environment variable

Disassembly:
movabs r11, 0x70ac1f2766a65f44
call fcn.180356065

Function at 0x1803d4726
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
mov qword [rsp], 0xffffffffef3cd8b6
call fcn.180b7be22

Function at 0x1803d4734
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
shl word [rsp + 0x18], 0x1d
push r14
ja 0x180864baf
cmp word [rsp + 0x20], 0x76c8
movabs r14, 0x650474c2468433bd
xchg qword [rsp + 0x30], rax
mov r14, qword [rsp]
call fcn.1807555a9
jg 0x180584bca
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.180ab50a8
pushfq
movabs r9, 0x6d6213bf14265268
add r9b, r9b
sub r9, r9
jbe 0x180a45aa7
mov r9b, 0x79
mov qword [rsp + 0x10], 0x1b94567
mov r9, qword [rsp + r9*2 - 0xea]
call 0x1803d4762
Function at 0x1803d4762
Capabilities:
Query environment variable

Disassembly:
shl word [rsp + 0x18], 0x1d
push r14
ja 0x180864baf
cmp word [rsp + 0x20], 0x76c8
movabs r14, 0x650474c2468433bd
xchg qword [rsp + 0x30], rax
mov r14, qword [rsp]
call fcn.1807555a9
jg 0x180584bca
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.180ab50a8
pushfq
movabs r9, 0x6d6213bf14265268
add r9b, r9b
sub r9, r9
jbe 0x180a45aa7
mov r9b, 0x79
mov qword [rsp + 0x10], 0x1b94567
mov r9, qword [rsp + r9*2 - 0xea]
call 0x1803d4762

Function at 0x180459d34
Capabilities:
Packed with generic packer

Disassembly:
push 0x51d170ba
mov qword [rsp + 0x40], rbp
add qword [rsp + r14*4 - 0x10698820], 0xffffffffff889a68
xor r14, qword [rsp]
cmovge r14, qword [rsp + r14 - 0x55cb12b4]
je 0x1806e8299
push r15
shr r8b, 0xb6
mov word [rsp + 8], r8w
jb fcn.1805920a7
nop
js 0x1807317c8
push rsi
mov rsi, qword [rsp + r14 - 0x51d170aa]
not sil
movabs r15, 0x19901f143a805e81
call fcn.1806fefd1
test dword [rsp], 0x2cf30dcb
call fcn.180748e34

Function at 0x180463177
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 8], 0x26fdb5
shl r10b, 0xc4
neg sil
movabs rax, 0x6546782d48763f12
neg r10
shl r10w, 0x9f
push rcx
mov si, r10w
mov r11, qword [rsp + 0xa8]
jle 0x1802aa169
call fcn.18057fb46
pushfq
add qword [rsp + 8], 0x23f687
movabs rax, 0x6a5c572419c855db
xor ax, 0x1ad9
lea rax, [rax + riz + 0x602d4818]
ja 0x18063d4c4
sbb byte [rsi], cl
jo 0x1804631f2
js 0x18046322a
add ebp, dword [rdx - 0x5c]
jl 0x18046313e
fst st(3)
cmp esi, dword [rcx + 0x70]
invalid
outsb dx, byte [rsi]
iretd
push rcx
sbb al, byte [rdx]
sub eax, 0xffb4208
out 0x99, al
and dl, dl
pop rsp
xor ch, byte [rbp - 0x66aa3d68]
cdq
fisub dword [rbx]
js 0x180463234
out 0x2d, al
mov dword [r8 - 0x1642006a], edx
cmpsd dword [rsi], dword [rdi]
and dword [rsi + 0x1c], esp
sub bl, byte [rbp + rcx*4 + 0x34af2b8b]
mov esi, dword [rdi + 0x61]
test al, 0x2d
fist word [rcx + 0x4c]
pop rsp
and dword [0x1d4851c0c], ecx
xlatb
invalid
add rax, rax
xor al, 0xfd
mov rax, qword [rsp + 8]
mov rax, qword [rax]
lea rax, [rax + 0x49335e27]
jo 0x180478813
xchg qword [rsp + 0x10], rax
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
ret

Function at 0x18046d11a
Capabilities:
Packed with generic packer

Disassembly:
shr dword [rsp + r9 + 0x28], 0x71
mov r9w, 0xe79
jbe 0x180087036

Function at 0x180492aac
Capabilities:
Packed with generic packer

Disassembly:
shr r15, 0x89
jbe 0x1807eddf4
mov eax, esi
loope 0x18037f8db
add al, 0xbd
invalid
movsb byte [rdi], byte [rsi]
cli
push rbp
ret
jle 0x18037f8d7
mov ah, 0x62
invalid
or bpl, 0x3f
neg r14d
test qword [rsp + r15*8 - 0x6ff208c0], rbp
lea rbx, [rbx + rbp*2 + 0x481269d2]
jge 0x18037f8c4

Function at 0x180497a9b
Capabilities:
Packed with generic packer

Disassembly:
js 0x1806b0f39
movabs rdi, 0x4ef3672a682f4795
ja 0x180002a87

Function at 0x1804b2c65
Capabilities:
Link many functions at runtime

Disassembly:
or dx, 0xcc4
jo 0x18001fcc9
mov rdx, qword [rsp + 0x38]
add qword [rsp], 0x7fe419c0
shr dword [rsp + 0x48], 0x5d
test dword [rsp + 0x48], 0x7951808
movabs rcx, 0x2e2d3a317cc8014c
movabs rcx, 0x6bea688307b73952
mov rcx, qword [rsp + 0x10]
setbe byte [rsp + 0x48]
Function at 0x1804cc347
Capabilities:
Query environment variable

Disassembly:
add qword [rsp], 0x42e414
cmp rcx, 0x55e12b09
not r12d
movabs rdi, 0x5ff572607c10dae
movabs r10, 0x50f666814f7001dc

Function at 0x1804cf312
Capabilities:
Encode data using base64

Disassembly:
jb 0x1803f2cba
add qword [rsp + 0x20], 0xffffffffff89a26e
movabs rax, 0x42a5594d368d08d5
xor dil, r8b
push r10
ja 0x180393262
invalid

Function at 0x1804d23d8
Capabilities:
Encode data using xor

Disassembly:
or di, 0x3287
cmp r10, 0x1a61756a
xchg qword [rsp + 0x70], rax
mov rdx, qword [rsp + r8*2 - 0x3ad1ffb0]
call fcn.180348231
mov qword [rsp + 8], 0xffffffff973ab669
lea rsp, [rsp + 8]
call fcn.180bb2243
nop
sbb eax, 0x2b87c523
invalid

Function at 0x1804e07fd
Capabilities:
Packed with generic packer

Disassembly:
jae 0x1807cfbb5
mov rbx, qword [rsp + 0x38]
mov rbx, qword [rbx]
movabs rcx, 0x135a56c42fd84694
mov qword [rsp + 0x38], rcx
sub qword [rsp + 0x28], 0x25072c40
call fcn.1800826c0
xor al, 6
add byte [rdx], bl
xor dl, byte [rsi]
ror byte [rax - 0x77], 0x9c
mov qword [rsp + rbp*4 - 0x104c1044], rbx
not rbp
push rdx
call fcn.18076752a
or al, 0xe8
xchg ebx, eax
sbb al, 0xdb
call qword [rbx + 0x48]
push rbx
invalid
mov ebx, 0x56dc1822
invalid
mov ebx, 0xb1150bd
call fcn.1809630f2
js 0x18062a85c
stc
and dword [rsi], edx
jge 0x18062a81d
jae 0x18062a8da
fdiv dword [rcx - 0x70]
sbb al, 0x46
pop rdx
insd dword [rdi], dx
int3
retf
neg r9d
mov dx, r9w
sub bl, dl
mov rdx, qword [rsp + rdx - 0x5c8cc4fc]
mov rdx, qword [rdx + rbx - 0x5d8e6c73]
or ebx, 0x133a362e
neg rbx
shl r9d, 0x2f
and rbx, r9
lea rbx, [rbx*2 + 0xc2e5450]
bswap r9d
mov qword [rsp + r9*8 - 0x43700], rbx
jo 0x180269712
lea rdx, [rdx + 0x364666e0]
jl 0x18062a87a
call fcn.18040a1d4

Function at 0x180546de5
Capabilities:
Encode data using xor

Disassembly:
not di
mov rdi, qword [rsp + 8]
jl 0x180546dfd
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.180bb723d

Function at 0x180554613
Capabilities:
Packed with generic packer

Disassembly:
push 0x22ce1ba1
pushfq
or word [rsp + 8], 0x307c
jns 0x1802621a5
je fcn.18030dc88
lea rax, [rax + 0x70f579c8]
or edi, r12d
test rdi, 0x5dfc18e6
mov qword [rsp + rdi - 0x7b777fce], r12
jns 0x1806d8bef
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
ret

Function at 0x180561658
Capabilities:
Packed with generic packer

Disassembly:
shl r13b, 0x22
jne 0x180877e2d
xchg qword [rsp + 0x28], rax
mov r8, qword [rsp + 0x20]
sub r13d, r13d
add r13d, 0x224039e0
ja 0x180a04957
fcmove st(0), st(6)
invalid
test r13d, r13d
jae 0x1802c03a6
Function at 0x18059012c
Capabilities:
Packed with generic packer

Disassembly:
shl word [rsp + rbp - 0x689b7ccb], 0x9e
js 0x18031abf8
sub word [rsp + rbp - 0x689b7d1b], bp
sete byte [rsp + rbp - 0x689b7d1b]
mov rbp, qword [rsp + rbp - 0x689b7cf3]
seto byte [rsp + 0x70]
jns 0x1805669b9
call fcn.1806f8135
int1
adc al, 0x2d
push rcx
test al, 0x23
push rdi
movabs dword es:[0xa8dfb53c98a8df87], eax
jno 0x18059019b
or dh, bl
test al, 6
dec dword [rsi - 0x25]
test al, 0x98
adc al, 0xb6
and dl, byte [rdi + 0x49]
add dword [rdx - 0x21], ecx
test al, 0x20
sbb dword [rbx - 0x14d15725], esi
invalid
fisubr dword [rax + 0x2446bb08]
push rdi
rcl byte [rcx]
imul ebx, eax, 0x5b1e92a8
fsubr dword [rax - 0x26193689]
test al, 0x84
movsd dword [rdi], dword [rsi]
movabs al, byte [0x8f572558d6dea8dc]
or esp, dword [rax + rbx*8 + 0x8d46aa8]
fild qword [rax - 0x7fa7868b]
add ebx, ebx
invalid

Function at 0x180590886
Capabilities:
Packed with generic packer

Disassembly:
not si
mov rsi, qword [rsp + 0x30]
call fcn.1802cd787

Function at 0x18061c78a
Capabilities:
Encode data using xor

Disassembly:
jne 0x1808d44ed
shr bx, 0xea
mov qword [rsp + r11 + 0x50], rax
add qword [rsp + r11*8], 0xffffffffff9b5208
or r11d, 0x5e63429
push r14
shl rbx, 0x36
jns 0x18029a1ba
mov ebp, 0x98f2cced
mov edx, 0x590d37fc
or ebp, dword [rdi + 1]
or eax, 0x3db08224
or eax, 0xdf94198b
pop rsi
invalid

Function at 0x1806208db
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
pushfq
movabs r15, 0x1a55e33b1d00a0
neg r15w

Function at 0x180667cb0
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
js fcn.18076ae28
jae 0x1808a1dfe
pushfq
shr byte [rsp + 0x10], 0x2e
mov r8, qword [rsp + 0x10]
jne 0x1801a92f5
push r14
mov qword [rsp + 0x38], rcx
mov r12, r8
not r12
test dword [rsp + r8*2 - 0x40468de8], r12d
lea r8, [r8 + r8*4 - 0x1fd0a5f9]
add qword [rsp + 0x10], 0xffffffffffcbb663
mov r14, qword [rsp + 0x18]
movabs rcx, 0x52b2198f201a1a86
xor word [rsp + 0x18], 0x2107
test qword [rsp + 0x18], 0x682312a
not dword [rsp + r12 + 0x20234719]
jge 0x180234298

Function at 0x180684c50
Capabilities:
Encode data using xor

Disassembly:
mov word [rsp + rdi - 0x45f71fc0], 0x473f
mov r8, qword [rsp + rdi - 0x45f71fd8]
mov r8, qword [rsp + r8*2 + 0x517c5214]
jne 0x1805e093d
mov r12, qword [rsp + rdi - 0x45f71fe0]
je 0x1805edd61
jne 0x1801fc9e9

Function at 0x1806f786f
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
lea r12, [rax*4 + 0x7ff47c85]
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r10 - 0x2ebeb66d]
add qword [rsp + 0x10], 0x7f9b1729
mov qword [rsp + 0x20], r12
call fcn.180438a20

Function at 0x1806f78ad
Capabilities:
Query environment variable

Disassembly:
jg 0x1808cb81b
xchg byte [rdi - 0x748ec522], bl
add al, bpl
int3
jle fcn.1807c7920
lea rsi, [rsi + 0x69f11b66]
call fcn.1804236aa

Function at 0x18071d5d4
Capabilities:
Encode data using xor

Disassembly:
sub dword [rsp + 0x50], 0x316803c5
setg byte [rsp + 0x50]
ja 0x18067b34e
mov rsi, qword [rsp + 0x30]
jbe 0x1805c1e02
Function at 0x18072c0b0
Capabilities:
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + rcx + 0x38]
mov rbp, qword [rbp + riz]
or qword [rsp + rcx*8 + 8], rsi
shl rsi, 0x7e
shr cx, 0xf3
test dword [rsp + rsi + 8], 0x34e75107
lea rbp, [rbp + 0x364666e0]
mov qword [rsp + 0x38], rcx
jl 0x180070c0a
add qword [rsp + 0x50], 0x7f85ba60
call fcn.1805cefb1
jbe 0x18034e3da
ret

Function at 0x1807587b0
Capabilities:
Packed with generic packer

Disassembly:
not ebx
and r10w, word [rsp + 0x79]
sub sil, 0x50
setg r14b
shl rbx, 0xfa
mov r10, qword [rsp + r10 - 0x7954a4]
test esi, 0x41fa23ae
lea rsi, [rbx + rbx*4 + 0x75b85208]
call fcn.1807f451d
setb bl
mov rbx, qword [rsp + rbx*2 - 0x6a2095c2]
test qword [rsp + 0x60], 0x24ed1217
ja 0x18074d8d4
and dword [rax], 0xd9ff787d
stosb byte [rdi], al
jbe 0x18057a073
cmpsd dword [rsi], dword [rdi]
pop rbx
jmp 0x18057a0e6
push rsp
sti
invalid
sahf
mov ebx, 0x910b9f88
adc dword [rax], ebx
ret
invalid
shr byte [rsp + 0x60], 0x93
call fcn.18079c48f
sub al, 0x46
popfq
insd dword [rdi], dx
push rsi
outsd dx, dword [rsi]
xchg edx, eax
adc bl, byte [rsi - 0x30]
xchg r10d, eax
jo 0x18074d8a1
invalid
jge 0x18057a019

Function at 0x180765ce5
Capabilities:
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + 0x28]
bswap r12d
lea r8, [rdi + rdi*2 + 0x61d10060]
mov word [rsp + rdi*2 - 0x34828812], r8w
mov rdi, qword [rsp + 0x68]
not r12d
mov r8, qword [rsp + r12*2 - 0x737a8aec]
seto byte [rsp + r12*2 - 0x737a8aec]
jae 0x180a377d0
cmp byte [rsp + r12 - 0x39bd452a], r8b
call fcn.18025665b

Function at 0x18076ae54
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
call fcn.18038265b
jge 0x1808cb840
jb 0x1806f30e0
movabs r9, 0x6a464b771b95031c
call fcn.1806a1e5a

Function at 0x1807889dd
Capabilities:
Packed with generic packer

Disassembly:
movabs rcx, 0x13a76b362a2309be
not ecx
mov rcx, qword [rsp + 0x18]
movsx r13w, r13b
movzx r13d, byte [rsp + 0x20]
js 0x18079865e
je 0x1801d8bbc
and r13b, r13b

Function at 0x18078a0fc
Capabilities:
Packed with generic packer

Disassembly:
jl fcn.1807587b0
xor r13, 0x736e17e2
mov r13, qword [rsp + 0x28]
call fcn.180580912

Function at 0x180795947
Capabilities:
Encode data using xor

Disassembly:
mov bpl, 0x75
lea rbp, [rbp + riz + 0x588727a3]
push r12
mov rax, qword [rsp + 0x28]
test rbp, rbp
jl 0x18065b951
mov r12, rbp
cmp r12b, 0x86
lea rax, [rax + 1]
jbe 0x1805ded38
sub r10b, 0xcd
xchg qword [rsp + 0x58], rax
mov r10, qword [rsp + r10 - 0x50c45726]

Function at 0x1807a70d4
Capabilities:
Query environment variable

Disassembly:
or word [rsp + 8], 0x54c7
jb 0x1804b77f2
push 0x48fb0f48
call fcn.1803bb721
lea rbp, [rbp + 1]
js 0x180015765
push rbp
push r8
pushfq
movabs r8, 0x429617022b4a2dbd
push r14
movabs r14, 0x60eb22b526b36817
push r10
mov r10, r8
sub r14d, 0x53f97a04
call fcn.180271e3d

Function at 0x1807ed9f1
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
mov qword [rsp + 8], 0x1c89558d
lea rsp, [rsp + 8]
call fcn.180adf3e1