joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006716
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rbp
jmp 0x180013c81
mov rbp, qword [rsp + 8]

Function at 0x180006830
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get system information on windows
Packed with generic packer

Disassembly:
push r10
jb 0x1800073b1
xchg bp, bp
jae 0x1800073b1
jne 0x180013f9c
call fcn.18001166c
jae 0x1800068a0
jle 0x18000685a
call 0x1051028da
invalid
jmp qword [rcx]
call fcn.1800098c6
invalid
mov r10, qword [rsp + 8]
jp 0x180009677
mov rax, rax
jnp 0x180009677
movzx eax, word [rdx]
call fcn.180006609
wait
insd dword [rdi], dx
bnd call 0x1f54d27dd
invalid
call fcn.18000c9bb
jns 0x180013f84
sub dword [rsi], ebx
call 0x180c436f3
add byte [rax], al
add al, ch
adc al, 0x59
invalid

Function at 0x18000693c
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
js 0x18000d500
xchg rcx, rcx
jns 0x18000d500
jb 0x1800133c9
xor eax, eax
call fcn.180009657
movsd dword [rdi], dword [rsi]
invalid
movsxd rdx, dword [rdx]
jp 0x180009271
xchg sp, sp
jnp 0x180009271
je 0x180011ded
jmp 0x18000ac9d
mov rcx, rdi
call qword [0x18001a98c]
xchg esp, eax
in eax, 0xff
invalid
fisub dword [0x169bf8a7b]
std
add byte [rax], al
lea rcx, [rbp - 0x50]
call fcn.18000e8db
scasd eax, dword [rdi]
in al, dx
cmc
call 0x18d8dd2e1
cmp ebx, dword [rdx]
add dword [rax], eax
call fcn.1800072dc
and dword [rdi + 0x3de81f], r12d
add byte [rax], al
adc byte [rdi], cl
xchg byte [rdx], bh
stosb byte [rdi], al
add byte [rax], al
jbe 0x1800077b7
mov ebx, 0x57
jmp 0x180007345
pushfq
je 0x18001277a
xchg al, al
jne 0x18001277a
lea rcx, [rsp + 0x38]
call fcn.18000b7a6
call fcn.180005f86
scasb al, byte [rdi]
out 0x2e, al
call 0x1a4751be0
cmp al, ch
cmp eax, 0xb9000056
or byte [rbp + rsi*8 - 0x18], al
mov rcx, rax
call fcn.180009ee1
mov dl, byte [rdi + rax*2]
out 0xe8, eax
ret 0xb8
test r10, 0
jb 0x180008a75
test byte [rsp + 0x60], 0x10
call fcn.180007aca
invalid
mov eax, dword [rdi + 0x58]
mov dword [rsp + 0x20], eax
call fcn.18000a563
test rax, 0
jne 0x180011882
invalid
call fcn.180006069
and ebx, dword [rdi]
jrcxz 0x1800133d0
mov rdx, qword [rsp + 8]
jg 0x180007028
xchg r12, r12
jle 0x180007028

Function at 0x180007014
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
call fcn.1800120d9
xchg dword [rdx + 0x48e8c1e4], edx
invalid
Function at 0x1800072dc
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
jb 0x1800131cc
mov sp, sp
jae 0x1800131cc
mov r8d, edx
call fcn.18000a563
test r8, 0
call fcn.180010a38
invalid
mov r10, qword [rsp + 8]
jb 0x18000aa54
xchg cl, cl
jae 0x18000aa54
call qword [0x18001a15b]
call fcn.18000a19f
js 0x180013262
push rbp
sub ebp, eax
movsxd r15, dword [r15]
ja 0x1800090c4
mov ah, ah
jbe 0x1800090c4
jmp fcn.1800075ce
adc dword [rax], eax
add byte [rax - 0x75], cl
test byte [rdi], 0x83
invalid
Function at 0x180007aca
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
popfq
ja 0x1800098ec
nop
jbe 0x1800098ec
pushfq
jo 0x180011c92
push r14
js 0x180011e77
mov si, si
jns 0x180011e77
mov qword gs:[0x1a0], rbx
call fcn.1800148da
enter 0x4c02, 7
call 0x1e063ff01
test byte [rbx + 0x60], ah
add byte [rax], al
je 0x1800138b0
call fcn.1800109c6
mov ch, 0x13
fucompi st(1)
call 0x1a44d0850
and byte [rdx + 1], bh
call fcn.180011f57
call fcn.18000cfcf
cmp al, 0x9b
pop rbp
xor ch, al
xor r15, 0x25faaf45
jb 0x18000d111
mov r10, r10
jae 0x18000d111
test dh, 0
jo 0x1800112f7
call fcn.180013ca1
mov cl, cl
xor eax, 0xc2f6e8
jb 0x18000b5e8
call fcn.18000fc8e
sbb byte [rdx + 0x6d], bh
xlatb
call 0x109495690
push r8
test al, 0
jne 0x180012461
call fcn.180008f2e
invalid
popfq
jg 0x180012923
xchg bl, bl
jle 0x180012923
movsxd r10, dword [r10]
js 0x1800139ff
mov r15, r15
jns 0x1800139ff
call fcn.180014485
shl dword [rbx - 0x2a], cl
or ebp, eax
pushfq
jo 0x1800114fb
xchg rbp, rbp
jno 0x1800114fb
jb 0x180007aef
and eax, 0x490
call fcn.180009eae
enter 0x6df8, 0xfffffffffffffff2
call 0x1806dfa04
jmp 0x180011e2a
pop r15
js 0x1800125a7
xchg r12, r12
jns 0x1800125a7
xor eax, eax
call fcn.18000c161
cld
push rbx
mov eax, 0x2948e826
and al, 0x10
jmp 0x180009668
add cl, byte [rcx - 9]
invalid
add qword [rsp + 0x10], r15
jg 0x180007a49
xchg dl, dl
jle 0x180007a49
call fcn.18000dc1a
pop rsi
invalid
ret
sub qword [rsp + 0x10], rdx
jg 0x18000eb33
mov bx, bx
jle 0x18000eb33
mov rdx, qword [rbx + 0x10]
mov rcx, rsi
call fcn.18000b053
test cl, 0
js 0x180013d2b
xor edi, 0xeff687d2
call fcn.1800120d9
stc
invalid
add edi, eax
mov eax, dword [rdi]
call fcn.18000f391
cld
and ch, byte [rcx]
invalid
sub rdx, 0x74ca4a8
js 0x180011222
mov si, si
jns 0x180011222
pop r10
jo 0x18000f5bf
xchg cl, cl
jno 0x18000f5bf
jne 0x18000a649
mov r14, qword [rsp + 8]
jl 0x180012fab
xchg dl, dl
jge 0x180012fab
call fcn.18000fa65
mov rax, rdx
call fcn.180011aa8
rcl dword [rdi]
invalid
Function at 0x180007f38
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r12
jg 0x18000e579
xchg rdx, rdx
jle 0x18000e579
test rcx, rcx
je 0x18000dd60
call fcn.18000d0a6
jmp 0x1680f51b1

Function at 0x1800080e1
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r13
je 0x1800103ee
mov ah, ah
jne 0x1800103ee
call qword [0x18001a934]
test bh, 0
call fcn.18000c161
mov fs, word [rax + rdi*4 - 0x72b717da]
push rsp
and al, 0x68
call fcn.18000cfcf
pop rbp
stc
pop rbp
xor ch, al

Function at 0x1800082d9
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
jl 0x18001215b
mov rcx, rcx
jge 0x18001215b
mov r10, qword [rsp + 8]

Function at 0x180008805
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov rcx, qword [rsp + 8]
jb 0x1800071c7
mov r10, r10
jae 0x1800071c7
movsxd rcx, dword [rcx]
jp 0x180008d96
push rcx
js 0x1800061ef
nop
jns 0x1800061ef

Function at 0x180008a5d
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r9, qword [rsp + 8]
jg 0x18000933d
mov r13, r13
jle 0x18000933d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x10]
test al, 0
jnp 0x180013e6a
sub rsp, 0x110
test ah, 0
jne 0x1800088e1
and qword [rsp + 0x30], 0
lea edx, [rbp - 0x31]
test edi, 0
call fcn.180008a5d
lodsb al, byte [rsi]
xor byte [rdi - 0x307417ca], dl
call fcn.180006e12
call fcn.18000c9bb
and al, 0x9e
invalid
push r9
jb 0x180007f5c
mov ch, ch
jae 0x180007f5c
mov qword [rbp - 0x50], rbx
shl edx, 0x20
mov r8d, 0x989680
test rax, 0
jne 0x180007452
call fcn.18001046b
jmp 0x168f634b7
sub esp, 0x38
mov rdx, qword [rsp + 0x58]
call fcn.18000e40c
invalid
Function at 0x180008f1e
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov rax, qword [rsp + 8]
jo 0x18001325c
mov si, si
jno 0x18001325c
push rax
ja 0x180006928
xchg r15, r15
jbe 0x180006928
add rax, 0x3d373dc8
jg 0x180014853
xchg si, si
jle 0x180014853
movsxd rax, dword [rax]
jb 0x1800143a5
mov rsi, rsi
jae 0x1800143a5
call fcn.18000da7d
call fcn.180013325
xchg esi, eax
std
push rbx
sbb eax, ebp
pushfq
ja 0x18000fb4f
xchg bp, bp
jbe 0x18000fb4f
mov rcx, rdx
mov r12, rdx
call fcn.180009c3f
jnp 0x1800143f6
push rdx
invalid
loope 0x1800143f7
invalid
call [rdi + rcx - 0x40277e]
jmp qword [rsi - 0x70]
add qword [rsp + 0x10], rax
js 0x1800140be
mov bx, bx
jns 0x1800140be
Function at 0x180009158
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
test dl, cl
xchg ecx, eax
add byte [rax], al
mov al, byte [rcx - 5]
test bh, 0
jne 0x180008c82
ret
movsxd r15, dword [r15]
ja 0x180008e3c
xchg r11, r11
jbe 0x180008e3c
pushfq
jb 0x180009849
push r15
jo 0x180010cda
nop
jno 0x180010cda
add r9, 0x3fc7e714
jmp 0x180011b40
add r15, 0xe389003
jb 0x180014283
xchg rcx, rcx
jae 0x180014283
lea rdx, [rsp + 0x40]
call fcn.180012e98
sbb esi, ebx
push rcx
sub eax, 0xfa8b48e8
call qword [0x18001a877]
call fcn.18000b7de
invalid
popfq
je 0x18000ffa0
mov bp, bp
jne 0x18000ffa0
pushfq
js 0x18001442d
xchg bh, bh
jns 0x18001442d
mov rbx, r13
call fcn.1800074f2
invalid
call fcn.18000e40c
cmpsd dword [rsi], dword [rdi]
lea ebx, [rdi + 0x1f]
call 0x180c8b1d3
add byte [rax], al
add byte [rdi], cl
mov ecx, dword [rdx]
enter 0xffffffffffffffff, 0xffffffffffffffe8
shl byte [rbp + 0x232fffff], 1
jrcxz 0x18000ba86
test rdi, 0
call fcn.180013ca1
xor al, 0xcf
xor eax, 0x48c35be8
mov ecx, dword [rcx]
call fcn.18001166c
fdivr qword [r14 + 0xa]
call 0x10a80ca5e
pop qword [rax]
add byte [rbp - 0x79], cl
ror byte [rdi], cl
add dword [rcx + 0xf00008f], 0x38a485
add byte [rsi - 9], ah
mov dword [rax], 0xe403e800
invalid
popfq
js 0x180013412
xchg r8, r8
jns 0x180013412
pop rdi
jo 0x18000740d
xchg rbx, rbx
jno 0x18000740d
push r9
sub rsp, 0x28
call fcn.180012269
xchg edx, eax
lodsb al, byte [rsi]
sub dword [0x1804d24af], 0xc3f76600
add byte [rax], al
jo 0x18000ba7d
call fcn.18000ec03
adc ebp, ebx
sbb ebp, eax
add rsi, rax
call fcn.18000f0da
mov rdx, qword [rbp + 0x10]
mov r8d, ebx
mov rcx, rsi
call rax
mov edx, dword [rbp]
lea r8, [rsp + 0x40]
test r13, 0
jne 0x180007a6e
add edx, 0x1000
call fcn.1800117dd
and al, 0xdb
invalid
test ebx, ebx
jne 0x180013d2a
jne 0x180006447
call fcn.180009b91
int3
mov r15, qword [rsp + 8]
jp 0x180008813
mov ah, ah
jnp 0x180008813
popfq
jg 0x180010595
mov r8, r8
jle 0x180010595
sub qword [rsp + 0x10], rdi
jo 0x18000a8a3
mov rdx, rdx
jno 0x18000a8a3
mov eax, dword [rsi + 8]
call fcn.18000ebd2
mov dl, 0x49
invalid
add qword [rsp + 0x10], r9
jb 0x18000d13f
xchg bx, bx
jae 0x18000d13f
mov rax, rbx
test r10, 0
jnp 0x180010424
add rsp, 0x20
pop rbx
ret

Function at 0x180009657
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r14
jl 0x18000f813
mov rsi, rsi
jge 0x18000f813
sub r14, 0x1d5ec1ff
jp 0x1800074be
xchg r10, r10
jnp 0x1800074be
ret
movsxd r14, dword [r14]
jg 0x180010f6d
mov bp, bp
jle 0x180010f6d
mov rax, 0
mov qword gs:[0x190], rax
mov rax, qword gs:[0x198]
xchg qword [rsp], rax
call fcn.1800109c6
out 0x20, eax
invalid
mov r14, qword [rsp + 8]
jp 0x18000f64d
nop
jnp 0x18000f64d
pushfq
jg 0x18000a31a
mov ah, ah
jle 0x18000a31a
jb 0x18000ac5c
cmp rbx, rdi
call fcn.1800064ac
or al, 0xdb
invalid
Function at 0x180009839
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
jb 0x18000e632
cmp qword [rax + 0xe20], 0
cmp dword [rax + 0xe20], 0
call fcn.18000f58a
cld
xchg edi, eax
push rdi
loopne 0x18000621e
pushfq
jo 0x18000fa95
mov rdi, rdi
jno 0x18000fa95
pop rdi
call fcn.180009eae
fptan
insd dword [rdi], dx
bnd call 0x180c87b4f
add byte [rax], al
add byte [rdi], cl
test dword [rax + 0x3bfffff4], esp
invalid
popfq
jb 0x18000a0d0
xchg dh, dh
jae 0x18000a0d0
jo 0x180009c7f
test rax, rax
je 0x18000f920
call fcn.180006285
loopne 0x18000891a
invalid
push rbp
jb 0x18000eca1
xchg rdi, rdi
jae 0x18000eca1
call fcn.18000f3b4
invalid
mov byte [rax], ch
mov dword [rax], eax
add al, ch
jmp 0x180009c2f
pop rbp
js 0x180010b68
mov rcx, rcx
jns 0x180010b68
mov r11, rax
call fcn.1800147e5
call fcn.180012e98
clc
push rdi
push rdx
sub eax, 0xf5241e8
push r10
je 0x18001361e
mov r10, r10
jne 0x18001361e
test ch, 0
js 0x180006225
call fcn.180010746
push rdx
mov al, 0xaf
shr eax, 1
pushfq
jp 0x180012527
xchg r14, r14
jnp 0x180012527
call fcn.18000a20e
call fcn.18000fc8e
lahf
outsb dx, byte [rsi]
xlatb
call 0x1a4458e8c
and byte [rdx], al
add byte [rax], al
add al, ch
invalid
movsxd rbp, dword [rbp]
jb 0x1800083e8
xchg r8, r8
jae 0x1800083e8
mov rdi, qword [rsp + 8]
jo 0x180010012
nop
jno 0x180010012
mov ecx, dword [rdi + rbx*8]
add qword [rsp + 0x10], rbp
js 0x180008885
xchg r11, r11
jns 0x180008885
mov rbp, qword [rsp + 8]
jp 0x18000df40
mov sp, sp
jnp 0x18000df40
test ecx, 0
jnp 0x18000f936
xor ebx, ebx
test r14, 0
call fcn.180011aa8
setl byte [rdi]
add ch, al
test rax, 0
jne 0x18000cec4
xor eax, eax
test r14, 0
js 0x180011bec
mov byte [rcx - 0x17ffffde], dh
lodsd eax, dword [rsi]
sar edi, 1
call [rdi + 0x64]
add dh, dh
call fcn.18000caed
pop rdi
add dh, dh
call 0x1a4558495
or byte [rdi], cl
xchg esp, ebx
mov esp, 0x8b4dffff
ror byte [rdi], cl
xchg bl, dl
mov esp, 0x850fffff
pop rax
sub eax, dword [rax]
add byte [rdi], cl
test dword [rsi - 0x72000008], eax
or cl, r13b
jo 0x18000f905
invalid
sub rbp, 0x26e1750d
jg 0x18000ea7e
mov rsi, rsi
jle 0x18000ea7e
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
call fcn.180014297
or dword [rbx + 0x48e8f738], 0xa0cfeb81
lodsb al, byte [rsi]
and dword [rdi], ecx
mov byte [rbp - 0x33], ah
invalid
movsxd rdi, dword [rdi]
ja 0x18000c6a6
mov rdx, rdx
jbe 0x18000c6a6
test rax, rax
je 0x180010040
je 0x180010b52
mov r8d, dword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180009e67
lea rcx, [rbp - 0x50]
call fcn.18000a20e
call qword [0x18001a87f]
lea rdx, [rbp + 0x28]
call fcn.1800080e1
mov al, 0xb1
xchg byte [rax + rbp*8], bl
lea ecx, [rsp + 0x20]
mov edx, 1
mov r12d, eax
call fcn.1800147cb
inc byte [0x143e947c5]
ret
outsd dx, dword [rsi]
pop rdi
invalid
Function at 0x180009b91
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov rsi, qword [rsp + 0x58]
call fcn.1800135c2
mov ch, byte [rax + 0x48e8db81]
mov eax, dword [rbp + 0x57]
call fcn.18000d0b5
invalid
push r14
ja 0x18000f9c3
nop
jbe 0x18000f9c3
call qword [0x18001a934]
mov ebx, eax
jmp 0x18000734e
movsxd r14, dword [r14]
jg 0x18000e097
mov bx, bx
jle 0x18000e097
pop r10
jo 0x180013b02
xchg r9, r9
jno 0x180013b02
pop r14
jl 0x180014202
xchg r15, r15
jge 0x180014202
movsxd rbx, dword [rbx]
jmp 0x18001211f
pushfq
je 0x180011d0a
mov r14, qword [rsp + 8]
js 0x18000b0fc
mov rdx, rdx
jns 0x18000b0fc
je 0x180009d9d
Function at 0x180009c3f
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rcx
js 0x1800062f7
mov rdi, rdi
jns 0x1800062f7
je 0x18000ef85
mov ecx, 0x68
call fcn.180008dd2
invalid
invalid

Function at 0x180009ee1
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r10, qword [rsp + 8]
js 0x180006bb0
xchg ch, ch
jns 0x180006bb0
push r10
jmp 0x180007aa8

Function at 0x180009ef8
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov r13, qword [rsp + 8]
push r13
jo 0x1800062e3
mov r12, r12
jno 0x1800062e3

Function at 0x180009f09
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
jl 0x180006196
mov rdi, rdi
jge 0x180006196
sub r12, rax
jmp 0x1800112f9

Function at 0x18000a03c
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Get system information on windows
Packed with generic packer

Disassembly:
popfq
jmp 0x18000c3a3
movsxd rax, dword [rax]
jp 0x180011065
push rax
jg 0x18000bd38
mov dx, dx
jle 0x18000bd38
call fcn.18000828e
call fcn.1800149ad
or ebx, 1
invalid
mov rax, qword [rsp + 8]
jp 0x180007db1
xchg r10, r10
jnp 0x180007db1
add qword [rsp + 0x10], rdx
jp 0x1800068ea
mov dx, dx
jnp 0x1800068ea
js 0x18000f8b2
call fcn.180009c39
stosd dword [rdi], eax
invalid
pop rdx
jb 0x18001136a
xchg r11, r11
jae 0x18001136a
lea ebp, [rax + 1]
mov eax, 2
movsxd r8, ebp
mul r8
jmp 0x18000d05c
loopne 0x18000f8b3
inc dword [rax]
add dh, dh
mov byte [rax], 0xe8
stosd dword [rdi], eax
sub dword [rax], eax
add byte [rdi], ch
xchg ecx, eax
sub dword [0x18f9ebcb2], 0xff72d48a
inc dword [rsi - 0x3374f00a]
jb 0x18000f8d1
add byte [rax], al
test dh, 0
call fcn.180012269
invalid
pushfq
jg 0x18000827a
ret
Function at 0x18000a0f2
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
jb 0x18000e632
cmp qword [rax + 0xe20], 0
cmp dword [rax + 0xe20], 0
call fcn.18000f58a
cld
xchg edi, eax
push rdi
loopne 0x18000621e
pushfq
jo 0x18000fa95
mov rdi, rdi
jno 0x18000fa95
pop rdi
call fcn.180009eae
fptan
insd dword [rdi], dx
bnd call 0x180c87b4f
add byte [rax], al
add byte [rdi], cl
test dword [rax + 0x3bfffff4], esp
invalid
popfq
jb 0x18000a0d0
xchg dh, dh
jae 0x18000a0d0
jo 0x180009c7f
test rax, rax
je 0x18000f920
call fcn.180006285
loopne 0x18000891a
invalid
push rbp
jb 0x18000eca1
xchg rdi, rdi
jae 0x18000eca1
call fcn.18000f3b4
invalid
mov byte [rax], ch
mov dword [rax], eax
add al, ch
jmp 0x180009c2f
pop rbp
js 0x180010b68
mov rcx, rcx
jns 0x180010b68
mov r11, rax
call fcn.1800147e5
call fcn.180012e98
clc
push rdi
push rdx
sub eax, 0xf5241e8
push r10
je 0x18001361e
mov r10, r10
jne 0x18001361e
test ch, 0
js 0x180006225
call fcn.180010746
push rdx
mov al, 0xaf
shr eax, 1
pushfq
jp 0x180012527
xchg r14, r14
jnp 0x180012527
call fcn.18000a20e
call fcn.18000fc8e
lahf
outsb dx, byte [rsi]
xlatb
call 0x1a4458e8c
and byte [rdx], al
add byte [rax], al
add al, ch
invalid
movsxd rbp, dword [rbp]
jb 0x1800083e8
xchg r8, r8
jae 0x1800083e8
mov rdi, qword [rsp + 8]
jo 0x180010012
nop
jno 0x180010012
mov ecx, dword [rdi + rbx*8]
add qword [rsp + 0x10], rbp
js 0x180008885
xchg r11, r11
jns 0x180008885
mov rbp, qword [rsp + 8]
jp 0x18000df40
mov sp, sp
jnp 0x18000df40
test ecx, 0
jnp 0x18000f936
xor ebx, ebx
test r14, 0
call fcn.180011aa8
setl byte [rdi]
add ch, al
test rax, 0
jne 0x18000cec4
xor eax, eax
test r14, 0
js 0x180011bec
mov byte [rcx - 0x17ffffde], dh
lodsd eax, dword [rsi]
sar edi, 1
call [rdi + 0x64]
add dh, dh
call fcn.18000caed
pop rdi
add dh, dh
call 0x1a4558495
or byte [rdi], cl
xchg esp, ebx
mov esp, 0x8b4dffff
ror byte [rdi], cl
xchg bl, dl
mov esp, 0x850fffff
pop rax
sub eax, dword [rax]
add byte [rdi], cl
test dword [rsi - 0x72000008], eax
or cl, r13b
jo 0x18000f905
invalid
sub rbp, 0x26e1750d
jg 0x18000ea7e
mov rsi, rsi
jle 0x18000ea7e
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
call fcn.180014297
or dword [rbx + 0x48e8f738], 0xa0cfeb81
lodsb al, byte [rsi]
and dword [rdi], ecx
mov byte [rbp - 0x33], ah
invalid
movsxd rdi, dword [rdi]
ja 0x18000c6a6
mov rdx, rdx
jbe 0x18000c6a6
test rax, rax
je 0x180010040
je 0x180010b52
mov r8d, dword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180009e67
lea rcx, [rbp - 0x50]
call fcn.18000a20e
call qword [0x18001a87f]
lea rdx, [rbp + 0x28]
call fcn.1800080e1
mov al, 0xb1
xchg byte [rax + rbp*8], bl
lea ecx, [rsp + 0x20]
mov edx, 1
mov r12d, eax
call fcn.1800147cb
inc byte [0x143e947c5]
ret
outsd dx, dword [rsi]
pop rdi
invalid
Function at 0x18000a19f
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push r10
jl 0x180009739
mov sp, sp
jge 0x180009739
Function at 0x18000ad89
Capabilities:
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
push rdi
mov rdi, qword [rsp + 8]
ja 0x18000e568
mov ax, ax
jbe 0x18000e568
mov rax, qword gs:[0x190]
jmp rax

Function at 0x18000b053
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
call fcn.180009b91
mov edx, 0xe82c90ad

Function at 0x18000b4d9
Capabilities:
Authenticate hmac
Check for software breakpoints
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Get system information on windows

Disassembly:
xor r13, 0x1c86b888
jl 0x18000c7d0
nop
jge 0x18000c7d0
jl 0x18000a1e5
call fcn.1800145dc
nop ebp
sub al, ch
popfq
ja 0x1800144db
pushfq
je 0x18000a405
mov r15, r15
jne 0x18000a405
je 0x180014129
call fcn.180006285
imul ebp, ecx, 0x4de8153f
invalid
mov dword [rax + 0x18], esi
sub r12, 0x3db2a4de
js 0x18000ae25
mov dh, dh
jns 0x18000ae25
call fcn.18000c1d6
invalid
sub qword [rsp + 0x10], r12
jb 0x1800126c2
xchg rbx, rbx
jae 0x1800126c2
mov rcx, rax
call fcn.180008c3d
test r9, 0
call fcn.180011b14
out 0x9a, eax
xor al, 0xe8
jne 0x180014455
lea rcx, [rsp + 0x20]
mov edx, 0x5508ffec
mov r9d, 0x6657
mov r8d, 0x5f96182b
call fcn.18001273e
test ah, 0
call fcn.1800148da
xchg esp, eax
out 0x4c, eax
invalid
push r12
jmp 0x18000bfaf
mov r12, qword [rsp + 8]
jmp 0x180011544
popfq
jo 0x180012613
xchg rbx, rbx
jno 0x180012613
add qword [rsp + 0x10], r13
ja 0x18000c746
mov di, di
jbe 0x18000c746
pop r14
jb 0x180009dfa
movsxd r12, dword [r12]
je 0x18000944c
xchg ch, ch
jne 0x18000944c
pushfq
jl 0x180008b0f
nop
jge 0x180008b0f
mov r8, rdi
call fcn.180010541
ret 0x572