joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
enter 0x5002, 5
sub dword [rdi + 0x237163b2], ebp
invalid
Function at 0x1409bb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409bb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409bb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409bb06f
add dl, dl
jne 0x1409bb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409bb0f6
xor eax, eax
add dl, dl
jne 0x1409bb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409bb1ad
add dl, dl
jne 0x1409bb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409bb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409bb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409bb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409bb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409bb07e
mov eax, 1
add dl, dl
jne 0x1409bb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409bb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409bb0fb
sub eax, ebx
mov ebx, 1
jne 0x1409bb14c
mov ecx, 1
add dl, dl
jne 0x1409bb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409bb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409bb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409bb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409bb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409bb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409bb15d
cmp eax, 0x7d00
jae 0x1409bb19b
cmp eax, 0x500
jb 0x1409bb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409bb07e
cmp eax, 0x7f
ja 0x1409bb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409bb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409bb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409bb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140042a3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp r12d, dword [rsp + 0x19]
js 0x140112513
cmp dword [rax + rax*4 + 0x48], ebx
mov ecx, dword [rsp + 0x38]
call fcn.140056ffc
sbb dword [rax - 0x3ffffffb], edi
add qword [rsp + 0x18], r12
mov rbp, qword [rsp + rbp - 0x7e6c8f65]
setne byte [rsp + 0x18]

Function at 0x140044fb8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r9 + 0x36], r9
cmovbe r9d, dword [rsp + r9*8 + 0x2c]
lea rsi, [rsi + r13 - 0x4b8a7362]
ja 0x1400d967a
cmp word [rsp + r9 + 0x38], 0xd87

Function at 0x140049e49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xfffffffffff672f2
neg cl
jge 0x1400e9dd5
cmp qword [rsp + 0x30], 0xd9c6c22

Function at 0x140049e5a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edi
xor byte [rsp + 0x30], 0xa4
mov r13, qword [rsp + 0x58]
call fcn.140183468

Function at 0x14004bc9d
Capabilities:
Encode data using xor

Disassembly:
shl bl, 0xc6
mov rcx, qword [rsp + 8]
shl r13b, 0xc
setne r13b
js 0x14009f0a6
lea r13, [r13*4 + 0x17ae3e94]
mov word [rsp + 0x28], 0xe381
jns 0x1401c9daf
call fcn.1400c291b

Function at 0x1400577b0
Capabilities:
Encode data using base64

Disassembly:
or dword [rsp + 0x78], 0x96910083
sub r10w, r10w
add qword [rsp + 0x18], 0xffffffffbffb2751
shl dword [rsp + 0x78], 0x98
or dword [rsp + 0x48], 0xe6061929

Function at 0x1400582f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push 0xffffffff9f12b725
pushfq
or byte [rsp + 8], 0x2d
xor word [rsp + 8], 0x77b6
not dword [rsp + 8]
jns 0x14006297e
jne 0x14018828a
jl 0x140058326
test ebx, esp
sub ecx, ebx
push 0x7a
pop rdi
stc
cmp al, 0x90
rcr dword [rdi], 0xcc
int3
int3
call fcn.140125c43
cmp cl, byte [rax - 0x75]
invalid

Function at 0x1400a3500
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
test qword [rsp + 0x58], 0x6223a23c
not word [rsp + 0x58]
mov word [rsp + 0x58], 0x7435
call fcn.1401604b1
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
call fcn.140194204

Function at 0x1400a3531
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x9b7d595], rdi
setns cl
jbe 0x1400ea682
mov cx, 0x5136
mov ecx, 0xf4112604
add qword [rsp], 0x61ccb
test cl, 0x1e
jns 0x14011f15b
and eax, 0xeb04fcea
push rsp
outsb dx, byte [rsi]
sub eax, edx
mov esi, 0xfc2a6561
invalid
Function at 0x1400c845a
Capabilities:
Encode data using base64

Disassembly:
mov r15, qword [rsp + r8 - 0x77beff8f]
jb fcn.1401921fd
xor r8w, si
shl r8, 0xb0
not r8b
shr dword [rsp + 0x38], 0x3d
test dword [rsp + 0x38], 0x233481e
mov r8, qword [rsp + 8]
jbe 0x140105152
or byte [rsp + 0x38], sil
test qword [rsp + 0x28], 0x1181f6aa
not byte [rsp + 0x28]
mov dword [rsp + 0x38], esi
mov rsi, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
call fcn.140056ff7
pushfq
movabs rdi, 0x32060eb61aa85b8d
push 0x340a9286
not edi
add qword [rsp + 0x10], 0x98172
xchg qword [rsp + 0x20], rbp
call fcn.1400e2ccf
mov rax, qword [rsp + r15*4]
mov rax, qword [rax + r15]
or r15b, 0x39
shl r15w, 0x5d
test r15, 0x76122a18
mov qword [rsp + r15*4], r15
push r12
lea rax, [rax + r15 + 0x4cbde72d]
push r11
mov qword [rsp + r15*8 + 0x10], 0x1a9c5106
mov r11, r15
xchg qword [rsp + r15 + 0x40], rax
mov r15, qword [rsp + r15 + 0x30]
ja 0x140046dcc
mov r12, qword [rsp + r11*2 + 0x10]
or qword [rsp + r12*4 - 0x6a714408], 0xffffffffda21950d
jno 0x140138644
xor word [rsp + 0x38], r14w
mov rdx, r14
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
xor dword [rsp + 0x38], 0xae12a3b9
mov qword [rsp + 0x48], r14
ja 0x14016bd63
shr dword [rsp + r12*2 - 0x3538a1fc], 0x21
mov r12, qword [rsp + r11*2 + 8]
mov r11, qword [rsp + r11*2]
lea rsp, [rsp + 0x20]
ret 8
cmovo rdx, qword [rsp + 0x38]
cmp word [rsp + 0x48], 0x9bbd
push r8
lea rdi, [rdi + 0x4cbde72d]
call fcn.14012ff9b

Function at 0x1400cf109
Capabilities:
Encode data using xor

Disassembly:
js 0x1400cf9ad
sub r14w, 0xa58d
test word [rsp + r14 + 0xa649], 0x8289
movzx r14, byte [rsp + r14*2 + 0x14c52]
setb r14b
add qword [rsp + r14*2 + 8], 0xffffffffbffa4e98
mov r14, qword [rsp + r14 + 0x80]
mov byte [rsp + 0x40], 0x83
shl byte [rsp + 0x40], 0x8d
not dword [rsp + 0x40]
add dword [rsp + 0x58], 0x35a5d137
call fcn.140190667
push rdi
scasb al, byte [rdi]
rcr byte [rsi - 5], 0xd4
adc cl, byte [rdx]
xor eax, 0x47a1ce2a
pop rsi
loopne 0x1400cf14b
or eax, dword [rdx + rsi*4 + 0x6e537d1b]
jo 0x1400cf184
invalid
invalid

Function at 0x1400d2aad
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 8], 0x1e1c2
movabs rbp, 0xe43f6331d62a89a1
not ebp
cmp bp, 0x348e
jle fcn.14016491d
add qword [rsp + rbp*2 - 0x53aaecbc], 0xffffffffbfee0e34
mov rbp, qword [rsp + rbp - 0x29d57656]
mov rbp, qword [rbp + riz]
mov qword [rsp + 8], 0xffffffffa00c46a5
or word [rsp + 8], 0x8217
add qword [rsp + 8], 0xffffffffff88e2a8
lea rbp, [rbp - 0x51f2afcd]
lodsd eax, dword [rsi]
xor edx, dword [rax + 0xd]
scasb al, byte [rdi]
shl dword [rsp + 8], 0x63
call fcn.14017b560
mov fs, word [rbp - 0x7d4dc9a4]
jrcxz 0x1400d2b01
invalid
Function at 0x1400e5d16
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
movzx r13d, r13w
xor r13, 0xffffffff97258703
setno r13b
xor r13d, 0x7f862a9b
add di, di
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
neg di
and r13d, 0xce919db0
jg fcn.1400a3531
xor dil, r13b
shl r13d, 0x61
add qword [rsp + 0x28], 0xfffffffffff5692e
lea rbp, [rbp + r13 - 0x7dfae711]
test r13w, r13w
call fcn.140160511
mov r15, r9
jle 0x1400fd0a8
int3
jno 0x14017f394
test qword [rsp + r9 + 0x38], r9
jge 0x1400698d3
jno 0x1400df4c9
or r13w, di
jae 0x14013d9e1
xor eax, 0xe1051a5d
invalid
shl dword [rsp + r15], 0x8e
add dword [rsp + r15*4], 0xd1252514
jbe 0x14017d9e9
push 0x2150f9d
test word [rsp + r9 + 0x40], 0x2fbe
xchg qword [rsp + r9*8 + 0x48], rax
mov r9, qword [rsp + r15 + 0x20]
jle 0x1400eab3f
test dil, 0x12
setno r13b
sub r13w, di
nop
movsx r13, r13w
movabs rbp, 0x238cdd8b1ab8ff0a
not rbp
ja 0x1400571fb
xor qword [rsp + r15 + 0x40], 0xffffffffedab5987
add qword [rsp + r15 + 8], 0xffffffffbff1789b
call fcn.1401a387b
adc dword [rdi - 0x3fcae0c0], 6
call 0xeeb7f96d
insd dword [rdi], dx
test eax, 0xafdb59d6
sub byte [rdi + 0x4d], dl
test al, 6
sub bl, bh
pop rdi
push rax
outsb dx, byte [rsi]
xchg ebp, eax
push rax
scasb al, byte [rdi]
mov cl, 0xfb
iretd

Function at 0x1400f1a5e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + r12*2 + 0x38b77c], 0x9ae919c
add byte [rsp + r12 + 0x1c5bea], r12b
mov qword [rsp + r12 + 0x1c5bea], r12
jge 0x14013eca8
push rax
invalid
mov r12, qword [rsp + r12*8 + 0xe2dcb8]
setle byte [rsp + 0x30]
mov word [rsp + 0x58], 0x40a5
add qword [rsp], 0xffffffffbff2068e
cmp qword [rsp + 0x30], 0xffffffff9990bd2e
jno 0x1401c9074

Function at 0x1400f53ad
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [rsi - 0x41ea5a49]
setbe cl
call fcn.1400d90d0
and dx, dx
and edx, edx
add rdx, 0x6d35e79d
push r8
mov r8, rdx
sub r8b, 6
mov qword [rsp + r8 - 0x6d35f51a], rax
push rcx
and dx, r8w
cmovge dx, r8w
movabs rcx, 0xd51c6a21678e0204
lea rcx, [r8 + r8*8 - 0x44d612d4]
push rdx
add qword [rsp + 0x18], 0xb97e2
call fcn.14004e60d
syscall
push rbx
pushfq
movabs rbx, 0xb6176907e81b8d32
mov rbx, qword [rsp + 8]
mov qword [rsp + 8], 0x2e86d184
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1401f3f25
cmp dword [rbx - 0x47], 0xd54bf99f
fistp dword [0x17985eb84]
invalid
jl 0x140056b5a
xor r9b, byte [rsp + r9 + 0x3b]
setg byte [rsp + r9*2 - 0x1c2]
call fcn.140049cb4
push rax
invalid
jns 0x140190635
jns 0x1400c7193
call fcn.140059ea0
movzx r9w, byte [rsp + 0x4b]
shr r9d, 0x6b
xor word [rsp + r9*4 - 0x7449d0], 0x7aa5
mov word [rsp + r9*4 - 0x7449a0], r9w
call fcn.14012c58e
lea rax, [rax + rdx - 0xdb2]
jg 0x1400aa949

Function at 0x1400f53be
Capabilities:
Encode data using base64

Disassembly:
test r12b, 0xaa
setae r12b
shr r12d, 0x58
call fcn.14017f886
and r14d, 0xb991aaa7
and r14d, 0x5ba89ea3
add r14, r14
add qword [rsp + 0x20], 0xffffffffffe997e3
call fcn.14018ddac
neg r15
push rdi
call fcn.14011b67b
Function at 0x1400f53f7
Capabilities:
Encode data using base64

Disassembly:
movabs rbx, 0x69ac3b37ea24a726
movabs rbp, 0x861e551f1d0d5435
mov qword [rsp + r14*2 - 0x26002a74], rbx
shr bpl, 0x24
mov rbx, qword [rsp + r14*4 - 0x4c0054d8]
mov rbx, qword [rbx]
js fcn.1401ab52c
mov byte [rsp + r14 - 0x13001532], 0x3d
mov qword [rsp + 0x30], rbp
sub bp, r14w
push r13
lea r14, [r14*8 + 0x1a3fa5a8]
lea rbx, [rbx + 0x65b70f33]
shl r14d, 0x3b
call fcn.1401bd365
call fcn.140151863

Function at 0x140103a6e
Capabilities:
Encode data using base64

Disassembly:
movzx r8d, r10b
lea rbp, [rbp + 0x13083a0f]
seta r8b
push r13
movabs r13, 0x7232b42fd924ec2c
push r10
mov r8w, word [rsp + 0x50]
movabs r9, 0xbd1c2918af20073e
add word [rsp + 0x60], r13w
add qword [rsp + 0x40], 0xffffffffbfeeaa68
xchg qword [rsp + 0x70], rbp

Function at 0x14010d9b6
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
and r15d, r12d
lea rax, [rax + r12 - 0x1348cdfa]
add qword [rsp + 8], 0xffffffffbfedc49d
shl dl, 0x63
ja fcn.1400e5d16
not dx
jb 0x14019f3ef

Function at 0x14010fd42
Capabilities:
Encode data using base64

Disassembly:
test r8b, r8b
mov qword [rsp + 0x20], r8
xchg qword [rsp + 0x40], rsi
mov r8, qword [rsp + 0x30]
call fcn.140152b08
shl r8w, 0x8a
js 0x1400ebba3

Function at 0x14010fd4d
Capabilities:
Encode data using base64

Disassembly:
test cl, 0x31
call fcn.1400c66ef
add r15, r15
jno 0x1400e1c07

Function at 0x14010fd72
Capabilities:
Encode data using base64

Disassembly:
xor dx, 0x2d3e
ja 0x140198574
invalid

Function at 0x140112968
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1401a5792
xchg byte [rbx + 0x63757af8], al
mov r8, qword [rbp + 0x38]
mov r15d, r14d
mov rsi, r8
test r14d, r14d
je 0x14001e0d6
dec r15d
cmp byte [rsi], r12b
je 0x14001e0d2
movzx ecx, byte [rsi]
lea rdx, [rbp - 0x18]
call fcn.14001fc60
test eax, eax
je 0x14001e0ca
inc rsi
cmp byte [rsi], r12b
je 0x14001e0fe
inc rsi
test r15d, r15d
jne 0x14001e0aa
mov r8, qword [rbp + 0x38]
mov rax, qword [rbp - 0x18]
sub esi, r8d
mov dword [rsp + 0x28], r14d
mov r9d, esi
mov edx, 1
mov qword [rsp + 0x20], rdi
mov ecx, dword [rax + 0xc]
call fcn.14001f954
movsxd rcx, eax
test eax, eax
jne 0x14001e10f
call fcn.1400169bc
mov dword [rax], 0x2a
mov word [rdi], r12w
jmp 0x14001e163
mov rbx, rcx
jmp 0x14001e163
cmp byte [rbp - 8], r12b
je 0x14001e174
mov rcx, qword [rbp - 0x20]
and dword [rcx + 0x3a8], 0xfffffffd
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov r9, rbx
jb 0x14001e090
add qword [rsp + 0x10], 0xffffffffbfe81291
call fcn.140146d9e
jo 0x1400d7b98
invalid
push r11
mov r11, qword [rsp + 0x28]
lea rsi, [rsi + r11*2 - 0x3c5bffff]
movabs r13, 0xd1fc737a5b2e800
or r13w, word [rsp + 0x2e]
jge 0x14011ee7f
and r11, r11
ja 0x140144ae5
test dl, 0x1e
call fcn.1400d369e
mov qword [rsp + 0x38], rsi
neg byte [rsp + r11 - 0x1e2dffd8]
seta byte [rsp + r11 - 0x1e2dffd8]
or dword [rsp + 0x28], 0x478cf613
push r8
shr word [rsp + r11*4 - 0x78b7ffd0], 0x71
movabs r8, 0xec8bf282bcbb192d
jne 0x1400d7b4f
call fcn.1400dfeae
Function at 0x140117261
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rcx
xchg qword [rsp + 0x38], rdi
mov rcx, qword [rsp + 0x30]
jle 0x1400c5d19
xor byte [rsp + 0x18], 9
sub byte [rsp + 0x18], r8b
mov word [rsp + 0x18], 0x5203
mov r8, qword [rsp + 0x10]

Function at 0x14011b62b
Capabilities:
Encode data using xor

Disassembly:
jne 0x1401a4205
mov word [rsp + r14 - 0x3921765b], r14w
xchg qword [rsp + rbx*4 - 0x642e6420], rdi
mov r14, qword [rsp + r14 - 0x39217683]
and qword [rsp + rbx*2 - 0x32173208], rbx
sub ebx, dword [rsp + rbx*2 - 0x321731f6]
sub qword [rsp + rbx - 0x190b27cb], 0x53abce09
jle 0x1401766af
jg 0x140127013

Function at 0x14011ee87
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x60], rdx
lea rdx, [rdx + rbp + 0x62eb9974]
jo 0x1401a3c71
cmp byte [rsp + rbp*4 - 0x2f01fed0], 0x8c
lea rbx, [r14*2 - 0x5d40417b]
push rdi
push r13
lea r14, [r14 + rbx*8 + 0x60b6d1b2]
js 0x140042c54

Function at 0x14011f1a0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov r15, r9
jo 0x1400f1a4e
xor r9b, r15b
mov r9, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
or r15b, r15b
call fcn.14004d92f
xchg qword [rsp + 0x20], rax
bswap r9
jno 0x14011ac31

Function at 0x140121f88
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x20], 0xf8b1
or rbp, rbp
lea rbp, [rbp*2 + 0x30e7110]
shr bpl, 0x1e
add qword [rsp + 8], 0xffffffffbff2363e
call fcn.1401aa1b6
pop rsi
sbb al, 0xc
mov edx, eax
fcomp dword [0x1799ebc90]
jb 0x140121fb3
invalid

Function at 0x1401237cb
Capabilities:
Encode data using base64

Disassembly:
mov rbp, r8
shl rbp, 0x9a
ja 0x1400f53b9
jno 0x140123834
movabs r14, 0xb763ba7156e3a2c9
sub dword [rbp + 0x4b], ebx
cmp eax, 0x2fdb9da9
cdq
xor al, byte [rbx - 0x2cca7e78]
invalid
clc
stosd dword [rdi], eax
jrcxz 0x140123865
jb 0x14012389b
or dword [rdi + 0x6c738ab8], eax
mov bh, cl
loope 0x140123853
invalid
add byte [rax], al
add byte [rdx - 0x75], cl
mov word [rcx], ds
and al, 0x10

Function at 0x14012fe4c
Capabilities:
Encode data using base64

Disassembly:
movabs r12, 0xaf9413b424397e21
setg r12b
call fcn.1400e239c
Function at 0x14012feb9
Capabilities:
Encode data using base64

Disassembly:
seta byte [rsp + rdi - 0x2594c510]
jns 0x14013f157
insd dword [rdi], dx
add esi, eax
hlt
mov r14, qword [rsp + rdi - 0x1ae]
je 0x140198574
mov rdi, qword [rsp + r14 - 0x8f72]
call fcn.1401caa29
mov rdi, qword [rsp + 0x38]
shr dword [rsp + 0x58], 0xd4
call fcn.14004b94e
xchg esi, eax
mov qword [rsp + 0x28], rcx
jne 0x1400491aa
neg edi
mov r15, qword [rsp + r15 - 0x6d354ff0]
jl fcn.1401bfff4
not byte [rsp + rdi*2 - 0x4b298a90]
neg cl
jb 0x1400c5da7
cwde
and dword [rdi + 0x51], ebp
add al, 0xbb
xchg ebp, eax
jl 0x140198616
jne 0x140198537
xchg byte [rax + 0x40], bh
sal qword [r10 + r9 + 5], 1
jge 0x1401985fa
in al, dx
jns 0x140198621
sbb byte [rcx + 7], 0xe8
hlt
cwde
leave
leave
sbb r12d, dword [rbx + r12 - 0x4a]
imul esp, dword [rsi + 0x49c70b04], 0xe32cf366
sub al, 0xe3
mov esp, 0x71a98ddb
invalid
sahf
jl 0x140198607
and byte [rsi + 0x2ce957ae], ch
mov al, 0x7e
mov r11d, edx
adc eax, 0xe0dd2e9
jle 0x140198671
mov ebx, edx
rol byte [rcx], 1
wait
mov ebp, 0x433b79eb
test dword [rcx + 0x27], ebx
jb 0x140198687
lea edi, [rbx - 0x6084da8c]
pop rdi
push rbx
jb 0x1401985d3
jl 0x1401986b9
push rax
movabs byte [0x74bb8cb25ece0fac], al
and eax, 0x723095ad
mov ebp, 0xd32465
shr byte [rbp - 0x6da6889d], 1
lea esp, [rcx + 0x59]
mov bl, 0xe7
invalid
push rbp
ret

Function at 0x14014d429
Capabilities:
Encode data using xor

Disassembly:
jl 0x14011fa44
and r9w, r9w
jae 0x1400fd533
jp 0x14014d42f
pop rcx
push rsi
movabs al, byte [0xfa946d6bc44987b8]
adc eax, 0xb9806609
invalid

Function at 0x14016a8c6
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x20], rdi
add r12b, r12b
shl r12w, 0xb0
bswap r12
add r12, 0x59a4192c
mov r12d, 0xee056101
push rcx
mov qword [rsp + 0x20], rdi
and r12d, r12d
movabs rcx, 0x8bb05dab25327e9b
bswap rcx
xor ecx, 0xfa379cbf
add qword [rsp + 8], 0x27453
mov cl, 0x11
shr r12w, 0xd3
not cl
shl r12w, cl
jne 0x140046e1d
shr r12d, cl
call fcn.1401b8136

Function at 0x14017ddec
Capabilities:
Encode data using base64

Disassembly:
movzx r15w, r15b
je fcn.1401334cf
jl 0x14012ffad
jle fcn.140127b79
or r15d, 0x68a4bd9f
shr r15d, 0x57
mov qword [rsp + 0x18], rdx

Function at 0x140181897
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
movabs r9, 0xb2b95bae83ab7792
push 0x728bc532
sete byte [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
cmp byte [rsp + 0x10], 0xae
mov rdi, qword [rsp + 0x30]
mov rdi, qword [rdi]
jae 0x14016f6fb
or qword [rsp], 0xffffffffbc3c9686
call fcn.14016e779
pop rsi
invalid
ret
lea rdi, [rdi + r10*4 - 0x5666648b]
neg r10
push rdi
movabs rdi, 0xba1d05a9f4205519
push rdi
cmp rdi, 0xffffffff9295779d
mov rdi, qword [rsp + 8]
mov qword [rsp + r10 + 0x1599996b], rdi
mov qword [rsp + r10 + 0x1599992b], r10
jno 0x1401c4f64
neg r10w
lea rbx, [r10 + rbx*2 + 0x258bda88]
add qword [rsp + 0x20], 0xa9b37
shl bl, 0xf2
push r9
jns 0x1400caaec

Function at 0x14019fcec
Capabilities:
Encode data using base64

Disassembly:
ja fcn.14012fe4c
call fcn.1401743ef
invalid
Function at 0x1401a2064
Capabilities:
Encode data using base64

Disassembly:
shr qword [rsp + r10*2 - 0x1b780], 0xc7
movabs rbp, 0x78322810ef0eee25
add ebp, esi
shl r10d, 0xfd
and r10d, dword [rsp + 0x14]
lea rdi, [rdi + 0x13083a0f]
cmp esi, r10d
mov sil, byte [rsp + r10*4 + 0x10]
ja 0x1400e8765
invalid
push rbp
call fcn.140109312
int3
shl r10, 0xb2
not bpl
jne 0x14012076f
xchg qword [rsp + rbp - 0x79be41c6], rdi
mov r14, qword [rsp + r10*8 + 0x30]
and rbp, qword [rsp + r10 + 0x10]
je 0x14005f569
cmovb esi, r10d
sub bp, 0x6e3d
or r10, rbp
xor r10b, sil
sub r10w, word [rsp + 0x11]
mov rbp, qword [rsp + 8]
lea rsi, [rsi + r10 - 0x1074c446]
ja 0x1401b5cb8
movabs r9, 0x97b30d22d39caa08
pushfq
sub r9d, 0x24098d98
call fcn.14015dada
syscall
call fcn.14018f969
sub rsi, 0xffffffff899c2911
mov r10, qword [rsp + 0x28]
movsx rsi, byte [rsp + 0x10]
shl word [rsp + rsi + 0x48], 0xef
movsx esi, si
and word [rsp + 0x10], si
call fcn.14004de04
test dword [rsp + 0x60], r9d
movzx r13, word [rsp + 0x60]
mov r13, qword [rsp + 8]
call fcn.14019161f
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi + r10*8 - 0x6de40]
shl byte [rsp + 0x10], 0x68
sub r14b, 0x93
jg 0x1400439a6
jg 0x140167a52

Function at 0x1401aae1e
Capabilities:
Encode data using xor

Disassembly:
shr r9, 0x92
movsx r9d, r9b
mov r9, qword [rsp]
call fcn.14018562b
not rbp
pushfq
add qword [rsp + 0x10], 0x80d3f
or bpl, 0x18
add byte [rax - 0x80], al
int 0x18
lea rax, [rax + 1]
cmp bpl, 0x83
jle 0x140055438
push r10
push rdx
movabs r10, 0x7d89d1abef903601
call fcn.140160516
push rcx
call fcn.14010bfbb
lea r9, [r9 + riz - 0x68555c55]
and r9b, r9b
jl 0x14004c2fb
in al, dx
add byte [rcx + 0x7b], dh
push rdi
neg byte [rax + rdx - 0x78848ec0]
mov bh, 0xf6
fdivr st(0), st(0)
shl cl, 0xeb
xlatb
out 0xe6, eax
in al, dx
push rax
sar dword [rbx], 1
ja 0x1401aadfa
push rsi
jl 0x1401aadee
xchg edx, eax
adc eax, 0x931462cc
xchg esp, eax
shr dword [rsi - 0x72279415], cl
jno 0x1401aae99
cmp byte [rax - 0x7c826789], bl
xor eax, 0x2a53bb64
invalid
jns 0x1401aaebf
js 0x1401aae0e
ror edi, 0xf0
movabs dword [0x5bd52d5ca358c69e], eax
mov ah, 0x38
push rdx
xchg edi, eax
invalid
xor byte [0x12bf2667c], r15b
jnp 0x1401aae75
push rbx
push 0xffffffffffffffc6
and edi, dword [r9 - 0x32]
orps xmm3, xmmword [rdx + 8]
cmp edi, dword [0xf7f6ebe3]
and dword [rcx - 0xac03139], 0xa965a993
adc dword [r8], ebp
retf 0xf956
sub dl, cl
push rsi
stc
fnstsw word [rdi]
movabs eax, dword [0x4572bbf6d3e6313]
std
xor dl, bl
invalid

Function at 0x1401bf3ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setle byte [rsp + 0x50]
test byte [rsp + 0x50], 0x10
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret 8
mov byte [rsp + 0x50], 2
jl 0x1400bdb72
jb 0x1400f1a4e
jno 0x1401479f5

Function at 0x1401c83f7
Capabilities:
Encode data using xor

Disassembly:
jo 0x14011ac82
mov r9, qword [rsp + 0x10]
cmp word [rsp + 0x20], 0x9a1
setae byte [rsp + 0x20]
and word [rsp + 0x20], 0xde9a
push qword [rsp + 0x28]