joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180279fd9
Capabilities:
Packed with generic packer

Disassembly:
cmpsd dword [rsi], dword [rdi]
and dword [rcx + rbp*8 + 0x714ec421], 0x26ed16d4
invalid
jl fcn.180534a0a
or r14d, 0x4e440e33
mov r10, qword [rsp + r14 - 0x4ec51df3]
mov dil, byte [rsp + rdi - 0x18e57bac]
sub dil, 0xeb
jne 0x1806874be
xor byte [rcx - 0x2e], 0x7e
xor ch, cl
fisub dword [rsi + rsi*8]
js 0x180279f9a
fsubr qword [rcx - 0xa]
invalid

Function at 0x1802a6c8c
Capabilities:
Link many functions at runtime
Packed with generic packer

Disassembly:
shr rdx, 0x93
jae 0x180720a57
neg r14w
push r15
je 0x1802a6cb4
movabs r15, 0x7fb07e3f2d2d477c
mov r14, qword [rsp + r14 - 0x2634ac1c]
mov qword [rsp + 0x10], 0xffffffffb2014ee4
mov r15, qword [rsp]
call fcn.1807f23db
add r9, 0x28692ed9
call fcn.1804d008c
call fcn.1801bbc2f
mov rdx, qword [rsp + rdx*8 - 0xecf0]
jbe 0x180591f40
sub byte [rsp + 0x48], 0x2e
or qword [rsp + 0x48], 0x58b038b3
jbe 0x1805ad055
xor r15d, dword [rsp + 0x48]
xor r15, r15
mov r15, qword [rsp + r15 + 0x60]
jle 0x180790d1c
jae 0x18007ce46
push qword [rsp]
popfq
lea rsp, [rsp + 8]
ret

Function at 0x1802cc58f
Capabilities:
Packed with generic packer

Disassembly:
lea rbp, [rbp + 0x2ebc3a75]
push rcx
push r11
movabs rcx, 0x1fd94f0a2cba61d1
je 0x1805304af
push r12
xchg qword [rsp + 0x30], rbp
mov rcx, qword [rsp + 0x10]
not word [rsp + 0x28]
xor dword [rsp + 0x28], 0xd3746c5
add qword [rsp + 0x28], 0x69406e98
sub word [rsp + 0x28], 0x5591
mov r12, qword [rsp + 0x28]
mov r11, r12
mov r11, qword [rsp + r11 - 0x6ce5c539]
or r12, r12
cmp dword [rsp + r12 - 0x6ce5c519], r12d
js 0x1807ef521
sub byte [rsp + r12 - 0x6ce5c519], r12b
jb 0x18000f4a3
mov r12, qword [rsp + r12 - 0x6ce5c541]
not qword [rsp + 0x28]
mov byte [rsp + 0x28], 0xd6
jo 0x1801c9199
shr dword [rsp + 0x28], 0xff
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x1802d9326
Capabilities:
Packed with generic packer

Disassembly:
js 0x180378386
push rsi
call fcn.18027325c
and sil, 0x70
cmovno r13, rsi
movabs rbx, 0x28e06ac13e0e65c8
push r8
not sil
jle 0x18004a9c0
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
test r13w, si
mov r8, rsi
jge 0x180464f3f
lea rbx, [rbx + 0x468635d1]
shl rsi, 0x93
shl r13b, 0x1d
jg 0x18072fe66

Function at 0x1802fa53d
Capabilities:
Packed with generic packer

Disassembly:
lea rcx, [rcx + 0xde5253e]
jb 0x180431bba
neg r8
shl r8w, 0xf8
add qword [rsp + 0x10], 0x7fc5c191
xchg qword [rsp + 0x60], rcx
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x30]
jne 0x180388337
Function at 0x18030996a
Capabilities:
Link many functions at runtime

Disassembly:
add r10w, r9w
not r13b
lea rsi, [rsi + 0x795f2b1a]
test r15d, r15d
call fcn.18023ea56
push r12
lea rsi, [rsi + r13 - 0x7ba41c65]
shr r13, 2
movzx r10w, r10b
mov r12, r10
push r15
ja 0x1805b113c
mov qword [rsp + r12 - 0x42a0001f], rsi
jne 0x1805b458d
movabs r15, 0x80267a13a6d1241
sete r12b
js 0x18067c1e4
add qword [rsp + 0x20], 0xfffffffffff3c278
cmp r12, 0x193e5d43
push r15
push r9
mov rsi, qword [rsp + r10 - 0x429fffd0]
mov rsi, qword [rsi + r10 - 0x42a00000]
movsx r10w, r10b
movzx r13, word [rsp + r10 - 0x429ffff8]
mov qword [rsp + 0x30], r10
mov r9, qword [rsp + r10 - 0x429ffff8]
jae 0x180087710
and al, 0x51
add bl, byte [rax - 0x70]
invalid
not byte [rsp + 0x30]
setae r12b
shl r10w, 0xff
je 0x1804011d3

Function at 0x18031b587
Capabilities:
Encode data using xor

Disassembly:
xor bx, 0x2215
or bl, 0x63
shr ebx, 0x4e
xor rbx, 0x180e1dae
je 0x18031b58f
je 0x1803e0481
mov rbx, qword [rsp + rbx*4 - 0x603b7a68]
mov qword [rsp + 0x10], 0xfffffffff7ea4294
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1809012d2

Function at 0x18035b955
Capabilities:
Packed with generic packer

Disassembly:
neg r13w
setns cl
and dword [rsp + r13*2 - 0x11f52], ecx
or cx, word [rsp + r13*8 - 0x47e07]
movzx r13d, word [rsp + r13 - 0x8f87]
mov r13, qword [rsp + r13 - 0xad]
and ecx, 0x738b127b
mov cl, ch
setbe byte [rsp + rcx*4 - 0x4e2c07c8]
sub word [rsp + rcx - 0x138b01c2], 0x173
jns 0x1804099e9
or cx, 0x4c53
shr rcx, 0xb2
mov rcx, qword [rsp + rcx*8 + 0x10]
jns 0x180442bcf
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
movabs rdx, 0x34533bfd7baf34b6
movabs r8, 0x364b4d876d3f27ff
call fcn.180410fd2
leave
mov ebp, 0x40a01
or dh, byte [rdi + rax]
add byte [rdx], cl
xor al, byte [rsi]
invalid
jns 0x1805cd88a
call fcn.1807453bb
Function at 0x180393b94
Capabilities:
Get geographical location

Disassembly:
adc eax, 0x152c4b2
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x20], r12d
je 0x180044931
lea rax, [r14 + 0x100]
neg r14
lea rdx, [rbp - 0x20]
sbb rcx, rcx
and rcx, rax
call fcn.1800444ec
mov ebx, eax
test eax, eax
je 0x180044931
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x180044931
mov ecx, dword [rbp - 0x1c]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x180044931
test r15, r15
je 0x1800448a8
mov dword [r15], ebx
mov ecx, dword [rbp - 0x1c]
lea rdx, [rsi + 0x2f0]
xor r9d, r9d
lea esi, [r9 + 0x55]
mov r8d, esi
call fcn.180037f20
test rdi, rdi
je 0x18004492a
mov ecx, dword [rbp - 0x1c]
lea rdx, [rdi + 0x120]
xor r9d, r9d
mov r8d, esi
call fcn.180037f20
mov ecx, dword [rbp - 0x1c]
mov esi, 0x40
mov r9d, esi
mov r8, rdi
mov edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180044931
mov ecx, dword [rbp - 0x18]
lea r8, [rdi + 0x80]
mov r9d, esi
mov edx, 0x1002
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180044931
lea rdx, [rdi + 0x100]
mov ecx, ebx
lea r9d, [rsi - 0x36]
lea r8d, [rsi - 0x30]
call fcn.180048d0c
mov eax, 1
jmp 0x180044933
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180022480
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
je 0x180044841
call fcn.1805b207b
push rdx
push rdi

Function at 0x1803befe0
Capabilities:
Encode data using xor

Disassembly:
sbb dl, bh
xchg ebx, eax
cmp byte [rbp - 0x3942242b], cl
xor edx, dword [rdi + 0x7f59ddff]
pop rsi
invalid
push rbp
mov qword [rsp + 8], 0xffffffffb166ef8e
lea rsp, [rsp + 8]
call fcn.180977273
setge r9b
jo 0x180500091
psllq mm0, mm1
jg 0x1803bef9c
invalid

Function at 0x1803c7c1b
Capabilities:
Packed with generic packer

Disassembly:
neg dl
and dx, word [rsp + rdx*2 - 0x80103e9]
add qword [rsp + rdx*8 - 0x20040fe0], 0x7fbcce00
call fcn.180085fe1
push rsi
je 0x1806b881f
test byte [rsp + rdx*2 - 0x80101f2], dh
lea rdi, [rdi + rdx*2 + 0x227f34c5]
ja 0x18034cbbf
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1809012d2
add qword [rsp + 8], 0x5cb9712a
mov qword [rsp + 8], 0xffffffffcf44240e
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1808c3692
push rbp
push r14
call fcn.1807ef440
jae 0x180550e95
cmp al, 0x42
adc dword [rdi - 0x20], ebp
cmp dword [rax - 0x6dea1d], esi
pop r8
mov byte [rcx + 0x48e6b05a], 0x6f
invalid
sbb dword [rdx - 0x50], 0x626f48e6
mov al, 0xba
sbb al, 0x28
xchg esp, eax
out dx, eax
pop rcx
sub al, 0x99
jp 0x180550f21
sahf
invalid
mov ebp, dword [rdi]
and byte [rax], bh
invalid
call fcn.1803a1896
sets byte [rsp + 8]
jle 0x180550e5c

Function at 0x1803e0921
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r15, qword [rsp + rcx + 0x28]
call fcn.1801ce2da
sub eax, dword [rsi + rcx*2 + 0x1b]
movabs al, byte [0xddee123f1b58ee01]
in al, 0xda
lodsd eax, dword [rsi]
invalid
Function at 0x180402abc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x38], rsi
jo 0x18079a4d1
sub r14, 0x23d756e8
xor r12d, 0x4a70269f
push rdx
add qword [rsp + 0x10], 0xffffffffffe4dd60
call fcn.1805323ca
pushfq
movabs r15, 0x37de709b036442fd
shr r15d, 0x66
or r15d, r15d
push rdi
movabs rdi, 0x31f80b7670f43306
mov rbp, qword [rsp + r15 - 0xd90e3]
shl dil, 0x1a
lea r15, [rdi + rdi*8 + 0xb602d3b]
js 0x180446f09

Function at 0x180411679
Capabilities:
Encode data using base64

Disassembly:
je fcn.1800789e5
call fcn.1807da1b1

Function at 0x180414917
Capabilities:
Authenticate hmac

Disassembly:
jb 0x180759719
jbe 0x18069330c
sub qword [rsp + 0x38], r9
mov r9, qword [rsp + 0x20]
xor qword [rsp + 0x38], 0x30480c53
je 0x1802a70fd
shl byte [rsp + 0x38], 0x9e
shr r10b, 0x45
jb fcn.18065fe30
cmp qword [rsp + 0x38], 0x282438f9
jb 0x180080a81
mov r10, qword [rsp + 0x58]
jo 0x180198641
shl dword [rsp + 0x38], 0xed
sub qword [rsp + 0x38], 0x65223fc6
and word [rsp + 0x38], 0x7315
mov dword [rsp + 0x38], 0x9913b79
or byte [rsp + 0x38], 0x88
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x180431bd4
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x1aabb2
call fcn.1806ecd32

Function at 0x180431be2
Capabilities:
Packed with generic packer

Disassembly:
xor r8, 0x4577235e
mov qword [rsp + r11*2 - 0x1231c894], rcx
xchg qword [rsp + r11 - 0x918e3fa], rbx
mov rcx, qword [rsp + 0x38]
call fcn.18037d93e

Function at 0x180431c03
Capabilities:
Packed with generic packer

Disassembly:
push r11
push rdi
push r12
pushfq
movabs rdx, 0x55ba4bee17290927
movabs r12, 0x7f7221fc1fd7410c
add qword [rsp + 0x20], 0x27362c
movabs r11, 0x6acb6f532bcd5adc
neg dl
add qword [rsp + 0x30], 0x7fc77d58
sub r12d, r12d
movabs rbp, 0x512d226f30ab3ede
push r9
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
movabs r9, 0x4ff521c03b675190
lea r9, [rdx + r11*8 + 0x30840f39]
neg r11d
sub rdx, 0x358422aa
lea r9, [rdx + r11*4 + 0x7b3075ca]
lea rbp, [rbp + 0xdd245c3]
mov qword [rsp + r12*2 + 0x28], r9
cmp byte [rsp + r12*2 + 0x28], 0xe2
jbe 0x180448f19
int3

Function at 0x180440e32
Capabilities:
Encode data using xor

Disassembly:
shl r12, 0xd
not r12b
call 0x1803d1af1
pop rdx
adc al, byte [rcx]
or al, byte [rax + rax]
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x18035d552
lodsb al, byte [rsi]
xlatb
pop rbp
invalid
jge 0x18035d546

Function at 0x180448eed
Capabilities:
Packed with generic packer

Disassembly:
lea rdi, [rdi + rcx - 0x5629af82]
mov qword [rsp + 0x48], r14
cmp r10d, 0x59a33fc4
seta r10b
Function at 0x180471bca
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + r13*8]
not r13b
mov qword [rsp + r13*2 - 0x1ee], r13
setl byte [rsp + r13 - 0xef]
sub r13, r13
add word [rsp + r13*2 + 0x18], 0x6f80
add qword [rsp + r13 + 8], 0x7fa393e9
lea rdx, [rdx + r13*8 + 0x46a43ec1]
and qword [rsp + r13*2 + 0x18], r13
call fcn.18057096b
lea rsp, [rsp + 8]
call fcn.1808667d7
xor dword [rax + 0x49], edi
xchg esi, esi
mov ecx, 0xe8ea1fec
jb fcn.180471bca
xchg edx, eax
mov bh, 0x1d
nop
lodsb al, byte es:[rsi]
in al, 0x5e
adc al, 0xe0
and al, 0x68
xchg ebx, eax
xor eax, 0x447a3702
and al, cl
pcmpgtb mm7, qword [rdx]
xchg ebx, eax
sub eax, 0xf22763cf
clc
jmp 0x1da23201b

Function at 0x18048250f
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], 0xffffffffb2432fba
lea rsp, [rsp + 0x10]
call fcn.180977273

Function at 0x180482522
Capabilities:
Packed with generic packer

Disassembly:
neg rcx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jb 0x1807ef4c4
neg cx
lea rcx, [rcx + rcx*8 + 0x28121e4]
call fcn.180429481

Function at 0x1804e45cc
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x20], rbx
and dword [rsp + 0x18], 0x36901ff6
mov byte [rsp + 0x18], 0xec
js 0x180566e93
neg byte [rsp + 0x18]
mov qword [rsp + 0x18], rbx
push rbx
mov rbx, qword [rsp + 0x10]
sub dword [rsp + rbx - 0x6d517dac], ebx
sub bx, 0x5d56
js 0x1806ad563
add qword [rsp + 8], 0x1582b4
mov qword [rsp], 0x4b911cb4
call fcn.1805ad8da
js 0x18036edf4
movzx rsi, r14b
jbe 0x18053979d
mov r14, qword [rsp + 0x40]
not rsi
call fcn.180333c7c
ret 0xa53c

Function at 0x1804ed8e3
Capabilities:
Encode data using xor

Disassembly:
invalid
xor r15, r15
jae 0x18026ff48
popfq
adc dword [rdi + 0x21b45000], eax
test eax, 0x4d31211c
in al, dx
xor dword [rbp - 0x14], ecx
int 0xb0
xchg ecx, eax
fsubr dword [rdx]
push rcx
scasd eax, dword [rdi]
or bl, cl
adc ebx, dword [rsi - 0x4ab9e687]
xchg edx, eax
loopne 0x1804ed8f6
stosd dword [rdi], eax
sub al, 0x2f
jrcxz 0x1804ed8de
pop rsi
sub byte [rdi + 0x66398fa8], al
invalid

Function at 0x1804f572d
Capabilities:
Packed with generic packer

Disassembly:
push r14
jo 0x180077d3d
or dword [rsp + 0x18], 0x68217724
jae 0x18070c89d
mov qword [rsp + 0x40], rsi
mov r14, qword [rsp + 0x18]
call fcn.180750e23
add al, byte [rsi]
push rsp
sbb al, 0x8c
and byte [0x101b9650e], dh
pushfq
invalid
invalid
and al, 8
invalid

Function at 0x1805002d4
Capabilities:
Authenticate hmac

Disassembly:
je 0x18000aab6
jo 0x1806c5000
mov r9, qword [rsp + 0x20]
or byte [rsp + 0x68], 0xf6
or word [rsp + 0x68], 0x59dc
sub qword [rsp + 0x70], 0x79d40320
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x90]
ret 8
Function at 0x180507acf
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + r13 - 0x6817b8], r13
mov r13b, 0xa0
neg dword [rsp + r13*4 - 0x1a06238]
push rcx
xor ebp, dword [rsp + r13*2 - 0xd030ef]
xor ebp, dword [rsp + rbp*2 - 0xd030ef]
iretd
lea rcx, [rcx + r13 + 0x3ec80245]
add bpl, byte [rsp + r11*2 - 0x2f7b1bea]
jb 0x180619076
shl r13w, 0xd
xchg qword [rsp + r13 - 0x67ff78], rcx
mov r11, qword [rsp + r13*8 - 0x33fffe0]
call fcn.18042886a
cli
jb 0x180507b17
or rax, 0x72fafff2
stc
jg 0x180507ae4
jp 0x180507ae8
add al, 0x52
call fcn.180231cd1

Function at 0x18055e659
Capabilities:
Packed with generic packer

Disassembly:
lea rsp, [rsp + 0x78]
ret
jo 0x18054a414
and r9b, 0xc9
shr r9d, 0x9e
mov r9, qword [rsp + r9 + 0x4f]
jae 0x18027d68c
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x70]
ret
Function at 0x1805ae142
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jge 0x1806e1e27
cmp r9d, 0x39d74206
mov qword [rsp + 0x20], rdx
lea rcx, [rcx + r8 - 0x320db17c]
not rdx
push rcx
push r8
xchg qword [rsp + 0x60], rcx
mov r9, qword [rsp + r8 - 0x7258fc25]
call fcn.180425fb2
out 0x60, eax
in al, 0x7e
sti
stosd dword [rdi], eax
test byte [rcx - 0x6e], 0xa0
movabs eax, dword [0x4f3c09eca6fc1b09]
rol byte [rsi - 0x2fc8df0b], 0x12
test bl, 0xec
lahf
mov byte [rcx], cl
enter 0x27eb, 0xffffffffffffffa5
cmc
clc
mov bh, 0x7b
not byte [r9 + 0x9e8e132]
sub dword [rsi - 0x1309aa2c], 0xf5814aa3
xchg ecx, eax
mov edx, 0xfbf67add
rcl dh, 1
mov ebp, 0xd006f109
invalid
jg fcn.180714bcf
sub r14w, r14w
push r15
lea rdx, [rdx + r14 + 1]
movsx r14d, r14w
mov r15, r14
push rbx
movabs rbx, 0x5cf7a6a3cdf3c5e
movzx r14w, r15b
seta r15b
mov qword [rsp + r14 + 0x40], rdx
jo 0x1805ae41b
bswap ebx

Function at 0x1805b113c
Capabilities:
Link many functions at runtime

Disassembly:
add r10w, r9w
not r13b
lea rsi, [rsi + 0x795f2b1a]
test r15d, r15d
call fcn.18023ea56
push r12
lea rsi, [rsi + r13 - 0x7ba41c65]
shr r13, 2
movzx r10w, r10b
mov r12, r10
push r15
ja 0x1805b113c
mov qword [rsp + r12 - 0x42a0001f], rsi
jne 0x1805b458d
movabs r15, 0x80267a13a6d1241
sete r12b
js 0x18067c1e4
add qword [rsp + 0x20], 0xfffffffffff3c278
cmp r12, 0x193e5d43
push r15
push r9
mov rsi, qword [rsp + r10 - 0x429fffd0]
mov rsi, qword [rsi + r10 - 0x42a00000]
movsx r10w, r10b
movzx r13, word [rsp + r10 - 0x429ffff8]
mov qword [rsp + 0x30], r10
mov r9, qword [rsp + r10 - 0x429ffff8]
jae 0x180087710
and al, 0x51
add bl, byte [rax - 0x70]
invalid
not byte [rsp + 0x30]
setae r12b
shl r10w, 0xff
je 0x1804011d3

Function at 0x1805c3b89
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1805d4ab4
mov dword [rsp + 0x60], 0x31e1516
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x80]
ret 8

Function at 0x1805c86b5
Capabilities:
Packed with generic packer

Disassembly:
sub ax, 0x7555
je 0x180373a3d
jae 0x1801e987c
mov eax, 0xbed3ae7
mov rax, qword [rsp + rax*4 - 0x2fb4eb7c]
mov rax, qword [rax]
call fcn.18000ddf2
sub al, 0xfb
xor byte [rdi], 0xf0
invalid

Function at 0x18060637b
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 8], 0xffffffffb25ed182
lea rsp, [rsp + 8]
call fcn.180977273
call fcn.180836e4d

Function at 0x180624f69
Capabilities:
Encode data using xor

Disassembly:
jo 0x1807f23ef
xchg edi, eax
xchg dword [rcx - 0x80], esi
mov ecx, 0x9a1758ed
sti
insb byte [rdi], dx
imul edi, dword [rbp + 0x5c99984], 0x298855f8
nop
leave
xchg esp, eax
xor byte [rbx - 0x36a5f9f9], al
invalid

Function at 0x1806531f7
Capabilities:
Encode data using xor

Disassembly:
je 0x18047c8d3
cmovns bp, word [rsp + r12 + 0x22]
and r12b, r12b
call fcn.1802c75d6
Function at 0x18066da64
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add qword [rsp + 0x28], 0x7fc889cd
movzx di, byte [rsp + 8]
lea rbx, [rbx + 0x5861087]
shr byte [rsp + 8], 0x2c
sub byte [rsp + 8], dil
movabs rdx, 0x3eeb09c7433d5e6d
jae fcn.180654747
call fcn.180187f29
not byte [rsp + 0x28]
add qword [rsp + 0x40], 0x7fd3d0a3
mov word [rsp + 0x28], 0x3717
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x48]
ret
add r8b, byte [rsp + r14 + 3]
seto bpl
ja 0x180437ee4
xchg qword [rsp + r14*2], rsi
mov r8, qword [rsp + rbp*8 - 0x2b7b27c8]
test word [rsp + rbp - 0x56f64da], bp
call fcn.18046a95c

Function at 0x18067f9dc
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x7f7daf42
mov qword [rsp + 0x10], 0x37f9519c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.18090eace

Function at 0x18067f9fd
Capabilities:
Packed with generic packer

Disassembly:
movabs rsi, 0x4dc2e850cec06c7
shr rsi, 0x6b
jns 0x180261aa2
push rdi
call fcn.18060da8d

Function at 0x1806896f5
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
lea rax, [rax + 0x5d9e7bcc]
not bx
cmp word [rsp + 0x10], bx
not ebx
jl fcn.1806932fc
bswap ebx
xor r8b, 0x4a
ja 0x180233853
not r8d
xchg qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x28]
movsx ebx, bl
setb byte [rsp + rbx*4 - 0x1c]
cmovae bx, word [rsp + rbx*2 - 3]
not bx
mov word [rsp + rbx - 0x60fb], bx
mov rbx, qword [rsp + rbx - 0x60f3]
not byte [rsp + 0x10]
not dword [rsp + 0x10]
mov word [rsp + 0x10], 0x405f
setb byte [rsp + 0x10]
shl word [rsp + 0x10], 0xb7
shl qword [rsp + 0x10], 0x63
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
jns fcn.18029d8e5
ja 0x1801b3466

Function at 0x180693a6b
Capabilities:
Packed with generic packer

Disassembly:
shr r8, 0x61
mov qword [rsp + r8*4 + 0x18], r13
push rbx
lea rbp, [rbp + r8 + 0xaa673a6]
push r9
or dword [rsp + 0x28], 0x4234621f
and r13w, r13w
push r14
jns 0x1807ef445
test r8b, bpl
mov rbp, qword [rsp + rbp + 0x12]
mov rbp, qword [rbp + r8 - 0x755127cf]
jle 0x180562cc0
movsxd r8, r8d
jno 0x1800866b0

Function at 0x18069f103
Capabilities:
Packed with generic packer

Disassembly:
push r9
shl r12w, 0x4f
mov r12b, 0x5a
jb fcn.18065357c
add r8w, 0xa35
push r10
xchg qword [rsp + r12*2 - 0x1424005c], rdx
mov r9, qword [rsp + r12 - 0xa12002a]
jbe 0x1807ef44e
or word [rsp + 8], 0x14c6
call fcn.1805b4fb4
add qword [rsp], 0xffffffffffee21d8
mov rdx, r12
push r9
mov r9, r12
push r8
movabs r13, 0x1a3a27d82f3a0554
push r11
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
mov qword [rsp + 0x18], r12
movabs r11, 0x5bc0558a4a765547
or dword [rsp + 0x18], 0x723b75a1
shl r9d, 0x26
mov r8, r11
push rdi
and r12d, r13d
push 0x33c308d0
lea rdx, [rdx + 0x372a320e]
jae 0x18007c0d5
jb 0x18069f186
lea ebx, [rsi]
push rbp
in eax, 0x85
movabs al, byte [0x9969e7d8037baf12]
mov esp, 0x1dd24ae6
jp 0x18069f1e4
add al, 0x9f
invalid
mov ebx, 0x5ab8bd6a
adc eax, 0xfd9699cc
stc
push rcx
test byte [rdx + 0x2f7cabdd], dh
xchg r11b, dil
invalid
in eax, 0x69
sal ecx, cl
std
push rcx
invalid

Function at 0x1806af6c7
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 8]
call int.1804f1470
Function at 0x1806b6c69
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
wait
invalid
not ecx
setne cl
add rcx, 0x65eb6fb0
call fcn.1806c501e
ficom dword [rsi + rbx*8 + 0x7e]
sahf
push rbp
lahf
pop rsp
imul byte [rdi + rsi*4 - 0x6c]
wait
or dword [rsi + 0x9d69251], esp
or dword [rdx - 0xc], ecx
mov esp, 0xe4e255f5
sub dh, dh
out dx, al
stosq qword [rdi], rax
mov dl, 9
xor eax, 0xf59f1366
push rbp
pop rdx
jno 0x18060d09c
not ebp
ror byte [rcx], cl
xchg esp, eax
cmp esp, eax
outsd dx, dword [rsi]
test byte [rcx + 6], 0x7e
mov ebx, 0xe987bcf5
neg byte [rsi + 0x987e245]
je 0x18060d044
in al, 0xca
or dword [rbx + 0x30], eax
invalid
jb 0x18060d069
sete r8b
cmp r8b, r15b
mov qword [rsp + r8 - 0x3fc8], rax
lea r8, [r15 + r15*2 + 0x7d5301cb]
push r8
call fcn.1807c8c83

Function at 0x1806ce992
Capabilities:
Write file on windows

Disassembly:
or dword [rsp + 0x70], 0x3d4e1f96
call fcn.180003cb2
Function at 0x180701411
Capabilities:
Packed with generic packer

Disassembly:
jns 0x18019db73
sub r14d, ebp
mov r14, qword [rsp + 8]
or bp, word [rsp + rbp*2 - 0x57c5cd]
sets byte [rsp + rbp*4 - 0xaf8bb4]
shr rbp, 0xac
shr word [rsp + rbp + 0x28], 0x64
call fcn.1804e66bd
mov edi, 0x83096ea4
lahf
pop rsi
test eax, 0x14e33fd
xor eax, 0xedbe0731
mov dword es:[rdx], edi
cmp ch, byte [rbx - 0x452edee0]
sub bh, byte [rsi + 0xa]
sub dword [rcx + 0x6fdcf903], edi
sbb eax, 0xc30e0e3e
invalid
mov rdx, qword [rsp + 0x30]
sub byte [rsp + rdx*2 - 0x229fd2], dl
push r14
mov r10, rdx
cmp dx, word [rsp + r10 - 0x114fc5]
push rbp
mov rdx, qword [rsp + r10*2 - 0x229fda]
mov rdx, qword [rdx + r10 - 0x115001]
setge byte [rsp + r10 - 0x114fc1]
movabs rbp, 0x2be203d842f64308
mov qword [rsp + r10*8 - 0x8a7fe0], r10
not r10b
jb 0x180600f04
lea rdx, [rdx + 0x55d55276]
jle 0x1801f25ad
mov r14, r10
and qword [rsp + r10*2 - 0x22a1bc], 0x15a51882
add bp, word [rsp + r14 - 0x1150d4]
cmp dword [rsp + 0x28], 0x53bd7cbe
xchg qword [rsp + r10 - 0x1150b6], rdx
mov r10, qword [rsp + r14 - 0x1150de]
not dword [rsp + 0x28]
jae 0x180216e19
neg qword [rsp + r14*8 - 0x8a87b0]
shr rbp, 0x68
mov qword [rsp + r14 - 0x1150be], 0x44604851
neg bpl
jbe 0x180699c9f

Function at 0x180708d70
Capabilities:
Packed with generic packer

Disassembly:
call fcn.180735e98
fsubp st(5)
jmp fcn.180500077
lea r11, [r11 + r11 - 0x13a99f5d]
mov r10, qword [rsp + 0x28]
call fcn.1803ccbc1
xor dx, 0x1131
js 0x180650dff
mov dl, 0x18
mov rdx, qword [rsp + 8]
call fcn.180088571
and dl, 0xba
seta dl
ret 8
lea r9, [rbx + riz + 0x14a0149a]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rbx
jb fcn.180336c20
jge 0x18004aab9
xchg qword [rsp + 0x58], rdx
mov r15, qword [rsp + 0x50]
add r13b, sil
call fcn.18008ac61
or ecx, 0x594d2c23
lea rcx, [rcx*4 + 0x153d0e07]
cmp cl, ch
mov rcx, qword [rsp + 0x10]
call fcn.1807295a2
or r8w, 0x5c4a
and dword [rsp + 0x20], r8d
mov byte [rsp + 0x20], bl
xchg qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x38]
jne 0x1807867f1
test byte [rax], bl
invalid
cmp word [rsp + 0x20], bx
je 0x18069ceb1
jo 0x1803c9038
or r11w, 0x426e
jno 0x1801e5df7
cld
jge 0x180786813
add al, 0x7d
invalid

Function at 0x180762dcb
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
pushfq
add qword [rsp + 8], 0xffffffffffc41c6c
nop
movabs rsi, 0x24581b193cf610b2
sub rsi, rsi
mov esi, 0x3cf610b2
sbb dword [rbx], ebx
pop rax
and al, 0x48
sub esi, esi
xor rsi, 0x55ea3f4a
jl 0x18067d91d
shl sil, 0xa6
mov rsi, qword [rsp + rsi - 0x55ea3f78]
mov rsi, qword [rsi]
js 0x18050e8a5
lodsd eax, dword [rsi]
mov esp, 0x8504cd3
xchg esi, eax
loop 0x180762ddc
sbb eax, 0xf7e4ab41
mov ebx, 0x6b639653
mov dl, 0x19
adc dword [rbx], ecx
in eax, 0x4b
pop rcx
popfq
movabs al, byte [0xe10dddd8c10343f6]
jle 0x180762e1a
xchg esi, eax
invalid
invalid

Function at 0x1807a0389
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x40], rdx
jge 0x18007d3d4
invalid