joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b4d30
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x48], r8d
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x4c], r9d
lea rcx, [rbp - 0x88]
call fcn.140006940
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x48]
mov r9d, dword [rbp - 0x4c]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140006990
mov dword [rbp - 0x40], esi
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
mov rcx, rsp
call fcn.1401b4ddb
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1405c2966
Capabilities:
Encode data using xor

Disassembly:
jge 0x140b16ffe
invalid
pop rdx
cld
movabs dword [0xb7ad7f347f2f4005], eax
mov ah, 0x90
loop 0x140b16f6c
outsd dx, dword [rsi]
adc dword [rdx - 0x76], esp
mov ch, 0x6d
fdivr dword [rdx - 0x50b70356]
invalid
add di, r9w
jno 0x140b6f242
push 0x79
js 0x140b17056
and dh, al
push rdi
jp 0x140b16fd8
push rcx
invalid
push rsp
in al, 0xf3
stc
or eax, 0x5e531a30
js 0x140b17070
mov edx, 0x1d98b42f
invalid
cmp edi, dword [rbp - 0x1bac579a]
mov ebp, 0x24032017
rcr dword [rcx], cl
cvtpi2ps xmm1, qword [rdx - 0x2e]
add byte [rsi - 0x3d9c0ddd], 0x33
or ebx, dword [rbp - 0x1bab7242]
add edx, dword [rdx + 0x23ea300d]
xor eax, 0xc7da0f78
xor ecx, dword [rbx]
popfq
mov esi, 0x3e4548d
xchg edx, eax
or eax, 0x3523ea30
js 0x140b170a7
fcmovb st(0), st(7)
fistp word [rax - 0xf69d1e3]
je 0x140b17088
in eax, dx
and dword [rsi + 0x565137c0], edx
push rcx
push rsi
mov ah, 0x75
xchg edi, eax
cmp esi, edx
stosd dword [rdi], eax
int1
sar al, cl
and al, ah
in eax, 0xb1
movabs byte [0x5196f17ef868b321], al
add rax, 0xffffffffc39a78d8
fistp word [0x1bbcacb19]
invalid
test r8, 0x172444ad
not r9b

Function at 0x1405c9d7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
ja 0x140bbf960
cmovle dx, word [rsp + 0x15]
jge 0x140af63e6
lea rdx, [rbp + 0x1c256d3e]
not edx
not edx
mov rbp, qword [rsp + 0x18]
lea rdx, [rdx + rdx*8 + 0x1e93eee]
neg word [rsp + 0x10]
or byte [rsp + 0x10], dl
setne dl
mov rdx, qword [rsp + 0x20]
not dword [rsp + 0x10]
call fcn.140a176e1
push r12
movabs r12, 0x3acf36996d881688
pushfq
sub r12, 0x6faf37fa
add r12b, 0x11
push rdx
push rsi
movabs rdx, 0x50404cae54f75c8e
mov rsi, r12
push 0x50907495
xor word [rsp], si
test qword [rsp], r12
jb 0x140af63e6
cmp r12w, 0xe2
push r15
call fcn.140b62a0b
lea ebp, [rax + 0x3a]
xor eax, 0x489c17c3
add dword [rsp + 8], 0x4f6c6896
xor byte [rsp + 8], 0x12
sub dword [rsp + 8], 0x5ecc4779
sub qword [rsp + 8], 0x2874207d
call fcn.140b222ec
popfq
rdtsc
nop
push r13
movabs r13, 0x3506372c0de27ffa
pushfq
test r13, r13
not r13w
lea r13, [r13 + r13*4 + 0x55d718a1]
push rdx
call fcn.1409f86f4
call fcn.140a04017
popfq
rdtsc
nop
call fcn.140a3fec4
call fcn.140b62959
popfq
cpuid
nop
push rsi
push rbp
pushfq
movabs rsi, 0x32155b7b31577c0a
movabs rbp, 0x63ce5bc8528d0a93
push rdx
add bp, 0x1a3f
mov rdx, rbp
not rdx
sub bp, si
xor edx, 0x66952f1e
neg dx
cmp dl, 0x39
mov bpl, 0x34
push rsi
jg 0x140a133d7
or edx, 0x76b9645b
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffbf73860d
setge byte [rsp]

Function at 0x1409f1e01
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub dl, 0xd9
add qword [rsp], 0xffffffffbf485eb3
and word [rsp + 8], 0x5547
cmp dx, word [rsp + 8]
mov byte [rsp + 8], 0xef
cmovns edx, dword [rsp + 0xb]
sub rdx, rdx
call fcn.1405c9d7b
Function at 0x140a3a1ad
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
add sil, 0x3a
bswap rsi
jno 0x140a8ace6
mov dword [rsp + 0x68], 0x53044234
xor rbp, 0x19ca000e
or byte [rsp + 0x88], 0xf6
mov r14, qword [rsp + 0x28]
xor rdx, 0xc2b6d59
test bp, 0x6de7
jno 0x140a50538
call fcn.140a4f73d
pop rbp
jbe 0x140a3a251
invalid
adc eax, dword [rax]
mov r14, qword [rsp + 0x70]
not word [rsp + 0x88]
or rsi, rsi
or esi, esi
cmp byte [rsp + 0x88], 0xcc
mov qword [rsp + 0x88], 0x55941e3f
jb 0x140b3f65f
setae sil
jae 0x140a3592b
cmp eax, 0x4e65425a
fst dword ss:[rdx]
jo 0x140a3a241
pop rsp
add dword [rbx - 0x7210e937], esi
cdq
mov eax, 0xdcb594e6
invalid
add qword [rsp + 0x70], 0xffffffffbf4a2817
call 0x140a3a243
or word [rsp + 0x68], 0x4ec4
add cx, word [rsp + 0x6b]
jb 0x140a28eeb
call fcn.140a5b1a8
call fcn.140b6f302
neg r14w
or qword [rsp + 0x58], r8
cmp r8d, r14d
not r8w
setb byte [rsp + 0x58]
mov r14d, esi
add qword [rsp + 0x10], 0x59b9c7
sub byte [rsp + 0x58], r8b
xor dword [rsp + 0x58], 0x641a4c7b
mov r14, qword [rsp + 0x58]
jb 0x140b4bf71
cmp r8d, 0x3f124c59
call fcn.140a322b9
push rbx
adc dword [rbx + rdx + 0x5b2b9450], esi
xchg ebp, eax
invalid
cmove r14, rsi
or byte [rsp + 0x68], 0x68
neg r14
js 0x140a3c52b
mov sil, r14b
xor esi, r14d
xor r14d, r14d
mov sil, byte [rsp + 0x68]
neg r14w
add r14, 0x5a4e32e0
cmp qword [rsp + 0x68], 0x116d2909
call fcn.140af9dc8

Function at 0x140a3a1ee
Capabilities:
Check for software breakpoints

Disassembly:
movabs r14, 0x290f16f85fc207c2
mov r15, qword [rsp + 0x30]
and r14b, 0xf0
xor bpl, 0xff
xor ebp, r14d
xor bpl, 0xcc
and r14b, bpl
sub r14, rbx
mov ebx, 0x77c645b5
sub ebx, ebp
or ebp, 0x6b6a41b3
lea rbp, [r14 + r14*8 + 0x5c505a37]
bswap ebx
lea rbx, [rbx + r14*2 + 0x7d88316a]
add r14w, 0x1f3b
mov r14b, 0x4c
xor bx, r14w
call fcn.140b71260
Function at 0x140a3a243
Capabilities:
Check for software breakpoints

Disassembly:
add sil, 0x3a
bswap rsi
jno 0x140a8ace6
mov dword [rsp + 0x68], 0x53044234
xor rbp, 0x19ca000e
or byte [rsp + 0x88], 0xf6
mov r14, qword [rsp + 0x28]
xor rdx, 0xc2b6d59
test bp, 0x6de7
jno 0x140a50538
call fcn.140a4f73d
pop rbp
jbe 0x140a3a251
invalid
adc eax, dword [rax]
mov r14, qword [rsp + 0x70]
not word [rsp + 0x88]
or rsi, rsi
or esi, esi
cmp byte [rsp + 0x88], 0xcc
mov qword [rsp + 0x88], 0x55941e3f
jb 0x140b3f65f
setae sil
jae 0x140a3592b
cmp eax, 0x4e65425a
fst dword ss:[rdx]
jo 0x140a3a241
pop rsp
add dword [rbx - 0x7210e937], esi
cdq
mov eax, 0xdcb594e6
invalid
add qword [rsp + 0x70], 0xffffffffbf4a2817
call 0x140a3a243
or word [rsp + 0x68], 0x4ec4
add cx, word [rsp + 0x6b]
jb 0x140a28eeb
call fcn.140a5b1a8
call fcn.140b6f302
neg r14w
or qword [rsp + 0x58], r8
cmp r8d, r14d
not r8w
setb byte [rsp + 0x58]
mov r14d, esi
add qword [rsp + 0x10], 0x59b9c7
sub byte [rsp + 0x58], r8b
xor dword [rsp + 0x58], 0x641a4c7b
mov r14, qword [rsp + 0x58]
jb 0x140b4bf71
cmp r8d, 0x3f124c59
call fcn.140a322b9
push rbx
adc dword [rbx + rdx + 0x5b2b9450], esi
xchg ebp, eax
invalid
cmove r14, rsi
or byte [rsp + 0x68], 0x68
neg r14
js 0x140a3c52b
mov sil, r14b
xor esi, r14d
xor r14d, r14d
mov sil, byte [rsp + 0x68]
neg r14w
add r14, 0x5a4e32e0
cmp qword [rsp + 0x68], 0x116d2909
call fcn.140af9dc8

Function at 0x140a404c5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not r12w
cmovs r13d, r11d
cmovns r11w, word [rsp + 0x2a]
and r13, qword [rsp + 0x40]
neg byte [rsp + 0x40]
add r11d, dword [rsp + 0x44]
or r13w, word [rsp + 0x1c]
add qword [rsp], 0xffffffffbf5a6ed4
neg r13w
or qword [rsp + 0x40], 0x79a1009e
jbe fcn.140a8e5c2
not r13w
lea r13, [r11 + r12*2 + 0x5bc64921]
mov word [rsp + 0x18], 0x1bf4
mov byte [rsp + 0x40], 0xb2
setns r11b
sub r13, r11
setb r12b
call fcn.140a52803

Function at 0x140a474b6
Capabilities:
Encode data using base64

Disassembly:
or dword [rsp + 0x28], r15d
lea r9, [r15 + r9*2 + 0x6e687350]
or r9w, 0x44f3
add r9, r15
lea r9, [r15 + r9*2 + 0x57e740cd]
add r9b, r9b
lea r9, [r9 + r15*4 + 0x72142b31]
neg r15
xor r9b, r15b
not r9w
not qword [rsp + 0x28]
Function at 0x140a7f30a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add r8, qword [rsp + 8]
call fcn.140b8295d
mov sil, r10b
out dx, eax
cmp byte [rdx], dh
lodsb al, byte [rsi]
fst qword [rcx - 0x1947a9f9]
push rsi
mov edx, 0x524ef9f1
mov ecx, 0x98757adb
invalid
not word [rsp + 0x10]
push r11
not r8
push r15
mov r11, r14
add byte [rsp + 0x20], 0xce
mov r14, qword [rsp + 0x38]
mov r15, r8
neg r11d
jae 0x140b8a69d
mov r8b, 0x64
movsx r15w, byte [rsp + 0x20]
call fcn.140baa772
cmp r15, 0x77cd5525
push r14
mov r9, qword [rsp + 0x20]
movabs r14, 0x493c6a7942056008
jge 0x140a3df41
or dword [rax], eax
invalid
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret

Function at 0x140a8acf0
Capabilities:
Encode data using base64

Disassembly:
jns 0x140af3081
or byte [rcx - 0x376a75ef], al
addps xmm3, xmmword [rbx - 0x18da0420]
jg 0x140a1853e
invalid
invalid
jns 0x140b2bb69
push rsp
insb byte [rdi], dx
jns 0x140a8ad5b
pop rbp
invalid
push rdx
scasb al, byte [rdi]
jno 0x140a8adaf
imul esi, dword [rax], 0x91cb3775
invalid
test dword fs:[rsi + rax*8 + 0x34], 0x64d579b
invalid
je 0x140a3d0c3
je 0x140a184cc
mov r11w, 0x5cd0
add dword [rsp + 0x20], 0x6e877c1d
xor r11b, 0xee
or byte [rsp + 0x20], r11b
mov rdx, qword [rsp + 0x40]
and r11w, r11w
bswap r15d
not r15w
seta byte [rsp + 0x20]
lea r15, [r15 + 0x742f038f]
call fcn.140b35323

Function at 0x140aa9fd2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg cx
not cx
not r9b
mov r8, qword [rsp + 8]
push r8
jle 0x140a7f33e

Function at 0x140af5208
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
mov r8, qword [rsp + 0x20]
or dx, 0x568e
je 0x140a81f3c
setns dl
mov r13w, dx
movabs r14, 0x3bd505e56e3a579e
sub edx, r14d
bswap r13d
cmovbe r13, qword [rsp + 0x68]
bswap rbp
mov r8, rdx
bswap ebx
jo 0x140a3a178
xor qword [rsp + 0x68], r9
neg word [rsp + 0x68]
jb 0x140a7e4c9

Function at 0x140af8990
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x40]
call fcn.140c2c4e9
jbe 0x140af89ff
je 0x140af89e8
invalid
xchg edi, eax
lahf
mov ah, 0x8f
push rbp
invalid
in al, dx
pop rsp
iretd
jbe 0x140af89ce
adc byte [rbx], ah
movabs dword [0xede4aa50b487811b], eax
pop rsp
xchg ebx, eax
xor byte [rsi + 0x2c619dcc], cl
out 9, eax
mov ch, 0x86
mov edx, 0xd887d043
out 0x98, al
out 0x84, eax
push rdi
xor al, bh
add eax, 0x287be072
call 0x1066fe917
stc
xor byte [rdi], dl
and ecx, dword [rax - 0xe]
leave
jle 0x140af8a0e
invalid
Function at 0x140b2bbac
Capabilities:
Encode data using base64

Disassembly:
setno byte [rsp + 0x28]
neg word [rsp + 0x28]
sub dword [rsp + 0x28], 0x4b614e8
not qword [rsp + 0x28]
sub byte [rsp + 0x28], 0x1d
xor dword [rsp + 0x28], 0x6b1a0286
jg 0x140ae9996
add word [rsp + 0x50], 0x362a
not bp
mov rsi, rbp
cmp esi, dword [rsp + 0x51]
mov rsi, qword [rsp + 0x28]
mov r10, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 8]
mov rcx, qword [rsp]
lea rsp, [rsp + 0x38]
ret 8
test qword [rsp + 0x28], 0x910120b
mov byte [rsp + 0x28], 0xa0
not qword [rsp + 0x28]
call fcn.1405cb90b
invalid
push rdi
push rbx
mov rdi, qword [rsp + 0x48]
jbe 0x140a64c20
and r14w, word [rsp + 0x48]
cmovle ebp, r14d
push rcx
mov r13, qword [rsp + 0x40]
cmovae r14w, word [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
test bl, bpl
jns 0x140ae999f
sub bl, byte [rsp + 0x51]
mov r10, rdi
bswap ebx
lea rbx, [r10 + rbx + 0x6f544621]
movabs rcx, 0x3074193506716774
setl bl
neg ebp
or r14, r10
jge 0x140a7fbd2

Function at 0x140b7c637
Capabilities:
Encode data using xor

Disassembly:
movabs rdx, 0x372e05d80b1a12c1
push r15
push r12
pushfq

Function at 0x140b7ed16
Capabilities:
Encode data using xor

Disassembly:
xor r12w, word [rsp + 0x2c]
mov r8, r12
mov eax, esp
push rdi
mov rdi, qword [rsp + 0x30]
add qword [rsp + 0x28], 0xffffffffffa01710
xor di, word [rsp + 0x30]
neg r8d
xor byte [rsp + 0x30], dil
sets r12b
add di, r15w
cmp word [rsp + 0x30], r8w
push r12
call fcn.140b5ac92
jb 0x140b21301
mov ebx, eax
mov ecx, dword [rdx + rdx]
mov dh, 0x7b
in eax, 0x9d
adc ebp, dword [rdi]
in al, 0x4d
movabs byte [0x6b20227f02b4476d], al
push rbx
movabs byte [0x50bd7bd7f424ad44], al
invalid
not r8w
neg r13b
xor r8d, 0x4eb11cd0
sub rbp, 0x2bf457e2
cmp r8b, 0x14
seta r13b
mov r13b, r8b
mov rcx, qword [rsp + 0x38]
neg r13d
xor r8d, 0x51387e4d
neg r13
neg ebp
sub r8, 0x1bee2f5d
sub bpl, 0xad
add r13b, 0x54
movzx r13, bp
in eax, dx
add qword [rsp], 0xffffffffbf606be2
test r13, 0x3c763c15
lea r8, [r13*2 + 0x710e4274]
lea rbp, [r13 + r8*2 + 0x7c6b0ac4]
setl r8b
and bpl, 0xfc
and r13, 0x2b0415a
neg r13d
call fcn.140b6d3f9
pop rbp
jbe 0x140b56568
je 0x140b56547
js 0x140b5649a
sub eax, 0xb6d2931b
jb 0x140b564ae
int1
pop rdi
xchg esp, eax
shl byte [rcx], 0xdc
fild qword [rsi - 0x79]
invalid
cmp al, 0xac
invalid
mov qword [r10 + 0x36], r12
int3
not r8b
jne 0x140b5646a
setl r12b
bswap r11
add dl, 0x44
test byte [rsp + 0x1d], r12b
not r12d
push r15
lea r12, [rdx + rdx + 0x3d3c0862]
not edx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffff8faeb141
push r8
mov r15, qword [rsp + 0x28]
movzx r15, word [rsp + 0x28]
mov r15, qword [rsp + 0x28]
jns 0x140b212fa
xchg edi, eax
and al, al
and al, 0xf1
or eax, 0xa396a28f
adc byte [rcx], dh
add dword [rsi + 0x67], ebp
fidivr word [rbx + 0x6c]
push 0x4e00fb77
xchg esp, eax
jno 0x140b7ed7d
sub eax, 0x456e6ece
pop gs
imul edx, esi, 0x9323029a
pop rax
and eax, 0xbf969a76
invalid

Function at 0x140b87346
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x60]
call fcn.140cfa8c3
Function at 0x140b8a895
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0x10fa4dac6ce356cc
sub r8, 0x17d3d37
push r8
mov r8w, 0x16fa
jne 0x140a7f422
mov r10b, r8b
call fcn.140afa683
not word [rsp + 0x18]
ja 0x140af6fb4
add byte [rax], al
and dword [rax], eax
add byte [rax], al
add byte [rbx - 0x7cebfff7], al
or dword [rax], eax
adc al, 0xc6
mov bh, 0
bswap r12
seta r10b
cmp r12d, 0x37f528cf
bswap r15d
cmovb ecx, r12d
setno r15b
movsx ecx, r15b
jb 0x140ae9023
push r8
jge 0x140a1be05
add r8d, dword [rsp + 1]
movzx r8, r8w
add r8b, r8b
mov r8b, byte [rsp + 7]
movzx r8w, byte [rsp + 3]
call fcn.140b62acd
jmp 0x17f989b72
bswap r10
mov r10, qword [rsp + 0x40]
mov cx, 0x38f4
setg r12b
lea rcx, [rcx + rcx*8 + 0x233b2afc]
not cl
add r15w, r12w
lea rcx, [r15 + r15 + 0x26650005]
sets cl
add qword [rsp], 0xffffffffffea8d92
test r12b, 0xce
ret 0x18
neg dword [rsp + 0x18]
test byte [rsp + 0x18], 0xf5
jg 0x140b1c5f3
invalid
test rcx, 0x637567f6
lea r12, [r12 + r10*2 + 0x42c51cd6]
jl 0x140a65265
seto cl
and r15b, 0x90
test r12, 0x51660934
call fcn.140a65255
invalid

Function at 0x140b8ea49
Capabilities:
Encode data using xor

Disassembly:
and qword [rsp + 0x50], 0x5b15501c
cmove di, word [rsp + 0x7d]
or dil, 0x77
lea r8, [rdi + r8*4 + 0x32d246d8]
xor dil, 0x95
not byte [rsp + 0x30]
not dil
xor qword [rsp + 0x78], 0x434c25f4
call fcn.140a3c560
not word [rsp + 0x88]
neg word [rsp + 0x40]
sub word [rsp + 0x40], 0x31c5
ja 0x140a81891
xor word [rsp + 0x88], 0x4222

Function at 0x140ba67ae
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsi + 0x7c514d17]
sub r12b, sil
add qword [rsp + 0x60], 0x10e13109
xor qword [rsp + 0x78], r12
and dword [rsp + 0x60], 0x34515e31
add word [rsp + 0x78], 0x3665
xor qword [rsp + 0x78], 0x266d6db3
cmp r12d, dword [rsp + 0x79]
call fcn.140ae7eb0

Function at 0x140ba6873
Capabilities:
Encode data using base64

Disassembly:
invalid
movsxd r10, r10d
call fcn.140b3b5fe
xor esp, dword [0x1a46e470f]
pop rdx
loope 0x140a3dc32
mov al, ch
sahf
fmul dword [rsi + 0x419f042c]
invalid
bswap r10
seta sil
and rsi, rsi
not rsi
or si, si
xor r10d, 0x24101eca
lea rsi, [r10 + rsi + 0x7591529c]
not r10d
mov rsi, qword [rsp + 0x10]
neg r10
and r10w, 0x42f5
xor r10d, 0x16ac151f
mov r10w, 0xaf7
sub r10b, r10b
not r10w
js 0x140a3dc9f
lea r10, [r10 + r10*2 + 0x5d206138]
setl r10b
jns 0x140ba6db7
neg r10w
and r10, 0x44406d20
xor r10, r10
movsx r10d, r10b
and r10, 0x21ee6ebb
test r10, 0x7c2b4d3e
movzx r10, r10w
call 0x140a3dc9f
Function at 0x140ba68ce
Capabilities:
Encode data using base64

Disassembly:
neg dword [rsp + 0x10]
or r10d, 0x46d76308
not r13d
mov rbx, qword [rsp + 8]
not edi
not qword [rsp + 0x28]
movzx r13, r13w
lea rdi, [r13*8 + 0xb86bf9]
add bpl, dil
or word [rsp + 0x10], 0x3f90
setns r13b
or r13d, 0x6c9e0a71
test word [rsp + 0x28], 0x6ac0
mov r10d, 0x1d6d24eb
sete dil
setno byte [rsp + 0x30]
test r10, r13
not qword [rsp + 0x10]
not edi
mov rbp, qword [rsp + 0x48]
js 0x1409f1e9b
xor r10, qword [rsp + 0x28]
lea rdi, [r10 + rdi + 0x71a931c5]
mov r10, r13
add qword [rsp + 0x10], 0x72377d84
or dword [rsp + 0x28], 0xd5312a4
add edi, 0x440c0dbc
xor r13w, word [rsp + 0x10]
or r13w, word [rsp + 0x12]
neg qword [rsp + 0x28]
lea r10, [r10 + r10*2 + 0x62763461]
lea r13, [r13*8 + 0x82d64f0]
setg byte [rsp + 0x30]
jg 0x140b6ca25
xor qword [rsp + 0x30], rdi
not r10
sub dword [rsp + 0x30], 0x62cf3d1a
ret 8
seto byte [rsp + 0x10]
movabs r13, 0x57a252e440b723a4
sets byte [rsp + 0x18]
not bp
or r10, 0x60c76a49
sub r14d, 0x3191428f
push r10
sub r14w, 0xeb3
xor ebp, ebp
bswap r10
add word [rsp + 0x18], 0x7f0d
or r13, rbp
sub word [rsp + 0x18], r10w
and byte [rsp + 0x20], r14b
push rbx
sub r13b, byte [rsp + 0x23]
and r14, r14
sub word [rsp + 0x28], 0x4fe5
test r10w, 0x6471
mov rbx, r14
bswap edi
mov r14, qword [rsp + 0x30]
bswap rbx
not di
js 0x140b8b2df
or r10, 0x276505ba
call fcn.140a9e493
and word [rsp + 0x30], 0x1eb3
add qword [rsp], 0x414eb
bswap rdi
mov byte [rsp + 0x30], 0x83
xor dil, 0x2b
test qword [rsp + 0x28], rdi
mov word [rsp + 0x28], di
lea rdi, [r13*2 + 0x19303133]
mov r13, qword [rsp + 0x20]
movsx r10d, r10w
not dword [rsp + 0x10]
setb byte [rsp + 0x30]
or qword [rsp + 0x28], r10
not word [rsp + 0x28]
movsx r10, byte [rsp + 0x30]
movzx di, byte [rsp + 0x2d]
jge 0x140a6e7cb
mov esi, 0x3fa5d6ba
push rbp
xchg edx, eax
fst qword [rdx + rsi*2]
pushfq
insb byte [rdi], dx
movabs eax, dword [0xadf87ef9564a743a]
imul eax, esp, 0x3a
mov al, 0x7b
shl byte [rcx], 0x4a
ror dword [0xdc23ebfc], cl
std
sbb dword [rsi + 0x31], edi
sar byte [rax], 0x3f
sbb ebx, dword [rsi]
hlt
not di
sub dword [rsp], 0x278c6e43
mov byte [rsp], r10b
call fcn.140bb352b
sete r13b
neg r10w
not bl
lea rdi, [rbx + rbp*8 + 0x1d340d18]
mov ebx, dword [rsp + 0x14]
neg byte [rsp + 0x28]
jae 0x140a6e927
xor ebx, dword [rsp + 0x34]
movzx r10, bpl
mov dword [rsp + 0x30], 0x6e0b5806
neg di
jbe 0x1409f1e47

Function at 0x140baa1f7
Capabilities:
Encode data using xor

Disassembly:
push r13
or r11w, 0x440e
movabs r13, 0x19212e9f51543918
push r10
sub edi, 0x3f1c746c
neg r13d
not ebp
setg bpl
mov r10, r15
movabs rdi, 0x2a10033c11bd3f9e
push 0x7c421e20
not r12b
jl 0x140baa26e
not ah
neg r13w
xor di, 0x2070
mov r10, qword [rsp + 8]
bswap r15
xor r12b, byte [rsp + 1]
lea rbp, [r12*8 + 0x284e3d08]
and r12d, 0x504a26c1
cmovbe r15, r11
call fcn.140bac951
mov dh, 0xe8
insd dword [rdi], dx
jg 0x140baa22b
invalid
in al, dx
push rax
invalid
Function at 0x1405a1cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
mov eax, dword [0x140b87240]
mov ecx, dword [0x140b87244]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x25]
cmp ecx, 0xa
setl byte [rsp + 0x26]
mov eax, 0x252ef7fb
jmp 0x1405a1d11
xor bl, 1
cmp ecx, 0xa
cmovl eax, edx
cmp eax, 0x188303cf
jle 0x1405a1d40
cmp eax, 0x4b00f5cb
jle 0x1405a1d70
cmp eax, 0x4b00f5cc
je 0x1405a1dd0
cmp eax, 0x79fcefb7
jne 0x1405a1e88
mov eax, 0x188303d0
jmp 0x1405a1d11
cmp eax, 0xff573291
jg 0x1405a1db0
cmp eax, 0x957c53a1
je 0x1405a1e00
cmp eax, 0xe5a12aa4
jne 0x1405a1d11
mov rcx, rdi
mov rdx, r14
call fcn.14066f310
mov byte [rsp + 0x24], al
mov eax, 0x4b00f5cc
jmp 0x1405a1d11
cmp eax, 0x188303d0
je 0x1405a1e35
cmp eax, 0x252ef7fb
jne 0x1405a1d11
movzx ecx, byte [rsp + 0x25]
cmp byte [rsp + 0x26], 0
mov edx, 0x188303d0
mov eax, 0x188303d0
jne 0x1405a1d9d
mov eax, 0x79fcefb7
test cl, cl
cmovne eax, edx
jmp 0x1405a1d11
cmp eax, 0xff573292
je 0x1405a1e65
cmp eax, 0x163eaca9
jne 0x1405a1d11
mov eax, 0xe5a12aa4
jmp 0x1405a1d11
mov eax, dword [0x140b87240]
mov ecx, dword [0x140b87244]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x957c53a1
mov eax, 0x957c53a1
test sil, 1
je 0x1405a1d0b
mov eax, 0xff573292
jmp 0x1405a1d0b
movzx ebx, byte [rsp + 0x24]
mov eax, dword [0x140b87240]
mov ecx, dword [0x140b87244]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x7dfef14f
mov eax, 0x7dfef14f
test sil, 1
je 0x1405a1d08
mov eax, 0xff573292
jmp 0x1405a1d08
mov eax, dword [0x140b87240]
mov ecx, dword [0x140b87244]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x163eaca9
mov eax, 0x163eaca9
test sil, 1
je 0x1405a1d0b
mov eax, 0x79fcefb7
jmp 0x1405a1d0b
movzx eax, byte [rsp + 0x24]
movzx eax, byte [rsp + 0x24]
movzx eax, byte [rsp + 0x24]
movzx eax, byte [rsp + 0x24]
movzx eax, byte [rsp + 0x24]
mov eax, 0x957c53a1
jmp 0x1405a1d11
cmp eax, 0x7dfef14f
jne 0x1405a1d11
and bl, 1
mov byte [rsp + 0x27], bl
mov al, byte [rsp + 0x27]
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1406b0e60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1406b0eaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1406b0eaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1406b0eaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1406b0eaa
cmp dword [rcx + 0x84], 0xe
jbe 0x1406b0eaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1406b0eac
xor al, al
add rsp, 0x28
ret
Function at 0x1406c3290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x158
mov rax, qword [0x140b74de8]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xae5], 0
mov rbx, rcx
jne 0x1406c32d4
cmp qword [rcx + 0x1e0], 0
je 0x1406c338d
mov r8, rdx
lea r9, [rsp + 0x180]
mov edx, 0x100
lea rcx, [rsp + 0x30]
call fcn.1406d5eb0
mov rdx, qword [rbx + 0x1e0]
movsxd r8, eax
test rdx, rdx
je 0x1406c3328
cmp byte [rbx + 0x1313], 0
jne 0x1406c3328
lea rcx, [rsp + 0x30]
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1406c3310
mov byte [rbx + 0x1313], 1
lea eax, [r8 + 1]
mov byte [rsp + r8 + 0x30], 0xa
movsxd rdi, eax
cmp rdi, 0x102
jae 0x1406c33df
cmp byte [rbx + 0xae5], 0
mov byte [rsp + rdi + 0x30], 0
je 0x1406c338d
cmp qword [rbx + 0x270], 0
je 0x1406c33a7
mov dl, 1
mov rcx, rbx
call fcn.1406b25e0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.1406b25e0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1406ad9c0
add rsp, 0x158
pop rdi
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x14071d120]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1406c338d
call fcn.1406b1120
int3

Function at 0x1406c3440
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1406c3482
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret