joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001de2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x65
mov word [rsp + 0x22], 0x5b
mov word [rsp + 0x24], 0x6e
mov word [rsp + 0x26], 0x70
mov word [rsp + 0x28], 0x72
mov word [rsp + 0x2a], 0x7c
mov word [rsp + 0x2c], 0x7d
mov word [rsp + 0x2e], 0x7b
mov word [rsp + 0x30], 0x82
mov word [rsp + 0x32], 0x65
mov word [rsp + 0x34], 0x56
mov word [rsp + 0x36], 0x6a
mov word [rsp + 0x38], 0x6c
mov word [rsp + 0x3a], 0x71
mov word [rsp + 0x3c], 0x72
mov word [rsp + 0x3e], 0x77
mov word [rsp + 0x40], 0x6e
mov word [rsp + 0x42], 0x65
mov word [rsp + 0x44], 0x5c
mov word [rsp + 0x46], 0x62
mov word [rsp + 0x48], 0x5c
mov word [rsp + 0x4a], 0x5d
mov word [rsp + 0x4c], 0x4e
mov word [rsp + 0x4e], 0x56
mov word [rsp + 0x50], 0x65
mov word [rsp + 0x52], 0x4c
mov word [rsp + 0x54], 0x7e
mov word [rsp + 0x56], 0x7b
mov word [rsp + 0x58], 0x7b
mov word [rsp + 0x5a], 0x6e
mov word [rsp + 0x5c], 0x77
mov word [rsp + 0x5e], 0x7d
mov word [rsp + 0x60], 0x4c
mov word [rsp + 0x62], 0x78
mov word [rsp + 0x64], 0x77
mov word [rsp + 0x66], 0x7d
mov word [rsp + 0x68], 0x7b
mov word [rsp + 0x6a], 0x78
mov word [rsp + 0x6c], 0x75
mov word [rsp + 0x6e], 0x5c
mov word [rsp + 0x70], 0x6e
mov word [rsp + 0x72], 0x7d
mov word [rsp + 0x74], 0x65
mov word [rsp + 0x76], 0x5c
mov word [rsp + 0x78], 0x6e
mov word [rsp + 0x7a], 0x7b
mov word [rsp + 0x7c], 0x7f
mov word [rsp + 0x7e], 0x72
mov word [rsp + 0x80], 0x6c
mov word [rsp + 0x82], 0x6e
mov word [rsp + 0x84], 0x7c
mov word [rsp + 0x86], 0x65
mov word [rsp + 0x88], pe_nt_image_headers64
mov word [rsp + 0x8a], 0x7e
mov word [rsp + 0x8c], 0x6a
mov word [rsp + 0x8e], 0x7e
mov word [rsp + 0x90], 0x7c
mov word [rsp + 0x92], 0x6e
mov word [rsp + 0x94], 0x7b
mov word [rsp + 0x96], 0x7f
mov word [rsp + 0x98], 9
cmp byte [0x14087c640], 0
jne 0x140001ffd
mov byte [0x14087c6da], 1
mov eax, 0
lea rcx, [0x14087c660]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x140001fd7
mov byte [0x14087c640], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x14087c660]
add rsp, 0xa8
ret

Function at 0x140002218
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x46
mov byte [rsp + 0x27], 0x4b
mov byte [rsp + 0x28], 0x48
mov byte [rsp + 0x29], 0x46
mov byte [rsp + 0x2a], 0x4e
mov byte [rsp + 0x2b], 0x50
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x57
mov byte [rsp + 0x2e], 0x48
mov byte [rsp + 0x2f], 0x11
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x50
mov byte [rsp + 0x33], 0xe3
cmp byte [0x14087c2c8], 0
jne 0x1400022c1
mov byte [0x14087c2e4], 1
mov eax, 0
lea rcx, [0x14087c2d0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x14000229c
mov byte [0x14087c2c8], 1
lea rcx, [0x1400017bd]
call fcn.1400014f0
lea rax, [0x14087c2d0]
add rsp, 0x48
ret
Function at 0x1400022ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x46
mov byte [rsp + 0x28], 0x44
mov byte [rsp + 0x29], 0x51
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x4d
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x57
mov byte [rsp + 0x2e], 0x57
mov byte [rsp + 0x2f], 0x4c
mov byte [rsp + 0x30], 0x11
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x55
mov byte [rsp + 0x33], 0x4a
mov byte [rsp + 0x34], 0xe3
cmp byte [0x14087c268], 0
jne 0x14000237c
mov byte [0x14087c285], 1
mov eax, 0
lea rcx, [0x14087c270]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140002357
mov byte [0x14087c268], 1
lea rcx, [0x140001805]
call fcn.1400014f0
lea rax, [0x14087c270]
add rsp, 0x48
ret

Function at 0x140002388
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x44
mov byte [rsp + 0x23], 0x51
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x44
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x48
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0x57
mov byte [rsp + 0x2d], 0x5c
mov byte [rsp + 0x2e], 0x11
mov byte [rsp + 0x2f], 0x46
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x50
mov byte [rsp + 0x32], 0xe3
cmp byte [0x14087c1b8], 0
jne 0x14000242c
mov byte [0x14087c1d3], 1
mov eax, 0
lea rcx, [0x14087c1c0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x140002407
mov byte [0x14087c1b8], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x14087c1c0]
add rsp, 0x48
ret

Function at 0x140002438
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x16
mov byte [rsp + 0x22], 0x19
mov byte [rsp + 0x23], 0x13
mov byte [rsp + 0x24], 0x57
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x4f
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x58
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x4c
mov byte [rsp + 0x2f], 0x57
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x14087c160], 0
jne 0x1400024eb
mov byte [0x14087c186], 1
mov eax, 0
lea rcx, [0x14087c170]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x1400024c6
mov byte [0x14087c160], 1
lea rcx, [0x1400018f5]
call fcn.1400014f0
lea rax, [0x14087c170]
add rsp, 0x48
ret
Function at 0x1400024f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x44
mov byte [rsp + 0x22], 0x51
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x24], 0x4c
mov byte [rsp + 0x25], 0x59
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x58
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x50
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x47
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x14087c128], 0
jne 0x1400025ab
mov byte [0x14087c146], 1
mov eax, 0
lea rcx, [0x14087c130]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140002586
mov byte [0x14087c128], 1
lea rcx, [0x140001925]
call fcn.1400014f0
lea rax, [0x14087c130]
add rsp, 0x48
ret

Function at 0x1400027a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov word [rsp + 0x20], 0xe4
mov word [rsp + 0x22], 0x12
mov word [rsp + 0x24], 0xdf
mov word [rsp + 0x26], 0xee
mov word [rsp + 0x28], 0x22
mov word [rsp + 0x2a], 0xdf
mov word [rsp + 0x2c], 0x22
mov word [rsp + 0x2e], 0x27
mov word [rsp + 0x30], 0x2e
mov word [rsp + 0x32], 0x28
mov word [rsp + 0x34], 0x22
mov word [rsp + 0x36], 0x24
mov word [rsp + 0x38], 0xdf
mov word [rsp + 0x3a], 0xee
mov word [rsp + 0x3c], 2
mov word [rsp + 0x3e], 0xdf
mov word [rsp + 0x40], 0x18
mov word [rsp + 0x42], 0xdf
mov word [rsp + 0x44], 0xee
mov word [rsp + 0x46], 0xd
mov word [rsp + 0x48], 0xdf
mov word [rsp + 0x4a], 0xee
mov word [rsp + 0x4c], 3
mov word [rsp + 0x4e], 0xdf
mov word [rsp + 0x50], 0x18
mov word [rsp + 0x52], 0xdf
mov word [rsp + 0x54], 0xee
mov word [rsp + 0x56], 0x13
mov word [rsp + 0x58], 0xdf
mov word [rsp + 0x5a], 0xf2
mov word [rsp + 0x5c], 0xdf
mov word [rsp + 0x5e], 0xe5
mov word [rsp + 0x60], 0xdf
mov word [rsp + 0x62], 3
mov word [rsp + 0x64], 0x24
mov word [rsp + 0x66], 0x2b
mov word [rsp + 0x68], 0xdf
mov word [rsp + 0x6a], 0xe1
mov word [rsp + 0x6c], 0xe4
mov word [rsp + 0x6e], 0x12
mov word [rsp + 0x70], 0xe1
mov word [rsp + 0x72], 0xbf
cmp byte [0x14087b998], 0
jne 0x140002915
mov byte [0x14087b9f4], 1
mov eax, 0
lea rcx, [0x14087b9a0]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x2a
jne 0x1400028ef
mov byte [0x14087b998], 1
lea rcx, [0x140001a8a]
call fcn.1400014f0
lea rax, [0x14087b9a0]
add rsp, 0x88
ret
Function at 0x140002988
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140002afc
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x14087cba1]
jmp 0x1400029ee
mov byte [0x14087cba1], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x14087cb80]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140002afc
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x86
mov byte [rsp + 0x21], pe_nt_image_headers64
mov byte [rsp + 0x22], 0x83
mov byte [rsp + 0x23], 0x8c
mov byte [rsp + 0x24], 0x76
mov byte [rsp + 0x25], 0x8b
mov byte [rsp + 0x26], 0x8c
mov byte [rsp + 0x27], 0x81
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x89
mov byte [rsp + 0x2a], 0x7f
mov byte [rsp + 0x2b], 0x78
mov byte [rsp + 0x2c], 0x87
mov byte [rsp + 0x2d], 0x8b
mov byte [rsp + 0x2e], 0x7c
mov byte [rsp + 0x2f], 0x7f
mov byte [rsp + 0x30], 0x74
mov byte [rsp + 0x31], 0x87
mov byte [rsp + 0x32], 0x8c
mov byte [rsp + 0x33], 0x8d
mov byte [rsp + 0x34], 0x78
mov byte [rsp + 0x35], 0x76
mov byte [rsp + 0x36], 0x89
mov byte [rsp + 0x37], 0x7a
mov byte [rsp + 0x38], pe_nt_image_headers64
mov byte [rsp + 0x39], 0x81
mov byte [rsp + 0x3a], 0x75
mov byte [rsp + 0x3b], 0x8b
mov byte [rsp + 0x3c], 0x75
mov byte [rsp + 0x3d], 0x88
mov byte [rsp + 0x3e], 0x79
mov byte [rsp + 0x3f], 0x7a
mov byte [rsp + 0x40], 0x13
cmp byte [0x14087cb60], 0
jne 0x140002ad7
mov byte [0x14087cba1], 1
mov eax, 0
lea rcx, [0x14087cb80]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140002ab6
mov byte [0x14087cb60], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x14087cba1], 0
je 0x1400029c0
lea rax, [0x14087cb80]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140002aeb
jmp 0x1400029b9
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400085f0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140008620
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000861f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140008625
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000861f
mov eax, 0
jmp 0x14000861f

Function at 0x140008ca0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140008c50
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400122a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001ade0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call fcn.14001b3c8
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001ade0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14001b430
call fcn.14001b380
nop
nop dword [rax]
Function at 0x140012310
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14087cf54]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400124a0
mov rax, qword [0x14087cf58]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001235c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x1400123e5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012340
mov rcx, rdi
call fcn.140012e70
test rax, rax
mov r12, rax
je 0x1400124f2
mov rax, qword [0x14087cf58]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140012fb0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14087cf58]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400124d5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400123de
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012450
add dword [0x14087cf54], 1
cmp ebx, 8
jae 0x140012411
test bl, 4
jne 0x1400124b0
test ebx, ebx
je 0x140012406
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400124c4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012406
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001242a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x14087cf58]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123de
call qword [0x14087e2c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400122a0
xor esi, esi
jmp 0x140012367
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012406
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012406
mov rax, qword [0x14087cf58]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400122a0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400122a0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012e70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14086f750]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140012edf
mov rcx, r9
call fcn.140012d40
test eax, eax
je 0x140012edf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140012edd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140012ed4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140012edf
add rdx, 0x28
cmp rdx, r9
jne 0x140012ec0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001d380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140865f60]
jmp 0x140013ca0

Function at 0x14001d390
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x140865f60]
jmp 0x140013ca0

Function at 0x14088a9d7
Capabilities:
Write file on windows

Disassembly:
shr r13, 0x1a
not r13b
shr r13d, 0x98
add qword [rsp + 8], 0x8698b
lea r13, [r13 + r13*4 - 0x2bf5f9ed]
and r13, r13
mov rdx, r13
jns 0x1408913c8
call fcn.140995ab5

Function at 0x14088aa04
Capabilities:
Write file on windows

Disassembly:
push rbx
jle 0x14092f642
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
jno 0x1409074d2
Function at 0x140894123
Capabilities:
Packed with generic packer

Disassembly:
movsxd rbp, ebp
mov r8, qword [rsp + rbp + 0x7e360038]
and bpl, 0x80
movabs rbp, 0x9e1012923c3a7b3c
movzx rbp, bpl
jg 0x1408a0bb2
or rbp, rbp
mov rbp, qword [rsp + rbp*2 - 0x28]
jbe 0x14099c673
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
xchg qword [rsp + 0x40], rdi
mov rbp, qword [rsp + 0x10]
jg 0x1408a4340
mov r12, qword [rsp + 0x28]
add word [rsp + r12 + 0x1ff35410], 0xe0a4
jae 0x14098f986
lea r14, [r14 + r14*8 - 0x79f73ec6]
mov r14, qword [rsp + 0x20]
call fcn.1400014c5
movabs rdi, 0x2025b80998266b28
pushfq
shr rdi, 0xb5
lea rdi, [rdi*4 + 0x5d1cee36]
sub rdi, 0x3932f887
push rdi
mov rdi, qword [rsp + rdi - 0x23e9f9a3]
xchg qword [rsp + 0x18], rdi
sub qword [rsp], 0x10b34225
not byte [rsp]
call fcn.140914468

Function at 0x140895e33
Capabilities:
Encode data using xor

Disassembly:
not edx
sub dx, word [rsp + rdx - 0x33b893e7]
mov rdx, qword [rsp + rdx - 0x33b841c6]
jo 0x14095c7a4
push r12
pushfq
movabs r12, 0xf09051b1f80e95b2
push r12
sub r12, 0xffffffffa8131cab
sub word [rsp], 0x2cb0
mov r12w, word [rsp + 2]
mov qword [rsp + 0x20], 0xffffffff8397cf0d
mov r12, qword [rsp + 0x10]
neg byte [rsp]
xor byte [rsp], 0xa9
jbe 0x140895e7c
shl byte [rsp], 0xb8
neg qword [rsp]
shr qword [rsp], 0x8f
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1409cafe5
xor byte [rsp + 0x20], 0x2f
neg dword [rsp + 0x20]
not qword [rsp + 0x20]
cmp byte [rsp + 0x20], 0xb3
jns 0x140891fb5

Function at 0x14089f3b6
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
not qword [rsp + 0x10]
test dword [rsp + 0x10], 0xacab8a07
jle 0x140936e18
pop rbx
call fcn.1409a3fb3
not byte [rsp + rdx - 0x2affe5b8]
and r13b, dl
js 0x14088f857
mov rdx, qword [rsp + rdx - 0x2affe578]
neg qword [rsp + r13 - 0x62a803b8]
add r13b, byte [rsp + r13 - 0x62a803b1]
jge 0x1408900b9
jg 0x14091936e
shr byte [rsp + 0x18], 0x53
jns 0x14091a2bc
movabs r12, 0x12e75949e37e519
lea rbp, [rbp + r10*4 - 0x7ddb0b7d]
push r14
shr r12w, 0x44
mov rdi, r12
shr word [rsp + rsi*2 + 8], 0x72
js 0x14096af4b
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x28]
ret 8
movabs rdi, 0x962c45bb2e2cdeab
jno 0x14097caa6
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
cmp edi, dword [rsp + 2]
jbe 0x1409b2682
xor rdi, rdi
mov rdi, qword [rsp + rdi*2 + 0x10]
mov qword [rsp + 0x10], rax
js 0x1409c0255
jl 0x14093efa5
add qword [rsp], 0x2e119
nop
push rdi
movabs rdi, 0x23bd7dbe0781afba
movabs rax, 0x4bb05da94fbc1d01
push 0xffffffffa50af8a8
add di, word [rsp]
jl 0x140939aa8
call fcn.14094f207
mov qword [rsp + r10*4 - 0x6e7267b0], rsi
push r10
cmp qword [rsp + rsi*2 + 0x50], 0xffffffffc589572c
jge 0x1408fef70

Function at 0x14089fa15
Capabilities:
Encode data using base64

Disassembly:
jg 0x14090739e
jl 0x1408a00db
mov rax, qword [rsp + 0x28]
add ebp, 0x1a3db21c
movzx rbp, bpl
push r15
cmp bp, 0x7880
mov r15, rbp
lea rbp, [r15*2 + 0x3092ef20]

Function at 0x1408a0bb0
Capabilities:
Packed with generic packer

Disassembly:
push r12
cmp byte [rsp + 0x28], r14b
movsx ebp, r14w
jns 0x1408a0bb0
Function at 0x1409074e7
Capabilities:
Write file on windows

Disassembly:
push 0xffffffff93904120
pushfq
add qword [rsp + 0x10], 0xfffffffffff704d4
or qword [rsp + 8], 0x382c7489
jns 0x140916ca4
mov qword [rsp + 0x18], rax
call fcn.14088ae03
call fcn.14089e4e1

Function at 0x14090c7b7
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov r13, qword [rsp + 0x40]
setl cl
jle 0x1409bba57
add qword [rsp + rdi*2 - 0x200163d8], 0x1239f
call fcn.14096363b
pop rcx
in al, dx
clc
int 0x69
pop rsp
nop
movsd dword [rdi], dword [rsi]
xor dword [rax + rcx], eax
cmp eax, 0x1d286451
stc
int3

Function at 0x140916ca9
Capabilities:
Write file on windows

Disassembly:
shr r9, 0x7e
jne 0x14095f138
jns 0x14092eded
push r12
and qword [rsp + 0x38], r11
push r15
add r9, qword [rsp + 0x40]
cmp r11, r9
xchg qword [rsp + 0x78], rcx
mov r11, qword [rsp + 0x50]
jle 0x140901d81
std
cdq
lodsb al, byte [rsi]
sal ch, 0x89
mov esp, 0x94a1d5e0
xor byte [0xedba39d5], al
fadd qword [rsi - 0x6fd3e62b]
movsd dword [rdi], dword [rsi]
xor dword [rax + rdi*8 - 0x27ab9e33], 0xe0dce9ed
fnsave dword [r8 - 0x26]
push rsi
invalid
mov r13, qword [rsp + r9 + 0x48]
mov r12, r9
mov r12b, 0x93
add qword [rsp + r9*2 + 0x20], 0xffffffffbf6d3a78
not byte [rsp + r12 - 0x53]
xor word [rsp + r9*2 + 0x40], r9w
xor byte [rsp + r12 - 0x53], r12b
lea r12, [r9 + r12*4 - 0x57643e0]
mov r12, qword [rsp + r12*2 + 0xaec8330]
call fcn.140939a7a

Function at 0x14091d9b6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
test esi, 0x1bba75bb
jbe 0x14088dba4
or ebp, 0xb2338403
add qword [rsp], 0xd93e1
movabs rbx, 0x410fcd2f95169121
add qword [rsp + 0x10], 0xffffffffbf6d0249

Function at 0x14092e4a8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not r9d
push rdi
xchg qword [rsp + 0x20], rax
movabs rdi, 0x52068c3261ad7b9a
jae 0x14088aa26

Function at 0x14092f635
Capabilities:
Write file on windows

Disassembly:
neg byte [rsp + 0x28]
bswap rcx
jns 0x1409b4efe
mov rcx, qword [rsp + rbp + 0x5262ae]
mov rcx, qword [rcx]
or byte [rsp + 0x28], 0x25
xor r8b, 0x97
shr byte [rsp + 0x28], 0xc
call fcn.1408fc75a

Function at 0x140949710
Capabilities:
Packed with generic packer

Disassembly:
push r12
cmp byte [rsp + 0x28], r14b
movsx ebp, r14w
jns 0x1408a0bb0

Function at 0x14094a324
Capabilities:
Write file on windows

Disassembly:
jg 0x14095f11a
call fcn.14088ce04
Function at 0x140956eb3
Capabilities:
Execute shellcode via indirect call

Disassembly:
test byte [rsp + 0x20], ch
jg 0x14098aa07
mov rcx, qword [rsp + 0x20]
xor r12d, 0xe915cd28
lea rdx, [rdx + rcx*4 + 0x23222419]
movabs r13, 0x2d9fac8586ad9f35
not qword [rsp + r12 - 0x2a2fe4e8]
xor word [rsp + r12*2 - 0x545fca30], 0xc8aa
not r12b
not ecx
call fcn.1409bd0de
btc dword [rsi], 0xb
outsd dx, dword [rsi]
pop rdx
push rsi
invalid
mov dx, word [rsp + rdx*4 + 0x41]
sub rdx, 0xffffffffc5286e8b
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
setb byte [rsp + 0x20]
je 0x140893a20
jge 0x140952eca
push r14
push rsi
movabs r14, 0x76b68e00ee204d82
push rbx
not r14d
shr r14d, 0x8f
setbe r14b
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rsi
movabs rsi, 0x882de625f918662a
mov rbx, r14
movsx ebx, si
movzx ebx, bl
lea rsi, [r14 + rbx*4 - 0x13ffffcf]
xor r14b, 2
setbe bl
and esi, r14d
call fcn.140966c5d
push rbp
call fcn.140968c33

Function at 0x140956ef3
Capabilities:
Execute shellcode via indirect call

Disassembly:
shr r9w, 0xb3
add qword [rsp + 0x18], 0xfffffffffffa3b90
push r11
call fcn.14090dbd8

Function at 0x140956f08
Capabilities:
Execute shellcode via indirect call

Disassembly:
pop rdx
push rcx
movabs rcx, 0x2a18daae97359033
push 0x1e044711
pushfq
and ecx, 0x5433cdb9
call fcn.14097d434

Function at 0x140956f25
Capabilities:
Execute shellcode via indirect call

Disassembly:
not r15b
add r12d, dword [rsp + 0x48]
or qword [rsp + 0x48], 0xfffffffff33e813d
mov rbx, qword [rsp + r12*2 - 0x3a6dde6a]
jns 0x1400123bb
xor r12w, word [rsp + r12 - 0x1d36ef16]
jle 0x14088b964
call fcn.1409b04b6
lodsb al, byte [rsi]
invalid

Function at 0x1409595f3
Capabilities:
Encode data using xor

Disassembly:
test r12, 0xfffffffff89a56a0
ja 0x14099b8ff
movabs eax, dword [0x7175406451fdc814]
jge 0x140959676
pop rsp
enter 0xffffffffffffc1fd, 0xfffffffffffffff4
add byte [rbp + 0x4c8d422], ah
and dword [rbx], 0x30b5d182
and bh, byte [0x1aad3a1bb]
pop rdi
sbb ebp, dword [rsi]
invalid
xchg byte [rdx], ch
loopne 0x14095969e
scasd eax, dword [rdi]
push rbp
insd dword [rdi], dx
cmp eax, 0xe38422f6
fcom st(0)
or eax, 0xce3b3697
xchg edi, eax
sbb r11, qword [r14]
mov edx, dword [0x19122c410]
jne 0x1409596ec
jne 0x140959657
fild qword [rbx]
push 0xffffffffaf252805
sbb ch, cl
invalid
sub ebp, dword [rax + 5]
sub byte [0x1177eb130], ah
mov eax, 0xedc31c2f
xor sp, cx
cwde
invalid
adc edx, dword [rsi*8 + 0x153f22ec]
outsd dx, dword [rsi]
sub eax, 0x6b249d6d
add eax, 0xe2fa7b0b
hlt
ficomp word [r9 + 0x71]
push rax
sub edi, dword [rbx + 0x5ad75806]
in al, 0x9d
invalid
test word [rsp + r12*4 + 0x7fcd4fe0], r12w

Function at 0x14095f115
Capabilities:
Write file on windows

Disassembly:
xchg qword [rsp + 0x70], rax
mov r14, qword [rsp + 0x38]
test word [rsp + r10 - 0x520605d3], 0x8f04
seta r15b
not r13w
mov r15w, word [rsp + 0x65]
jl fcn.14001b3c8