joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407510
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x40751d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x40752d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x407515
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x407545
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x407532
sub eax, 3
jb 0x40755f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x407596
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x407586
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x407584
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x407573
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.004074d2
jmp 0x40751d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5000]
mov eax, dword [rdi]
or eax, eax
je 0x4075f2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x4075a2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x4075ec
mov qword [rbx], rax
add rbx, 8
jmp 0x4075c2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x40764a
sub rsp, 0xffffffffffffff80
jmp 0x401290
Function at 0x140001a70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmc
movabs rax, 0x68262793de42f0f4
cmp rax, 0xffffffff9a543f9e
cmc
dec eax
add eax, 0xc9a0223b
cmp eax, ecx
add rax, 0xffffffffb820e427
inc eax
cmp rax, rcx
inc eax
call fcn.140001ab5

Function at 0x140003b90
Capabilities:
Enumerate process modules
Link many functions at runtime
Parse credit card information

Disassembly:
mov eax, 0x20d8
call fcn.140018950
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x80], rax
inc rax
push r8
pop rax
xor eax, eax
call fcn.140003bb8

Function at 0x140006db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
dec rax
movabs rax, 0x9e7692e909ed0bd4
mov eax, 0xd55c22ea
inc rax
call fcn.140006df6
Function at 0x14000a500
Capabilities:
Accept command line arguments
Parse pe header
Read file on windows
Set current directory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x450
pushfq
cmp ecx, edx
popfq
push rax
pop rax
add rax, 0xffffffffa29fb622
add rax, 0x2535607e
xor rax, rax
movabs rax, 0x283f02af8d5fae5b
cmp rax, rcx
mov eax, 0x37a3c75e
cmp cx, cx
add eax, 0x140c8574
cmc
call fcn.14000a2c0
add eax, 0xffcb4f2c
inc rax
add eax, 0x432e2cd1
jmp 0x14000a563
nop
call fcn.14000a569

Function at 0x140019510
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001955a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001955a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001955a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001955a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001955a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001955c
xor al, al
add rsp, 0x28
ret

Function at 0x14002dd78
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14002db67
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002db67
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002db67
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002db67
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002db67
cmp dword [rcx + 0x84], 0xe
jbe 0x14002db67
cmp dword [rcx + 0xf8], 0
je 0x14002db67
mov ecx, ebx
call fcn.14002dc98
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14002d8e4
cmp dword [rbp + 0x20], 0
je 0x14002dbb4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002dbbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002db00
Function at 0x14000130e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r8
jb 0x14000d31e
mov r9, r9
jae 0x14000d31e
mov r8, qword [rsp + 8]
ja 0x140003cac
mov rcx, rcx

Function at 0x1400015c9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r15
js 0x14000b133
xchg si, si
jns 0x14000b133
add qword [rsp + 0x10], r12
ja 0x14000c980
xchg r13, r13
jbe 0x14000c980
movsxd rdx, dword [rsi + 0x14]
lea rcx, [r11 + r13]
shr rax, 3
call fcn.140005779
or eax, dword [rdx + 0x48e8c92f]
mov ecx, ebp
call fcn.1400077e7
test si, 0
call fcn.14000ec65
push rcx
pop rsi
invalid
pushfq
je 0x140001f48
mov rsi, rsi
jne 0x140001f48
mov r8d, 0x12fdea46
call fcn.14000e1cf
jl 0x140001e53
pop rax
and al, 0xe8
mov ecx, 0x40
call qword [0x140012087]
call fcn.14000a6eb
mov dl, 0x7f
or bh, dh
call 0x188c2a990
mov dword [rsp + 0x18], ecx
call fcn.140001f69
adc rax, 0x41e8d2c1
lea edx, [rax + 5]
call fcn.14000c6e7
sahf
call qword [rdi - 0x166317f3]
pop rcx
invalid
push rax
add eax, 0xa88de8
add byte [rsi - 0x17f26801], bl
pushfq
jmp 0x140007ebe
sub r15, 0x3b122e3b
jb 0x14000f01a
mov dl, dl
jae 0x14000f01a
test eax, eax
call fcn.140003b4e
invalid
pop r12
je 0x140005164
mov rsi, rsi
jne 0x140005164
lea rcx, [rsi + 0xfff]
lea r8d, [rax + 0x20]
sub r12, 0x1a154042
jp 0x140001d94
xchg ah, ah
jnp 0x140001d94
test eax, eax
je 0x14000978a
call fcn.14000c6e7
in al, 0x40
xchg edi, eax
or eax, 0x59e85fe8
out dx, al
invalid
call qword [0x140011972]
test al, 0
call fcn.1400072d2
std
invalid
movsxd r15, dword [r15]
jmp 0x140001e0a
mov r15, qword [rsp + 8]
js 0x14000979c
mov rsp, rsp
jns 0x14000979c
popfq
jmp 0x140004719
and dword [rsp + 0x28], 0
sub qword [rsp + 0x10], r15
jo 0x14000ac9a
mov r15, r15
jno 0x14000ac9a

Function at 0x14000194f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r11
jl 0x140001086
xchg rsp, rsp
jge 0x140001086
call fcn.140001721
mov r13, rax
call fcn.140008d79
mov rsi, rax
call fcn.14000be93
jl fcn.1400019f1
cmp al, 0xfe
call 0x1762a0241
add byte [rax], al
mov ebx, eax
call fcn.1400057f9
xchg edi, eax
pop rdx
push rsp
adc eax, ebp
lea rcx, [rsp + 0x30]

Function at 0x140001a3a
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push r9
jb 0x14000cd0e
mov al, al
jae 0x14000cd0e
call fcn.140009dec
call fcn.140007df1
invalid

Function at 0x140002327
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push rbp
jp 0x140009d3b
mov dh, dh
jnp 0x140009d3b

Function at 0x140002a38
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push rsi
jb 0x14000cabc
xchg r15, r15
jae 0x14000cabc
jne 0x140006ccb
mov edi, dword [rsi + 8]
test cx, 0
call fcn.140007ff7
int 0x48
invalid
mov esi, ecx
Function at 0x140002b85
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
jb 0x140004380
xchg bh, bh
jae 0x140004380
mov rax, qword [rsi]
mov r8d, edi
call fcn.1400046ae
retf
mov r14, qword [rsp + 8]
jl 0x14000c9ce
xchg rdi, rdi
jge 0x14000c9ce
je 0x14000eb88
je 0x14000f225
mov eax, 0x32
jmp 0x14000eb94
movsxd r14, dword [r14]
jg 0x14000447b
xchg rsi, rsi
jle 0x14000447b
je 0x14000ce72
call fcn.140002d76
push 0x3be83d96
fisttp word [rdi]
mov word [rbp + 0xfffff61], ds
mov eax, gs
iretd
mov ecx, eax
loopne 0x14000ce75
invalid
push qword [rbx]
sar bh, cl
ror byte [rax - 0x75], 1
pop rsp
and al, 0x38
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1400025a9
call fcn.14000277c
clc
adc byte [rax - 2], dh
call 0x14df76cea
jno 0x14000ebcb
je 0x1400010d0
xchg rsp, rsp
jne 0x1400010d0
jmp fcn.140003a55
pop rdi
cld
invalid
ret

Function at 0x140002d76
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push r9
ja 0x140007c52
xchg dx, dx
jbe 0x140007c52
test ecx, 0
jne 0x14000f2de
xor eax, eax
jmp fcn.140002d99
shl edx, 0x20

Function at 0x140002dc4
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push rcx
jmp 0x14000660e
mov rcx, qword [rsp + 8]
jb 0x14000c482
mov rdi, rdi

Function at 0x140002f2d
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r8
jb 0x14000cb06
mov r8, r8
jae 0x14000cb06
test r11, 0
jo 0x14000b114
movsxd r8, dword [r8]
jl 0x14000aa08
mov cl, cl
jge 0x14000aa08
test byte [rbx - 0x27], bh
invalid
mov r8, qword [rsp + 8]
jb 0x140007c2c
nop
jae 0x140007c2c
lea rcx, [rsp + 0x98]
call fcn.14000302f
mov eax, ebx
call fcn.1400034b1
hlt

Function at 0x14000302f
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Manipulate console buffer

Disassembly:
push rbx
call fcn.14000df8c
xadd byte [rsi + 0x3f], dh
call 0x14873ba01
mov rax, rdi
call fcn.14000194f
mov esi, 0xe8e9d888
mov qword [rbx], rax
call fcn.14000130e
mov esi, 0xe8ec0691
add r9, 0x23911150
jb 0x1400068f0
mov sp, sp
jae 0x1400068f0
mov edi, eax
call fcn.14000d2bc
sbb esp, dword [rsi - 0x4f]
call 0x105e92593
mov edi, 0x304effff
mov edx, cs
call 0x13fd154ff
adc eax, 0x5443
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14000ec26
in al, 0xe5
ret 0xe8e3
pushfq
ja 0x14000c986
mov r9, r9
jbe 0x14000c986
mov rcx, rax
call fcn.140009a3f
lea rcx, [rsp + 0x20]
call fcn.14000abe1
mov ah, 0x14
outsd dx, dword [rsi]
call 0x1858a5c99
invalid

Function at 0x1400034b1
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push r14
js 0x140009edb
mov r8, r8
jns 0x140009edb
Function at 0x140003bda
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rax, qword [rsp + 8]
jg 0x140003b90
mov dl, dl
jle 0x140003b90
movsxd rdx, dword [rsi + 0x10]
call fcn.14000ae3d
lea r11, [rsp + 0x50]
test dl, 0
call fcn.14000de59
sub dword [rbx], ebx
xchg ebp, eax
sti
call 0xdf0c975e
xchg byte [rcx], al
add al, ch
scasb al, byte [rdi]
lahf
add byte [rax], al
xlatb
or edi, dword [rsi + rdi*8]
call 0x16444aa36
or byte [rdi], cl
test byte [rbx + 0x4d00002f], dh
mov ecx, ecx
jne 0x140004ea8
movsxd rax, dword [rax]
je 0x140006530
mov bl, bl
jne 0x140006530
test eax, eax
jne fcn.14000d0cd
jne 0x1400086f1
call qword [0x140011eb4]
lea rdx, [rsp + 0x70]
call fcn.14000d80e
cmp eax, 0xe838fc76
je 0x14000bda5
je 0x14000439b
call fcn.14000de49
loopne 0x140003ba3
call 0x1402d83c6
add byte [rax + rdx*2 - 0x10], al
add ch, al
test byte [rbp - 0x47ffff52], al
xor al, byte [rax]
add byte [rax], al
movsxd rax, dword [rax]
jg 0x140005082
xchg rsp, rsp
jle 0x140005082
pushfq
jp 0x14000ca17
nop
jnp 0x14000ca17
pushfq
push rax
jo 0x140001eab
mov r8, r8
jno 0x140001eab
test r12, 0
call fcn.140001a3a
invalid
mov eax, edx
call fcn.14000d71d
mov dl, byte [rdi]
mov edx, 0x850fe8e3
add al, 0x8e
invalid
xor rax, 0x1a4098bd
add qword [rsp + 0x10], rax
js 0x140005423
mov r10, r10
jns 0x140005423
jne 0x140008ec4
call fcn.1400089e2
pop rbx
insd dword [rdi], dx

Function at 0x140003c18
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push rdx
jmp 0x14000e981
sbb eax, edx
invalid
popfq
je 0x14000de29
xchg bh, bh
jle 0x140006af3
js 0x14000a645
xchg sp, sp
jns 0x14000a645
mov dword [rbp + 0x3b], ecx
add byte [rax], al
mov r8d, 0x20
mov eax, 0x20
call fcn.14000ec65
add al, 0x2a
jo 0x140006ae7
call 0x12390f01b
invalid
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.14000f525
adc dh, byte [rdx]
invalid
invalid

Function at 0x140003fa5
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sti
cmpsd dword [rsi], dword [rdi]
add byte [rax], al
call fcn.14000ba34
cld
fcom dword [rbx - 0x27]
call 0xc70f9522
invalid
push r12
je 0x1400011e0
mov bp, bp
jne 0x1400011e0
mov rdx, rbp
mov rcx, rbx
call rax
mov rcx, qword [rsi]
test esi, 0
call fcn.14000e0df
mov dl, 0xc9
add eax, esp
call 0x120b065d4
add byte [rax], al
test r11, 0
jb 0x1400036cf
call fcn.14000cb90
xor al, 0xd
fadd st(0)
call 0x1400101e9
add byte [rax], al
jb 0x14000b9f0
test r8b, r8b
call fcn.140003b4e
xchg ebx, eax
outsd dx, dword [rsi]
cmp edx, ecx
call 0x1409f0cf3
add bh, dh
ret
invalid

Function at 0x1400040d8
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov rax, qword [rsp + 8]
je 0x140004ea8
mov r9, r9
push rax
jo 0x140001eea
xchg r12, r12
jno 0x140001eea
Function at 0x140005154
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push rdx
call fcn.14000ec15
adc al, 0x64
int 0x1b
call sub.KERNEL32.dll_EnumCalendarInfoExA
jb 0x140005123
test eax, eax
je 0x140006168
je 0x140004e4e
test bl, 0
jb 0x14000bcd8
test rbx, rbx
je 0x1400026e6
call fcn.14000b867
ja 0x140001073
jb 0x140001039
call 0xc149d435
and eax, 0xf2844d9
and eax, 0xf2844d9
mov word [0x188001117], gs
xchg ecx, ecx
invalid
mov ecx, ebx
mov dword [rbp + 0x2e8], eax
call fcn.140004801
call fcn.14000ba34
stosb byte [rdi], al
adc dword [rbx - 0x27], 0x54e8c3e8
sbb eax, dword [rax]
add dh, cl
mov word [rdx - 0xa], es
call 0x1238060e6
mov al, byte [rax]
add byte [rdx - 0x247ef01c], cl
mov al, byte [rax]
add byte [rcx + 0x51], al
push r9
test r13, 0
jo 0x14000c972
test rbx, rbx
je 0x14000be52
call fcn.14000ec26
out dx, eax
xchg ebx, eax
ret 0xe8e3
clc
movabs byte [0x1f8249c8b48ffff], al
add byte [rax], al
mov rax, rsi
test rax, 0
jo 0x14000f180
add rsp, 0x1b0
call fcn.140003a87
and al, 0xa6
test eax, 0x634de80e
invalid
lea r11, [rsp + 0xf0]
mov eax, esi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
call fcn.1400060b7
add dword [rdx + 0x41e8ec8d], esp
call rsp
test edi, 0
call fcn.14000e802
int1
add dl, byte [rbx - 0x74b7173c]
and al, 0x50
call fcn.140007722
adc al, 0xb2
and al, 0x3d
invalid

Function at 0x1400052e4
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pop r15
jp 0x1400058ae
nop
jnp 0x1400058ae
xor ebx, ebx
call fcn.14000d8f6
invalid
push r12
ja 0x1400060f4
mov rax, rax
jbe 0x1400060f4
call fcn.140004197
call fcn.140008122
mov dword [rsp + rdi*4 - 0x16], edx
call 0x103e94493
mov eax, dword [rax]
add byte [rax - 0x75], cl
js 0x14000536f
movzx eax, byte [rdi + 2]
imul rax, rax, 0x38
call fcn.140007d5b
and byte [rdx], bl
invalid
invalid
ret
mov r12, qword [rsp + 8]
jb 0x14000f310
mov rdx, rdx
jae 0x14000f310
popfq
jp 0x140003c61
mov r8, r8
jnp 0x140003c61
push rcx
lea rcx, [0x14001129b]
call fcn.14000e2b6
invalid

Function at 0x1400057f9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push rbx
jo 0x140009383
mov r12, r12
jno 0x140009383
lea rdx, [rsp + 0x70]
call fcn.14000dd40
invalid

Function at 0x14000590b
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov edi, dword [rsi]
cmp byte [rax], al
add bl, al
mov qword [rsp + 8], rbx
call fcn.14000ec75
js 0x1400058a9
jrcxz 0x140005902
jne 0x14000a442
xor eax, 0x9f4597e0
call fcn.14000f0f5
scasb al, byte [rdi]
stosd dword [rdi], eax
mov ah, 0x32
call sub.KERNEL32.dll_SetCommBreak
mov ebx, dword [rsp + 0x58]
call fcn.140008cc4
lahf
lodsd eax, dword [rsi]
js 0x140006478
call 0xf646e67e
invalid
invalid
cmp esi, ebx
mov ebp, ecx
test r11, 0
jnp 0x14000645d
cmp ebx, 0x10000
jbe 0x14000aec3
jbe 0x140008d0e
call fcn.1400089e2
cmp eax, 0xe8db5398
test rax, 0
call fcn.140009d4f
sub eax, 0xe8357f78
add dword [rsi + 8], ebp
call fcn.14000befe
wait
invalid
call fcn.14000bd16
invalid
Function at 0x140005933
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rsi, qword [rsp + 8]
jp 0x14000560c
xchg bh, bh
jnp 0x14000560c
ret
push rsi
jb 0x140002a07
mov rdi, rdi
jae 0x140002a07
call fcn.14000f51b
jmp 0x140008a84

Function at 0x140005b53
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov r9, qword [rsp + 8]
jb 0x140006321
mov ah, ah
jae 0x140006321
push r9
jp 0x140001353
mov rdi, rdi
jnp 0x140001353
lea rcx, [0x140011e51]
movsxd r9, dword [r9]
jmp 0x14000c1ad
pushfq
jo 0x1400028df
mov rsi, rsi
jno 0x1400028df
lea rcx, [0x1400115e6]
call fcn.140007ff7
scasb al, byte [rdi]
fimul dword [rcx + 0x27]
call 0x141514f13
lea ecx, [rdx + 1]
call qword [0x14001149f]

Function at 0x1400060b7
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov r14, qword [rsp + 8]
jg 0x140002990
nop
jle 0x140002990
jo 0x1400060de
call fcn.140006f90
cmpsd dword [rsi], dword [rdi]
test byte [rbx - 0x3f7a17f5], cl
cmove eax, ecx
jmp fcn.14000d804
movsxd r14, dword [r14]
jg 0x14000f300
push r14
jb 0x140002557
xchg r9, r9
jae 0x140002557
invalid
pushfq
jo 0x1400042c0
xchg r14, r14
jno 0x1400042c0
movsxd r12, dword [r12]
jp 0x1400038bc
xchg di, di
jnp 0x1400038bc
mov ebx, eax
call fcn.14000e2b6
clc
invalid

Function at 0x140006261
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sbb al, 0
add byte [rax - 0x75], cl
iretd
mov r12, qword [rsp + 8]
je 0x14000b470
mov rsi, rsi
jne 0x14000b470
mov ebx, 0x94
lea rdx, [0x140011ed4]
call fcn.140006d68
loop 0x1400015a6
invalid
test edi, 0
jb 0x14000e5e6
cmp rax, rbx
push r12
jmp 0x1400015fd
xor rdx, 0x3555125a
ja 0x140001a27
xchg r9, r9
jbe 0x140001a27
mov ebx, eax
test dx, 0
call fcn.140002a38
test al, 0x8f
sbb eax, 0x8348e81b
invalid
call fcn.140006d44
add eax, 0x55e826f5
push rbp
movsxd r12, dword [r12]
jl 0x14000ef60
mov bp, bp
jge 0x14000ef60
call qword [0x140011b6e]
mov esi, eax
test edx, 0
js 0x14000540a
test eax, eax
call fcn.140007df1
sar dword [rax + rdi*4], 0xdb
call 0x103c23fef
pop rax
ja 0x14000bd25
xchg r14, r14
jbe 0x14000bd25
pushfq
ja 0x14000893d
mov rcx, rcx
jbe 0x14000893d
cmp dword [rbp + 0x1c8], 0
call fcn.140003c18
invalid
pushfq
jb 0x140004b6a
xchg dx, dx
jae 0x140004b6a
test r8, 0
call int.14000d8be
xor al, byte [rcx]
xlatb
and ebp, eax
test dh, 0
jo 0x140008969
test byte [rbp - 0x80], 0x10
call fcn.140007356
sbb eax, edx
outsb dx, byte [rsi]
fsub st(0), st(0)
mov rsp, r11
call fcn.140002a38
xchg ebx, eax
push rbp
sbb eax, 0xf748e81b
ret 0

Function at 0x140006c94
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r9
jb 0x14000adb0
nop
jae 0x14000adb0
mov r9, qword [rsp + 8]

Function at 0x140006d68
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r8
jb 0x14000b8b7
mov r12, r12
jae 0x14000b8b7
lea rcx, [rbp - 0x19]
mov ebx, eax
call fcn.14000302f
lea rcx, [rbp - 0x39]
call fcn.14000302f
lea rcx, [rbp + 7]
call fcn.14000befe
jmp 0x128f17137
Function at 0x140006d9b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r10
jg 0x140009601
mov bh, bh
jle 0x140009601
mov r10, qword [rsp + 8]
ja 0x14000c128

Function at 0x1400071f0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rsi, qword [rsp + 8]
js 0x14000d10c
xchg rcx, rcx
jns 0x14000d10c
push rsi
jl 0x140004092
xchg al, al
jge 0x140004092
mov qword [rax + 8], rbx
push rdi
test ch, 0
jne 0x14000db43
call fcn.140008270
invalid
test dword [rdx - 0x90000a8], ecx
ret 0xe800

Function at 0x1400072d2
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
in eax, dx
mov dl, 0
add al, ch
xor eax, 0x3f300000
mov r10, qword [rsp + 8]
jo 0x1400059a1
mov ah, ah
jno 0x1400059a1
test dh, 0
jnp 0x140002408
cmp edi, 0xffffffff
call fcn.1400094b4
stc
ret 0x3ef6
movsxd r10, dword [r10]
jb 0x14000ab48
xchg ch, ch
jae 0x14000ab48
mov r11d, dword [0x140011d1f]
mov eax, dword [rsp + 0x30]
call fcn.140007d5b
xor eax, 0xe831d517
sub qword [rsp + 0x10], r10
jmp 0x14000e85b
push r10
jmp 0x140003aa8
xor r10, 0x13f12c70
je 0x140005a08
mov di, di
jne 0x140005a08
pushfq
ja 0x140008bb6
xchg r9, r9
jbe 0x140008bb6
popfq
je 0x1400089f0
mov rdx, rdx
jne 0x1400089f0
call qword [0x140011e71]
lea rcx, [rsp + 0x30]
call fcn.14000302f
lea rdx, [rsp + 0x70]
call fcn.14000c097
add cl, byte [rcx]
xchg dh, al
call 0x160252d55
mov bl, 0
add byte [rax], al
mov rbx, rax
call fcn.140003bda
mov rcx, qword [rax + 0x10]
call fcn.14000abe1
sbb al, 0xfe
outsb dx, byte [rsi]
call 0x1645d71f4
or byte [rax - 0x77], cl
je 0x14000e8d5
adc byte [rdi + 0x49], dl
test edi, 0
jnp 0x1400085ab
sub rsp, 0x420
mov rax, qword [rcx + 0x10]
mov rdi, rcx
call fcn.140007d5b
xchg esp, eax
cmp esi, edx
xor eax, ebp
invalid
ret

Function at 0x140007356
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push r9
js 0x140004268
mov r11, r11
jns 0x140004268
and dword [rdi + 0x18], 0
mov qword [rdi + 0x10], rsi
call fcn.140007356
cwde
invalid

Function at 0x1400075a3
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 8], rbx
call fcn.14000e2b6
mov dl, byte [rcx - 0x7f]
cmc
call 0xddc5f6ff
jp 0x1400075f2
invalid

Function at 0x140007722
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push r14
jg 0x14000a256
nop
jle 0x14000a256
movsxd r10, dword [r10]
js 0x140004077
xchg cl, cl
jns 0x140004077
mov r14, qword [rsp + 8]
jb 0x140001200
mov rdx, rdx
jae 0x140001200
add qword [rsp + 0x10], rbx
je 0x14000440f
mov bp, bp
jne 0x14000440f
jnp 0x14000a7f3
test eax, eax
call fcn.14000b123
movabs eax, dword [0xffd30ee8e827123d]
push rsi
mov byte [rax], 0xf
or byte [rax], 0xe3
invalid
mov dword [rax], 0xf000000
mov eax, dword [rbx + 0x25]
add byte [rax], al
Function at 0x1400079b0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push r10
jl 0x14000b192
mov sp, sp
jge 0x14000b192
test r15, 0
jnp 0x14000aeaa
add rsp, 0x20
call fcn.14000cb90
jns 0x1400079e3
fadd st(0)
call 0x14484893a
insd dword [rdi], dx
add byte [rax], al
ret