joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042726
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add r8b, r8b
push rbp
mov r8, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x7d833733
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14052fef4
je 0x140651c28
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.14057450f
push r10
movabs r10, 0x828524957e2fac36
xor r10d, 0x8b9b2686
mov qword [rsp + 0x18], 0xffffffffd5e8fa20
mov r11, qword [rsp + 0x10]
mov r10w, 0x750e
setne r10b
shl r10d, 0xa6
lea r10, [r10 + r10*2 - 0x2fe5f4ea]
add r10b, r10b
jg 0x140651c5e
mov r10, qword [rsp]
call fcn.140039b51
sbb dword [rax + rdx*2 - 0x2dba3219], esi
add ah, ah
and bl, byte [rcx]
rol eax, 1
fiadd dword [rsi + 0x32]
push rdi
pushfq
movabs rdi, 0x2a1eca99cc2a82ad
push r9
push r11
movabs r9, 0x852fb99008a0d4a5
movabs r11, 0x28b480007a55d32
test r9b, dil
mov rdi, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xfffffffff78a5882
mov r9, qword [rsp + 8]
lea r11, [r11 + r11*2 - 0x3ed8167c]
call fcn.14007f85c
mov eax, gs
xchg ecx, eax
lea esp, [rbx + 0x41aaf3ff]
push rax
pushfq
movabs r8, 0x771241ab1b052d82
shl r8b, 0xb8
jns 0x14002c31d
rep stosb byte [rdi], al
call fcn.14003deee
movdqa xmm0, xmmword [rsp + 0x180]
push r10
call fcn.1400bd5b0
movdqa xmmword [rsp + 0x350], xmm0
push r12
call fcn.1403723a1
movdqa xmm0, xmmword [rsp + 0x80]
push r15
movabs r15, 0xb0b5e818eaabae3f
push rsi
push r15
pushfq

Function at 0x1400447b8
Capabilities:
Encode data using base64

Disassembly:
push r11
pushfq
movabs r11, 0xc8b1fc159dbd6c18
call fcn.1400c52fe
fmul st(4), st(0)
jmp fcn.14069f050

Function at 0x140046a9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x140065087
jo 0x1400429f7
add qword [rsp], 0xd5055
add qword [rsp + 0x20], 0x842d
neg rdi
xor r13w, 0x928e
movabs rbp, 0x7328ea37899a4fbc
ret

Function at 0x14004716b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14038c8df
jmp fcn.1406a3880

Function at 0x140047170
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14038c8df
jmp fcn.1406a3880

Function at 0x14004889c
Capabilities:
Encode data using base64

Disassembly:
jns 0x1400c16bd
invalid
or r9w, 0x9a34
add word [rsp + 0x18], 0x3d24
xchg qword [rsp + 0x30], rax
mov r10, qword [rsp + 0x28]
and r9b, byte [rsp + 0x1c]
mov r13, qword [rsp + 0x18]
not r13b
ja 0x1400581fe
je 0x140027849
mov rbx, qword [rbx]
mov qword [rsp + 8], 0xffffffffa1909e2a
call fcn.14000155c
sti
mov esp, 0xe9cc31f9
mov ecx, 0x9f006694
adc ecx, esi
invalid
jle 0x14007bbb6
jmp fcn.1406d26e5
not byte [rsp + 0x18]
not qword [rsp + 0x18]
add qword [rsp], 0xffffffffbfc1d4f9
mov r13, qword [rsp + 8]
sub word [rsp + 0x18], 0x2280
call fcn.14006dc35
mov r9, qword [rsp + 0x10]
not r13w
jno 0x1400619b6
Function at 0x140049b90
Capabilities:
Terminate process

Disassembly:
adc eax, 0xa0b04d
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x258]
call fcn.14001b244
mov eax, dword [rsp + 0x50]
jmp 0x14000bbc8
add rsp, 0x3a0
pop rdi
ret
ret
push rsi
not rsi
test word [rsp], 0x894
call fcn.1403c217a
invalid
not sil
push r11
mov r11, rsi
movabs rax, 0x7d124f1d0d391227
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
jb 0x14000bb72
and esi, r11d
mov qword [rsp + 0x48], r11
shl si, 0x15
lea rax, [rax + 0x580c5a8]
jns 0x1400271e8
je 0x14004ba72
mov edx, dword [rax + 0xc]
stc
clc
jmp loc.14043f9d4
sub eax, eax
jmp 0x140017ee3

Function at 0x14004a695
Capabilities:
Packed with generic packer

Disassembly:
shl qword [rsp + 0x10], 0xf
push rbx
shl r14, 0xff

Function at 0x14004a6c4
Capabilities:
Packed with generic packer

Disassembly:
neg byte [rsp + r14*4 + 0x18]
add r14b, byte [rsp + r14*2 + 0x1e]
mov rbx, r14
add qword [rsp + 8], 0x3c6740
movzx ebx, bx
call fcn.1403561dc
neg edi
sub rdi, qword [rsp + rdi - 0x79acd66a]
test r14w, 0xd81
push rbx
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
jg 0x140426f05
shr r15d, 0xfb
mov r15, qword [rsp + r15 + 0x34]
setae byte [rsp + 0x40]
not byte [rsp + 0x40]
jbe 0x14004a6a0
neg byte [rsp + 0x18]
or dword [rsp + 0x40], 0xdbd48a8
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
ret

Function at 0x14004fa08
Capabilities:
Encrypt data using speck

Disassembly:
push rdi
call fcn.1403b1b31
call fcn.140420c57
mov esi, ebx
xor ecx, esp
jmp fcn.1406b2b70

Function at 0x140050e54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and bp, 0x7b23
add qword [rsp], 0x30696c
movabs rbx, 0x8923708b7b8d4427
shr rbx, 0xb7
call fcn.140097195
wait
mov edi, 0x664009e9
add byte [rax], ah
sbb eax, 0x8d2f3dd0
and ebp, ebx
lahf
sahf
fsub st(2)
mov edi, 0x129d240e
sbb al, byte [rsi + rdi*4 + 0x20]
fstp qword [rdi + 0x1d20a9c1]
xor al, 0xf9
jmp 0x140050ebc
int3

Function at 0x140050fc8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop rax
call fcn.14037a85a
mov esp, ecx
jmp fcn.1406b50ee

Function at 0x14005403d
Capabilities:
Packed with generic packer

Disassembly:
sub r12, r12
xor r12b, r12b
sete r12b
not r12w
mov qword [rsp + r12*8 - 0x7ffc0], rax
shr r12w, 0xa4
cmp r12b, 2
jns 0x1403f89cc
mov r12b, 0x19
not r12b
and r12d, 0x7e30078f
add qword [rsp], 0xfffffffffff93ae6
mov rax, r12
shr r12b, 0x3b
push rsi
call fcn.1403d8f43
mov ds, word [rbp - 0x19]
ret

Function at 0x14005408f
Capabilities:
Packed with generic packer

Disassembly:
jne 0x14047a037
int3
fld xword [rdx]
sub bh, cl
invalid
call fcn.14046f6a3
add dword [rdx], ecx
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x14047a02c
cwde
invalid
Function at 0x14005acc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
neg word [rsp]
lea rax, [rax + r12 + 0x3baf5818]
xor qword [rsp + r12 + 0x110], 0xffffffffa93b680d
movabs r13, 0x153e7e94138cf209
add qword [rsp + 8], 0xfffffffffffc8655
lea rbx, [rsi*8 + 0x2e85c211]
neg bx
xor si, word [rsp + r12*2 + 0x215]
je 0x14005ac85
movsx r13w, bl
xchg qword [rsp + 0x48], rax
mov rbp, rax
push r15
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r15, r13
mov qword [rsp + 0x20], r15
lea rax, [rax - 0x141de6b]
sub r15, r15
sub rbx, qword [rsp + 0x20]
shl bpl, 0x5c
xor ebx, dword [rsp + r15 + 0x20]
call fcn.1403bdb19
push rdi
call fcn.1400330f9
jmp fcn.1406c6436
mov qword [rsp + r12 + 0x118], r12
je 0x140090da9
test word [rsp + 0x18], si
jne 0x14002c1f1

Function at 0x14005ae07
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rcx
push rdi
call fcn.1403c8de3

Function at 0x14005ae12
Capabilities:
Execute anti-debugging instructions

Disassembly:
add qword [rsp], 0xfffffffffffd769f
movabs rbp, 0x5c277abccc31db2a
call fcn.1404a4a73

Function at 0x14005ae3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0x4fe920ff
call fcn.14051e570
add dword [rax], eax
add byte [rax], al
jmp fcn.1406c6692

Function at 0x14005c2c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap ebx
push rdi
mov rcx, qword [rsp + rbx - 0x243765c2]
mov rcx, qword [rcx]
jge 0x14043b492
ja 0x140320087
sbb dword [rbx], edx
add dword [rax], eax
add al, 0xa2
add byte [rax], al
sub al, 0xd1
outsb dx, byte [rsi]
add byte [rax], al
add byte [rax], al
add dword [rcx + rax], eax
add byte [rdx + rax*2], al
add byte [rax], al
in eax, dx
pushfq
cmp ecx, esp
jmp fcn.1406c8922
mov qword [rsp + rbx*2 - 0x486ecbc4], rbx
movabs rdi, 0x3c10180a53801b8b
lea rdi, [r12 + r12*8 + 0x15237607]
or r12d, 0x1abdb324
push rdx
jge 0x1403b9a19
lea rcx, [rcx + 0x3baf5718]
lea rdi, [rbx*8 - 0x1ef0955e]
call fcn.14038def7
cmp dword [rcx], eax
add al, 1
add byte [rdx + rax*4], al
add byte [rax], al
call fcn.1404dd473
xchg ebx, eax
invalid
add qword [rsp + 8], 0xffffffffffc5830b
shl r14b, 0xbe
and r14w, r14w
mov rcx, r14
push rbp
je 0x14036fb2b

Function at 0x14005c2f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap ebx
push rdi
mov rcx, qword [rsp + rbx - 0x243765c2]
mov rcx, qword [rcx]
jge 0x14043b492
ja 0x140320087
sbb dword [rbx], edx
add dword [rax], eax
add al, 0xa2
add byte [rax], al
sub al, 0xd1
outsb dx, byte [rsi]
add byte [rax], al
add byte [rax], al
add dword [rcx + rax], eax
add byte [rdx + rax*2], al
add byte [rax], al
in eax, dx
pushfq
cmp ecx, esp
jmp fcn.1406c8922
mov qword [rsp + rbx*2 - 0x486ecbc4], rbx
movabs rdi, 0x3c10180a53801b8b
lea rdi, [r12 + r12*8 + 0x15237607]
or r12d, 0x1abdb324
push rdx
jge 0x1403b9a19
lea rcx, [rcx + 0x3baf5718]
lea rdi, [rbx*8 - 0x1ef0955e]
call fcn.14038def7
cmp dword [rcx], eax
add al, 1
add byte [rdx + rax*4], al
add byte [rax], al
call fcn.1404dd473
xchg ebx, eax
invalid
add qword [rsp + 8], 0xffffffffffc5830b
shl r14b, 0xbe
and r14w, r14w
mov rcx, r14
push rbp
je 0x14036fb2b
Function at 0x14005d71c
Capabilities:
Parse pe header

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.140620483

Function at 0x14005dfb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add al, ch
int3
call fcn.14048732d
jne 0x14005df80
jmp fcn.1406cbfa6

Function at 0x14005e160
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
call fcn.1403d9e01
or ah, 0xcc
jmp fcn.1406cc317

Function at 0x140060101
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rdx, qword [rsp + 0x20]
mov r13b, 0xa7
mov r10b, byte [rsp + rcx - 0x3583019c]
call fcn.1400340bf

Function at 0x140060116
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1403a7b35
push rdi
jmp fcn.1406cf902

Function at 0x14006011c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1403a7b35
push rdi
jmp fcn.1406cf902

Function at 0x1400619bc
Capabilities:
Encode data using base64

Disassembly:
jns 0x1400c16bd
invalid
or r9w, 0x9a34
add word [rsp + 0x18], 0x3d24
xchg qword [rsp + 0x30], rax
mov r10, qword [rsp + 0x28]
and r9b, byte [rsp + 0x1c]
mov r13, qword [rsp + 0x18]
not r13b
ja 0x1400581fe
je 0x140027849
mov rbx, qword [rbx]
mov qword [rsp + 8], 0xffffffffa1909e2a
call fcn.14000155c
sti
mov esp, 0xe9cc31f9
mov ecx, 0x9f006694
adc ecx, esi
invalid
jle 0x14007bbb6
jmp fcn.1406d26e5
not byte [rsp + 0x18]
not qword [rsp + 0x18]
add qword [rsp], 0xffffffffbfc1d4f9
mov r13, qword [rsp + 8]
sub word [rsp + 0x18], 0x2280
call fcn.14006dc35
mov r9, qword [rsp + 0x10]
not r13w
jno 0x1400619b6

Function at 0x1400651e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r11
mov rbp, r10
call fcn.140008b07
sub byte [rax + 0x2060164], dl
add byte [rsi], al
push rdx
add dh, byte [rax]
jmp fcn.1406d8d0e

Function at 0x1400651fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r11
mov rbp, r10
call fcn.140008b07
sub byte [rax + 0x2060164], dl
add byte [rsi], al
push rdx
add dh, byte [rax]
jmp fcn.1406d8d0e

Function at 0x140066740
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140079ec0
mov word [rdx - 0x16333334], ds
lock add byte [ebp + 0xf], ah
invalid
Function at 0x14007966e
Capabilities:
Packed with generic packer

Disassembly:
not r8b
test r8b, r8b
lea r8, [r8*4 - 0x31e0b4d1]
lea rcx, [rcx + r8 + 0x6f8ef0f6]
mov qword [rsp + r8*2 + 0x63c161ca], r8
call fcn.14039a036

Function at 0x140079691
Capabilities:
Packed with generic packer

Disassembly:
push r11
movabs r11, 0xcd36fa2f1222020a
pushfq
test r11b, 7
xchg qword [rsp + 0x18], rax

Function at 0x140079779
Capabilities:
Hash data with crc32
Packed with generic packer

Disassembly:
mov rbp, rbx
mov rbx, qword [rsp + 0x18]
push qword [rsp + 0x10]
popfq
mov r10, qword [rsp + 8]
mov rbp, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
sub r10b, 0x90
mov qword [rsp + 0x38], rcx
jge 0x14000821f
xor dword [rsp], 0x8125322d
xchg qword [rsp + 0x28], rdx
mov r10, qword [rsp + 8]
cmp qword [rsp], 0xffffffffd40fbc17
jo 0x14039760f
not byte [rsp]
sub dword [rsp], 0xddacb687
call fcn.14032637d
jno 0x1403edcc1
jmp fcn.140676264
push rbx
pushfq
add qword [rsp + 0x10], 0x383894
mov rcx, qword [rsp + 0x28]
movabs rbx, 0x18191a050faac223
neg bl
lea rbx, [rbx + rbx*2 + 0x1b13af0b]
or bl, 0x1f
shr bx, 0x29
lea rcx, [rcx + 1]
push r10
mov bx, 0xe526
push rbp
movabs r10, 0x18697a0bb87959c
sub r10w, 0x8b34
jno 0x1403f3460
ret
call fcn.14009558e
std
sub dword [rax], ecx
invalid
jg 0x14002b0e9
push rsi
jbe 0x1403f343c
adc byte [rdi], 0x1a
mov ecx, 0xeba10b3a
lea eax, [rsp + rsi*4]
invalid

Function at 0x14007a888
Capabilities:
Encode data using xor

Disassembly:
mov r13, rdx
jno 0x140358517
movabs byte [0x87006710c6e9cc93], al
invalid
js 0x1400cd2ff

Function at 0x14007bb29
Capabilities:
Packed with generic packer

Disassembly:
add word [rsp + r15 - 0xffffe0], 0xa788
jg fcn.1404426c5
jg 0x1403d8326
mov r15, qword [rsp + r15 - 0xfffff0]
test byte [rsp + 0x20], 0xbe
je 0x140039b77
jo fcn.140310531

Function at 0x14007d533
Capabilities:
Hash data with crc32
Packed with generic packer

Disassembly:
mov r9, qword [rsp + r9*4 - 0xfee248]
je 0x1403525e7
js 0x140661e39
jae 0x140426ef1
pop rsp
adc dword [rdi + 1], eax
or byte [rcx], al
add byte [rax], cl
and al, byte [rax]
add byte [rdx + 0x17], dl
movsq qword [rdi], qword [rsi]
nop dword [rax]
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
call fcn.14057450f
call fcn.140377be8
pop rsp
push r12
pushfq
movabs r12, 0xa2306482d78aa0b1
test r12d, 0x80ba9d06
setg r12b
mov r12, qword [rsp + 8]
mov qword [rsp + 8], 0xfffffffffdb7af6e
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14055bab0
invalid

Function at 0x14008433e
Capabilities:
Encode data using xor

Disassembly:
jne 0x14007a093
je 0x140084349
int3
fbld tbyte [rbp + 0x67]
add byte [rbx + 0x35534ea8], dh
invalid

Function at 0x14008940e
Capabilities:
Encode data using xor

Disassembly:
push r13
pushfq
movabs r13, 0x243ecdb0710f2437
shl r13, 0x5f
xor r13b, 0x1a
shl r13d, 0xb8
add r13d, 0xcdbf091b
mov qword [rsp + 0x18], 0x779f7227
mov r13, qword [rsp + 8]
jge 0x140089410
popfq
lea rsp, [rsp + 0x10]
call fcn.14057450f
Function at 0x14008a5c9
Capabilities:
Hash data with crc32

Disassembly:
mov rdx, qword [rsp + 0x30]
neg byte [rsp + 0x18]
jo 0x14043f0cf
ja 0x14002b100
shl dword [rsp + 0x30], 0x89
neg qword [rsp + 0x30]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1400c58b0
Capabilities:
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + 0x88]
jno 0x140067ff4
jae 0x1400d0cec

Function at 0x1400d0ca6
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14051e570

Function at 0x1400d0cb5
Capabilities:
Packed with generic packer

Disassembly:
shl r8b, 0xd4
jne 0x14007bfda
lea rax, [rax + r8 - 0xf3ca044]
jns 0x14007975f
sub r8w, 0x958a
mov r8, qword [rsp + r8*2 - 0x26abd4e4]
lea rsp, [rsp + 0x18]
ret
call fcn.1400bcaa5
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14055bab0
jmp fcn.140008d43
not r8
shl r8d, 0x8e
jbe 0x140026eb6

Function at 0x1400d0e2b
Capabilities:
Packed with generic packer

Disassembly:
push rdx
pushfq
movabs rdx, 0xa92ec4b247165f83
not edx
shl dl, 0xa9
mov rsi, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xfffffffffff8f4d1

Function at 0x1403032b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movabs rcx, 0xe12f81222505be2f
test rcx, 0xffffffff96aa8797
movabs r8, 0xcab41d2e3e1db919
call fcn.140473969
Function at 0x14031880b
Capabilities:
Hash data with crc32
Packed with generic packer

Disassembly:
call fcn.1404a4959
lea r11, [r11 + r11 - 0x28ea0fcc]
jbe 0x1403202f3
jns 0x1400986cb
mov qword [rsp + 0x10], rax
jge 0x140035daf
push rdx
sets byte [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
jg 0x140426f00
not word [rsp + rcx - 0x1e1a336f]
jno 0x140494646
loopne 0x14032035c
cmpsd dword [rsi], dword [rdi]
je 0x14032036a
movabs dword [0x58afec84ca056753], eax
mul dword [rsi + 0x1b]
pop rbx
add dword [ebx + 0x4b69e753], ebx
xor al, 0x56
invalid
outsd dx, dword [rsi]
ficom word [rbx + 0x27]
sub dword [rdi], ebx
jae 0x1403203b5
invalid
clc
xchg r8d, eax
stc
cmc
invalid
jge 0x1403203b1
loop 0x1403203e3
mov al, 0xea
js 0x14032036c
xchg esp, eax
and cl, byte [rdx]
add dword [rdx + 0x529a522a], eax
movabs al, byte [0xf9c1842f5028de45]
and al, 0x84
pushfq
pop r14
sbb dl, byte [rax - 0x60]
add al, 0xde
jrcxz 0x1403203a8
jae 0x14032035b
xchg edx, eax
test eax, 0x27fa18ad
pop rsi
mov al, 0x62
jl 0x140320360
push rdx
jns 0x1403203fb
int3
call 0x122d2b7da
mov esp, 0xb6477c82
invalid
mov dh, 0x17
xchg byte [rbx + 0x62179baa], bh
rcr dword [rcx + 0x51683149], 0x9d
out dx, eax
invalid
stosb byte [rdi], al
wait
invalid
mov bh, 0x98
cmc
jp 0x140320442
sbb eax, 0xe44f511d
adc al, 0xe1
push rsp
popfq
invalid
jp 0x140320438
sal esi, cl
cmpsd dword [rsi], dword [rdi]
loopne 0x140320474
xchg esp, eax
mov eax, 0xa696de47
popfq
insb byte [rdi], dx
invalid
push rsi
scasb al, byte [rdi]
movabs byte [0xd38b065a460cb34c], al
invalid
loopne 0x140320418
setne byte [rsi - 0x5d12e3f4]
mov cl, byte [rcx]
mov eax, 0x14dd466a
or dword [rax + 0x14dd466a], edi
cmpsb byte [rsi], byte [rdi]
adc al, 0x6c
mov bh, 2
movsb byte [rdi], byte [rsi]
stc
je 0x1403204be
invalid
mov byte [rsi], cl
popfq
mov bl, 0x7b
invalid
lodsd eax, dword [rsi]
loopne 0x140320449
retf
call fcn.14003dc18
movabs rbx, 0x4d2d9d2cf3af472d
test r14d, ebx
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x18], 0x8982
lea rdi, [rdi + 0x93615b2]
jb 0x1400796a7
sub r14w, word [rsp + 0x1e]
call fcn.14049b013
xor qword [rsp + rcx - 0x1e1a336f], 0x660d101e
test word [rsp + rcx - 0x1e1a336f], cx
call fcn.140450bd5
je 0x1400cfe9a
or eax, 0xffffffff
lock xadd dword [rcx + 0x15c], eax
jmp fcn.14007fd5a

Function at 0x140352623
Capabilities:
Encode data using base64

Disassembly:
mov r10, qword [rsp + 0x58]
cmova r15d, ebx
shl r15b, 0x27
bswap ebx
call fcn.14001c787
Function at 0x1403647f1
Capabilities:
Encode data using base64

Disassembly:
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdi
push r11
movabs r11, 0xe793da312203f514
push rbx
movabs rbx, 0x5b908d857f0c3a15
and r11d, 0x6135b92d
lea rbx, [rbx + rbx - 0x24c6176e]
not ebx
add qword [rsp + 0x20], 0x4c0eb6
movabs rdi, 0xfb1d321e9bd7c0b
push rcx
cmp ebx, edi
bswap r11
jl 0x140092646
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
jge 0x140431b33
mov rcx, r11
ja 0x1403a1d73
not rbx
lea rdi, [rdi - 0x6d4f2750]
xor r11d, r11d
call fcn.14002f291
xor r9w, 0x1d02
mov r9, qword [rsp + r15 - 0x5104d6e8]
sub qword [rsp + r15 - 0x5104d6c8], r15
add qword [rsp + r15 - 0x5104d6f0], 0xffffffffbfc0924f
mov r15b, byte [rsp + r15 - 0x5104d6c7]
test qword [rsp + r15 - 0x5104d71a], r15
je 0x1400488c0
shl r15, 0x86
shl qword [rsp + 0x38], 0xf2
mov r15, qword [rsp + 0x30]
add dword [rsp + 0x38], 0xd6287995
or qword [rsp + 0x38], 0x2310f596
and word [rsp + 0x38], 0xa5a9
cmp qword [rsp + 0x38], 0x4fb86d10
call fcn.1404d1bcc

Function at 0x14037a7e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0xfb81d715
add qword [rsp + 0x48], 0xbbea
mov qword [rsp + 0x20], r12
push rsi
lea rax, [rax + r12*4 - 0x67cdec58]
mov rsi, rbp
call fcn.140398636

Function at 0x14038f22d
Capabilities:
Hash data with crc32

Disassembly:
cmp ebx, 0xe38fd53a
jne 0x140398bfe
movsd dword [rdi], dword [rsi]
add dword [rcx], edx
add al, byte [rax]
adc dword [rcx], eax
adc eax, 0x62ffe800
add al, byte [rax]
seto byte [rsp + 0x28]
xor dword [rsp + 0x28], 0xad235733
jns 0x1404db6db
mov word [rsp + 0x28], 0x6a29
test qword [rsp + 0x28], 0xffffffffd3b2c4b9
call fcn.140049e90
mov rdx, qword [rdx]
js 0x1404af9bf
jl 0x140338be3
and byte [rsp + 0x28], r10b
test word [rsp + 0x2c], r10w
mov r10, qword [rsp + 0x40]
jno 0x140031702
jne 0x1404d0018
jb 0x14032e51e
jg 0x140029a9f
cmp r10b, byte [rsp + 5]
lea rdx, [rdx + 0x2f39ba06]
not byte [rsp]
bswap r10
sete byte [rsp]
lea r10, [r10*4 + 0x62cf63e]
jle 0x14002b0f8
invalid

Function at 0x1403975a4
Capabilities:
Encrypt data using speck

Disassembly:
mov r15, qword [rsp + r13*8 - 0x19a4e50]
cmp word [rsp + r13*2 - 0x669388], 0x2585
jle 0x14042eabd
cmp word [rsp + r13 - 0x3349b0], 0xc126
call fcn.140363385
test r15, rbx
jae 0x14007ae41

Function at 0x1403a44d2
Capabilities:
Encode data using xor

Disassembly:
jo 0x140029215
mov qword [rsp + 0x18], r12
call fcn.1403f3a83
rol byte [rcx - 9], cl
fiadd dword [rcx - 0x40]
invalid
movabs rbx, 0xa1344982340ab128
xor r12w, bx
or r12b, r12b
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
shr r12, 0x18
xor r12d, 0xd487a50c
je 0x1403fc6ac
jno 0x140388bf1
jnp 0x1403a454e
jno 0x1403a44a3
pop rbp
cmc
fadd qword [rdx + 0x32]
mov edi, 0xb2a2ea96
sub al, 0xac
and al, 0xbd
adc byte [rsi + 0x6d3d1084], cl
invalid
sbb al, 0x3d
lea ebp, [rdi]
stosb byte [rdi], al
out 0x42, al
lodsb al, byte [rsi]
add al, 0xb6
and edi, dword [0x156bc1c48]
fst st(6)
invalid
Function at 0x1403a7489
Capabilities:
Terminate process

Disassembly:
add qword [rsp], 0xd0b6f
call fcn.14004b9f9
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14053949b
pushfq
call fcn.14048637b
jmp fcn.1406ebf35
neg r8
cmp byte [rsp + 0x28], 0xa6
jo 0x140049b98
xor r14d, 0xf2bee8a5
shr di, 0xe5
xor dword [rsp + 0x38], r14d
mov r14, qword [rsp + 8]
jno 0x14007ac7d

Function at 0x1403c8de3
Capabilities:
Packed with generic packer

Disassembly:
movabs rdi, 0xb8575a9f928f33a
not byte [rsp + r8 - 0x6678eab3]
xor dword [rsp + 0x30], 0xee1fd083
neg r8w
je 0x1403ddd15
xchg qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + r8 - 0x667814cd]
push qword [rsp + 0x48]
popfq
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x10]
lea rsp, [rsp + 0x60]
ret 8
push r13
shl r15b, 0x92
jns 0x14005134c
lea rax, [rax - 0x3cc6decc]
jae 0x1400d0e1f

Function at 0x1403dc9bd
Capabilities:
Hash data with crc32
Packed with generic packer

Disassembly:
movabs r10, 0x65a5f09b2214c534
push r10
mov r15, r10
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
neg r15w
sub dword [rsp], 0xf03aec2c
cmp r15d, r10d
lea rdi, [rdi - 0x3e72b876]
ja fcn.140079779
mov qword [rsp + 0x28], r15
movsx r15w, r15b
push r9
xchg qword [rsp + 0x38], rdi
mov r10, qword [rsp + 0x18]
add qword [rsp + 0x10], 0xffffffffbffae991
cmp dword [rsp + 0x30], 0x4d04d9b9
jns 0x14033213b
call fcn.140431a68

Function at 0x1403de236
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x3ddfe7
lea r10, [r10*8 - 0x33ff74ec]
mov rcx, r10
lea r10, [r10 + r10 - 0x7e574b76]
cmp r10w, 0x31b6
push rbp
jl 0x1404460d8
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
cmp r9, r10
call fcn.1403e7057
call fcn.14044a9a6
add al, 0x5f
invalid

Function at 0x1403eb8cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + r11 + 0xf], r11
lea rdx, [rdx*8 + 0x44a46a93]
call fcn.1404bbcef
shr bl, 0x85
nop
or bx, bx
jg 0x140399b13
movzx bx, bl
sete bl
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
neg bx
sub bx, 0x3d1f
sub rbx, 0x43097735
ja 0x140412ba5
xor bl, 1
jle 0x1400bda34
neg r15d
call fcn.1403aa2ff
jg 0x1402ffb0d
movsx r10, r13b
movsx r10d, r10w
call fcn.1400998dd
invalid
xor bx, bx
mov qword [rsp], rbx
jl 0x140049785
lea rbp, [rbp - 0x95c13e8]
shr byte [rsp], 0x5b
shr qword [rsp], 0xbc
jbe 0x14008dbe9
sar dword [rcx - 0x67], 1
adc dword [rbp + 0x519cdd17], eax
invalid

Function at 0x1403ee411
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax + 0x3f923d2e]
neg r14d
call fcn.14048e108
jle 0x14041c5e4
movabs r15, 0x14b5853158b149a5
mov rax, qword [rsp + rax + 0x5f7187f8]
mov rax, qword [rax]
push rbp
mov qword [rsp + 0x30], rax
je 0x1404713e5
movabs rbp, 0xc9d5a13533a55ab
movabs r12, 0x4c09212fb5ba1b14
call fcn.140079e09
push rax
push rsi
pushfq
movabs rsi, 0x9ebef1260b04e291
shr rsi, 0x33
and esi, 0xe2047495
and si, 0x8688
call fcn.1403c5b8a
mov dword [rbx - 0x7270dce1], eax
pushfq
invalid
jno 0x14000595f

Function at 0x1403f0b66
Capabilities:
Encode data using xor

Disassembly:
jae 0x1400914cd
insd dword [rdi], dx
and eax, 0xa7f0a5e8
invalid