joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c45cc
Capabilities:
Get geographical location

Disassembly:
adc eax, 0xa9f8a7
adc eax, 0xa91fa4
test eax, eax
je 0x140074e39
test r15, r15
je 0x140074db0
mov dword [r15], ebx
mov ecx, dword [rbp - 0x1c]
lea rdx, [rsi + 0x2f0]
xor r9d, r9d
lea esi, [r9 + 0x55]
mov r8d, esi
call fcn.1400675f0
test rdi, rdi
je 0x140074e32
mov ecx, dword [rbp - 0x1c]
lea rdx, [rdi + 0x120]
xor r9d, r9d
mov r8d, esi
call fcn.1400675f0
mov ecx, dword [rbp - 0x1c]
mov esi, 0x40
mov r9d, esi
mov r8, rdi
mov edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140074e39
mov ecx, dword [rbp - 0x18]
lea r8, [rdi + 0x80]
mov r9d, esi
mov edx, 0x1002
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140074e39
lea rdx, [rdi + 0x100]
mov ecx, ebx
lea r9d, [rsi - 0x36]
lea r8d, [rsi - 0x30]
call fcn.140078744
mov eax, 1
jmp 0x140074e3b
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14004f3c0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmovg r14d, r12d
movzx r12, byte [rsp + 0x48]
xchg qword [rsp + 0x60], rsi
mov r12, qword [rsp + 0x28]
mov word [rsp + 0x48], 0x3726
jge 0x140646187
lea r14, [r14*8 + 0x2891d5a0]
jbe 0x140067580
shl qword [rsp + 0x48], 0x91
setb r8b
and r14, r14
mov r8, qword [rsp + 0x58]
or byte [rsp + 0x48], 0x2d
jle 0x140074d9b
shl r14w, 0x1f
or r14w, word [rsp + 0x49]
neg dword [rsp + 0x48]
mov r14, qword [rsp + 0x20]
mov word [rsp + 0x48], 0x92af
shl qword [rsp + 0x48], 0xc5
call fcn.14066311c

Function at 0x1404c6807
Capabilities:
Encode data using xor

Disassembly:
xor dword [rcx + rbp*8 + 0x2474ffff], esi
sbb byte [rbp + 0x24648d48], bl
xor al, ch
mov dh, 0x98
and eax, 0x7ded7e00
outsd dx, dword [rsi]
jmp 0x164c16809
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.1407200cc
jle 0x1404c6805
jge 0x1404c6889
test byte [rcx], 0x5f
cmpsd dword [rsi], dword [rdi]
or ebx, esi
or byte ds:[r9], 0xa
jb 0x1404c6803
call qword [rbx - 0x7b705f7]
insb byte [rdi], dx
or ecx, edx
test byte ss:[rcx + 0x59], 0x3c
invalid
int3

Function at 0x1404cdb1d
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0xffffffffffe884e7
mov r11b, 0x35

Function at 0x1404d15b8
Capabilities:
Enumerate processes

Disassembly:
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400013a3
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.140053d90
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
jb 0x14048cca6
jns 0x140001317
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1404d2484
Capabilities:
Authenticate hmac

Disassembly:
shr byte [rsp + r14 - 0x539900df], 0x10
js 0x1404cd1b1
mov r14, qword [rsp + r14 - 0x539900f7]
call fcn.140046c7b
jne 0x1405b1141
not byte [rsp + rdi - 0x5399cde2]
or dil, 0xab
xchg qword [rsp + rdi - 0x5399ce7b], rdx
mov rdi, qword [rsp + rdi - 0x5399ce83]
mov r14, qword [rsp + 0x20]
jl 0x1404b85b6
push rcx
call fcn.14064d9ee
Function at 0x1404d2714
Capabilities:
Encode data using base64

Disassembly:
mov r12, qword [rsp + r13*8 + 0x28]
mov qword [rsp + 0x28], 0x70488dc0
mov r13, qword [rsp + r13*2 + 0x18]
movabs r9, 0xd1852f3d439dfb34
cmp r9, 0xffffffffb2029539
mov r9, qword [rsp + 8]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.1407200cc

Function at 0x1404d2752
Capabilities:
Encode data using base64

Disassembly:
jbe 0x1403c157d
test r10w, 0x4729
jne 0x1406cf38d
add qword [rsp + 0x20], 0x40c295
call fcn.14060627f
mov r10, qword [rsp + 0x18]
mov qword [rsp + 0x18], rsi
push r12
push r13
jg 0x14056b958

Function at 0x1404d71ef
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
call fcn.140457c46
xchg esp, eax
add ebp, esp
xchg rdi, rax
cmp byte [rsi + riz*2 - 0xc4d9743], bh
or al, 0xbd
test al, 0xff
sbb bl, bl
mov dh, 0xa8
mov ah, 0x8f
push rbp
push rdi
invalid
mov qword [rsp + 0x20], rdx
push rdx
jg 0x1403ba2f5
mov rbx, qword [rsp + 0x18]
add qword [rsp + 0x20], 0xffffffffffe780e9
sub dword [rsp + rbx + 0x3fdc9c8a], 0x16862bbd
neg ebx
jae 0x140414756
movabs rbp, 0x9e99548033b5b413
push r14
push rbx
add word [rsp], bx
movabs r14, 0x20912d9930abc013
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + rbx*2 - 0x7fb938e4]
mov qword [rsp + 0x30], rbx
shr ebx, 0xc1
cmp bl, 0xa6
call fcn.1403bb972

Function at 0x1404d82c6
Capabilities:
Encode data using base64

Disassembly:
ja 0x14042c521
mov rbx, qword [rsp + 0x10]
xchg qword [rsp + 0x30], rbx
add r10, r10
add r10, r10
jl 0x1403e7627
mov r10, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
add qword [rsp], 0xe7b2b
mov qword [rsp + 0x10], 0xffffffffb701c10a
or qword [rsp + 0x10], 0xffffffffda099403
mov rbx, qword [rsp + 0x10]
not bl
mov rbx, qword [rsp + rbx + 0xf62a0c]
mov rbx, qword [rbx]
xor dword [rsp + 0x10], 0x8801de26

Function at 0x1404d8e41
Capabilities:
Packed with generic packer

Disassembly:
push r10
and bp, bp
xor bp, bp
xchg qword [rsp + 0x20], rdi
movabs r10, 0xd9ae5a0ef305fa28
push r13
bswap r10d
push rcx
js 0x1406858fc
movabs rcx, 0xc63e7922b6311717
and r10, rcx
push r11
mov rbp, qword [rsp + r10*2 - 0x406009f6]
mov qword [rsp + 0x30], rdi
mov r11, r10
setge cl
cmp ecx, 0x44b579a5
lea r10, [r11 + r11*4 - 0x2077d965]

Function at 0x140505436
Capabilities:
Get system information on windows

Disassembly:
jne 0x140508040
jae 0x1404d8e3b
Function at 0x14050749f
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x18], 0xfffffffffff7ca1a
add qword [rsp + r12 - 0x77fefed8], 0xffffffffbfbc9e10
shl edi, 0x7f
jbe 0x1407033a2
sub word [rsp + r12 - 0x77fefef8], r12w
jns 0x140464be1
mov rdx, qword [rsp + r12 - 0x77fefee8]
mov rdx, qword [rdx + rdi - 0x80000000]
shr qword [rsp + rdi - 0x7ffffff8], 0x30
jb 0x1404d594f
add qword [rsp + r12 - 0x77feff00], 0xffffffffbf956b36
shr qword [rsp + rdi - 0x7ffffff8], 0x11
jae 0x1406a9c7a
pop rcx
ret 0x3485
call fcn.140353205
xchg qword [rsp + 0x28], rsi
shr edx, 0x2f
js 0x1404192d9
neg edx
push rsi
jbe 0x1406bed54
sub dword [rsp + 0x10], 0x902ab9b1
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x10]
shl qword [rsp + 0x10], 0xb9
cmp byte [rsp + 0x10], 0x24
jg fcn.14044ce87
xor si, 0x8aa4
shr word [rsp + 0x10], 0x3c
shr qword [rsp + 0x10], 0x47
add qword [rsp + 0x18], 0xffffffffffe33b9c
movabs rsi, 0x1b2bc70dd6812988
setne byte [rsp + 0x20]
mov rsi, qword [rsp]
setae byte [rsp + 0x20]
shr word [rsp + 0x20], 0xe5
or word [rsp + 0x20], 0x3b0a
or bh, byte [rbx]
shl byte [rsp + 0x20], 7
call fcn.140719a70
cmp byte [rax + 0x18], bh
mov bl, 0x59
loopne 0x1407033bc
mov ds, word [rsi]
and dl, al
push 0x61659f67
mov eax, 0x6cad215c
stosd dword [rdi], eax
cmp eax, 0x4b818f1c
hlt

Function at 0x140508b39
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x10], rsi
mov qword [rsp + 8], rsi
push r9
movabs r9, 0xd729882702bf5804
pushfq
add qword [rsp + 0x10], 0xffffffffffe85293
movabs rsi, 0xbf96418ad59fb0ba
push rcx
movabs rcx, 0x26bdbcac51acc415
and esi, 0xf99d43a5
push r9
push r10
sub byte [rsp + 8], r9b
movabs r10, 0xd58ceb2f4a81d69a
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
and cl, byte [rsp + 0xe]
mov qword [rsp + 0x28], rcx
jl 0x14034df28
jl 0x1403ba9fc
jns 0x1405b07d7
call fcn.1406c2b1b

Function at 0x14050b129
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rsp + r9 - 0x908a5], 0x20
mov rcx, qword [rsp + r9*8 - 0x4845b8]
mov rcx, qword [rcx + r9 - 0x908bd]
jns 0x14043c538
add r9, r9
sub r11b, 0x96
jge 0x140408a52
invalid

Function at 0x14051211d
Capabilities:
Terminate process

Disassembly:
shl byte [rsp + 0x38], 0xca
xor dword [rsp + 0x38], 0x113da51a
call fcn.1405db817

Function at 0x14051212f
Capabilities:
Terminate process

Disassembly:
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
sets r11b
push rdi
mov ebp, 0x9b1f9a4
nop
movabs rsi, 0x6a0bf5b34599de3b
shr esi, 0x5d
cmp r11w, bp
jns 0x14005b851
cmp word [rsp + rbp*8 - 0x4d8fcd10], 0x21a7
mov rdi, qword [rsp + rsi + 0xe]
jg 0x1406461ff
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi]
neg byte [rsp + 0x10]
mov byte [rsp + rbp - 0x9b1f994], 0xb9
add rdi, r11
call fcn.1406029e7

Function at 0x140515c3d
Capabilities:
Encode data using base64

Disassembly:
push rsi
bswap r15
shr byte [rsp + 0x30], 0xb
shl qword [rsp + 0x30], 0x15
lea rbp, [rbp - 0x53d0fa51]
movabs rsi, 0x92ab3f024e1615b7
call fcn.14060ab14
Function at 0x140521c20
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1404d596f
xchg qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x50]
shr edi, 0xa9
add r12, r8
xor di, di
neg r8d
jae 0x1404c6edb
movabs rbp, 0xbb3b6d0978109b12
mov r8, qword [rsp + r8*2 - 0x17fd613c]
call fcn.14059281e

Function at 0x14052a228
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
jo 0x14065c39a
lea rax, [rax + rbp - 0x7a1ad3c0]
lea rbp, [rbp + rbp*4 + 0x1d200db2]
not rbp
mov qword [rsp + 0x28], rbp
jo 0x1403d067d
call fcn.1403cef87
jbe fcn.14034d2c0
lea rdx, [rdx - 0x5e4489f1]

Function at 0x140534370
Capabilities:
Encode data using base64
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
call 0x140534370
movabs r8, 0x636ef81a080f603
lea rcx, [r8 + r8*4 + 0x7632d521]
setb cl
movzx r8d, byte [rsp + 0x18]
lea rsi, [rsi + 0x3aa2d71a]
cmp byte [rsp + r9 - 0x17881d18], r9b
call fcn.140507164
push r13
mov rsi, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x8006944
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14076110b
jb 0x1408851d5
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1408697db
setle cl
push rbp
mov rbp, rcx
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xfffffffff9c19afe
mov rbp, qword [rsp]
jne 0x14042c4d6
push r10
push rdi
mov rdi, qword [rsp + rdi*2 + 0x20]
mov qword [rsp + 0x20], 0xffffffffbb785d58
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.14071c090
jns 0x140534322
pushfq
int 0xb9
invalid
push rcx
movabs rcx, 0x428925bf17373bbf
pushfq
add cx, 0xa3c
jne 0x1405e67aa
invalid

Function at 0x14053746c
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + rcx*4 + 0x4346c0ac], rsi
neg cl
jne 0x140491224
invalid

Function at 0x14053e4a4
Capabilities:
Encode data using base64

Disassembly:
add word [rsp + 0x20], 0xbd28
mov byte [rsp + 0x20], 0x25
jno 0x140409cd7

Function at 0x14053e87a
Capabilities:
Encode data using base64

Disassembly:
call fcn.14040850c
shl qword [rsp + 0x60], 0xdc
jbe 0x1403ca02a

Function at 0x14053e886
Capabilities:
Encode data using base64

Disassembly:
shl byte [rsp + r13 + 0x58e5188c], 0x89
jne 0x14041e995
movzx edx, r13b
lea rcx, [rcx + r13 + 0xaf780f6]
sub r13w, dx
shr qword [rsp + r8*2 + 0x30], 0x70
movzx rdx, word [rsp + r8*2 + 0x30]
cmovne r13d, r8d
je 0x14054f35a
mov r13, qword [rsp + rdx + 0x58e5189c]
mov qword [rsp + r8*2 + 0x30], r8
jno 0x1403f1206
xchg byte [rdi + rsi*4 - 0x78f00018], ah
adc ch, byte [rbx - 2]
invalid
ja 0x14052539e
jge 0x14053e881
xor eax, 0xd626fe3c
invalid
adc dword [rax], edi
iretd
call fcn.1404c22ab
xor dword [rcx], ebx
and dword [0x15e890267], eax
add byte [rdi], cl
add dword [rax + rax], ebx
or byte [rax], dh
add al, ch
invalid
invalid
add al, dl
add byte [rax], al
invalid

Function at 0x1405404e2
Capabilities:
Encode data using xor

Disassembly:
add byte [rsp + 0x10], 0x30
movabs r10, 0x1192a4a387add3ac
neg dword [rsp + 0x10]
Function at 0x14054154c
Capabilities:
Encode data using base64

Disassembly:
shr dword [rsp + r15*2 + 0x24a2e], 0xf7
sub qword [rsp + r15 + 0x1252f], 0x12121c1f
mov r15, qword [rsp + r15*4 + 0x49434]
xor word [rsp + 0x48], 0x1ebf
and dword [rsp + 0x48], 0xc222923
or word [rsp + 0x30], 0x7a87

Function at 0x140549426
Capabilities:
Packed with generic packer

Disassembly:
call 0x1405687ad
sub byte [rbp + 0x340059b6], dl
xchg esp, eax
push rsp
add byte [rdi + rcx], al
xor eax, dword [rax]
add byte [rax], al
add cl, byte [rdi]
add dword [rax], eax
add byte [rax], al
add byte [rax - 0x73], cl
and al, 0x30
call fcn.140837e71

Function at 0x140554783
Capabilities:
Get system information on windows

Disassembly:
shr byte [rsp + 0x28], 0xfc
test qword [rsp + 0x48], r13
mov r13, qword [rsp + 0x38]
call fcn.1405089e4
and dword [rcx], 0x5000205
je 0x14041a151
add al, dl
adc al, 0x36
add dl, ch
adc al, 0x36
add al, ch
jo fcn.14041a158
add qword [rsp + 8], 0xffffffffbfc0e5df
mov word [rsp + 0x28], 0x42c
shl dword [rsp + 0x28], 0xc7
sete byte [rsp + 0x28]
shr byte [rsp + 0x28], 0xd6
xchg qword [rsp + 0x50], rbx
mov rbp, qword [rsp + 0x10]
add qword [rsp], 0xffffffffbfb99854
add qword [rsp + 0x28], 0xffffffffe5932e2f
seta byte [rsp + 0x28]
js 0x14041a12e
cmp edi, dword [rbp - 0x16]
xor al, 0x94
invalid

Function at 0x140559739
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
pushfq
sub esi, esi
lea rsi, [rsi + rsi + 0x402153af]
push rbx
movabs rbx, 0xcf32883db1040715
ja 0x140559744
mov qword [rsp + 0x20], 0xffffffff9d0578fb
mov rsi, qword [rsp + 0x18]
test bl, 5
jno 0x14057aad6
add qword [rsp + 0x10], 0xffffffffbfa6d9a2
pop rbx
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.14075e55b

Function at 0x14056ca98
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
push rdx
mov qword [rsp + 0x18], 0xffffffffbc3c3d04
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14071c090

Function at 0x14056daff
Capabilities:
Enumerate processes

Disassembly:
add qword [rsp + 0x38], 0x12fcc0
movabs rax, 0x4daa0005fb03aa34
movabs rdi, 0xb226ea3dbe1e5325
neg r14b
jg 0x1405b7c2c

Function at 0x140571db5
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407f2cfd
lea rcx, [rcx*8 - 0x6a50826f]
not ecx
mov rcx, qword [rsp + rcx - 0x198d248e]
jle 0x1404249da
Function at 0x140581379
Capabilities:
Authenticate hmac

Disassembly:
lea rdx, [rdx + rbx*2 - 0x7e38f43b]
js 0x14056edab
neg rbx
shl rbx, 0x5f
lea rbx, [rbx + rbx*2 + 0xf1d2d81]
movzx rbx, bx
bswap rbx
mov qword [rsp + 0x20], rdx
lea rbx, [rbx + rbx*8 + 0x21a92e85]
test bx, 0xb12c
not rbx
add qword [rsp], 0x4309b
movabs rdx, 0xc899889bdd28dc83
movabs rbx, 0x421aed3e92aabdaa
and edx, 0xa00bf029
push rcx
jbe 0x14059d25c
movabs rcx, 0x918c700d9e8cd121
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
mov qword [rsp + 8], rbx
shl word [rsp + 8], cl
push rsi
shr cx, 0xc3
jb 0x140546241
sete bl
lea rdx, [rdx - 0x3d609b64]
je 0x1406cee68
add ecx, 0xf59a97a9
mov byte [rsp + 0x10], 0xa5
xchg qword [rsp + 0x28], rdx
mov rcx, qword [rsp + 8]
or byte [rsp + r11 - 0x3da0472e], 0x16
xchg qword [rsp + 0x60], rsi
mov r13, qword [rsp + 8]
shr word [rsp + r11*2 - 0x7b408eb4], 3
call fcn.140422142
mov qword [rsp + 8], 0x7faaf3b
lea rsp, [rsp + 8]
call fcn.14076110b
lea rbp, [rbp + rbx*8 - 0x7716948a]
jns 0x140404f90
push r14
ja 0x14044b912

Function at 0x14058fec3
Capabilities:
Encode data using base64

Disassembly:
push 0xfffffffff22c9421
add qword [rsp + 0x10], 0x14b24e
and word [rsp], 0xd381
push r9
test dword [rsp + 8], 0x6d31798d
push r10
call fcn.14051d184

Function at 0x140596bf3
Capabilities:
Encode data using base64

Disassembly:
pushfq
add qword [rsp + 8], 0xf84a8
push rsi
movabs rax, 0xa79f642252b383ac
neg al
mov rsi, rax
add qword [rsp + 0x18], 0xffffffffbfa6fc04
call fcn.140541e06

Function at 0x1405a44e6
Capabilities:
Packed with generic packer

Disassembly:
mov rsi, qword [rsi + r15 - 0x8120]
cmp rdx, 0xffffffff8fb67a10
or r8, r8
shl r8b, 0x90
shl r8w, 0x50
add r8, r8
shl r8b, 0x87
cmp r8, 0xffffffffbebce5b6
mov r8, qword [rsp + 0x40]
jo fcn.14061893c
call fcn.140374a20
cli
mov dword [rax + rax*2 - 0x58], 0xaaff84b4
cmp dh, al
invalid
add qword [rsp], 0xfffffffffff9f8f3
push r9
push rdx
mov rdx, r9
add qword [rsp + 0x28], 0xffffffffbfbfe80d
mov rsi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
test r12d, 0xadb1ceb4
jb 0x140421545
mov qword [rsp + 0x10], rdx
js 0x1403e01e1
push r14
lea rsi, [rsi - 0x3d53fc47]
call fcn.14050f228

Function at 0x1405ac63a
Capabilities:
Packed with generic packer

Disassembly:
cmp r9b, r12b
cmovns r11d, dword [rsp + 0x42]
xchg qword [rsp + r11 - 0x3a1f], rbx
mov r12, qword [rsp + 0x20]
sub word [rsp + r11*8 - 0x1d3b8], 0x1610
cmovle r11d, dword [rsp + r9*2 - 0x74ffeb37]
and r11b, r11b
cmp dword [rsp + r9*2 - 0x74ffeb38], 0xd431ab00
mov byte [rsp + r11*2 - 0x7d195ba4], 0x27
mov r9, qword [rsp + r11 - 0x3e8cada2]
jg 0x14068706e
jb 0x140409ef0

Function at 0x1405b3606
Capabilities:
Set registry value

Disassembly:
sub r11, qword [rsp + 0x30]
jle 0x14065c38f
mov r11, qword [rsp + 0x40]
xor word [rsp + 0x30], 0xac18
jle 0x1406b3e7e

Function at 0x1405b4d30
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
push rbp
push rsi
not word [rsp + 0x20]
mov qword [rsp + 0x28], 0xffffffffe97d0b96
lea rsp, [rsp + 0x28]
call fcn.1407f2cfd
Function at 0x1405b67d4
Capabilities:
Get system information on windows

Disassembly:
mov rcx, qword [rcx]
lea rbp, [rbx + riz - 0xa6d0c47]
shr ebx, 0xe8
mov qword [rsp + rsi + 0x50], rbx
call fcn.1404876b3
je 0x1403f78b2
lea r11, [r11 + r11*2 + 0x4233e0a]
mov r11, qword [rsp + r11 - 0x4233dfa]
test word [rsp + 0x28], 0x653d
lea rsp, [rsp + 0x18]
ret 0x18
shr r13w, 0x24
jb 0x1403cd663
add qword [rsp + 0x18], 0x3cba78ae
push rbx
mov rbx, r13
mov rbx, qword [rsp]
mov qword [rsp + 0x48], rbx
xor byte [rsp + 0x20], dil
test word [rsp + 0x38], 0xbc06
jl 0x140374dae
ja 0x140423eb6

Function at 0x1405b681f
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x18], 0x55b525bc
lea rsp, [rsp + 0x18]
call fcn.1407769e0
push r11
push r14
push rsi
lea rdx, [rdx + 1]
pushfq
movabs r14, 0x622f1a91b9a907b4
movabs r11, 0x3c842fbfdf0e6f94
sub r14w, 0x8e2f
xor r11d, 0xed958820
mov rsi, r14
xor r11d, 0xe1853fa2
mov r14b, 0xb8
mov qword [rsp + 0x28], rdx
xor esi, esi
xor r14d, 0x4c9a0b00
shr r11, 0x25
cmp si, 0x181f
jge 0x1406e6738
jne 0x140667f35
call fcn.14042a85c
cmp r12b, 0x84
add qword [rsp + 8], 0x62999
call fcn.14070c0bc
call fcn.1404b954e

Function at 0x1405b7c05
Capabilities:
Enumerate processes

Disassembly:
xor rdi, r9
neg r15
movzx di, r9b
jae 0x14041fc42
call fcn.14067965a

Function at 0x1405b8799
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
shl r12, 0xfa
xchg qword [rsp + r12*2 + 0x70], rcx
mov r11, qword [rsp + 0x38]
neg r12w
ja fcn.1404eda4b
lea r12, [r12 + r12*4 - 0x704c95ee]
mov byte [rsp + r12 + 0x704c9656], r12b
mov r12, qword [rsp + r12 + 0x704c9646]
add qword [rsp + 0x30], 0xffffffffbfa15b66
test word [rsp + 0x68], 0x6482
call fcn.1404c8fdf

Function at 0x1405b9c7b
Capabilities:
Encode data using xor

Disassembly:
sub rsi, rsi
lea rsi, [rsi + rsi*8 - 0x54777acd]
mov rsi, qword [rsp + rsi + 0x54777add]
test dword [rax - 0x4b74b755], ecx
xor al, 0xdd
jp 0x1405b9d04
push rsp
mov qword [rsp + 0x10], 0x828b422
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14076110b
fstp xword [rdx]
popfq
xor al, 0x7d
mov dword [rdx + 0x40], ebx
or edi, dword [rcx + 0x4a]
pop rsi
scasd eax, dword [rdi]
jrcxz 0x1405b9c83
pop rdx
xlatb
pop rbx
xchg esi, eax
sbb ebx, dword [rbp - 0x5c]
mov edi, 0x405a2209
push rdi
ja 0x1405b9cee
int1
movabs byte [0x90cf50bfa97258bf], al
pop rdx
pop rdx
pop rdx
clc
pop rsi
outsd dx, dword [rsi]
invalid
mov edi, 0xa5f04b40
mov edi, 0xed6f5d9b
pop rdx
jge 0x1405b9c8e
movsb byte [rdi], byte [rsi]
mov edi, 0x41881ac3
pop rsp
mov eax, 0x2e4057e0
mov eax, 0x2e4057e0
push rsi
call 0x1b81a02be
and eax, 0xfffffffc
test al, 0x4f
invalid
Function at 0x1405be187
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
mov r12, qword [rsp + 0x40]
sub byte [rsp + 0x60], bpl
sub byte [rsp + r10 - 0x880fbaf], bpl
mov rbp, r10
shl byte [rsp + r10*8 - 0x4407df98], 0xa7
add qword [rsp + r10 - 0x880fbaf], rbp
mov rbp, qword [rsp + r10*2 - 0x1101f7a6]
neg word [rsp + r10 - 0x880fb9f]
or word [rsp + r10*2 - 0x1101f79e], r10w
call fcn.140468fcc
setne dl
mov rdx, qword [rsp + 8]
je 0x1403e01f8
add qword [rsp], 0xffffffffbfc1fdcc
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140837e71

Function at 0x1405bfede
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + r8 - 0x5986f493], rsi
mov r8, qword [rsp + r8 - 0x5986f4bb]
jo fcn.14048f1df
jb fcn.140444a7f
not rbp
or r10d, ecx
jns 0x1405423e6

Function at 0x1405c4544
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
lea rax, [rax + rdx + 0x7cb51c1c]
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
or dx, 0xd490
add rdx, 0xffffffffc6a4352f
call fcn.14050c1c0

Function at 0x1405c458a
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x20], 0xfffffffffff3c81d
call fcn.1405ad20c
not word [rsp + r10*2 - 0x280e23c4]
je 0x1404feb49
movzx di, byte [rsp + 0x43]
je 0x1405c855d
xchg qword [rsp + r13*4 + 0x20220], rsi
mov rcx, qword [rsp + 0x30]
mov r11, qword [rsp + r10 - 0x140711c2]
shr r13d, 0xe8
call fcn.14068b228
mov rbp, qword [rsp + rdx*2 - 0x1fde0]
mov r10d, 0x97979eaa
jge 0x140533572
movabs rdi, 0xfb8b813e548a85b9
add r13w, 0x8008
and r10d, 0x342f3302
lea rsi, [rsi + rcx - 0xfdf3357]
mov qword [rsp + r13 + 0x80b2], r10
shr ecx, 0xfd
jns 0x14050543c
js 0x14042037e

Function at 0x1405c89a7
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
jge 0x1404799b8
shl r13d, cl
call 0x1404feacb
js 0x14069704c
call 0x14045c200
shr r13d, 0x72
lea rsi, [rsi + r13*2 - 0x3d9d]
neg r13d
movzx r13d, r13w
je 0x1404eda6d
mov r13w, 0x59e
not r13b
push r9
and r13, r13
mov qword [rsp + r13 - 0x541], rsi
jle 0x1406584b4
call fcn.14044c3f7

Function at 0x1405cf87d
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbfbcaf94
push r11
mov qword [rsp + 0x18], 0xffffffffd55419fb
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14075e55b
mov dh, 0xa1
jg 0x1405cf845
call 0x196cd06b9
push rdi
mov dh, 0xa0
xor byte [rbp + 0x236d528], ah
pop rbx
xchg edi, eax
add bl, byte [rbx - 0x69]
xor ecx, 0xac575b68
push rax
mov edi, 0xebfe5750
mov bl, 0xa8
loopne 0x1405cf8b2
scasd eax, dword [rdi]
xchg ebx, eax
mov bh, 0xa8
loop 0x1405cf917
xlatb
lodsb al, byte [rsi]
fcom dword [rdi + rcx*2 - 0x69]
cmpsb byte [rsi], byte [rdi]
cmp bl, byte [rsi + 0x4e]
xchg edi, eax
and ecx, dword [rbp - 0x2da8b3b1]
fcom qword [rbx + 0x1a19a8bb]
ror dword [rax - 0x29], cl
xor byte [rcx + riz*8 + 0x433568b6], dh
mov esi, dword [rsi + 0x5cf204a8]
mov ebp, 0x5e085ca8
push rdi
push rbp
jo 0x1405cf959
push rdi
push 0x28a7a8b8
and bl, byte [rsi + 0x2a]
invalid
push 0xffffffffd067f009
mov edi, 0xa8d0d6ba
mov edi, 0x56ec0db9
je 0x1405cf93e