joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400013a3
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.140057410
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx

Function at 0x1400024e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x30]
mov ebp, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov r14, qword [rax + 0x10]
nop
mov rbx, qword [r14 + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r15, rdx
mov esi, edx
shr r15, 0x20
add rsi, rbx
cmp rsi, rbx
je 0x1400025bd
mov edi, dword [rsi + 0x18]
xor r11d, r11d
test edi, edi
je 0x1400025bd
mov r10d, dword [rsi + 0x20]
add r10, rbx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r10]
mov r9d, 0x811c9dc5
add rax, rbx
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400025ac
nop dword [rax + rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x140002580
cmp r9d, ebp
je 0x1400025c5
inc r11d
add r10, 4
cmp r11d, edi
jb 0x140002560
mov r14, qword [r14]
jmp 0x140002520
mov eax, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
add rax, rbx
add rcx, rbx
movzx edx, word [rax + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, rsi
jbe 0x1400025f9
lea rax, [r15 + rsi]
cmp r8, rax
jae 0x1400025f9
mov edx, 0x811c9dc5
mov ecx, edx
call fcn.140002630
jmp 0x1400025fc
mov rax, r8
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140005cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
and al, 0x18
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r12, rcx
lea rcx, [0x140091710]
push rcx
movabs rcx, 0x78024d8923085b2a
pushfq
xor rcx, rcx
xor ecx, 0x4b91b82b
push r11
mov rcx, qword [rsp + rcx - 0x4b91b81b]
mov qword [rsp + 0x10], 0xffffffff8e55c800
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140848552
xchg ebx, eax
push rdi
jb 0x140005cc8
out 0x95, eax
pushfq
jne 0x140005cfc
ret 0x48a6
Function at 0x1400125f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4078]
mov eax, 0x4178
call fcn.14007db80
sub rsp, rax
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp + 0x4060], rax
mov qword [rsp + 0x30], r9
mov rdi, r8
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x38], rcx
mov byte [rbp - 0x20], 0
mov rbx, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140012648
mov rdi, qword [r8]
mov rax, qword [rdx]
xor r14d, r14d
cmp qword [rax + 0x28], 0xffffffffffffffff
jne 0x1400126a5
mov qword [rbp - 0x68], r14
movdqa xmm0, xmmword [0x1400927d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], r14b
mov dword [rbp - 0x70], 0x2749
xor r8d, r8d
lea rdx, [0x140090948]
lea rcx, [rbp - 0x68]
call fcn.140001f50
nop
mov byte [rsp + 0x40], 1
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x48], eax
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x60], xmm1
jmp 0x1400126e6
test rbx, rbx
je 0x1400126e1
mov esi, 0x7fffffff
nop
mov r8, rbx
cmp rbx, rsi
cmova r8, rsi
mov rcx, qword [r12]
xor r9d, r9d
mov rdx, rdi
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14001275b
cdqe
add rdi, rax
sub rbx, rax
jne 0x1400126b0
mov byte [rsp + 0x40], r14b

Function at 0x140014bb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140014be4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140014bd0
ret
Function at 0x14001bdf0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r15, rdx
mov r12, rcx
mov qword [rbp - 0x40], rdx
xor r13d, r13d
mov ebx, r13d
mov dword [rsp + 0x30], ebx
mov rdi, qword [rcx]
movzx eax, byte [rdi + 0x30]
test al, al
je 0x14001be53
mov byte [rdx], al
mov eax, dword [rdi + 0x38]
mov dword [rdx + 8], eax
lea rdx, [rdi + 0x40]
lea rcx, [r15 + 0x10]
call fcn.140003290
jmp 0x14001c0d7
mov rcx, qword [rdi + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14001be73
Function at 0x14001c110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x79], rdx
mov rsi, qword [rbp + 0x7f]
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rdx, qword [rcx]
mov rcx, qword [rdx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x14001c16e
mov edx, 0x2749
mov rcx, rbx
call fcn.14001bb50
jmp 0x14001c2a0
xor r9d, r9d
mov r8d, 0x4000
mov rdx, rax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jle 0x14001c192
mov qword [rsi], rdi
mov byte [rbx], r15b
jmp 0x14001c2a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rbp - 0x39], r15
movdqa xmm0, xmmword [0x1400927d0]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov dword [rbp - 0x41], eax
xor r8d, r8d
lea rdx, [0x140090948]
lea rcx, [rbp - 0x39]
call fcn.140001f50
nop
mov dl, 1
mov byte [rbp - 0x11], dl
mov r8d, dword [rbp - 0x41]
mov dword [rbp - 9], r8d
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp + 0xf], xmm1
mov dword [rsp + 0x20], 0x18
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14001c20f
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [r14]
mov qword [rax + 0x28], 0xffffffffffffffff
mov r8d, dword [rbp - 9]
movzx edx, byte [rbp - 0x11]
mov qword [rsi], r15
test edi, edi
jne 0x14001c224
mov byte [rbp - 0x41], dil
mov edi, 0x1a
mov byte [rbx], 0
jmp 0x14001c271
mov byte [rbp - 0x71], dl
test dl, dl
je 0x14001c240
mov dword [rbp - 0x69], r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x61]
call fcn.140003290
movzx edx, byte [rbp - 0x71]
mov edi, 0x1c
mov byte [rbx], dl
test dl, dl
je 0x14001c271
mov eax, dword [rbp - 0x69]
mov dword [rbx + 8], eax
movups xmm0, xmmword [rbp - 0x61]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x51]
movups xmmword [rbx + 0x20], xmm1
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], send
mov byte [rbp - 0x61], 0
or edi, 1
test dil, 4
je 0x14001c287
and edi, 0xfffffffb
lea rcx, [rbp - 0x71]
call fcn.140013d60
nop
test dil, 2
je 0x14001c297
lea rcx, [rbp - 0x41]
call fcn.140013d60
nop
lea rcx, [rbp - 0x11]
call fcn.140013d60
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140022470
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14009d010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, rcx
xor esi, esi
mov dword [rbp - 0x18], esi
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, dword [rbp - 0x18]
lea edx, [rax + rax]
xor ecx, ecx
lea r9d, [rsi + 4]
mov r8d, 0x3000
Function at 0x14002b440
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x140092300]
jmp 0x14089212b

Function at 0x140040570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rbx, rcx
lea rcx, [0x1400925a0]
push rdi
pushfq
movabs rdi, 0x2a13a3351b180c2d
push rbx
not dil
call fcn.140717cb2
xor eax, 0xaab39e01
loope 0x1400405aa
insd dword [rdi], dx
insd dword [rdi], dx
fbstp tbyte [rdx - 0x1e]
and eax, ebp
fiadd dword [rcx]
lahf
mov esp, 0xd8fb2614
hlt
Function at 0x1400478ca
Capabilities:
Packed with generic packer

Disassembly:
push r9
pushfq
xor r8b, 0x2c
neg r8d
push rbp
xchg qword [rsp + 0x28], rax
test r8w, 0x42b0
je 0x1405dde78
bswap r8
jo 0x14065325e
ja 0x140623a29
test byte [rsp + 0x30], 0x21
mov byte [rsp + 0x30], pe_nt_image_headers64
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x70]
ret
lea r12, [r12 + 0x6322b012]
jb 0x1404219b0
not ebp
bswap rbp
call fcn.140547b6d
invalid
jbe 0x1406ce784
movabs r12, 0xed2f35af64080322
ja 0x140556273
movabs r9, 0xc12c81ac93921026
lea r8, [r9 + r8*8 + 0x287f9ae]
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
movabs rbp, 0x5a015a0e87398325
call fcn.140688db0
popfq
lea rsp, [rsp + 0x10]
ret
mov rbp, qword [rbp + r14*2 - 0x44]
jle 0x1403be67f
neg dx
and r14b, 0x20
mov rsi, r10
call int.1403cb9d2

Function at 0x140052e28
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140063ccc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140063af8

Function at 0x14006e49c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14006e4bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140060e6c
or eax, 0xffffffff
jmp 0x14006e4be
xor eax, eax
add rsp, 0x28
ret
Function at 0x140350060
Capabilities:
Get local ipv4 addresses

Disassembly:
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
lea edx, [r8 + 0xe]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
je 0x140030e76
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], send
mov byte [rsp + 0xa0], 0
mov rax, rdi
jmp 0x14003100a
mov rbx, r14
movabs r12, 0xdb98e9cc17a3c360
movabs r13, 0x9d6632b285b0b52e
movabs r11, 0x2b67deeaa858f507
test rbx, rbx
je 0x140030fd7
cmp dword [rbx + 0x64], 0x18
je 0x140030fce
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rax
movzx eax, byte [rbx + 0x55]
movzx ecx, byte [rbx + 0x54]
movzx edx, byte [rbx + 0x53]
movzx r10d, byte [rbx + 0x52]
movzx r9d, byte [rbx + 0x51]
movzx r8d, byte [rbx + 0x50]
movabs r15, 0xe9a8cce14f91f345
mov qword [rsp + 0xc0], r15
movabs r15, 0xb84b6a80b5959876
mov qword [rsp + 0xc8], r15
movabs r15, 0x7355eecf8500c737
mov qword [rsp + 0xd0], r15
movabs r15, 0x873a067e0934a3f8
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r11
movabs r11, 0x873a0c263b0486d5
mov qword [rsp + 0x58], r11
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x70], xmm0
pxor xmm1, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x80], xmm1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xe0]
call fcn.140052210
lea rax, [rsp + 0xe0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140030fa5
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.140001f50
movabs r11, 0x2b67deeaa858f507
mov rbx, qword [rbx + 8]
jmp 0x140030e97
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
jmp 0x140030ff0
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140052a40
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp r12, 0xffffffffc704f519
jg 0x140030dfe
push rsi
sub r10, r12
mov rcx, r12
add qword [rsp + 8], 0x1b914c
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
movabs rsi, 0x53270a87bdacb99c
call fcn.14036b32c

Function at 0x140350976
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.140887023

Function at 0x140350985
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
jno 0x14070f697
sbb eax, 0xcccccccc
invalid
Function at 0x14035119d
Capabilities:
Encrypt data using aes mixcolumns step
Packed with generic packer

Disassembly:
mov di, word [rsp + 0xc]
xchg qword [rsp + 0x50], rcx
mov rdi, qword [rsp + 0x38]
je 0x1406ce764
ja 0x140378090
movsx bp, byte [rsp + 0xe]
jns 0x1403ca5a5
int3
add qword [rsp + 0x20], 0xffffffffbfafb585
add rbp, 0xffffffff8d014f0c
movsx r11w, r11b
neg byte [rsp + 8]
mov r11, qword [rsp + 0x48]
call fcn.14048475d
xchg qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x20]
call fcn.14059a7a0
push rax
push rdi
pushfq
push rsi
or dword [rsp + rdx + 0x73f210c1], 0xe502c6a2
and r14, r10
push rbp
and word [rsp + rdx + 0x73f210c1], dx
mov rbp, qword [rsp + rdi*8 - 0x4048]

Function at 0x140351611
Capabilities:
Terminate process

Disassembly:
push r11
mov r11, r8
push rbx
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbp
movabs rbx, 0x3a92889fd510c03c
add qword [rsp + 0x20], 0x1372cd
lea rbx, [rbx + rbx - 0x654baf7f]
nop
xor r11, r11
movabs rbp, 0xaba79994ef031c3b
xor bx, 0x80b2
sub rbp, 0x67b607a9
js 0x14064b285

Function at 0x140353441
Capabilities:
Packed with generic packer

Disassembly:
push r11
mov qword [rsp + 0x18], 0xffffffffac7e9906
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407cde16
js 0x14057ba4a
jne 0x14036510b
mov rcx, qword [rsp + 0x80]
Function at 0x1403669b0
Capabilities:
Packed with generic packer

Disassembly:
lea rsp, [rsp + 0x18]
call fcn.1407d7530

Function at 0x1403b6392
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x50]
lea esp, [rsp + 0x50]
call fcn.1407d7530
xor byte [rdi + 0x33a8fc0], ch
mov ch, 0x8d
cmp al, 0xf
in al, dx
and al, 0xf
sub al, 0xec
push 0xffffffffffffffd9
jo 0x1403b6398
ret

Function at 0x1403b6b30
Capabilities:
Encode data using base64

Disassembly:
sbb byte [rax + 0x67], bh
outsd dx, dword [rsi]
stosb byte [rdi], al
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
and al, 0x18
call fcn.14084c046
sub r12, qword [rsp + 0x50]
neg r9d
and qword [rsp + 0x50], 0xffffffff8a8b6c9c
lea rdx, [rdx*2 + 0x3f9c478a]
mov r9, qword [rsp + 0x48]
ja 0x140550820
push rbp
mov al, byte [rdi - 0x64]
invalid
fcompi st(0)
loopne 0x1403b6b18
outsd dx, dword [rsi]
sti
loop 0x1403b6b0b
jbe 0x1403b6b44
ret 0xec7a

Function at 0x1403beec1
Capabilities:
Encode data using xor

Disassembly:
sets sil
call 0x140534fb2
movabs r13, 0x44be933c958b33b9
call fcn.1406f469e
mov ecx, 0x3c958b33
xchg ebx, eax
mov esi, 0x57c5e844
xor eax, dword [rax]
add byte [rcx - 3], bh
jns 0x1403beed8
push rbp
cmp dl, byte [rsi + 0xa]
lea ecx, [rdi]
jno 0x1403beecc
cmp dword [rdx + 0x227b5466], edx
fisubr word [rbx + 0x49]
or byte [rdi + 0x43], bl
jg 0x1403beeef
jg 0x1403beeef
sbb byte [rbx], cl
ret

Function at 0x1403cbb51
Capabilities:
Packed with generic packer

Disassembly:
and bpl, bpl
neg bpl
mov rdx, rbp

Function at 0x1403d0e9c
Capabilities:
Packed with generic packer

Disassembly:
seto r14b
mov r14, qword [rsp + r14*8 - 0x14ff0]
not dword [rsp + 0x30]
jae 0x1406acee0
xor dword [rsp + 0x30], 0x1f19429c
jae 0x14053e0fb
shr esi, 0x55
shl bx, 0x41
bswap ebx
je 0x1406e1334
call fcn.140475e98
cmp r10w, 0xc013
mov qword [rsp + 0x30], rdx
lea rdi, [rdi + rdx*2 - 0x2e2fe1c2]
mov byte [rsp + rdx*2 - 0x6e817c8], r13b
movsx r10d, byte [rsp + rdx - 0x3740bc8]
jne 0x140637cac
jno 0x1406c428c
xchg qword [rsp + 0x48], rdi
mov r13, qword [rsp + r10 + 0x20]
mov r10w, r14w
shl r10, 0xfa
not r10w
not r10d
add qword [rsp], 0xffffffffbfb5247c
shl r14w, 0xc6
mov rdx, qword [rsp + rdx*4 - 0xdd02fb0]
sub byte [rsp + 0x30], 0x20
and qword [rsp + 0x30], 0x36bc15bb
shr r14d, 0x1e
xor byte [rsp + 0x30], r14b
mov r10, qword [rsp + r14*2 + 0x32]
sub word [rsp + r14*2 + 0x2a], 0x8f9d
mov r14w, 0x2a13
jne 0x140352890
lea rsp, [rsp + 0x70]
ret
cmp word [rsp + 0x30], 0x2911
adc dword [rcx], ebp
call fcn.1405b3fcf
lodsb al, byte [rsi]
push qword [rdx - 0x3a990b38]
fcom st(3)
mul ch
call 0xe14c4f77
mov ah, 0xc3
enter 0xffffffffffff98d2, 0xffffffffffffffd5
test dword [rax - 0x6b], ebx
jge 0x1406c4291
push rbp
call 0xec95ac76
invalid
Function at 0x1403d5cb2
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
or cl, ch
cmp cx, 0xd59d
lea rcx, [rcx*2 + 0x7b2b953e]
not rcx
lea rbp, [rbp + 1]
lea rcx, [rcx + rcx*2 + 0x1aa392b0]
push r15
push rbp
movabs rbp, 0xc682100650b00734
jae 0x14067dcf4
mov rbp, qword [rsp]
mov qword [rsp + 0x30], rbp
and rcx, 0x27b8113c
add qword [rsp + rcx*2 - 0xe100208], 0x70c5
mov qword [rsp + rcx*2 - 0xe100218], rcx
push rcx
lea rcx, [rcx + rcx*2 + 0x33ab30a6]
sub cx, word [rsp + rcx - 0x48c333c0]
nop
cmp dword [rsp + rcx - 0x48c32cba], 0x959d4b8f
call fcn.1403c2a22

Function at 0x1403d5ce3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.14046e2b4
js 0x1406cb556
call fcn.1406bc281
movabs rdx, 0xb62d7c111638f928
or edx, 0xc7134982
and dx, 0x30b
push r9
movabs r9, 0xe32b179f698525bc
setno dl
call fcn.14002d1eb
mov rbp, qword [rbp + riz]
xor r14, qword [rsp + 0x20]
je 0x1403d9cbd
sub word [rsp + 0x20], bx
call fcn.140447631
add dword [0x10eff4104], edx
invalid
add r8w, r8w
lea rax, [rax + 0x7eb6cf9e]
bswap r8d
add qword [rsp + r8 - 0x905205], 0xffffffffbf9a496a
add r8b, 0x8f
xor r8b, 0x3d
xchg qword [rsp + r8 - 0x905261], rax
mov r8, qword [rsp + r8*2 - 0x120a51a]
call fcn.140510785
shl ebx, 0x9a
mov bpl, byte [rsp + r10 + 0x1c]
push r15
jns 0x1405e7990
and word [rsp + 0x40], 0xb0
xchg qword [rsp + 0x78], rsi
mov r9, qword [rsp + 0x68]
or word [rsp], bp
jo 0x14059bb39
call fcn.1403efb0e

Function at 0x1403e24a4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Set socket configuration

Disassembly:
push r8
mov rdi, qword [rsp + 0x20]
pushfq
add qword [rsp + 0x10], 0x19e63
movabs r8, 0x4ea9430b23bea0b4
neg r8d
or r8d, 0x5f0e5486
jo fcn.14057ea1a
not r8
lea r8, [r8 + r8 + 0x1881583f]
lea rdi, [rdi + 1]
sub r8b, 1
setb r8b
push r8
add qword [rsp + 0x20], 0xffffffffbf9a95eb
and r8d, r8d
not byte [rsp + r8 - 0x59e29800]
jl 0x14001c029
mov qword [rsp + r8 - 0x59e297d0], rdi
push r12
sub r8, qword [rsp + r8 - 0x59e297f8]
movabs r12, 0x433407a1cb12482f
nop
movabs rdi, 0xfe0b33be9539253d
movzx r8d, word [rsp + 9]
or r12b, 0xb4
add r8b, r12b
add r12w, word [rsp + 0xb]
movsxd r12, r8d
shl r12b, 0x41
mov rdi, qword [rsp + r8 - 0xe237]
mov rdi, qword [rdi + r12*2 - 0x1c55c]
sub r12d, 0x4e102bba
or r8w, 0xfb13

Function at 0x1403e2587
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.1405d8b7e
test rdi, 0xfffffffffd0b1135
xchg qword [rsp + 0x40], rsi
mov rdi, qword [rsp + 0x38]
js fcn.1406f30c5
jge 0x1403fc6c2

Function at 0x1403ec594
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x28], 0xffffffffffe282f0
or r13, 0x3599d791
mov r9, rbp
xor r9d, r13d
cmp r9b, 0xe
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi + rdi*4 - 0x2703187c]
lea rbp, [rbp + r9*8 + 0x110736b2]
call fcn.14052d346
mov edi, 0x51fab22d
invalid

Function at 0x1403f65fe
Capabilities:
Packed with generic packer

Disassembly:
ja 0x140472c26
push qword [rsp + 0x78]
popfq
Function at 0x1403fe57e
Capabilities:
Packed with generic packer

Disassembly:
mov bl, 0x19
add bx, 0x3c17
xchg qword [rsp + 0x20], rdx
mov rbx, qword [rsp + 0x18]
add qword [rsp], 0xffffffffbfb8d3b3
call fcn.1406f999a
add bx, bx
test rbx, 0x248ccc99
jae 0x140356aaa

Function at 0x14040a898
Capabilities:
Packed with generic packer

Disassembly:
je 0x1406569b3
add qword [rsp + 8], 0x250a0
test rcx, 0x388a75aa
jb 0x1404715a5
mov rbp, r15
add r8b, 0xa7
push rdx
ja 0x14060623f
mov rbp, qword [rsp + 0x60]
call fcn.1406717d3
mov ebx, dword [rsp + r11 - 0x40691a10]
cmovl r11w, bx
mov r11, qword [rsp + 0x48]
jge 0x14067ad6a
cmpsb byte [rsi], byte [rdi]
sbb dword [rbx + 0x7f], edi
loope fcn.1405d67d7
fxch st(7)
invalid
movabs rdx, 0x3c3fa08cc58520a4
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
call fcn.140653265
ret
lea rdx, [r9*4 + 0x11f6ad]
jno 0x140707ae6
xchg qword [rsp + 0x68], rdi
mov r15, qword [rsp + 0x30]
sub dl, byte [rsp + 0x2f]
not r9b
mov r8, rdx
setae dl
mov rdx, qword [rsp + 0x38]
neg r8
jae fcn.1405b871c
mov r8, qword [rsp]
movsx r9w, byte [rsp + 0x2d]
test word [rsp + 0x2b], bp
not sil
setb sil
setbe byte [rsp + 0x28]
shl word [rsp + 0x28], 0xcc
je 0x1404d75db
push rdi
call fcn.1405250d2
je 0x14068c076
add qword [rsp + 8], 0xffffffffbfae376f
call fcn.14064e105
and dword [rax + 0x6d6bfdd5], ecx
rcr dword [rdi - 0x6e], 1
cmp eax, 0x6dbddfec
push rdx
xchg edx, eax
mov esi, 0x47544ce6
xchg edx, eax
inc cl
xchg r10, rax
add dword [rsi + 0x2b6d85b4], esp
int3
ja 0x1405d6801
call fcn.140401712
mov r15, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffbee78d32
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14073ff2a

Function at 0x14040a8c7
Capabilities:
Packed with generic packer

Disassembly:
xor dx, 0x4ea9
not dword [rsp + r8*2 - 0x1fe46]
jne 0x14066e695

Function at 0x14040a8da
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0xffffffffbf984dfb
push r11
shl r9, 0x22
or r9d, dword [rsp + 0x29]
xchg qword [rsp + rbp - 0x7787a6d2], rax
mov rcx, qword [rsp + 0x30]
jns 0x1404dc83e
push rbx
pushfq
movabs rbx, 0x291677ba0eb92090
xchg qword [rsp + 0x20], rcx
push rbx
push r15
test word [rsp + 9], bx
lea rbx, [rbx + rbx*8 + 0x421c0888]
mov qword [rsp + 0x28], rcx
push r10
mov dword [rsp + 0x10], ebx
jle 0x1405d5b41
add qword [rsp + 0x28], 0xfffffffffffa056f
movzx bx, bl
mov r10, qword [rsp + 0x10]
add byte [rsp + 0x10], 0x2b
call fcn.14061368b
mov r13, r9
or r13w, 0xda00
shr qword [rsp + 0x30], 0x7b
mov r9, qword [rsp + 0x28]
call fcn.14070f270
xor r9b, r10b
xor dword [rsp + 0x38], 0xe588031a
shl r9b, 0xca
jne 0x14053b91b
neg dword [rsp + r9*4 - 0x1de1bc8]
mov r9, qword [rsp + 0x18]
call int.1407087bb
push rbx
lea rax, [rax + r9*2 - 0x4c6eed5a]
jb 0x14065204a
jne 0x14002d251
mov r11, qword [rsp + 0x28]
push 0x62a8bd18
movzx r11w, r9b
not sil
seta byte [rsp]
xchg qword [rsp + 0x48], rcx
mov rsi, qword [rsp + 0x40]
jle 0x14048bea3