joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140398367
Capabilities:
Packed with generic packer

Disassembly:
shr dword [rsp + r11*2 - 0x36], 0xf2
shl r11b, 0x25
neg rsi
mov r14, qword [rsp + r11 - 0xc8]
jne 0x140551944

Function at 0x1403983e4
Capabilities:
Packed with generic packer

Disassembly:
setb byte [rsp + 0x40]
and word [rsp + 0x90], 0x5290
mov word [rsp + 0x98], 0x5e93
xor dword [rsp + 0x40], 0xa8b68f9d
sub word [rsp + 0x98], 0xd590
push qword [rsp + 0x80]
popfq
lea rsp, [rsp + 0xa8]
ret
call fcn.1402895b2
push r8
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x453b8d88
lea rsp, [rsp + 0x10]
call fcn.140697f63
int3
mov qword [rsp + 0x10], r8
push r11
ja 0x14041bd17
not r14
xchg qword [rsp + 0x38], rsi
mov r14, qword [rsp + 0x20]
jge 0x14026a58c
mov r11, r8
mov byte [rsp + 0x18], recv
test qword [rsp + 0x18], 0xffffffffd498db26
jns 0x1402c2aa5
push r8
pushfq
movabs r8, 0x370a850c640f1905
test r8d, r8d
not r8b
setae r8b
mov qword [rsp + 0x10], 0xffffffff8cbee049
mov r8, qword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1406af0c2
jbe 0x14049ff61
call fcn.14003f416

Function at 0x14039e8e5
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
or bp, bp
not ebp
add qword [rsp + 8], 0xfffffffffffe48e4
movabs rax, 0x963ac58858afe909
neg ax
push rbp
xchg qword [rsp + 0x20], rax
mov rbp, r12
lea rbp, [rbp + riz - 0x6b7dc8]
neg bpl
js 0x1403bf919
cmp rbp, r12
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
jne 0x1402f03d0

Function at 0x1403bb01d
Capabilities:
Packed with generic packer

Disassembly:
rep lodsb al, byte [rsi]
invalid
movsx r10w, byte [rsp + r10*2 - 0x4222e712]
lea rdi, [rdi + r13 + 0x58dfc1c]
push r10
call fcn.14026870a
clc
jbe 0x1403bafeb
add eax, 0xf1dd4e8e
out dx, eax
add dword fs:[rbp - 0x17], 0xdf1fdb7e
int1
ja 0x162767e61
mov eax, 0xd12eff24
sbb eax, 0xae88015d
nop
sub al, 0xe5
invalid

Function at 0x1403c5117
Capabilities:
Packed with generic packer

Disassembly:
mov rcx, qword [rsp + 0x10]
call fcn.140557d49

Function at 0x1403c5193
Capabilities:
Packed with generic packer

Disassembly:
sub r9w, r9w
xchg qword [rsp + rdi - 0x452dd2c6], rax
mov rdi, qword [rsp + r9 - 0x4cbcffe8]

Function at 0x1403dbe36
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x58], rsi
mov r9, qword [rsp + 0x10]
jno 0x1404c7750
pop rax
adc al, byte [rax]
jbe 0x140519940
xor dword [rsp + 8], 0x113f4f96
sete byte [rsp + 8]
shl byte [rsp + 8], 0x87
and byte [rsp + 8], 0x33
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1406f0d80
cmp cl, cl
jnp 0x1403a1e52
scasb al, byte [rdi]
mov bl, 0x1b
add al, 0x4c
stosd dword [rdi], eax
invalid
setb dil
neg r9d
seta cl
jb 0x1403a1e45
or qword [rsp + 0x20], 0x102353a1
shr rdi, 0x2e
add qword [rsp + rdi - 0x3cb12], 0xffffffffbfb52d61
xor cl, dil
mov rdi, qword [rsp + 0x38]
call fcn.14020a6a6
mov r10, qword [rsp + 0x10]
test word [rsp], 0xf81
call 0x1403a1e55

Function at 0x1403e2da5
Capabilities:
Encode data using xor

Disassembly:
jns 0x1404afc9e
movabs rdi, 0x8f29d7aaf61fb52e
bswap edi
movzx edi, dil
or di, 0x3502
mov rdi, qword [rsp + rdi*4 - 0xd7c8]
mov rdi, qword [rdi]
jae 0x140301c7d
pushfq
invalid
Function at 0x1403f5421
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + r15*2 - 0x4db587e8], r12
jbe 0x14033738d
push rcx
sub byte [rsp + r15*2 - 0x4db587e0], 0x14
lea rax, [rax - 0x75ebf0fd]
je fcn.1402d6460
add qword [rsp + 0x38], 0xfffffffffff87d90
movabs r14, 0x42a80c1efe1a52bb
push rbp
movabs rcx, 0xcab7f8ab73332081
mov rbp, r15
not r15d
mov r14w, word [rsp + 0x2e]
xchg qword [rsp + rbp*2 - 0x4db587c8], rax
mov r15, qword [rsp + 0x38]
neg rcx
pop rbp
neg r12b
shl r12d, cl
mov r12, qword [rsp + 0x28]
and word [rsp + 0x40], 0x3935
jae 0x14028f2c3

Function at 0x1404077dd
Capabilities:
Authenticate hmac

Disassembly:
sets byte [rsp + 0x10]
shr r14d, 0xfa
add qword [rsp + r8 + 0xfc], 0xffffffffbfce614b
or r14, qword [rsp + r8 + 0x104]
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi + r14 - 0x13f]
jbe 0x1405ce1f0
shr r8w, 0x95
not r15b
or r15w, r10w
movzx r8w, byte [rsp + r8 + 0x10016]

Function at 0x14040d6b2
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
movabs rcx, 0xeeb912b6bda297ab
jo 0x14055ca63
lea rdi, [rdi - 0x3ed46377]
mov qword [rsp + 0x20], rcx
call fcn.1404d30dc
neg rdx
and byte [rsp + 0x20], 0x3e
setne byte [rsp + 0x20]
cmp byte [rsp + 0x18], dl
mov rdx, qword [rsp + 0x38]
call fcn.1404e73e5

Function at 0x14040d6ee
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add byte [rsp + 0x50], 0xb6
js 0x1404277cc
push rdi
movsb byte [rdi], byte [rsi]
jne 0x1402983f8
mov ah, 5
or al, 0xcd
mov esp, 0xd18e6b16
mov gs, word [rcx]
popfq
sal dword [rbp + 0x25232e], 1
jl 0x14040d6b0
or al, 0xde
jmp qword [rax]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x60]
ret 8

Function at 0x140414b81
Capabilities:
Packed with generic packer

Disassembly:
test byte [rsp + 0x28], 0xb7
not word [rsp + 0x38]
call fcn.1404aa395

Function at 0x140414bfc
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbfc361a7
lea rdx, [rdx - 0x72743b54]
mov qword [rsp + r9 + 0x40], rsi
shl word [rsp + r9 + 0x40], 0xc1
jne 0x1404c8d22
call fcn.140385322
and r9d, 0x4936c81
shl r9b, 0xd4
je 0x1402e9583

Function at 0x14041b89f
Capabilities:
Packed with generic packer

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbf8bb00f
push r13
mov qword [rsp + 0x10], 0xffffffffc6db558e
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140697f63

Function at 0x1404311b5
Capabilities:
Packed with generic packer

Disassembly:
sub r8w, 0x4836
add r9b, 0x1e
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + r9 - 0x604108e9]
jae 0x14041ea3c
movabs r10, 0x668808369bb9fd33
jbe 0x14029b23f
lea rcx, [rcx - 0x284d6076]
or r10, r15
jns 0x14040124e
call fcn.14047ed52
push r15
movabs r15, 0x5f015418110ecc98
push r8
xchg qword [rsp + 0x20], rcx
push r9
pushfq
shl r15, 0x12
mov r8, r15
movabs r9, 0xa214b9a4d2326800
ja 0x140326cf7
shr r8b, 0xc8
neg r15
mov qword [rsp + 0x28], rcx
add r8, 0x7a9a8ca7
not r8
mov r9d, 0x598f025
or r9d, 0x9f2ee715
xor r15w, 0x129
push r10
add qword [rsp + 0x28], 0x696f9
neg r9d
jns 0x140297bf1
Function at 0x14043167b
Capabilities:
Packed with generic packer

Disassembly:
push r11
jg 0x1405d7b71
lea r10, [r12 + r10*8 - 0x24f08add]
xchg qword [rsp + rdi + 0x24], rbx
mov r10, qword [rsp + 0x48]
jo 0x1402e6ab2
movabs r11, 0x782826b8060eee1c
test qword [rsp + rdi*4 - 0xb0], rdi
not edi
mov r11, qword [rsp]
call fcn.140213327
neg word [rsp + 0x50]
setne byte [rsp + 0x30]

Function at 0x140436266
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfq
movabs r13, 0x3c002a07578001ab
mov qword [rsp + 0x18], 0xffffffffc5234dd7
mov r13, qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x10]
call fcn.14072b378

Function at 0x140436296
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs r10, 0x7d238ca8cd0bb484
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
call fcn.1403c1eaa
jae 0x140442a5e
mov r11, qword [rsp + 0x30]
movabs r11, 0xdd201e8db2b48d20
shr word [rsp + 0x30], 0xe9
jne 0x14032e120
mov qword [rsp], 0x37d42a3
call fcn.14071281a
movabs rdx, 0x253ef40f72338fa6
xchg qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 8]
call fcn.140443b25
js 0x14055ca65
mov qword [rsp + 0x20], 0xffffffffee322b9d
shl qword [rsp + 0x20], 0xca
not dword [rsp + 0x20]
sub byte [rsp + 0x20], 0xad
lea rdi, [rdi - 0x3ed46377]
test dword [rsp + 0x20], 0xc12a06b5
push r11
push r15
mov word [rsp + 0x30], 0xb824
mov r15, qword [rsp + 0x30]
setbe byte [rsp + 0x30]
not dword [rsp + 0x30]
xchg qword [rsp + 0x38], rdi
mov r15, qword [rsp]
jae 0x14033481e
ror al, cl
jo 0x140436364
or al, 0x94
cmp esp, dword [rax]
movabs dword [0xbbbb5188447c3b9c], eax
movsd dword [rdi], dword [rsi]
loop 0x14043637b
invalid
pop rbp
mov edx, 0xd3d43bb2
cwde
jp 0x140436366
invalid
and byte [r14], bl
mov cs, word [rax + 0x900433d]
adc ebp, edx
in eax, 0xec
jp 0x1404363b9
imul edi, dword [rdx - 0x7c], 0xb696582a
jnp 0x140436319
jg 0x140436357
wait
inc eax
outsb dx, byte [rsi]
push 0xfffffffffffffff1
fisubr dword [rdi]
add byte [rax], al
add byte [rsi], al
movabs eax, dword [0xebecf1c0180c3fca]
mov dl, 0xc0
mov ah, 0x7b
not dword [rsi - 0x7e]
add dword [rcx - 0x10], eax
imul eax, dword [rax], 0x6000000
outsd dx, dword [rsi]
pop rdx
adc edi, dword ds:[rdi]
imul byte [rsi + 0x1a1e39fb]
in al, dx
btr edi, esi
outsb dx, byte [rsi]
add dword [rax + 0x20], eax
invalid
lodsb al, byte [rsi]
invalid
shr word [rsp + 0x20], cl
nop
push r10
and r8d, 0xed9db2a4
jbe 0x14039a38f
jns 0x14026c9e2

Function at 0x14044dea4
Capabilities:
Encode data using base64

Disassembly:
lea rdi, [rdi + 1]
add rbp, 0xffffffff8c234c18
and ebp, 0x698f7f97
push rbx
call fcn.14057e0b9
and r9, qword [rcx + rax*4 - 0x7080681b]
imul edx, dword [rbx - 0x18], 0x31934c
jp 0x140264d5e
push rbx
or ch, byte gs:[rbx - 0x5b]
sub byte [rcx + 0x64], al
invalid
jo 0x140264d56
call fcn.1404c6a06
add dword [rdx], ebx
or al, byte [rax]
sbb dh, byte [rcx + rcx]
sbb ah, byte [rax + rcx]
sbb dl, byte [rdi + rax]
sbb dh, byte [rsi + rax]
add byte [rdx], bl
xor dl, byte [rsi]
rol byte [rcx + 0xf], 0x93
invalid
invalid
xchg ebx, eax
ret 0x8149
Function at 0x140451de2
Capabilities:
Encode data using base64

Disassembly:
sub dword [rsp + 0x50], r9d
mov rcx, qword [rsp + rcx - 0x4602fee0]
xor r9b, r9b
shr r9w, 0x51
cmp word [rsp + 0x50], r9w
mov qword [rsp + 0x50], r9
jae 0x14046debe
mov qword [rsp + 0x50], 0xffffffff8a9e3f8e
sub rcx, 0xffffffffb1ad7f0d
not r9
shr cx, 0x3f
and ecx, 0xd682ebbb
mov r12, qword [rsp + 0x30]
not cl
test r9, 0x102fa0a4
not cx
mov byte [rsp + 0x50], 0xbe
jae 0x140296104
push rax
invalid

Function at 0x14049ff87
Capabilities:
Packed with generic packer

Disassembly:
xor ebp, ebp
jne 0x1405932cb
mov rbp, qword [rsp + rbp + 0x18]
call fcn.14026fc44
call fcn.1405d030e
mov qword [rsp + 0x10], 0x1a1ea363
lea rsp, [rsp + 0x10]
call fcn.14071281a

Function at 0x14049ff9c
Capabilities:
Packed with generic packer

Disassembly:
movsx rsi, word [rsp + rdi - 0xdf1]
test dil, dil
lea rax, [rax + rdi*4 + 0x401dc844]
setle sil
Function at 0x1404a0004
Capabilities:
Packed with generic packer

Disassembly:
cmp rcx, 0x7b3b02b3
jbe 0x140408df5
mov rax, rbp
jg 0x14058da32
invalid
and word [rsp + 0x48], r8w
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
setb r8b
shr r8w, 1
jl 0x1403774ab
cmp byte [rsp + 0x48], 0x93
call fcn.1403b47c0
or byte [rdx + 0xe5d62bb], cl
invalid
mov r14d, dword [rsp + 0x19]
movsx r14d, byte [rsp + r14 - 0x78312483]
mov r14, qword [rsp + r14 - 0x1c]
or byte [rsp + 0x18], 0xbe
mov word [rsp + 0x18], 0x1297
add qword [rsp + 0x20], 0xffffffffbfe00f12
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret
neg r14b
mov qword [rsp + 0x40], r14
js 0x1404aca6d
xor qword [rsp + 0x40], 0xffffffffe7a7c68d
not r13d
mov rsi, r14
cmp si, 0xeb29
or rbx, 0xffffffff948de5be
or qword [rsp + 8], 0xffffffff80a3b624
cmp qword [rsp + rbx + 0x62401049], rbp
push rsi
movabs rsi, 0x86399b1017a8f411
mov rsi, qword [rsp + 0x30]
push rdi
mov rsi, qword [rsp + rbx + 0x62401049]
xchg qword [rsp + rbx + 0x62401089], rsi
mov rcx, qword [rsp + 0x28]
jns 0x14046fbcb
adc byte [rsi + 0x74bffa4a], cl
movabs eax, dword [0x406966131878bff9]
mov edx, 0x403d6135
and ebx, dword [rdi - 0x40]
mov edi, 0xc0e60a20
leave
mov edi, 0x35a3b0b8
invalid
test dword [rsp + r13 + 0x40], r13d
call fcn.1401fec30
not word [rsp + 0x18]
mov rdi, qword [rsp + 0x18]
sub rdi, 0xffffffffd52a22a4
mov rbp, qword [rsp + rdi*2 - 0x709cab8]
call fcn.14040dec4
sub eax, 0x1ec35770
pop rcx
mov esp, 0xd7763cb7
lodsb al, byte [rsi]
xchg esp, eax
cmp al, 0x2f
pop r8
ret
mov qword [rsp + rdi - 0xdd9], rdi
setns byte [rsp + rsi + 0x5328]
js 0x1405cc770
jl 0x1403a5b76
shr qword [rsp + rsi*4 + 0x14c28], 0x15
cmp sil, dil
xchg qword [rsp + rsi*4 + 0x14c50], rax
mov rdi, qword [rsp + rsi*8 + 0x29838]
mov dword [rsp + rsi + 0x5328], 0x8d21f3a3
not sil
call fcn.14034a6e0
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x404336f7
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406f0d80
jb 0x1404a002c
loope 0x14049ffb4
mov bl, 0xe
invalid
invalid
test r12b, 0x9a
ja 0x1402f4c53
mov qword [rsp + 0x28], rax
push rcx
not r12d
shr rbp, 0xf6
mov rcx, r12
neg r12b
shl r12b, 0xc5
add qword [rsp + rbp - 0x328], 0x17fbdd
sub r12b, bpl
nop
js 0x140217a1c
lea rax, [rax + rcx*8 + 0x6f323129]
je 0x1405c2eb6
mov rax, qword [rsp + 8]
mov rax, qword [rax]
lea r12, [r12*2 + 0x338d2ca2]
neg ecx
mov qword [rsp + rbp*2 - 0x658], rcx
call fcn.1404f5844
mov cl, 0xe7
xchg dword [rdi + 0x63242a51], edi
movabs dword [0xe9a0a04030443535], eax
mov edi, 0x675f5a24
jns 0x14058dab8
cmp cl, byte [rcx - 0x60bfd2a0]
pop rsi
sar byte [rdi - 0x3e559128], 1
fnstcw word [rdi + 0x25a2c4c2]
movabs al, byte [0x67c6c26fdb402fc3]
nop
add edx, esp
mov edi, 0x8078f8a9
mov edi, 0x182f011d
sar dword [rdi + 0x400afcba], cl
xchg esp, eax
ret 0x3bc5
adc edx, dword [rdi + 0x4b]
cmp byte [rax + 0x71], al
invalid
call fcn.1403be284
add qword [rsp + 0x18], 0xff957
test r8w, 0xb806
push rbp
jno 0x14029ca45

Function at 0x1404ace4b
Capabilities:
Encode data using xor

Disassembly:
not rsi
pushfq
xor esi, esi
mov qword [rsp + 0x20], 0x4d3f2440
mov rsi, qword [rsp + rsi*4 + 0x18]
call fcn.140211cbb
xor word [0x171bc27bb], ax
insb byte [rdi], dx
invalid
Function at 0x1404b4746
Capabilities:
Packed with generic packer

Disassembly:
mov r13, r8
lea rbp, [rbp + r11*2 + 0x69b4039d]

Function at 0x1404b4f94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], 0xffffffff8ca5920e
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1406af0c2

Function at 0x1404b4fac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + rbx - 0x689], ebx
call fcn.14020a985
lea rbp, [rbp + rbx - 0x78530660]
jne 0x14043628a

Function at 0x1404c0e9f
Capabilities:
Packed with generic packer

Disassembly:
jle 0x140401268
cmovb edi, r15d
call fcn.14043e316
Function at 0x1404cc868
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1403af7a7
setne cl
mov rbx, qword [rsp + 0x18]
setne cl
not rcx
jb 0x1402c55bf
neg cl
lea rcx, [rcx*4 - 0x754c55dd]
mov rcx, qword [rsp + 0x38]
ja 0x1404358ed
call fcn.1402e85c2

Function at 0x1404d4652
Capabilities:
Get geographical location

Disassembly:
sub r11d, ecx
setge cl
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
shl r11b, cl
sub r15b, byte [rsp + 0x34]
and ecx, ecx
and rcx, 0xffffffffa5359284
lea rbx, [rbx - 0x5d272db]
or r11d, dword [rsp + 0x33]
and r11w, 0x1221
sub byte [rsp + 0x30], r15b
push 0xffffffffc91826a4
je 0x1404d1355
shr r11d, 0xf8
neg byte [rsp + 0x38]
xchg qword [rsp + 0x58], rbx
mov r15, qword [rsp + r11*2 - 0x122]
jge 0x14027c3bf
push rdx
call fcn.1404ee4b0
mov bh, 0x9e
cmp byte [rbp - 9], ah
lahf
cwde
jo 0x1404d4728
xchg esi, eax
xchg ecx, eax
mov esi, 0x9f7f8fd7
mov edx, 0xa84d90bf
cmp edi, dword [rbp + 0x6a8ade40]
xchg ebx, eax
insd dword [rdi], dx
mov edi, 0x40b28ed8
movabs eax, dword [0xb08ac2be9a6c702d]
mov esi, 0x9f6df4c8
mov eax, 0x438f28be
mov edi, 0x9b1c2905
invalid
hlt

Function at 0x1404d66c0
Capabilities:
Packed with generic packer

Disassembly:
shr r14w, 0xa
js 0x14053beec
jbe 0x1404c8d0f
not r14b
jl 0x1401fe1fb
mov esi, 0xbacd0d19
invalid

Function at 0x1404df7c8
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1406763f0
Function at 0x1404e648e
Capabilities:
Packed with generic packer

Disassembly:
cmp word [rsp + 0x18], 0x9a84
call 0x140325233
je 0x1402c5530
shl bx, 0x26
not ebx
js 0x1405168bb
not byte [rsp + 0x18]
ja 0x1402f4544
insd dword [rdi], dx
mov edx, 0x4c056524
movabs r15, 0x480f4165aebdf80c
push rcx
push rax
pop rbp
adc eax, 0x5040bc4d
fisub word fs:[rdi + rdi*4 - 0xd]
invalid

Function at 0x1404ec5a0
Capabilities:
Encode data using xor

Disassembly:
movabs r15, 0x7ab78101deae16b1
shr r15, 0xc2
mov r12w, r15w
mov rbp, r15
scasb al, byte [rdi]
fiadd word [rcx]
xor dword [rdi - 0x103eb686], 0x8b4566c2
out 0x49, eax
mov ebp, edi
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
shl r12d, 0xb9
mov r12d, 0xa28dca14
neg r15w
mov qword [rsp + 0x28], r15
shl r12w, 0x16
shl qword [rsp + 0x28], 0x1f
push r10
lea r15, [r12 + r12 - 0x33e7d558]
lea rbp, [rbp + 0x1cbc00ba]
call fcn.14030e7a4
mov cl, 0x21
loop 0x1404ec5f2
jmp [rbx]
sub ebp, dword [0x1b2562b20]
setns byte [rsi - 0x414c1640]
out dx, al
push 0x4f
cld
mov ebx, 0x40ec0abe
mov edi, 0x987fa373
stc
jbe 0x1404ec5a4
mov esi, 0x7f6baf63
mov edx, 0x486188bf
outsb dx, byte [rsi]
fstp xword [rbp - 0x21c131c0]
jae 0x1404ec695
mov edi, 0x40b26e6c
or dword [rbp - 0x4165731c], ebp
push rsi
push 0xffffffffffffffb0
mov esi, 0x7f015830
mov eax, 0x436f44be
mov edi, 0x9bfc7561
loop 0x1404ec64f
cmc
xchg edx, eax
mov esi, 0xfcededcd
mov ecx, 0x63312bf
push rcx
clc
wait
jae 0x1404ec5ef
cmp cl, byte [rdi + rbp*4 - 0x6efdfe49]
add byte [rax], ch
jl 0x1404ec6b1
push rbp
invalid
add dword [rdi + 0x4f0051c4], edi
fild word [0x1224e6df0]
cld
lodsb al, byte [rsi]
invalid
adc eax, dword [rdi - 0x65]
cld
jmp qword [rbx - 0x58]

Function at 0x1404ee97c
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + rbp*4 - 0x120]
shl dword [rsp + rbp - 0x28], 0x1c
jae 0x1402dc47e
xchg esi, eax
jmp 0x1404eea01
invalid

Function at 0x1404fef3c
Capabilities:
Packed with generic packer

Disassembly:
jo 0x14002bf68
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x14050aec2
Capabilities:
Encode data using xor

Disassembly:
invalid
setns r12b
neg qword [rsp + 0x18]
mov qword [rsp + 0x38], rdx
not r8
bswap r8d
add word [rsp + r8*2 - 0x4a7f9a], 0xdca7
and r8, r12
xor r12b, r12b
jle 0x14057aa6c
mov al, ah
xor dh, byte [rax + rax*8 - 0x7b]
push rax
loopne 0x14050aeb4
invalid
invalid
add r8, r8
neg byte [rsp + r8*2 - 0x90d3e8]
add qword [rsp + 8], 0x113bee
or byte [rsp + 0x18], 0x80
xor r8d, r12d
mov rdx, r8
cmp dl, dh
ja 0x1403b7945
shr rdx, 0x15
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx + r8 - 0x7d24df00]
or r8d, dword [rsp + 0x1c]
cmovae r12w, r8w
mov dword [rsp + 0x18], 0xfba156b9
shr byte [rsp + 0x18], 0xa8
cmp word [rsp + 0x18], 0xf72d
jne 0x1402ea8d4
loop 0x14057aa59
xchg byte [rdi - 6], bh
mov al, 0xc4
mov ch, 0xc7
imul eax, edi, 0xce46903f
shr esi, 1
xchg rdx, rax
cmc
iretd
Function at 0x140521ec6
Capabilities:
Encode data using xor

Disassembly:
push r12
lea rsi, [r10 + r10*8 - 0x5b6a6d4f]
lea rdx, [rdx + 1]
mov r12, qword [rsp + 0x20]
or r10b, sil
xor esi, r12d
js 0x1405c9478
mov r14, rcx
push r12
mov r12, r14
neg rcx
mov rcx, qword [rsp + r14 - 0x76499241]
mov qword [rsp + 0x18], 0xffffffff81a39589
mov r14, qword [rsp + r14 - 0x76499251]
add r12, 0xffffffffe69d3684
xor r12, 0x70b3593d
lea r12, [r12*4 + 0xb19523d]
setge r12b
jbe 0x140340e8c
call fcn.1402d6446
push rax
push rsi
pushfq
movabs rsi, 0xe58a15aa880f2094
and esi, 0xd5aee8a2
test esi, 0x83b0df3d
call fcn.14027cb40
cmp byte [rsp], 0x87
call fcn.140480db7
push 0xfffffffff82a27b2
jno 0x140340e6d
push r12
test qword [rsp + 0x28], 0xffffffff8219b310
mov qword [rsp + 0x50], rdx
jl 0x1404e9942

Function at 0x140523d47
Capabilities:
Encode data using xor

Disassembly:
movabs r11, 0xe8a576bfb51db7b6
call fcn.140344a0c
not r15d
xor byte [rsp + 0x60], 0x31
or r15, 0xffffffffe28a9029
mov rbp, qword [rsp + rbp*4 - 0x2c]
or byte [rsp + 0x60], 0x25
test byte [rsp + 0x60], bh
jo 0x1404ceaaa
movsx r15w, r15b
and byte [rsp + r15*4 + 0xbc], 0xb1
mov rbx, qword [rsp + 0x38]
mov r15w, 0x4b0d
lea r15, [r15 + r15 - 0x54f3da76]
call fcn.1405552f7
movsx ecx, word [rsp + 0x31]
jno 0x1403f9fe9
setle cl
sub dword [rsp + rcx - 0x34c925a0], 0x2ca1d2b0
mov rcx, qword [rsp + rcx - 0x34c925b8]
sub qword [rsp + 0x40], 0xffffffffb1046c3e
shl byte [rsp + 0x38], 0x51
or byte [rsp + 0x40], 0x8f
not qword [rsp + 0x38]
ja 0x1400518d0

Function at 0x14052f949
Capabilities:
Encode data using xor

Disassembly:
ja 0x140352964
out dx, al
pop rdx
invalid
pop rsi
cmp eax, 0x9b99ab6f
invalid
xchg esi, eax
call qword [rbx]
movabs eax, dword [0x9c5541f622f03705]
push r13
pushfq
add qword [rsp + 0x10], 0xffffffffbfc0e1b2
movabs r13, 0xcda5fc26af160613
call fcn.14051b1fb
int 0xe8
jae 0x14035290e
sbb al, 0
mov edi, 0xe4ed20fb
ja 0x140352930
pop rcx
loope 0x140352982
invalid
call fcn.140321da2
not di
jle 0x1405360ce
cdq
add dword [rcx], esp
add eax, 0x64050002
invalid
mov rdi, qword [rsp + 0x68]
jo 0x140352979
xor word [rsp + 0x38], 0x138d
add qword [rsp + 0x38], 0xffffffffdba4e025
or qword [rsp + 0x38], 0x4711ae0c
jb 0x14041af5e
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret

Function at 0x1405308b9
Capabilities:
Packed with generic packer

Disassembly:
lea rdx, [r10 + rdx*8 - 0x2a4ecbf8]
add rdi, qword [rsp + 0x30]
xor dword [rsp + 0x30], 0x9287df87
movzx di, dil
jo fcn.14054859c
mov qword [rsp + r10*2 - 0x72a], rdi
lea rsi, [rsi + 0x7b9b940d]
push r13
mov rdi, qword [rsp + 0x38]
test di, 0x5a3b
xchg qword [rsp + 0x68], rsi
mov rdx, qword [rsp + 0x50]
je fcn.14026687f
and qword [rsp + r10*2 - 0x74a], r10
mov r13, r10
setb byte [rsp + r10*2 - 0x74a]
setae dil
mov dword [rsp + 0x38], edi

Function at 0x140537ccb
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x20], rdi
movabs r13, 0x7f9c0c9e2fbe3eb6
pushfq
shl r13, 0x89
cmp r13, 0x4e892430
movabs r13, 0xc0a2d97ea139381
call fcn.140469fdd
Function at 0x14053da9a
Capabilities:
Encode data using xor

Disassembly:
push rdx
push rbx
movabs rbx, 0x3e834faf75243098
pushfq
movabs rdx, 0xf52d6f04052b121f
mov qword [rsp + 0x18], 0xffffffffc91aad8f
mov rdx, qword [rsp + 0x10]
xor bl, 0x29
jns 0x14053da9c
test bl, 0xa3
call fcn.14036278a

Function at 0x1405429cd
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x28], rdi
shl r8b, 0x43
or r10b, r8b
add qword [rsp], 0xffffffffbfdfdd77
and r8w, 0x7e9b
neg r8d
sub r10d, r8d
call fcn.140508f5c
jns 0x14030b100
adc edx, dword [rsp + rcx + 0x57]
sahf
sahf
scasd eax, dword [rdi]
lea eax, ds:[rax + 6]
xchg byte [rsi], bh
sbb bl, byte [rax + rsi*4 + 0xc]
jae 0x14030b152
invalid
mov rbp, qword [rdx + rcx*2 - 0x4b9b62f0]
mov bh, 0xa8
fcmovne st(0), st(3)
outsd dx, dword [rsi]
push rax
int1
and dh, byte [rbx + rdx*2]
ja 0x14030b0d6
outsb dx, byte [rsi]
or dword [rcx - 0xd], eax
stosb byte [rdi], al
xchg ecx, eax
invalid
fiadd dword [rbx - 0x47]
push rax
xor al, al
lahf
sub al, byte [rdx + 0x11]
cmp dword [rbp + 0x3bba9c57], eax
cli
pop rax
push rdi
mov eax, 0x2bf3a5c0
jge 0x14030b192
insd dword [rdi], dx
cmp ch, byte [rbx + rsi*8 + 0x1a]
wait
or esi, dword [rcx + rbx*4 + 0x14286dbd]
jnp 0x14030b189
mov ebp, 0x3e14286d
jnp 0x14030b189
mov ebp, 0xe3abfbb4
js 0x14030b175
sub eax, 0xae64b82c
scasb al, byte [rdi]
push rcx
mov esp, 0x5d2d9a6
movabs dword cs:[0xfea92063b681a3ee], eax
mov ecx, 0x9f0a2aa8
out dx, al
movabs dword [0xa8b9fea92063b681], eax
sub cl, byte [rdx]
lahf
test edx, 0x3ee71c82
lea ecx, [rax + rdx*4]
lahf
invalid
mov dword [rsp + 0x18], 0xd58ff50c
xchg qword [rsp + r14*2 - 0x564fc4f4], rbx
mov r12, qword [rsp + r14 - 0x2b27e25a]
movabs rbp, 0x490265ab2ab42d8c
setne bpl
and bpl, r14b
lea r14, [rbp*4 - 0x49719969]
add dword [rsp + 0x40], ebp
mov r14, qword [rsp + 0x30]
call fcn.14048856c
add qword [rsp + r12 - 0x6bffffa8], 0xffffffffbfbd82c0
shl byte [rsp + r12 - 0x6bffffc0], 0xee
mov r12, qword [rsp + r12 - 0x6bffffb8]
add qword [rsp + 0x38], 0xffffffffab0efd0b
shl qword [rsp + 0x40], 0x30
call fcn.1405cbb6b
sub dword [rsi], ecx
stc
xor esp, eax
invalid
lea rbx, [rbx + r12 + 0x59ae1f3e]
add r12b, r14b
bswap r12
shl byte [rsp + r14 - 0x2b27e28a], 0xd4
jns 0x1405101f6
mov r10d, 0xfba106b6
and r10b, r8b
ja 0x14030b0a9

Function at 0x140542a91
Capabilities:
Packed with generic packer

Disassembly:
bswap r11
xchg qword [rsp + 0x20], rdx
movabs r9, 0x62ab5d1250016783
cmp r9b, 0xb8
lea r11, [r9*2 + 0x3736c68b]
jge 0x140435f90
shl r9w, 0x75
call fcn.1403af023
jbe 0x1404d6692
xchg edi, eax
sub bl, byte [rax + 0x7fb9adc3]
invalid

Function at 0x14055ca55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xffffffffbfb2ec62
push r11
neg r8
neg esi