joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140532e53
Capabilities:
Delete registry key
Packed with generic packer

Disassembly:
lea r9, [rsi + r9*4 - 0x7ce8f7e9]
sub rsi, 0xffffffffe63585a7
shr qword [rsp + 8], 0xaf
lea rdx, [rdx + 0x79a35988]
xor r9d, 0xb72f21a3
mov qword [rsp + r9 - 0x71e610a6], r9

Function at 0x140532e84
Capabilities:
Delete registry key
Packed with generic packer

Disassembly:
seto byte [rsp + rsi + 0x40]
ja 0x1403d04de

Function at 0x140539e2a
Capabilities:
Encode data using xor

Disassembly:
call fcn.1406766fe
or dil, 0x86
jae 0x1406a457e
or di, di
xor dil, 0x8e
jne 0x14057d26d
sub esi, dword [rsp + 0x2a]
mov r12, rsi
neg word [rsp + 0x28]
sets sil
mov r12, qword [rsp]
shr r13, 9
shl si, 0x21
jg 0x14049908f
test word [rsp + 0x29], r13w
jle 0x140653ab1
call fcn.14071b501
pushfq
mov qword [rsp + 0x28], rax
test r10b, 3
push rsi
jle 0x14054bc81
xor r10b, 0x91
push r13
add qword [rsp + 0x20], 0x23deb6
movabs rsi, 0x2c2fc9b76080a791
sub r10w, 0xae3c
mov r13, rsi
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
bswap r13
sub r10d, 0x153f0b0a
and esi, r10d
js 0x1406c6696
or r13w, 0xed3e
jge 0x1403d158e
cmp rsi, 0xffffffffc3167e9e
lea rax, [rax - 0x545caecf]
bswap r13
mov qword [rsp + rsi - 0x6080a2e0], r13
push r12
jl fcn.14064faf1
shr r13b, 0x8f
test byte [rsp + r10 - 0x60eeb322], 0x2a
xchg qword [rsp + rsi - 0x6080a2c0], rax
mov r10, qword [rsp + 0x38]
ja 0x140582c36
jge 0x140466aa5
add rdi, 0x5618cc9e
shl rdi, 0xa4
shr di, 0x42
mov rdi, qword [rsp + 8]
mov qword [rsp + 8], rax
push r8
movabs r8, 0x8aa76ca3028a3b0f
and dil, 0x81
test rdi, 0xffffffffe6b27a31
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
call fcn.1406a6aba
mov rbp, qword [rbp + riz]
jbe 0x140462f47
xchg esp, eax
jns 0x140582cc1
xlatb
test byte [rdi + rdi*4 - 0x6c394519], ah
wait
xchg esp, eax
out 0x49, eax
pop rbx
leave
out 0x9b, eax
invalid
jnp 0x140582d1b
fcmovnbe st(0), st(0)
sbb ch, byte [0xc0ae0149]
xchg esp, eax
invalid
rcr dword [rdi + 0x6e7a4806], cl
add esi, ebx
adc ebp, ebx
test al, 0xc8
cmp byte [rdx - 0x11], ch
mov bh, 0x93
inc dword [rax - 0x32c6c432]
cmpsd dword [rsi], dword [rdi]
sub eax, 0x90274396
xchg esi, eax
fbstp tbyte [rdi]
push rsp
pop rax
sbb byte [rdi - 0x5e012cea], bh
invalid
movabs eax, dword [0x980f8463d8901c82]
lodsd eax, dword [rsi]
mov dword [rbp + 1], edi
adc dword [rdi + 9], ecx
test al, 0x81
and ebp, dword [rsi - 0x5cf85bbd]
xchg al, dh
movabs byte [0xcab8f65d71cd8450], al
jg 0x140582d2b
adc dword [rsi - 0x665b581e], esp
jns 0x140582cf3
lahf
invalid
mov qword [rsp + 0x18], rdi
add qword [rsp + 0x18], rdi
lea rbp, [rbp + 0x1b8946b9]
call fcn.14046d9e0
push rdi
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
mov r10, qword [rsp + rsi - 0x702680f6]
mov rdx, qword [rsp + 0x10]
mov r11, qword [rsp + 8]
lea rsp, [rsp + 0x38]
ret 8

Function at 0x140543639
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407aaab6
Function at 0x140543648
Capabilities:
Authenticate hmac

Disassembly:
or qword [rsp + 0x58], 0x619d2b11
add qword [rsp + 0x10], 0xffffffffbfa18dd3
mov r8, qword [rsp + 0x20]
test byte [rsp + 0x58], 0x94
call fcn.1404b1611
sub al, 0x1f
test cl, bh
cli
push 0xffffffffffffff81
mov dword [rdi - 0x2ff50632], ebp
retf
jns fcn.140656c0c
mov r10, qword [rsp + 0x30]
xor qword [rsp + 0x48], r8
jge 0x1403ff314

Function at 0x14055274d
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov qword [rsp + 0x10], 0x43cb472d
lea rsp, [rsp + 0x10]
call fcn.140784571

Function at 0x14055c32f
Capabilities:
Packed with generic packer

Disassembly:
push rsi
shl sil, 0x61
push rbp
call fcn.1405cffa8
mov bl, dl
test al, 0xfe
invalid
cmp byte [rsp + 0x60], 3
ja 0x140547bfa
setle byte [rsp + 0x60]
call fcn.14057db96

Function at 0x1405669b7
Capabilities:
Packed with generic packer

Disassembly:
test word [rsp + 0x30], 0xc598
jg 0x140685e8b
cmp dword [rsp + 0x20], 0x209f515
jge 0x1405ce201

Function at 0x1405715ed
Capabilities:
Get common file path
Set registry value

Disassembly:
movabs rdi, 0xc4bc8625fa3f7b39
jns 0x1405dfa1f
push r13
mov r13, qword [rsp + 0x10]
ja 0x1406cea8d
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]

Function at 0x14057e070
Capabilities:
Get common file path
Set registry value

Disassembly:
ja 0x1406a77de
setb dil
setle dil
jle 0x1407153b2

Function at 0x140588f55
Capabilities:
Packed with generic packer

Disassembly:
call 0x1404646ad
add qword [rsp + 8], 0xac85d
cmp cx, 0x8695
movabs rax, 0x97272e99b6102d2c
jg 0x1404027a9
lahf
movsd dword [rdi], dword [rsi]
iretd
add r12, r12
mov r12, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
jg 0x14063f530
push rcx
movabs rcx, 0x5a0b4220edbe162a
jbe 0x1404ad070

Function at 0x140595ba4
Capabilities:
Packed with generic packer

Disassembly:
mov rbx, rdi
jns 0x140477c41

Function at 0x140597234
Capabilities:
Check for software breakpoints

Disassembly:
invalid
xor eax, 0x5abdc79e
add qword [rsp], 0x2d1a2c
nop
movabs rbp, 0xaf2bd79b4a28309e
shr ebp, 0x13
jbe 0x140707ee0
neg bpl
or ebp, ebp
add ebp, 0xafb48135
call fcn.1406c3f0d
mov al, 4
loope 0x140597215
movabs eax, dword [0x937c4a5122c8a3af]
jns 0x140597220
out 0x75, al
cmp al, 0xcc
retf

Function at 0x140597543
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x28], rbp
pushfq
add qword [rsp + 0x20], 0xfffffffffff087ef
add qword [rsp + 8], 0xffffffffbf9e9328
movabs rbp, 0x7335ac1ab9a70420
add rbp, rbp
and ebp, ebp
sub bp, 0x4130
neg rbp
in eax, dx
xor byte [rcx + 0x48], al
neg ebp
mov rbp, qword [rsp + rbp + 0x734ec730]
mov rbp, qword [rbp + riz]
call fcn.140441577
adc qword [rax - 0x79], 0x79f66bf5
or al, byte [rcx]
mov dh, 0x74
mov dh, ch
mov edx, 0x15878114
stc
or cl, byte [rbp + 0x62a7997]
test al, 0x1f
js 0x14059756c
sub eax, 0xd8ca7a65
xor byte [0xcdeef987], bl
invalid
Function at 0x14059ac78
Capabilities:
Packed with generic packer

Disassembly:
shl dword [rsp + 0x10], 0xed
add word [rsp + 0x10], 0x78b8
shr byte [rsp + 0x10], 0xef
cmp qword [rsp + 0x10], 0xffffffff81b0510f
lea rbx, [rbx + 1]
mov dword [rsp + 0x10], 0x44ac9296
call fcn.14040eda8
neg r8d
mov r8, qword [rsp + r8 - 0x1a495dd1]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
lea r8, [r14 + rbp*2 - 0x34d06669]
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x58], r14
jle 0x1404ec3f3
lea rbx, [rbx + r15*2 - 0x10c93d2a]
call fcn.140530ffa

Function at 0x14059ac9d
Capabilities:
Packed with generic packer

Disassembly:
shr r8b, 0x8d
add dword [rsp + 0x40], 0x63132f8c
jo 0x14066d00e
lea rsi, [rsi - 0x787e8d7e]
jge 0x1406df54a
call fcn.1406a2f2a

Function at 0x1405ab95e
Capabilities:
Packed with generic packer

Disassembly:
not r10d
lea rdi, [r10*2 + 0x54ba6d89]
call fcn.140706457
add qword [rsp], 0x17d4a8
movabs rsi, 0xbeaa0a2ab02bb4b8
neg esi
jle 0x14046b2c4
jns 0x140639c1d
push r15
xchg qword [rsp + 0x20], rcx
mov rdi, qword [rsp + 0x10]
mov r15, qword [rsp + 8]
cmp dword [rsp + 8], r15d
call fcn.140699f62
test al, 0xba
mov esi, 0x4e796b7b
sal byte [r10 + 0x14], cl
fadd qword [rbx + 0x41]
invalid
cmp sil, 0x3d
mov rsi, qword [rsp + rsi - 0x4fd44b48]
mov rsi, qword [rsi]
mov qword [rsp], 0x5bb7413f
not qword [rsp]
je 0x140484aa8
or qword [rsp], 0xd83ca33
push r14
movabs r14, 0x9f34ef0366016c0f
js 0x1406d85a3
mov qword [rsp + 8], r14
lea rsi, [rsi + 0x16372b96]
push rsi
push r10
mov rsi, qword [rsp + 0x18]
jns 0x14035aad6
call fcn.1406cb098
scasd eax, dword [rdi]
shr dword [rdx + 0x65], 0xa
in eax, dx
pushfq
invalid

Function at 0x1405ac793
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
call fcn.1404805b1
test r10d, 0xca2c5815
jne 0x140581955

Function at 0x1405ac7a0
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
seto bl
push rdx
add qword [rsp + 0x10], 0xffffffffffec188c
xor bl, 0x3d
call fcn.1406199f3
and bpl, 0x29
mov rbp, qword [rsp + rbp - 0x5231bfb9]
shr qword [rsp + 0x50], 0x7a
test qword [rsp + 0x50], 0xffffffffa896bb2c
js 0x1406f4174
xor qword [rsp + 0x50], 0x6881600a
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x58]
ret
not r11d
push rbx
mov r11, qword [rsp + r11 - 0x12c4ffe7]
mov qword [rsp + 0x18], rdx
movabs rbx, 0xb7344882172c7536
shr bx, 0x1c
add bx, 0x7b8e
jns 0x14048695d
xchg qword [rsp + rdi + 0x34], rdx
mov rdi, qword [rsp + 0x28]
cmovle r12d, ebp
shr r12b, 0x73
xor ebp, 0xad0e67b7
xor r12b, r12b
and r12d, 0xf5ac1a3d
movsx ebp, byte [rsp + 0x54]
je 0x140677c97
js 0x1406d250a
cdq
mov esp, edi
push rax
mov bl, 0xa9
or dword [rax + 0x79], ecx
movabs dword [0xbdc837c56d5f143a], eax
cmpsd dword [rsi], dword [rdi]
invalid
lea rbx, [rbx + r14 - 0x7c715b8a]
shr rbp, 0x31
shl bp, 0x28
jbe 0x1405e8a66
sbb al, 0x64
invalid
xor r12, 0x1410b436
mov rax, qword [rsp + 0x20]
jo 0x1405ead91
call fcn.140590ac4
mov r12, qword [rsp + rbp*4 + 8]
neg bp
add rbp, 0x5231c013
ja 0x14056f4b0
movabs r11, 0xce25b99e24a8698d
call fcn.14058ba26
Function at 0x1405acaf8
Capabilities:
Encode data using xor

Disassembly:
and al, 0x98
add byte [rax], al
add byte [rsi], dl
add qword [rsp + 0x68], 0xffffffffbfb78fa9
neg dword [rsp + 0x90]
test dword [rsp + 0x98], 0xeb9edc08
sete byte [rsp + 0x98]
jle 0x1406e32ec
not esi
neg esi
mov r14w, si
mov r12b, sil
mov qword [rsp + 0x18], r12
sub word [rsp + 0x18], r11w
xchg qword [rsp + 0x50], rax
mov r11, qword [rsp + 0x30]
call fcn.140356117
fdivrp st(0)
xor al, 0x2f
pop rsi
cmpsb byte [rsi], byte [rdi]
add byte [rcx - 0x394ca2e0], al
cwde
mov eax, 0x3b5b4568
pop rbp
pop rdi
imul esp, ecx, 0x7692a011
or eax, ecx
jno 0x1405acac9
mov byte [rsi], bh
invalid
setge byte [rsp + 0x90]
call fcn.14063c5bc

Function at 0x1405c455f
Capabilities:
Packed with generic packer

Disassembly:
jl 0x140509df0
movsxd rcx, ecx
mov rcx, qword [rsp + rcx - 0x1d9c083b]
jb 0x14059ac98
call fcn.1406bbe4d

Function at 0x1405c79b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg r11w
jge 0x14053834a
test byte [rsp + 0x1a], r15b
call fcn.14041b910
lea r13, [rbx + rdx*8 + 0x3d30fab6]
call fcn.14048e240
setbe r11b
jo 0x14051b988
xor r11d, dword [rsp + 0x18]
jns 0x14071097f
jl 0x1405d38b1
mov rsi, qword [rsp + 0x60]
and r15d, dword [rsp + 0x18]
jae 0x1404239d3
push rbp
mov qword [rsp + 0x30], rbx
movabs rbp, 0x2b9148b67b0561b9
call fcn.1403fd101

Function at 0x1405c9101
Capabilities:
Encode data using xor

Disassembly:
seto r15b
cmp r15, 0xffffffffc5841036
mov r15d, 0xee303ea6

Function at 0x1405cd92d
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1407e53ea
mov qword [rsp], 0xffffffff8e3af275
call fcn.140755750

Function at 0x1405d6baf
Capabilities:
Delete registry key
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 0x18]
or r13, qword [rsp + 0x28]
call fcn.14062d6d2

Function at 0x1405d6bce
Capabilities:
Delete registry key

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.14072bdb8
jle 0x14043e6e5

Function at 0x1405d6bd4
Capabilities:
Delete registry key

Disassembly:
rol ecx, 1
invalid
lea rdx, [rdx + r8 + 0x28bd752c]
shr r8, 0x9d
mov r8, qword [rsp + 0x30]
cmp dx, 0x838f
je 0x14041c552
jb 0x14040f8f7
push rbp
rdpmc
jns 0x1405d6b81
shl dword [rax + 0x7b], 1
xchg byte [rax - 0x75688980], al
xchg byte [rdx - 0x3e], bl
invalid

Function at 0x1405e45c7
Capabilities:
Set socket configuration

Disassembly:
lea r8, [r13*8 + 0x2b8fcd2c]
mov dil, 0x2c
cmp r8d, edi
add qword [rsp + 0x18], 0xffffffffffec5fc3
call fcn.14057d303
mov qword [rsp + 0x48], rbp
jo 0x14001c09a
lea r8, [r8 + r8*2 + 0x61951337]
and r8, 0xffffffffd505ab11
bswap edi
jge 0x140353d86

Function at 0x1405ec95f
Capabilities:
Set registry value

Disassembly:
mov r13, qword [rsp + r11 - 0x6cdc3930]
and word [rsp + r11 - 0x6cdc3918], 0xd5bf
call fcn.1406045b8
pop rcx
invalid
jne 0x140629918
add r13b, byte [rsp + r13 - 0x3804a4b5]
shl r11w, 0x23
and r13b, byte [rsp + r13 - 0x3804a4bc]
movsxd r13, dword [rsp + r13 - 0x3804a3c0]
jns 0x140560367
Function at 0x1405f4bc6
Capabilities:
Packed with generic packer

Disassembly:
bswap rdx
not edx
jle 0x1404ec6c0
xchg qword [rsp + r8 + 0x33ea3767], rbp
mov rdx, qword [rsp + r8 + 0x33ea3727]
add qword [rsp + r8*2 + 0x67d46e2e], 0x24a101
test dword [rsp + r8 + 0x33ea375f], r8d
lea rsp, [rsp + r8*2 + 0x67d46e2e]
ret
xor al, 0x20
push rdx
jbe 0x140401905
test byte [rbp - 0x65], dh
jb 0x1405f4b61
jb 0x1405f4bf1
cwde
stosb byte [rdi], al
iretd
cli
add eax, 0xced3e998
xchg dword [rdi + 0x6f], esp
xor al, 0xfa
pop rsi
retf 0xb7b2

Function at 0x14060052d
Capabilities:
Packed with generic packer

Disassembly:
not byte [rsp + 0x48]
jns fcn.14044dad6
cmp byte [rsp + 0x40], 0x86
jb 0x14055ba09
shr dword [rsp + 0x40], 0xd1
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x68]
ret
mov rbp, qword [rsp + 0x58]
or r15d, r15d
cmp qword [rsp + 0x40], r15
ja 0x1405727e4
add qword [rsp + 0x28], 0xffffffffbfbe90fb
mov r15, qword [rsp + 0x38]
or qword [rsp + 0x48], 0xffffffff88bd4a1e
js 0x14043e0bd
call fcn.14063f463
not word [rsp + 0x20]
je 0x14053af1a
xchg qword [rsp + 0x40], rbp
mov rbx, qword [rsp + 0x10]
neg qword [rsp + 0x30]
and byte [rsp + 0x20], 0x3e
xor byte [rsp + 0x20], 0xb3
shr word [rsp + 0x20], 0xfa
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
ret

Function at 0x14061ab00
Capabilities:
Encode data using xor

Disassembly:
xor qword [rsp + 0x40], 0xffffffff96243295
push r9
neg esi
neg r11w
xchg qword [rsp + 0x90], rbx
mov rsi, qword [rsp + 0x80]
movabs r9, 0xe956f19d81ee5b5
pop r9
call fcn.1405d5867

Function at 0x14061b368
Capabilities:
Get common file path
Set registry value

Disassembly:
setb byte [rsp + 0x30]
mov qword [rsp + 0x28], 0xffffffffa5927b8d
test byte [rsp + 0x30], 0x36
xchg qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x20]
jle 0x140709519
in eax, 0x23
loopne 0x1405b9148
add al, 0x91
pop rax
push rsp
mov ah, 0x4c
invalid
loopne 0x1405b9197
push rbx
mov al, 0x86
invalid
int3
je 0x1405b90d1
invalid
add qword [rsp], 0xffffffffbf9a3c3e
mov byte [rsp + 0x28], 0x81
call fcn.1406556b4
push 0x26
jle 0x1407094df
mov dh, 0x75
insd dword [rdi], dx
movsd dword [rdi], dword [rsi]
pop rdx
iretd
Function at 0x14061b381
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
jg 0x140378a70
call fcn.1405d38c1
add qword [rsp + 0x18], 0xfffffffffff8d69c
mov rbp, qword [rsp + 0x28]
movabs rcx, 0x4680461426953e29
call fcn.14061134f
fcom qword [rbx - 0x1d]
push rax
cmp eax, 0xa545be1
in eax, 0xcf
invalid
mov rdi, r11
push r8
jbe 0x140030b27
js 0x1406e8970
push 0x3f0ba31c
mov rdi, qword [rsp + 0x20]
pushfq
add qword [rsp + 0x18], 0x1d42b9
not byte [rsp + 8]
push r11
movabs r11, 0xa22e94a28499a81b
lea rdi, [rdi + 1]
neg dword [rsp + 0x10]
jge 0x1405f6e74
and r11d, r11d
mov qword [rsp + 0x30], rdi
shl r11, 0x63
js 0x1406cf099
test qword [rsp + 0x10], r11
setns byte [rsp + 0x10]
nop
test qword [rsp + 0x10], 0xffffffffc2b4f0a2
push r13
push rdx
mov rdi, qword [rsp + 0x30]
mov rdi, qword [rdi]
mov qword [rsp + 0x30], r11
push r14
mov r14, qword [rsp + 0x28]
jle 0x14058e0a5
movabs r13, 0x1b2ac71ba280a10e
lea rdi, [rdi - 0x3ce28c43]
setno byte [rsp + 0x38]
movabs rdx, 0xcf17b9b03e3e641b
and r11d, r13d
call fcn.140402a43
test al, 1
invalid
Function at 0x14062ac98
Capabilities:
Packed with generic packer

Disassembly:
sete byte [rsp + rdi*2 - 0x60]
bswap rdi
movzx r10, byte [rsp + r10 - 0x3ebaff0f]
not word [rsp + rdi*8 + 0x28]
add qword [rsp + rdi*4 + 0x10], 0xffffffffbfa9fb54
lea rcx, [rcx + r10 - 0x3bee33bc]
mov dword [rsp + r10 - 0x97], 0x798af73e
and edi, edi
cmova edi, dword [rsp + rdi + 0x20]
jo fcn.1403b08df
not rdi
sub byte [rsp + r10 - 0x97], 0x3d
test rdi, 0x6b19f295
cmovbe r10, qword [rsp + rdi + 0x29]
xchg qword [rsp + rdi*4 + 0x3c], rcx
mov r10, qword [rsp + r10 - 0xa7]
or rdi, rdi
neg dword [rsp + rdi*2 + 0x22]
mov word [rsp + rdi*4 + 0x2c], di
cmp dil, byte [rsp + rdi*8 + 0x32]
mov rdi, qword [rsp + rdi*8 + 0x10]
mov word [rsp + 0x28], 0x633
jns 0x1407079fd
or dword [rsp + 0x28], 0x773ea41f
shl qword [rsp + 0x28], 0x15
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x14062ad3f
Capabilities:
Packed with generic packer

Disassembly:
mov rax, r13
js 0x14072002b
push rbp
call fcn.1404d8eb7

Function at 0x140637db8
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1403d49e9
lea rbp, [rbp + 0x6cbf2aa4]
add r14w, r10w
and r10w, word [rsp + 0x2a]
sub byte [rsp + 0x30], r10b
test r10w, r14w
xchg qword [rsp + 0x50], rbp
mov r10, qword [rsp]
jl 0x1405280d0
mov qword [rsp + 0x30], 0xe11a4
setl byte [rsp + 0x28]
mov r14, qword [rsp + 0x40]
add qword [rsp + 0x10], 0xffffffffbfb09b51
test word [rsp + 0x28], 0x5124
not dword [rsp + 0x30]
call fcn.1406e4565
xor byte [rsi], dh
fldcw word [rdi - 0x104fd756]
push rcx
xchg ebp, eax
push rbx
adc eax, 0x6ab2aaa7
mov dl, 0x6a
in eax, 0x98
pop rdx
mov ch, 0xd3
jrcxz 0x140637e86
movabs dword [0xda41954aa3584c6a], eax
push rax
mov ch, 0xed
sub dword [rdi], 0x5d
push rbp
in eax, 0x95
cmp dword [rbx - 0x4e108e96], esp
movabs byte [0x3a17bf8aa0cb6a8a], al
je 0x140637ea7
invalid
cmp dl, byte [0xffbb512d]
jbe 0x140637e21
jo 0x140637e90
jne 0x140637ede
invalid
jl 0x140637e74
push rsi
sub esp, dword [rax]
invalid
mov dword [rax + 0x3b425746], 0xd9f0d268
mov ch, 0xd3
out 0xf3, al
ret
invalid
invalid

Function at 0x14063f425
Capabilities:
Encode data using xor

Disassembly:
call 0x14044c314
jle 0x1404603c1
push rax
call fcn.14065288d
Function at 0x14063f4da
Capabilities:
Packed with generic packer

Disassembly:
xor al, 0x8c
invalid
adc byte [rax], al
test byte [rsp + 0x18], 9
mov r11, qword [rsp + r13*4 - 0x74b22934]
jb fcn.14064518a
ja 0x140444538
pop rbx
jns 0x14052a47b
add si, word [rsp + 0x96]
add esi, dword [rsp + 0x96]
mov r14w, 0x5925
test dword [rsp + 0x90], 0xb41fb23d
mov r11, qword [rsp + 0x70]
lea r14, [rbp*8 - 0x59c1e95c]
jae 0x14051cc59
push rdx
rcr byte [rsi - 0xc258688], 0x61
xchg dl, dh
cmc
test byte [rcx - 0x7193047a], 0x83
jns 0x1403f4a48
pop rcx
fld qword [rdx + 0xc86867d]
js 0x1403f4a36
scasd eax, dword [rdi]
pop rdi
imul edi, ebx, 0xae458689
lea edi, [rcx - 0x23]
jb 0x1403f4ad5
jle 0x1403f4a46
pop rax
invalid
test byte [rsi - 0x79c58dea], al
jns 0x1403f4b5d
lodsb al, byte [rsi]
sbb esi, dword [rsi]
js 0x1403f4a69
wait
mov ebx, 0x3f9171b4
invalid
je 0x1403f4bd5
xchg ecx, eax
sahf
invalid
mov edi, 0xb1e5ddf2
invalid
ja 0x1403f4b9f
push rbp
rcl dword [rsi + 0x3e]
fnstcw word [rdx - 0x4a6716d2]
imul rsp, qword cs:[r9 + 0x5ab22ea5], 0x33d1432e
ret
push rdx
push r11
pushfq
movabs r11, 0x2190678f4fafee10
shl r9d, 0xbf
mov r13, rbp
mov rbp, qword [rsp + 0x28]
sub esi, r14d
cmovge si, r14w
ja 0x1403b4cea
js 0x140588abb
movzx r13, r13b
mov r13, qword [rsp + r13 - 0x47]
jbe 0x14001fd79
shl dword [rsp + 0x58], 0x94
sub dword [rsp + 0x58], ebx
mov rbx, qword [rsp + 0x48]
call fcn.14041c5c8
and r8d, r8d
push r13
add r8, 0x12b6209d
or r8b, 0x96
jo 0x140044e21
add r8w, r8w
not r8d
add qword [rsp + 8], 0x15ae4
movabs r13, 0x7780bc29ac07ad3a
mov rdx, r8
shl r13, 0xab
neg r8w
movzx rdx, dl
push r11
movabs r11, 0xd92d410d1d07eb90
lea r13, [r13*2 - 0x13c6bf73]
bswap rdx
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
sub r13d, 0xcf0cb63e
mov qword [rsp + r8*2 - 0x5f517a6e], r11
neg r8w
push rbx
lea rdx, [rdx + r13 + 0x8e5c3d5]
movzx r11w, r13b
setl r11b
ja 0x140724983
bswap r13
shl r11d, 0xb6
xchg qword [rsp + r8*2 - 0x5f508552], rdx
mov r8, qword [rsp + r11*8 + 0x28]
movabs rbx, 0x7aa892bf63022886
jbe 0x1407297aa
lea r11, [rbx + rbx*2 + 0x6fb78b33]
bswap r13
add ebx, dword [rsp + r13*2 - 0x3a591483]
jo 0x1403f4a48
pop rbp
and dword [rax], eax
invalid
jns 0x140666876

Function at 0x140650ec2
Capabilities:
Packed with generic packer

Disassembly:
mov word [rsp + rsi - 0x52e70947], 0x9334
ja 0x1403f4a68

Function at 0x140656c0c
Capabilities:
Authenticate hmac

Disassembly:
add rbx, qword [rsp + 0x48]
or bl, byte [rsp + 0x49]
movabs rbx, 0xb296711d858bc3a9
not r11w
mov word [rsp + 0x48], 0xcd17
lea rbx, [rbx + rbx*2 - 0x6f6fc569]
mov rbx, qword [rsp + r11 - 0x4807fa0]
jg 0x1405cd927
js 0x1405b7e5d
pushfq
mov qword [rsp], 0x43bff308
call fcn.140784571
jge 0x14045644a
rcl byte [rax - 0x7986db52], cl
add ebx, 0x18b986d7
and edi, dword [rcx + 0x18]
add dh, bh
invalid

Function at 0x140693e18
Capabilities:
Packed with generic packer

Disassembly:
push r14
movabs r14, 0x3d1e32a25c22c88e
movzx r14d, r14b
pushfq
shr r14, 0x1b
not r14d
neg r14b
xchg qword [rsp + 0x18], rax
call fcn.1406ed3ff
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14072bdb8
not qword [rsp + 0x50]
jle 0x14063f530
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x98]
ret
Function at 0x14069f124
Capabilities:
Packed with generic packer

Disassembly:
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [0x140346e30]
test rcx, rcx
je 0x14005348b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x28
ret
setno bl
lea rsi, [rsi + 1]
and ebx, ebx
or bl, 0x10
shl bx, 0x75
lea rbx, [rbx*8 + 0x73a43196]
call fcn.140642dd4
or r14w, 0x2ae
push rbx
neg r14b
movabs rbx, 0xb98fce028280b518
or rbx, r14
mov r14w, 0xde1e
add qword [rsp + 0x30], 0x7d2b0
add qword [rsp + 8], 0xffffffffbfbbde31
or ebx, r12d
add r14b, 0x3d
je 0x140053473
shr bl, 0xe6
not ebx
mov rdi, qword [rsp + 0x30]
mov rdi, qword [rdi]
je 0x1405a8396
test r14, 0xffffffff89beed9a
mov qword [rsp + 0x30], r14
not r14w
je 0x1406da602
sub r12, rbx
test qword [rsp + 0x30], 0x4b859a95
je 0x140477c04
push rsi
push rcx
movabs rcx, 0x43b26a3955832a1b
push rbx
pushfq
or rcx, 0x12ae070f
call fcn.140518de6

Function at 0x1406a7320
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
mov byte [rsp + rdx + 0x2be6bc88], 0x3e
lea rdi, [rdi - 0x597354cb]
sub dx, 0x6bbf
shl word [rsp + rcx*2 - 0x50c8c3ce], 0x68
jb 0x140423fa5

Function at 0x1406a7364
Capabilities:
Packed with generic packer

Disassembly:
neg cl
mov rcx, qword [rsp + 0x68]
jge 0x1405f4b50

Function at 0x1406a7371
Capabilities:
Packed with generic packer

Disassembly:
shl r15, 0xeb
test r15b, 0x19
call fcn.1407229f3

Function at 0x1406a737e
Capabilities:
Get common file path
Packed with generic packer
Set registry value

Disassembly:
add qword [rsp + 8], 0xfffffffffffab00f
and r10w, 0x9b89
jle 0x1405f6e65
stc
invalid

Function at 0x1406a7792
Capabilities:
Get common file path
Set registry value

Disassembly:
add qword [rsp + 0x20], 0xffffffffbfacdd7a
xor cx, 0xd235