joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400038d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400069d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400038f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400038f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400038f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000394d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003944
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400038f0
add rax, 0x28
cmp rax, r9
jne 0x140003930
xor eax, eax
ret

Function at 0x140003950
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400069d0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000396f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003978
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000396f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003a10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400069d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003a2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003a38
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1405ea058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405ea1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405ea089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ea06f
add dl, dl
jne 0x1405ea096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ea0f6
xor eax, eax
add dl, dl
jne 0x1405ea0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ea1ad
add dl, dl
jne 0x1405ea0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ea0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ea0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ea0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405ea0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405ea07e
mov eax, 1
add dl, dl
jne 0x1405ea106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ea113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ea0fb
sub eax, ebx
mov ebx, 1
jne 0x1405ea14c
mov ecx, 1
add dl, dl
jne 0x1405ea12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ea13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ea123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ea07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405ea168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ea175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ea15d
cmp eax, 0x7d00
jae 0x1405ea19b
cmp eax, 0x500
jb 0x1405ea196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ea07e
cmp eax, 0x7f
ja 0x1405ea19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ea07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405ea1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405ea07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400082c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140094a81
add dword [rax], eax
add byte [rax], al
jmp fcn.14065785d

Function at 0x140008a00
Capabilities:
Packed with generic packer

Disassembly:
js 0x14003e694
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
ret
lea rsi, [rsi + 0x282c2e2f]
push r12
push rbp
test qword [rsp + 0x20], r8
mov r12, r8
Function at 0x140016a70
Capabilities:
Access peb ldr_data
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], 0xb887767
lea rsp, [rsp + 0x10]
or ecx, dword [rax - 0x73]
and al, 0x10
call fcn.140532d8f
mov ah, 0x39
test eax, 0x93e9cccc
add byte gs:[rax], bh
rcl bh, 0xb0
fild qword [rdi + 0x63]
div byte [rdx - 0x4de6e821]
fisttp word [0x1604eca4d]
cmpsb byte [rsi], byte [rdi]
sahf
jp 0x140016a60
mov edi, 0xb263afdf
fild word [rax + 0x40]
invalid

Function at 0x14001f6c0
Capabilities:
Encode data using base64

Disassembly:
not r9
pushfq
test r9, 0x1831a402
jne 0x1403c4850
popfq
invalid
std
xor ebx, 0x1b
or byte [rax + 0x3b], dh
or dword [rdx + 0x7cacab02], 0xffffff8c
invalid
call 0x1403f15b6
pop rbx
jge 0x1403c47e6
out dx, eax
in al, 0x5f
shr byte [rbx + 0x7bb916cf], 0xeb
jl 0x1403c489d
jmp 0x1403c480a
add al, 0xbb
fadd qword [rdx + 0x78aefb11]
and ah, byte [rbp - 0x57170d2a]
xchg edi, eax
invalid

Function at 0x14001f6e9
Capabilities:
Read file on windows

Disassembly:
mov r8, qword [rsp + 0x58]
movabs r14, 0x781ba29e4617e69b
or byte [rsp + r15 - 0x127209e0], r14b
add qword [rsp + 0x18], 0xffffffffbff9fe59
shl r15d, 0x35
cmp qword [rsp + 0x48], 0x51a9c87
mov r15, qword [rsp + 0x50]
call fcn.1404612d5

Function at 0x14001f720
Capabilities:
Read file on windows

Disassembly:
jbe 0x14007eea2
call fcn.14032e035
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007ef20
xor r8d, r8d
mov rdx, rsi
mov ecx, r14d
call fcn.14008a270
test rax, rax
js 0x14007ef20
mov eax, dword [rsp + 0x30]
cmp rbp, rax
jg 0x14007ef20
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rbp, rbp
je 0x14007ef12
cmp rcx, rdx
jae 0x14007ef12
cmp byte [rcx], 0xd
jne 0x14007eef8
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14007ef07
cmp byte [rcx + 1], 0xa
jne 0x14007ef07
inc rcx
jmp 0x14007ef07
movzx eax, byte [rcx]
movsx rax, byte [rax + r13 + 0xaa340]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rbp
jne 0x14007eeda
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [r12 + rcx]
jmp 0x14007ef24
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140077cb0
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400215ff
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
call fcn.14035eeaf
jmp fcn.1406784f3

Function at 0x140021604
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
call fcn.14035eeaf
jmp fcn.1406784f3

Function at 0x14002a5b9
Capabilities:
Packed with generic packer

Disassembly:
mov dl, byte [rsp + rdx - 0x2b9bbf6c]
push r9
call fcn.140053d89
Function at 0x14002a5c7
Capabilities:
Packed with generic packer

Disassembly:
movzx r8, word [rsp + rbx*2 - 0x6f4d19ee]
lea rax, [rax + r8*2 + 0x6702b64c]
add ebx, r8d
cmp cx, word [rsp + rbx - 0x37a772a7]
xchg qword [rsp + 0x28], rax
mov r8, qword [rsp + r8*4 - 0x396c8]
jl 0x140424de3
shr qword [rsp], cl
jae 0x1404952ad
je fcn.14002c5b7
sub cl, ch
mov rcx, qword [rsp + rbx*2 - 0x6f4ee552]
call fcn.14005eeeb
mov qword [rsp + 0x38], r14
js 0x1403e0715
and r12b, 0xb4
or rbp, 0x38abc30a
xor r11b, 0x1a
xchg qword [rsp + r10 + 0xdccb098], rbx
mov rcx, qword [rsp + 0x10]
cmp qword [rsp + 0x38], 0xffffffffc2bdceaa
call fcn.14038270b

Function at 0x14002c5b7
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x18], rbp
push rdx
pushfq
movabs rdx, 0x3620990d573dffb0
push rsi
push r9
movabs rsi, 0x64847c0a520b3dbc
movabs r9, 0xf0100590ca106325
call fcn.14034b8a9

Function at 0x14002c5e4
Capabilities:
Packed with generic packer

Disassembly:
jno 0x140045410
movabs r8, 0x7abe852f260c56aa
and ebp, ebp
shl bpl, 0xe1
jae 0x140058158
lea rdx, [rdx + 1]
not r8w
jle 0x140422f84
mov r12, qword [rsp + 8]
setno byte [rsp + 0x10]
jl 0x14008cb45
js 0x140325d37
or r10b, 0xbd
jle 0x1400c7eb7
mov r11, qword [rsp + 0x38]
or esi, dword [rsp + 0x2c]
jl 0x140092c4e
or dword [rsp + rsi*4 - 0x7f15b1c4], 0xad14911f
mov rsi, qword [rsp + rsi*2 - 0x3f8ad8e6]
jns 0x1403624ca
and dword [rsp + 0x28], 0x4f2ec694
or qword [rsp + 0x28], 0xfffffffff9322932
not byte [rsp + 0x28]
call fcn.140092d9c
call fcn.1400402a8
jmp fcn.1406f5195
jmp fcn.14007874b
mov rdx, r9
jmp 0x140077559
je 0x140079fb5
add r9, 2
jmp loc.140470767
mov rsi, qword [rsp + 0x28]
movabs r9, 0xc00dc0952306b898
xchg qword [rsp + 0x40], rcx
mov r9, qword [rsp + rsi*2 - 0x21075b3a]
test word [rsp + rsi - 0x1083ad75], 0x1710
mov rsi, r11
jne 0x140095927
sub r10d, r10d
push r11
shl r8d, cl
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + r10*8]
bswap r10
je 0x1403249b9
movabs r11, 0x1a976688ed02d806
add cx, 0x6f89
lea rdx, [rdx - 0x43c15b79]
call fcn.1404323e1
cmp word [r9], cx
jmp 0x14007f840
jno 0x140074ff5
sbb cl, ch
movsb byte [rdi], byte [rsi]
invalid
ror dword [rdi], 1
sub dl, cl
jmp 0x14007767c
movabs r13, 0xb6b1c82fd8808d85
shl r13b, 0xcc
mov r13, qword [rsp + 0x18]
neg r10
call fcn.14043d091
xor al, 0xe7
add dword [rcx], ebx
or al, byte [rax]
sbb dword [rcx + rcx], esi
sbb dword [rax + rcx], esp
sbb dword [rdi + rax], edx
sbb dword [rsi + rax], esi
add byte [rcx], bl
invalid
invalid
invalid

Function at 0x14002e121
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x48], rax
mov r11, qword [rsp + 0x20]
lea rsi, [rsi + riz + 0xb340fba]
jns 0x1404d8942
setge sil
call fcn.1403bb80b

Function at 0x14002f532
Capabilities:
Packed with generic packer

Disassembly:
xor cx, word [rsp + 0x5a]
lea rdx, [rdx - 0x38c55ffb]
mov qword [rsp + rdi - 0x315fd5ca], rcx
call fcn.1404dcbe5
Function at 0x14002f54b
Capabilities:
Packed with generic packer

Disassembly:
je 0x140081e6b
mov rbx, rcx
mov rbx, qword [rsp + r14 - 0x5f38b016]
mov rbx, qword [rbx + r14 - 0x5f38b01e]
cmp r14w, 0x7512
mov qword [rsp + rcx + 0x1f], rcx
not qword [rsp + r14 - 0x5f38b016]
push r15
call fcn.14040c4f7
push r11
mov qword [rsp], 0xffffffffc6397a67
call fcn.140532d8f
invalid

Function at 0x1400317cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x1404ded08
jmp fcn.140692c7c

Function at 0x140031acc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.14042f2df
and r11d, dword [rsp + 0x10]
not qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
ja 0x140023d84
add dword [rcx], ecx
add dword [rax], eax
or dword [rdx], esp
add byte [rax], al
jmp fcn.1406931c9

Function at 0x140031ae4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.14042f2df
and r11d, dword [rsp + 0x10]
not qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
ja 0x140023d84
add dword [rcx], ecx
add dword [rax], eax
or dword [rdx], esp
add byte [rax], al
jmp fcn.1406931c9

Function at 0x140035664
Capabilities:
Execute anti-debugging instructions

Disassembly:
jl 0x14007cf64
or byte [rdi - 0x33335337], bl
jmp fcn.140699476
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1405af2b9

Function at 0x14003c9df
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rax, [rax + rax*2 + 0x4295e810]
add qword [rsp + rax - 0x42f9750a], 0xffffffffbff43a44
shl ax, 0x55
mov rax, qword [rsp + rax - 0x42f8ffd8]
mov rax, qword [rax]
lea rax, [rax - 0x37e1f80]
js 0x14032b79e
js 0x1400cd731
mov qword [rsp + 0x28], 0xffffffffcdb49193
call fcn.140005d79
or rcx, 0xffffffffb5b2f7b9
call fcn.14003d051

Function at 0x14003e63d
Capabilities:
Packed with generic packer

Disassembly:
movabs r8, 0x73353005a40c4215
add qword [rsp + 8], 0xfffffffffffdb5f7
shl r13w, 0xc
movabs rsi, 0x533aa12dc6341387
shr r13w, 0x99
mov si, 0x521c
shr esi, 0x4e
or r13b, r8b
neg esi
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi]
mov qword [rsp + 8], r8
push rdx
or byte [rsp + 0x10], 0x17
mov rdx, qword [rsp + 0x10]
not r13b
add qword [rsp + 8], 0x35a0a6

Function at 0x14003e6bc
Capabilities:
Packed with generic packer

Disassembly:
or r13w, word [rsp + 0x42]
or r13d, 0x400907a9
mov r8, qword [rsp + 0x20]
cmovl rcx, qword [rsp + 0x68]
je 0x1400cd5c9
cmp r13d, dword [rsp + r13 - 0x63a92f75]
call fcn.14001af58
mov rdi, qword [rsp]
mov rdi, qword [rdi]
call fcn.1403a9f88
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.1405af2b9
Function at 0x14003f44c
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs rdx, 0xe7007e2ad81a8510
mov rax, qword [rsp + 0x20]
neg dl
shl dl, 0x41
push r8
push rsi
movabs r8, 0xf6a7d2812b13dd38
movabs rsi, 0xf63cfa0a2d1abd8c
not dl
lea rax, [rax + 1]
cmp rsi, 0x431934b9
jno 0x1400cd5ba
pushfq
add qword [rsp + 0x10], 0xffffffffffc8f380
movabs rax, 0x1122f7069031fa3d
bswap eax
test rax, rax
jle 0x14003ae1a
mov rax, qword [rsp + rax*2 - 0x7bf46310]
mov rax, qword [rax]
call fcn.140030d17
or rbx, 0xffffffffb5b85d0e
mov rbx, qword [rsp + rbx + 0x240a30a]
mov rbx, qword [rbx]
movabs r8, 0x383ecd3c1d0447b3
call fcn.14049cdd2
mov cs, word [rsi]
push rsi
invalid
sub byte [rbp + 0x24648d48], bl
cmp al, ch
call [rsi + rcx*2]
add byte [rdi], cl
mov byte [rsi + rbx + 0x32], bl
add byte [rax - 0x75], cl
mov word [rax + rsi*4], fs
add byte [rax], al
add byte [rcx - 0x18], dl
cld
invalid
js 0x1403ef41c
mov rcx, qword [rsp + 0xb0]
push rcx
call fcn.1400cd2c0
mov eax, 0xc0000005
jmp 0x1400cd640
in eax, 0x8f
jnp 0x1400cd615
loop 0x1400cd58f
invalid
xchg edi, eax
pop rbp
clc
loop 0x1400cd65c
sti
mov gs, word [rdx + rbp*4 + 4]
mov esp, 0xa39d54f8
lodsb al, byte [rsi]
jle 0x1400cd5ae
mov dword [rcx + 0x74], edx
push rcx
mov ebp, 0xd9631d1
invalid
jp 0x1400cd60f
invalid
xchg ecx, eax
add al, 0xc1
jg 0x1400cd5ff
in eax, dx
invalid
push r14
mov r14, r8
mov qword [rsp + 0x38], rax
not r8
call fcn.14036c86c

Function at 0x140040906
Capabilities:
Packed with generic packer

Disassembly:
push rbp
pushfq
movabs rbp, 0xa98c4eb624385208
mov rbp, qword [rsp + 8]
mov qword [rsp + 0x10], rbp
call fcn.14004db81

Function at 0x140043964
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffe5a5299a
pushfq
neg qword [rsp + 8]
call fcn.14037b9c3
jmp fcn.1406b05b4

Function at 0x14004555c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rcx
mov rbp, qword [rsp + 0x30]
push rdx
call fcn.14045c243
movabs byte [0x66df02e9ccf153], al
add dword [rdi - 0x22], esi
cmp dword [rdi + rax - 0x57], edx
adc cl, al
sub edi, dword [rax + rdi*4 - 0x7e]
shl dword [rbx - 0xb], 1
shl dword [ebx - 0x36], 1
xchg bl, ah
ret

Function at 0x1400463ec
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1403a15e9
jae 0x140066eae
lea rax, [rax + r9*8 - 0x3ed7f178]
sub r9d, 0xfa4ca9c
mov r9b, 0x10
lea r9, [r9 + r9*8 - 0x3ffa2fd9]
call fcn.14001750b

Function at 0x140046f4a
Capabilities:
Encode data using base64

Disassembly:
sub byte [rsp + 0x60], 0x2d
neg byte [rsp + 0x60]
mov qword [rsp + 0x60], 0xffffffffb4298db1
je 0x140381dac
shl dword [rsp + 0x60], 0xc9
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x140047a7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.140450aee
leave
jmp fcn.1406b7be0

Function at 0x14004951c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14003b97c
movabs al, byte [0xd1f9006712cbe9cc]
sub ebp, ebp
mov fs, word [rsi + 0x43]
mov edi, 0x3fff1a6c
invalid

Function at 0x14004a6ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14008eb49
jmp fcn.1406bc844
Function at 0x14004d648
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr dword [rsp + 0x10], 0x2a
add qword [rsp + 8], 0xffffffffbff807ff
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.140532d8f
movsd dword [rdi], dword [rsi]
jmp fcn.1406c1a01

Function at 0x140050356
Capabilities:
Check for software breakpoints

Disassembly:
mov rdi, qword [rsp + rdi + 0x6002229]
not qword [rsp + 0x30]
call fcn.1400c0370
jno 0x140049dbc
cmp al, 0xcc
int3

Function at 0x1400516a0
Capabilities:
Encode data using base64

Disassembly:
sub rbp, 0x688ae134
call fcn.140342d69
jmp fcn.1406c8535

Function at 0x1400516ac
Capabilities:
Encode data using base64

Disassembly:
sub rbp, 0x688ae134
call fcn.140342d69
jmp fcn.1406c8535

Function at 0x14005e1a4
Capabilities:
Encode data using base64

Disassembly:
jns 0x140456320
movzx r13d, r13w
mov r13, qword [rsp + r13*2 - 0x17d9c]
add qword [rsp + 0x28], 0xffffffffbffa6f4f
call fcn.1403a269a
and dword [rsp + 8], ecx
jmp 0x14008c95d

Function at 0x14005e1aa
Capabilities:
Encode data using base64

Disassembly:
jle 0x14048317d
jmp fcn.1406df1c3
jl 0x140484ed5

Function at 0x14005e1b0
Capabilities:
Encode data using base64

Disassembly:
jle 0x14048317d
jmp fcn.1406df1c3
jl 0x140484ed5

Function at 0x1400619f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdx
call fcn.140001a2c
rcr ebp, 1
jmp fcn.1406e57e5

Function at 0x14006690c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
push rdx
push rsi
pushfq
movabs rdx, 0xf2a8a19d109c4603
call fcn.140027c19
lahf
sub ah, byte [rdx - 0x3333339f]
jmp fcn.1406edd2a

Function at 0x140067f0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop rcx
push 0xbb58024
pushfq
neg byte [rsp + 8]
jae fcn.140095264
and word [rsp + 8], 0xb090
not dword [rsp + 8]
cmp qword [rsp + 8], 0x5e0de683
xchg qword [rsp + 0x10], rcx
not byte [rsp + 8]
je 0x14041d11d
call fcn.1403878da
push rdx
call fcn.140008c58
jmp fcn.1406f003f
lea rdi, [rdi + r14 - 0x721b0d4d]
call fcn.1403c9bc1
sbb byte [rdx], ah
neg edx
ret 0x6bf0
Function at 0x1400791a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14007f809
xor r9d, r9d
xadd r8b, r8b
adc r8, 0x530ea29b
neg r8b
mov r8, rcx
cmp r12w, bp
test edx, edx
jne 0x1400b8b2d
and r8d, 0xf
rcl rdx, cl
movsx edx, si
mov rdx, rcx
jmp loc.140372938

Function at 0x14007e22c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
mov qword [rsp + 0x18], 0x1f9547a0
lea rsp, [rsp + 0x18]
call fcn.140502920

Function at 0x14008898c
Capabilities:
Packed with generic packer

Disassembly:
xor word [rsp + r14*8 - 0x1208], 0xec94
add r14w, word [rsp + r14 - 0x23a]
and r14b, byte [rsp + r14 - 0x796a]
cmp qword [rsp + r14 - 0x78f8], 0xa3c359c
mov r14, qword [rsp + r14*4 - 0x1e3d8]
call 0x14000af72
stosb byte [rdi], al
xor eax, 0xccccccd4
jmp fcn.140713a49
and dx, 0x8db0
jbe fcn.14002f54b
mov qword [rsp + r15*2 - 0x6fc1d57a], r15
call fcn.1404d5200
je 0x1400b48f7
mov rdx, qword [rsp + r14*2 - 0x232]
add r14, r14
jns 0x140086c95
cmp al, 0xe9
pop rsp
call 0xc9ca89c1
invalid

Function at 0x14008d0e4
Capabilities:
Packed with generic packer

Disassembly:
cmovbe r8w, word [rsp + 0x40]
jb 0x140359aec
call fcn.140367ecd

Function at 0x14008ee54
Capabilities:
Packed with generic packer

Disassembly:
jge 0x14002f57a
je fcn.1400c5e5f
lea rax, [rax - 0xe72c6de]
call fcn.14008dc6d

Function at 0x140095d3b
Capabilities:
Read file on windows

Disassembly:
add qword [rsp], 0x3270f4
shl bp, 0x29
call fcn.14001f720
call fcn.1400807ef
int3

Function at 0x1400b2220
Capabilities:
Packed with generic packer

Disassembly:
movzx r8, r13w
xchg qword [rsp + 0x40], rsi
mov r13, qword [rsp + r8 - 0xb2]
call fcn.1403de6db
add qword [rsp], 0xffffffffffccd498
mov rbp, r14
not bp
push rdx
test rbp, 0xffffffffd10cb598
jb 0x14003e6a6
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]

Function at 0x1400b3edc
Capabilities:
Packed with generic packer

Disassembly:
setg sil
sub esi, 0x66861926
not rsi
mov rsi, qword [rsp + 0x20]

Function at 0x1400cd5ab
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1405af2b9

Function at 0x1400da250
Capabilities:
Encode data using base64

Disassembly:
jns fcn.140368d80
neg r10d
movzx ecx, r10w
lea rdx, [rdx + rcx*2 + 0x6e299fd1]
and r10, 0xffffffff8fb6e980
mov r12, qword [rsp + rcx*2 - 0x10c36]
test byte [rsp + 0x39], r12b
push rcx
push r10
xchg qword [rsp + 0x50], rdx
mov rcx, qword [rsp + rcx*4 - 0x218ac]
call fcn.140022eb1
Function at 0x14032e843
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl qword [rsp + 8], 0x7a
neg r8d
jae 0x14005a0bb
jge 0x1404603d1
int3
shr qword [rsp + 0x18], 0xd8
call fcn.1400502e8
cli
in eax, 2
invalid
push r10
shl di, 0x51
setns dil
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r10, rdi
sete dil
not r10b
cmove rdi, r10
shr r10, 0x72
sub dil, 0xaf
call fcn.140048d53
movabs r10, 0x372e248c2d9f4332
bswap r10d
sub r10b, 0xa4
nop
setb r10b
movabs rax, 0xd8bf3b0459b0db8d
mov r10b, 0x94
push rdi
jb 0x1404aa849
cmp r10b, dil
lea rax, [rax - 0x5fe0db56]
jl 0x140029002
add qword [rsp + 8], 0xffffffffbfc73c49
or r10w, di
lea rdi, [rdi*2 + 0x3c8bc4a2]
mov qword [rsp + 0x20], r10
call fcn.140356ead
add qword [rsp], 0x405cd5
push r14
movabs rax, 0x583fec334086bf2e
call fcn.140488945
jmp qword [rsi]
add r8b, sil
shl byte [rsp + rbp + 0x38f00008], 0x9d
test byte [rsp + 0xc], r8b
mov rbp, qword [rsp + r8*2 - 0x160]
call fcn.140479df8
mov qword [rsp + 8], rbx
jns 0x140481371
invalid
neg bx
lea rcx, [rcx - 0x1c687b46]
call fcn.140087a99
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r10*2 - 0x64873f28]
jl 0x14039e1c4
je 0x140424e07
or r10d, 0xa8a51fbf
neg r10w
movabs rdi, 0x4e2183166c011306
jno 0x14032fe09
mov qword [rsp + r11 - 0x6a784118], r11
shl r11, 0x60
shr byte [rsp + 0x18], 0x22
cmp r11w, word [rsp + 0x1e]
lea rax, [rax - 0x1ee57942]
jle 0x14003ca4f

Function at 0x140348f0c
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffbfbedec7
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140502920

Function at 0x14035d4af
Capabilities:
Encode data using base64

Disassembly:
setno r15b
lea r15, [r12 + rdx*8 - 0x14de03f5]
cmp rsi, 0xffffffffd922e617
mov r15, qword [rsp + 0x40]
jl 0x1403729cc
mov r12b, dl
call fcn.140027e48
cmpsb byte [rsi], byte [rdi]
pop rdx
out 0x2e, eax
invalid

Function at 0x14037510f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x28], rdx
sete byte [rsp + 0x28]
xor byte [rsp + 0x20], 0x39
setns dl

Function at 0x14038f742
Capabilities:
Packed with generic packer

Disassembly:
mov dl, 0x20
push rbp
mov bl, 0x36
and dl, al
out 0x19, eax
push rsp
jnp 0x14038f6bd
mov ah, 7
invalid
jl 0x14038f642
sbb byte [rdx - 0x59c44b9], dl
mov esp, 0xe7bfd544
cmp dword [rsi - 0x3f], eax
sahf
int 0x2d
sbb eax, 0x55f4ec5d
ret
invalid
mov dh, 0x36
jae 0x14038f694
and dh, byte [rbx]
mov bh, 0x36
invalid
cmp al, 0xeb
xchg ebx, eax
mov ebp, eax
jp 0x14038f70d
sar edi, cl
lea rbx, [rbx + 0x6e2aac3f]
call fcn.140356680
and dword [rdi - 0x5c769ff5], edi
add bl, dh
test bh, bh
test eax, 0xbcd3eb35
and byte [rsi + 0x2c], bh
scasb al, byte [rdi]
call 0x14f0c8156
adc al, 0x27
sar dword [rbx + 0x27], 7
add dword [rcx], esp
pop rbx
sub al, 0xb5
pop rdi
pushfq
ror edx, cl
sti
add dword [rsi - 0x5cd584a4], ebp
xchg esi, eax
jnp int.14038f723
adc ah, byte [rdx - 0x3ed9d3e4]
ror word [0x14e170eca], cl
jnp 0x14038f739
mov ebp, 0xa82c15eb
inc byte [rax + 0x2edcdad3]
fsubr qword [rsi]
ja 0x14038f7c8
sti
loopne 0x14038f798
invalid
popfq
imul esi, dword [rbp - 0x760f8b65], 0xffffff97
invalid