joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403d30e4
Capabilities:
Encode data using xor

Disassembly:
jae 0x1404c440b
invalid
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14066973d
or bpl, 0x3a
mov rbp, qword [rsp + 8]
mov ebp, dword [rsp + 8]
mov qword [rsp + 8], 0xffffffffb5aff1b0
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1406f518b
push rcx
push r9
pushfq
movabs r9, 0xf1b6cf3053adf224
and r9w, r9w
or r9b, 0x99
movabs r9, 0x433382a911065db1
xor r9w, 0x5710
and r9d, r9d
call fcn.1404d600f
nop
outsd dx, dword [rsi]
movabs byte [0xf32cf2820e150d48], al
sub al, 0xf3
add byte [rax + 0xd], bh
jle 0x1404c441f
add eax, 0xd50d4e2e
and ecx, dword [rbp + 0xd]
sbb al, 0x2c
mov edx, dword [rsi - 0x7c]
push rsi
lea ebp, [rsi + rdi*2 + 0xd]
mov edi, 0x1c0d4081
cld
or rax, 0xffffffffe5effc1c
or rax, 0x4ee35bf8
or eax, 0x4ff7eb28
or eax, 0xf28ce5cb
or rax, 0xfffffffff28ce5cb
loop 0x1404c44d0
jmp 0x1404c4523
hlt
push rbx
push rsi
fbstp tbyte [rbx]
xchg ebp, eax
jge 0x1404c4471
wait
or rax, 0xffffffff9c6e8cee
sahf
jl 0x1404c44a3
movabs al, byte [0xcde534f700000001]
invalid
add byte [rax], al
add bh, dh
xor al, 0xe5
int 0x8f
cdq
mov ebx, 0x9019cfed
mov bl, 0xed
test al, 0x5c
scasb al, byte [rdi]
mov dl, 0xd7
push r8
adc edx, dword [rdx - 0x18e82ea8]
cmp dword [rax + riz*8 - 2], ecx
ja 0x1404c44ff
push rdx
cmpsb byte [rsi], byte [rdi]
mov dl, 0x26
pop rdx
pop rsi
xchg ebx, eax
fisubr word [rcx - 0x5c]
je 0x1404c4569
cwde
sub edx, dword [rcx - 0x344db29a]
push rax
int 0xf2
jne 0x1404c44e9
cmpsd dword [rsi], dword [rdi]
xor ah, bl
invalid
je 0x1404c44d6
xor dl, byte [rsi]
invalid
mov dl, 0xbc
fcmovnbe st(0), st(2)
fmulp st(5)
invalid
loope 0x1404c4512
xor ch, byte [rbx + 0x38]
adc eax, 0xef3909b2
pop rbx
int 0x2f
xchg ecx, eax
scasd eax, dword [rdi]
pop rsp
jbe 0x1404c4590
ficom dword [rsi + 0x5fc9dcb2]
invalid
cmp al, 0x9a
popfq
xor bl, byte [rax - 0x32259af5]
movsd dword [rdi], dword [rsi]
outsb dx, byte [rsi]
rcr dword [rdx + 0xf184f32], 0xcf
cdq
xor ch, cl
jl 0x1404c4543
xor cl, bl
jge 0x1404c45c5
lahf
mov dl, 0xa1
notrack jmp 0xfd1a17c7
int1
jo 0x1404c455c
xor ah, bh
cmp ecx, dword [rdi + 0xef5cdd5]
sub edx, dword [rbp - 0x20bf2fce]
and eax, 0x96393296
xchg ebx, eax
xor dl, byte [riz*8 - 0x64d6f10]
mov esi, 0xcdddf9d9
or al, 0x13
invalid

Function at 0x140404605
Capabilities:
Packed with generic packer

Disassembly:
mov dil, bl
push r14
ja 0x1404a902c
lea rcx, [rcx + 1]
jl 0x1403e0509
xor ebx, 0x87a8c1a5
push 0x7e1c9b29
jae 0x1405b2aaa

Function at 0x140410b5d
Capabilities:
Packed with generic packer

Disassembly:
add r13d, r15d
or r13d, r15d
add qword [rsp + 0x18], 0xd3bcb
push r14
call fcn.14053a067
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1406f518b
lea rbp, [rbp - 0x796eb66b]
jne 0x140527f41
jns 0x140446ee6
call fcn.14055c847
push rbx
call fcn.1402e8a48
push r9
xchg qword [rsp + 8], rbp
lea rsp, [rsp + 8]
ret
Function at 0x140410b95
Capabilities:
Packed with generic packer

Disassembly:
mov r12, qword [rsp + 0x28]
mov qword [rsp + 0x28], rdx
call fcn.1405547a0
popfq
lea rsp, [rsp + 0x50]
ret
sete bl
add qword [rsp + 0x20], 0xffffffffffd25856
not bl
movabs rcx, 0x9bafc1640852519
add qword [rsp + 0x10], 0x2f4b1
jl fcn.140208c25
add qword [rsp + r13*8 - 0x11bb8], 0xffffffffbfac7bd1
xchg qword [rsp + rdi*2 - 0x4512d0e4], rsi
mov r13, qword [rsp + r13*8 - 0x11b90]
sub di, 0x7480
and di, di
jg fcn.1403d168e
or rdi, rdi
not edi
cmp rdi, 0x570d58aa
mov rdi, qword [rsp + 0x48]
jb 0x1403afc6c
jo 0x1402003d8
ja 0x1404610af
or cl, byte cs:[rax]
and byte [rsi - 0x1e], cl
invalid
call 0x14043b255
call fcn.14053d238
movabs rbx, 0x548f7f2953b9b90d
jg 0x140399c49
mov rbx, qword [rsp + 0x10]
call fcn.14045b657
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1404197df
Capabilities:
Get system information on windows

Disassembly:
mov rbx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x30]
mov dword [rsp + 0x30], 0x6e2e6e8e
jo 0x1402eb4c1
lea r14, [rdx + riz + 0x71325b10]
sete dl
and r14b, 0xa1
mov rdx, qword [rsp + 0x18]
call fcn.140353c68
invalid

Function at 0x14041b542
Capabilities:
Get system information on windows

Disassembly:
mov dword [rsp + 0x18], 0x2b119e81
test dword [rsp + 0x18], 0xd33c12f
mov qword [rsp + 0x18], 0xffffffffbac7af04
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406d8037

Function at 0x14042a57a
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1403a984f
xchg qword [rsp + r12 - 0x40b1455d], rbx
mov r12, qword [rsp + rdx - 0xef]
shr byte [rsp + rdx*2 - 0x1ce], 0xf2
js 0x14031a454
and edx, dword [rsp + rdx - 0xcf]
mov qword [rsp + rdx*2 + 0x20], rdx
shr dl, 0x5e
mov byte [rsp + rdx + 0x30], dh
lea rdx, [rdx + rdx - 0x2df13900]
movsx dx, dl
mov rdx, qword [rsp + rdx*2 + 0x5be40008]
jne 0x140303420
test qword [rsp + 0x20], 0x6183692a
jl 0x1404e0a15
not dword [rsp + 0x30]
shl qword [rsp + 0x30], 0x9c
sub dword [rsp + 0x30], 0x4c880639
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x40]
ret
ret

Function at 0x14042a5fd
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x11fcd8
mov rdi, r8
add ebx, 0x6409ef9c
test bx, 0x7d33
setae dil
mov rdi, qword [rsp + rbx - 0x640a603c]
mov rdi, qword [rdi]
setbe r8b
lea r8, [r8 + r8 + 0x7e1a6d2f]
and r8b, 0x21
test bl, 0x3b
ja 0x14046f69f
Function at 0x140454bcc
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffbfbf565d
push r11
mov qword [rsp + 0x18], 0xffffffffe5d72789
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14065b5b2

Function at 0x140460d57
Capabilities:
Get geographical location

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140075a98
mov eax, dword [rsp + 0x30]
jmp fcn.140075aaa
xor eax, eax
jmp fcn.140075aaa
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.14065b5b2
jo 0x140075a61
neg word [rsp + 8]
call fcn.1401fe231

Function at 0x140461234
Capabilities:
Encode data using base64
Hash data using sha256 via x86 extensions

Disassembly:
push 0xffffffffe5baea18
call fcn.14003da77

Function at 0x14046f67f
Capabilities:
Packed with generic packer

Disassembly:
not word [rsp + 0x48]
mov r13, qword [rsp + 0x40]
call fcn.1404e725c

Function at 0x140474739
Capabilities:
Packed with generic packer

Disassembly:
lea rbx, [rbx + 0x57ad9634]
test qword [rsp + 0x18], r12
jbe 0x14043f1b1
xor r12b, 0xb7
or r12b, r12b
push r9
xchg qword [rsp + 0x50], rbx
mov r12, qword [rsp + 0x30]
shl qword [rsp + 0x20], 0x48
mov r9, qword [rsp + 0x20]
shr r9, 0x72
mov r9, qword [rsp + r9*8]
test word [rsp + 0x20], 0x4a0a
call fcn.140499a18

Function at 0x1404755ff
Capabilities:
Get system information on windows

Disassembly:
or dx, word [rsp + 0x14]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
add dword [rsp + 0x10], 0xc88dc20b
mov qword [rsp + 0x20], 0xffffffff8509e43b
push rbp
movabs rbp, 0x92b91b903c9a9f3e
and qword [rsp + 0x28], rbp
mov rbp, qword [rsp + 0x28]
push r11
movabs r11, 0x79ae22a852f5584
lea rdx, [rdx - 0x2d640dd4]
jo 0x1405acb0a
add qword [rsp + 0x10], 0x16cbde
mov rbp, qword [rsp + 8]
mov r11, qword [rsp]
lea rsp, [rsp + 0x10]
ret 8

Function at 0x140478faa
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + r9 + 0x74a3ffcb], rax
push rbx
call 0x1403d4524

Function at 0x14048028e
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x40], 0x5d896691
jle 0x140538472
call fcn.1402143f6

Function at 0x14048a262
Capabilities:
Encode data using base64

Disassembly:
shr r11w, 0xc8
jbe 0x14050d053
mov qword [rsp + 0x10], rsi
js 0x1403105da
shl r11w, 0x95
or r11d, 0xa839ae3c
sub r11w, 0x3838
movabs rdi, 0xa29b33813d15b425
lea rdi, [rdi*4 + 0x1bc549c]
or dil, dil
xor dil, dil
push qword [rsp + 0x10]
popfq
mov qword [rsp + 0x10], rsi
pushfq
add dil, dil
neg dil
xor edi, 0x57998393
call fcn.1404d0630
push rdi
mov qword [rsp], 0xffffffffb0bbf49d
call fcn.14069fd06
js 0x1402df592
setb byte [rsp + 0x78]
not qword [rsp + 0x78]
and dword [rsp + 0x78], 0x719b8c80
push qword [rsp + 0xa0]
popfq
lea rsp, [rsp + 0xb0]
ret
mov r13, qword [rsp + 0x68]
jb 0x14037a66e
jb 0x140493192
add si, word [rsp + 0x1a]
not esi
mov rsi, qword [rsp + 8]
shr qword [rsp + 0x18], 0x50
add qword [rsp], 0xffffffffbfd90916
or qword [rsp + 0x18], 0xb19aa81
cmp qword [rsp + 0x18], 0xffffffffe79bee27
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
Function at 0x14048a299
Capabilities:
Encode data using base64

Disassembly:
mov r10, r13
mov rcx, r10
setge byte [rsp + r13*2 + 0x7f76fd7c]
mov r15, r10
sub r15w, 0x6b3a
shl rcx, cl
mov r13, qword [rsp + r13*2 + 0x7f76fd6c]
cmp dword [rsp + r15 + 0x3fbbe9f8], ecx
ja 0x1404d3fc4
push rcx
jl 0x140433d8a
push r10
xchg qword [rsp + r13 - 0x3fbb7e25], rdi
mov rbx, qword [rsp + 0x20]
not word [rsp + r13*2 - 0x7f76fcda]
cmp r12d, r13d
not r12b
setno byte [rsp + 0x50]
not r13
sub r12b, 0xb7
mov r12, qword [rsp + 0x58]
jo 0x140206924
stosb byte [rdi], al
mov bl, 0x66
invalid
pop r10
shl byte [rsp + 0x48], 0x15
je 0x140338562

Function at 0x14049994f
Capabilities:
Packed with generic packer

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rcx, 0x9032740fcc4cd5a9
mov qword [rbp + 0x170], rcx
movabs rcx, 0x775761ea3718fcbe
mov qword [rbp + 0x178], rcx
movabs rcx, 0x133a72f18bc917cb
mov qword [rbp + 0x180], rcx
movabs rcx, 0x7eb98314255e4530
mov qword [rbp + 0x188], rcx
movabs rcx, 0xe4411563ec11f4f2
mov qword [rbp + 0x130], rcx
movabs rcx, 0x577f1385456a99e1
mov qword [rbp + 0x138], rcx
movabs rcx, 0x133a72fbf3ec2ae2
mov qword [rbp + 0x140], rcx
movabs rcx, 0x7eb98314255e4530
mov qword [rbp + 0x148], rcx
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [rbp + 0x180]
pxor xmm1, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm1
mov r9d, eax
lea r8, [rbp + 0x130]
mov edx, 1
mov rcx, qword [0x1401f4710]
call fcn.140004a50
nop
movabs rax, 0
add rsp, 0x40
pop rbp
ret
je 0x140213969
mov rcx, qword [rsp + rsi*8 - 0x3828]
not si
hlt
call fcn.1402f07d5
insb byte [rdi], dx
cmp eax, 0x18f15c97
xlatb
xchg edi, eax
lahf
fcomp qword [rdx - 0x44dc9e96]
mov edi, 0x98dc9f3a
mov eax, 0x9f9f0770
add byte [0x19c01a725], bl
jo 0x140460409
jb 0x140460427
enter 0xffffffffffff8141, 0xffffffffffffffdc
in eax, dx
invalid
cmpsd dword [rsi], dword [rdi]
js 0x140460397
movabs dword gs:[0xa1f46efcc1340d45], eax
xchg edi, eax
push rsp
push rax
lodsb al, byte [rsi]
je 0x14046039f
cmp dword [rax], esp
js 0x14046048f
outsb dx, byte [rsi]
adc ebx, esp
pop rdi
pop rsp
jmp 0x1404603fa
invalid
invalid
sub r8b, r8b
js 0x140440a85
movabs rdx, 0x3aabb1a77d0715b4
ja 0x14046038e
jo 0x14007be6d
shl rdx, 0xb7
shl r8w, 0x70
xchg qword [rsp + 0x48], rsi
mov r9, qword [rsp + r9 - 0x643cdc5d]
mov byte [rsp + 0x38], dh
call fcn.14051ac7a
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406c276c
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi]
or r8d, 0x6046e19
and r9, r8
cmp r8w, r9w
mov r8w, 0xba8
mov qword [rsp + 0x30], r9
push rdx
lea rsi, [rsi + 0xe9a5935]
jno 0x140471033
movabs r13, 0x87983c911803ef08
sub r13w, 0x852f
setns r13b
mov r13, qword [rsp + 8]
mov qword [rsp + 8], 0x5af6a90d
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1405cf5f2

Function at 0x14049ee4a
Capabilities:
Encode data using base64

Disassembly:
shr dx, 0xf0
mov rax, qword [rsp + 0x28]
js 0x14051820e
je 0x140598874
ror esi, 0xf
jns 0x14049ee8b
lahf
movabs eax, dword [0x257a6c1fdec2495c]
invalid
or eax, 0x58778c87
sub al, 0xfb
or al, 0x5b
cmp eax, edx
movabs al, byte [0x531b63dc25ba291c]
ret 0x55d0
Function at 0x1404a5036
Capabilities:
Packed with generic packer

Disassembly:
jle 0x140480266
call fcn.140478970
xor dword [rdx - 0x7d], edi
mov ebp, 0x854d7e3b
je 0x1404a50c5
pop rcx
xor al, 0x88
push 0xffffffffa3b97ab3
invalid
invalid

Function at 0x1404aa08a
Capabilities:
Encode data using base64
Get system information on windows

Disassembly:
mov r13, qword [rsp + 0x50]
cmp r10, qword [rsp + rcx + 0x80]
lea rcx, [r10 + rcx*2 - 0x72d791d8]

Function at 0x1404aaa6a
Capabilities:
Connect socket
Encode data using base64
Set socket configuration

Disassembly:
js 0x14026cfa2
sub r15w, r15w
shl byte [rsp + 0x18], 0xdd
not byte [rsp + 0x38]
mov r15, qword [rsp + 0x20]
shl byte [rsp + 0x18], 0x7b
not dword [rsp + 0x38]
setne byte [rsp + 0x38]
neg dword [rsp + 0x18]
call fcn.1404bcc45

Function at 0x1404c1577
Capabilities:
Encode data using xor

Disassembly:
call fcn.140481093
mov esi, 0x66384c55
vhsubps xmm15, xmm4, xmmword [rcx - 0xf]
and byte [0x142b6cfd3], cl
popfq
pushfq
push rsi
and dword [rcx - 0x6424e8c1], esp
mov edi, 0x498b00f4
mov ch, 0xe1
and dh, ah
pop rsi
mov edi, 0xe08e2f39
invalid

Function at 0x1404c4af5
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x50], rbp
mov rdx, qword [rsp + 0x20]
cmp cl, byte [rsp + 0x3d]
jge 0x140314700
or qword [rsp + 0x38], rcx
je fcn.1404a8dd1
cmp rcx, 0x22938323
not byte [rsp + 0x38]
mov rcx, qword [rsp + 0x10]
call fcn.140555937
sub dl, byte [rsi]
and ebp, dword [0x1a054fb9c]
jbe 0x14028aadb
hlt
adc dword [rax - 0x23], esp
invalid
push rcx
movabs rcx, 0x5c356bb0a2940e22
test cx, 0xf30d
jl 0x140576045
lea rdi, [rdi + r11*4 - 0x18267]
add r11b, 0x10
push r15
movabs r15, 0xb6023416a6b4c117
call fcn.140425f40
jb 0x1403f60b7
lea rbp, [rbp + 0x6720db2b]
movabs rcx, 0x7f30729e4a0c0b93
js 0x14056ddd7
test r9b, 0x8d
mov qword [rsp + 0x38], r9
cmovno r9d, dword [rsp + 0x3a]
movabs r9, 0x83bc43a19130f1b
jle 0x14028aa62
or byte [rsp + 0x18], 0x1e
jge 0x1403c944e
call fcn.14051accf
bswap ebp
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
and qword [rsp + 0x18], 0xffffffffa43b333b
add qword [rsp + 0x10], 0xffffffffffe903ed
and edx, edx
cmp rdx, qword [rsp + 8]
jae 0x1403f4849
movabs r10, 0x53b8e9bde90a4fbd
call fcn.140502cb8
lodsb al, byte [rsi]
add ebx, dword [rbx - 0x6a]
mov dl, 0x9a
invalid

Function at 0x1404d1db1
Capabilities:
Packed with generic packer

Disassembly:
je 0x1405a2e2d
jg 0x1404c27ef
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.14066973d

Function at 0x1404db5b3
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0xffffffff8c12cde0
lea rsp, [rsp + 8]
call fcn.14069e731

Function at 0x1404e3b6d
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
call fcn.14047e1af
test r14b, 0xaa
push r15
lea rdx, [rdx + 1]
movabs r15, 0x4a33a4180c11e390
jge 0x1404f8d89
jge 0x14043c75a
cmp al, 1
cmp byte [rax], cl
add byte [rax], bh
je 0x1404f8d9d
add byte [rsi], cl
jb 0x1404f8da5
invalid
loopne 0x1404f8da5
rol byte [rax + rax*8], 1
invalid
push rax

Function at 0x14050dfdb
Capabilities:
Packed with generic packer

Disassembly:
lea rax, [rax + rcx - 0x70a8a16e]
jb 0x140501dfe
push rcx
call fcn.14040069a
Function at 0x14051a7fc
Capabilities:
Check for software breakpoints

Disassembly:
mov r8, qword [rsp + 0x40]
call fcn.14034b2f3
shl r11b, 0x65
lea rbx, [rbx + r11 - 0x27cdc9e7]
call fcn.140339a1c
jg 0x140420149
test r8, 0x42a1bc15
mov r8w, 0xc49a
jge 0x1404d7656
push 0x509cb529
call fcn.140301104
mov word [rbp - 0x5b2417af], gs
fsub st(0), st(0)
xchg ecx, eax
sub dword [0x12bc68c18], ebx
mov al, 2
fbstp tbyte [rsp + rax*4 + 0x7d]
cmp al, 0xcc
jno 0x14051a853
mov ch, byte fs:[rdx + 0x1115d469]
pushfq
stc
stosb byte [rdi], al
imul edx, esp, 0xf99c1115
xchg esi, eax
invalid
sub dword [rbx], 0xabbb172f
push rdi
jle 0x14051a86c
mov esp, dword [rcx + 0x6e20f13f]
jne 0x14051a853
mov bl, 0x3f
invalid
loopne 0x14051a834
invalid

Function at 0x14051cab1
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov r8, r11
not r11d
neg r8b
lea r11, [r11 + riz - 0x79ed88d5]

Function at 0x14051e2cf
Capabilities:
Encode data using base64

Disassembly:
not qword [rsp + r9 - 0x4b27fff0]
neg byte [rsp + r9 - 0x4b27fff0]
call fcn.14004d102

Function at 0x14051e2e4
Capabilities:
Encode data using base64

Disassembly:
xor qword [rsp + rbx - 0x75c99dbe], 0x4bbc1897
shl byte [rsp + rbx - 0x75c99dbe], 0x63
xchg qword [rsp + 0x58], rbp
mov rcx, qword [rsp + rbx - 0x75c99dce]
test r9d, 0x2e82dc95
jle 0x1404e8376
sub r9w, 0xac23
not ebx
call fcn.14032ee24
cmp word [rsp + 0x68], cx
call fcn.1404f4bd7
push rsi
push r12
pushfq
movabs r12, 0x1b177b15f39c788
neg r12
call fcn.140210df1
not r10b
lea r10, [r10 + r10 - 0x3689fee]
movsx r10d, r10w
push r14
mov r10, qword [rsp + r10 - 0x6200]
mov qword [rsp + 0x10], rbp
movabs r14, 0x8c267f9207176f1c
xor r14b, 0x15
shl r14b, 0x2e
call fcn.1403122c3

Function at 0x1405253b9
Capabilities:
Packed with generic packer

Disassembly:
movabs rdx, 0xbf0e9b33bea2701d
neg dx
add qword [rsp + 0x40], 0xffffffffffff1b4c
test di, 0x191f
jno 0x1402f1740

Function at 0x140528c2d
Capabilities:
Encode data using xor

Disassembly:
push rsi
pushfq
movabs rsi, 0x8d3add0aeb94c885
xor si, 0x579c
test esi, 0x6c813d3b
movzx esi, sil
mov qword [rsp + 0x10], 0xffffffff8c1018ca
mov rsi, qword [rsp + rsi - 0x11]
jle 0x140528c39
call fcn.14030a39d
Function at 0x14052cf71
Capabilities:
Authenticate hmac

Disassembly:
test byte [rsp + 0x28], 0x28
jle 0x1404d7bf8
call fcn.140409c91
mov word [rsp + rbp + 0x26fdda48], 0xeb90
bswap rbp
mov qword [rsp + 0x48], rbp
xchg qword [rsp + 0x68], rsi
mov rbp, qword [rsp + 0x18]
test qword [rsp + 0x48], 0xffffffffb08e290c
jae 0x1404c96be
je 0x140454678
add qword [rsp + 0x48], 0xfffffffffff9f7fa
neg r9
call fcn.14043b306
add qword [rsp + 0x10], 0xfffffffffffe95af
add qword [rsp + 0x20], 0x38f35
and r8, 0xffffffffa0887f15
jl fcn.14047c9e0
js 0x140584647
movabs rdx, 0xc018dc056d100828
shl rbx, 0xec
mov rdx, qword [rsp + r8*4 - 0x200440]
mov rdx, qword [rdx + r8 - 0x80114]
call fcn.14056697f
add word [rsp + 0x58], 0x91b1
je 0x1402e1f4f
shl dword [rsp + 0x58], 0x8f
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x68]
ret
js 0x140202e1e
add dil, bpl
add qword [rsp + 0x20], 0xffffffffffcec368
not dil
or qword [rsp + 8], 0x223b56bd
je 0x1402d13a8
mov rsi, qword [rsp + 8]
mov rsi, qword [rsp + 0x20]
mov rsi, qword [rsi]
jge fcn.1402a42ff
neg rbp
cmovb bx, word [rsp + 0xc]
call fcn.140524766
lahf
invalid
sub r10b, 0x99
call fcn.14054600e

Function at 0x140533415
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rsi
xchg qword [rsp + 0x30], rdi
mov r10, qword [rsp + 0x28]
jno 0x14048a26d

Function at 0x14053dc2d
Capabilities:
Encode data using base64

Disassembly:
mov r12, qword [rsp + r12*2 - 0x761837dc]
mov qword [rsp + 8], 0x5779cdfa
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1406cc902
xchg ecx, eax
xlatb
cli
xchg ecx, eax
retf 0xe03f
jns 0x1402e1d11
sbb al, 0x23
pop rdi
out 0xb7, eax
push 0x1c
pop rsi
cmp byte [rdi], dh
test al, 0xbf
mov bh, 0xd9
invalid
je 0x140726d50
not qword [rsp + 0x18]
call fcn.140313b23
push r14
pushfq
shr qword [rsp + 8], 4
call fcn.1404beaa9
movdqa xmm0, xmmword [rbp + 0x1f0]
push r13
pushfq
movabs r13, 0x54396309480ad6a8
call fcn.1404f286c
pxor xmm0, xmmword [rbp + 0x240]
push 0xfffffffff5a7c0bd
call fcn.140218733
movdqa xmmword [rbp + 0x1f0], xmm0
push r12
movabs r12, 0xb691e0161035072e
pushfq
sub r12d, 0x7792c5be
xor r12d, 0x85244c89
add r12, r12
jae 0x14053a8c2
xchg esi, eax
push rsi
pushfq
movabs rsi, 0xc42a779c6d3e2980
shr rsi, 0xa9
neg rsi
bswap esi
not rsi
shr si, 0xc3
mov rsi, qword [rsp + 8]
mov qword [rsp + 8], 0x5ae4debb
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1405cf5f2
invalid
Function at 0x14053dc3d
Capabilities:
Encode data using base64

Disassembly:
push rdx
add edi, dword [rax + 0x73]
xchg ebx, eax
movabs byte [0x5787e2cced796c71], al
cmp eax, 0x41f48402
push rbx
call fcn.14058f0b4
test byte [0x18853fac5], bl
not dword [rsp + 0x18]
movsx r11d, r11b
lea rbp, [rbp + 1]
je 0x140207ba2
and rdx, 0xffffffffd616c30b
jae 0x140480bd8
jne 0x14053dc84
movabs rax, qword [0x544649341a8b300c]
movabs eax, dword [0x544649341a8b300c]
push 0xffffffffe5335739
xchg esi, eax
mov dword [rdx + rdi*2 - 0x787d5e43], edi
jne 0x14053dc0f
invalid
js 0x14053dc2e
lodsd eax, dword [rsi]
add byte [rdi], ah
cmpsd dword [rsi], dword [rdi]
int1
and eax, 0x5236dcae
sbb ecx, dword [rbx + rbp*4]
or al, 0xab
jbe 0x14053dc5b
outsb dx, byte [rsi]
in eax, 0x42
add esi, dword [rax + 0x6b6997b1]
mov dword [rbx], edx
jae 0x14053dd18
cmp al, cl
jge 0x14053dcdd
cmp dword [rcx - 0x64], 4
sub al, 0x49
pop rdx
test dword [rdi + 0x51], esi
add r11, qword [rdi + 0x52839a68]
sti
ror byte [rdx], cl
sbb dword [rbx - 0x580387c1], ebp
add byte [rdx + 0x4b], cl
xchg byte [rcx], ah
push 0x3f
pop rdi
invalid
loopne 0x14053dc91
adc edx, eax
invalid
sbb al, 0x83
mov edx, 0xd0122371
sub bl, byte [rdx - 0x6f]
or eax, dword [rcx - 0x27]
sub dword [rbx - 0x3d], ebp
invalid

Function at 0x140554ea0
Capabilities:
Encode data using xor

Disassembly:
jne 0x140588f63
jge 0x1403e621f
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x88]
ret

Function at 0x140559258
Capabilities:
Encode data using xor

Disassembly:
mov rcx, rbx
mov rcx, qword [rsp + rbx + 0x10f]
xchg qword [rsp + rsi - 0x97], rcx
mov rbx, qword [rsp + rbx + 0x127]
add r13d, 0xb2855b15
test qword [rsp + rsi*4 - 0x3cc], rsi
bswap r13
js 0x14021155a
shr r13, 0xa9
add sil, 0x23
shl byte [rsp + r13 - 0xaad12], 0x1e
je 0x1405a6f5f
cmp dword [rdx - 0x7aca05cb], eax
scasd eax, dword [rdi]
mov ebx, 0xbcc586ee
invalid
or qword [rsp + r13 - 0xaacf2], 0xffffffffc5913618
mov r13, qword [rsp + rsi + 0x3e]
or si, si
neg byte [rsp + rsi + 0x2e]
call fcn.14051edf2

Function at 0x14055c847
Capabilities:
Encode data using base64

Disassembly:
lea r9, [rdx + rdx*8 + 0x14b712b8]
xor r9b, 0x81
xchg qword [rsp + 0x60], rbp
mov rbx, qword [rsp + 0x38]
and r9b, 0x28
call fcn.1405bafc8

Function at 0x14056d3b3
Capabilities:
Packed with generic packer

Disassembly:
shl bpl, 0xe2
call fcn.1403a27d6

Function at 0x14058063a
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov qword [rsp + rdx + 0x5cc2cd79], r10
shr r14b, 0x47
jb 0x1403f5fb9
xchg qword [rsp + r14 + 0x48], rbp
mov r10, qword [rsp + 0x10]
sub dil, 7
shl edi, 0xdb
xor sil, byte [rsp + 0x24]
neg di
jno 0x14054c657
mov r14, qword [rsp + r14*2 + 0x40]
xor di, 0x808
lea rdi, [rsi + rsi*4 + 0x283a3028]
and dil, 0x14
xor dl, dh
lea rbp, [rbp + rdx*2 + 0x6c39554d]
cmovge dx, si
add r14b, 0x3d
cmp r14, 0x16153139
movsx r14d, dil
mov r10, r14
jl 0x140399bb0