joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405d38a9
Capabilities:
Packed with generic packer

Disassembly:
pushfq
add qword [rsp + 8], 0xfa35a
lea rbx, [rbx + 1]
push rbx

Function at 0x1405dcdac
Capabilities:
Packed with generic packer

Disassembly:
not r15
mov rbx, qword [rsp + 0x38]
not r15b
cmp r15, 0x5902298f
call fcn.14068cb5a

Function at 0x1405de64a
Capabilities:
Set registry value

Disassembly:
jg 0x1406e0ce5
shl dword [rsp + 0x40], 0x3f
lea rcx, [rcx - 0x5e4489f1]
or byte [rsp + 0x40], 0x8e
mov qword [rsp + 0x50], r8
call fcn.1403a7b86

Function at 0x1405de650
Capabilities:
Set registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x1400225cc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004f3c0
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004f3c0
add rsp, 0x50
pop rbx
ret
jbe 0x1400225a0
push qword [rsp + 0x40]

Function at 0x1405e338f
Capabilities:
Encode data using base64

Disassembly:
mov rdi, qword [rsp + 0x38]
call fcn.140647d19
add dword [rsp + r10 - 0x6fffffe0], 0x6bb6579c
neg dword [rsp + rdi*2 - 0xec]
bswap edi
jo 0x14065362c
xchg qword [rsp + rsi - 0x7fa09826], rax
mov rsi, qword [rsp + rsi - 0x7fa0985e]
shl r10, 0x7e
test word [rsp + 0x54], di
js 0x1404cd6e0
jbe 0x140449b18

Function at 0x1405e8eb8
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
mov qword [rsp + 0x20], 0xffffffffb282f830
lea rsp, [rsp + 0x20]
call fcn.140771367
mov rbx, qword [rsp + rdx - 0x1ffff0]
mov rbx, qword [rbx + rdx - 0x200000]
cmp edx, 0x7e084a3d
call fcn.14066b81c

Function at 0x1405eb178
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x1406f52b0
mov qword [rsp + 0x50], rbp
test r13, 0xffffffff863af134
call fcn.140452061
sub r13w, word [rsp + 0x55]
mov r13, qword [rsp + 0x38]
jno 0x1405bde6f
add byte [rsp + 0x58], 0x25

Function at 0x1405f398f
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + r9 - 0x7fffffc8], 0xffffffffbfa8e0b7

Function at 0x1405f39ce
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x1de1f8
mov rbx, r8
push rbp
movabs rbp, 0xe830fbbff51bcd10
or dword [rsp + 0x20], 0x3e1d463d
not rbp
jb 0x1403cc893
xor rbx, qword [rsp + 0x20]
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
and r8, r8
call fcn.14063703e
Function at 0x1405fc911
Capabilities:
Get system information on windows

Disassembly:
call fcn.140635472
xor edi, dword [rdi - 0x5d]
int3
shl r12, 0xa1
jne 0x140003bcd
xor r11b, 0xa0
movsxd r11, r11d
and r11b, 2
mov rdi, qword [rdi + r11*2 + 0x5f1201fc]
shr r11b, 0x59
call fcn.140683078
lea r9, [r15*8 - 0x1be74280]
not r15d
jne 0x1403b01fa
cmp bx, r9w
xchg qword [rsp + 0x38], rsi
mov rbx, qword [rsp + rbx - 0x321faff0]
je 0x14052afec
movabs rdi, 0xf6b13ca7f0b26d84
setbe byte [rsp + 0x10]
shr r13d, 0xcc
shl word [rsp + 0x10], 0xa1
mov edi, dword [rsp + r13 - 0x497ac]
call fcn.1405121bd
out 0xce, al
mov esi, 0xaae79513
mov ds, word [rdx]
push rdi
sti
stosb byte [rdi], al
sti
in al, 0xaa
pop rsp
xchg esp, eax
add dword [rsi + 0x5c9855b3], ebx
mov esp, 0xfed05514
sbb edx, dword [rbp + 0x62]
invalid
xor dword [rsp + 0x10], 0x3897e58a
add qword [rsp], 0xfffffffffffcabcd
test r13, 0x2e109b11
jno 0x140409a3b
movabs rsi, 0x1b05c83e54368b9f
mov rsi, qword [rsp + 0x38]
mov rsi, qword [rsi + r10*2 + 0xf4]
call fcn.1405c458a
movabs al, byte [0x556955c3debfa918]
add ecx, dword [rsi + 0x4f8aaa41]
sub byte [r13 - 0x7a], r10b
outsd dx, dword [rsi]
invalid
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.1408697db
or ebx, 0x321fb02e
js 0x1405acfbe
jb 0x14035abb9
shl r15w, 0x39
lea rsi, [rsi + 0x77863c34]
mov r9, rbx
setne bl
je 0x140374dc9
insd dword [rdi], dx
shr byte [rsi - 0x18], 1
or dword [rbp + 5], ecx
push 0xf379028
imul ebp, dword [rax], 0x6b1ec066
call 0xdd2212d6
invalid

Function at 0x140605005
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1405e57b2
invalid
mov qword [rsp + 0x30], r12
shr r12w, 0x9d
neg r12b
lea rax, [rax + 0x3d2a018c]
jg 0x140549884
cmp dword [rsp + 0x30], 0x6d867628
push r10
call fcn.14064474e

Function at 0x14060502e
Capabilities:
Packed with generic packer

Disassembly:
xor r9b, 0x96
shl r13, 0xc3
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
jns 0x1405eec20
add r11d, 0x3734e507
shl r11b, 0x2e
shl r13d, 0x7b
mov r15, r9
mov qword [rsp + r13*4 + 8], r9
mov r15, qword [rsp + 0x38]
ja 0x1404cdb29
add qword [rsp + 0x30], 0xffffffffbfa34b81
xor byte [rsp + 0x40], 0xb
shl word [rsp + 0x40], 0x1b
add word [rsp + 0x40], 0x2c30
shl word [rsp + 0x40], 0x93
sub dword [rsp + 0x40], 0xa0939d93
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x140609174
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov qword [rsp + 8], 0xfffffffffa09c633
lea rsp, [rsp + 8]
call fcn.140771367
Function at 0x14060ab14
Capabilities:
Packed with generic packer

Disassembly:
setbe byte [rsp + 0x38]
sub si, si
and dword [rsp + 0x38], esi
jg 0x1405569bf
pop rax
push r12
pushfq
movabs r12, 0xd2929124cdbffc1b
add r12b, 0xbe
and r12w, r12w
call fcn.1404ba97e
pushfq
add qword [rsp + 0x10], 0xffffffffbf77a05c
call fcn.140353019
mov rdi, qword [rsp + 0x10]
push r15
pushfq
movabs r15, 0x2fb9192031979834
mov r15b, 0x8e
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x60]
ret
jge fcn.140655d64
setns r15b
xchg qword [rsp + 0x60], rbp
mov r15, qword [rsp + 0x28]
jle 0x14041bbbd
invalid
mov rsi, qword [rsp + 8]
and dword [rsp + 0x38], 0x5e0c5c8f
neg byte [rsp + 0x38]
and dword [rsp + 0x38], 0xdeb73c8d
add dword [rsp + 0x38], 0xd2156d8d
jne 0x14045208a
or r15w, 0x1dad
jl 0x140505475

Function at 0x140613f09
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x20], rcx
push r8
movabs r8, 0xaf194b3adb99fe0d
bswap r11
call fcn.1405ff253

Function at 0x140613f22
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + r8*2 - 0x6dd8270e], rbp
mov r11, qword [rsp + r8*2 - 0x6dd8273e]
call fcn.140363a67

Function at 0x14061f81f
Capabilities:
Encode data using xor

Disassembly:
jns 0x1406607cc
xchg byte [rbx + 0x72d234db], ah
imul eax, dword [rax + 0x2c], 0x91a1efe4
mov edi, 0xbf9a2293
sbb al, 0x64
shr byte [rcx + 0x40], 0x16
test eax, 0x9c406da8
in al, 0x3c
xchg ebp, eax
mov edi, 0x9769a236
mov edi, 0x93aa2ef2
mov edi, 0x972d4c99
mov edi, 0x96a078e3
mov edi, 0xbd34e92e
imul eax, dword [rax + 0x26], 0x39bf97c2
out dx, al
cmp edx, dword [rcx]
outsd dx, dword [rsi]
xchg r10d, eax
pavgb mm6, qword fs:[rax - 0x69]
mov edi, 0x931855f4
mov edi, 0x6b8ca821
cmp bl, sil
fldcw word [rcx + 0x40]
push 0xffffffffbf928937
pop si
sti
and eax, 0xfffffffc
mov edi, 0x43fb5e66
and eax, 0xfffffffc
clc
push rdi
xor dl, cl
sbb al, 0x4e
fist dword [rcx + 0x467b281c]
jp 0x14061f886
jns 0x14061f904
add byte [rdi], al
imul edx, dword [rsi], 0xffffff97
jmp qword [rax]
and dword cs:[rdx], edi
mov esi, 0xffffff1a
invalid
not byte [rsp + 0x60]
mov r9, qword [rsp + 0x68]
movabs r11, 0x843c35869bbdaa3e
call fcn.14061dbaf
lahf
mov dword [0xf0f5d842], ebp
popfq
and dl, byte [rdi]
cmp eax, 0x68df45dd
stosd dword [rdi], eax
cmpsd dword [rsi], dword [rdi]
pop rdx
fisubr dword [rax]
invalid
Function at 0x1406214d1
Capabilities:
Packed with generic packer

Disassembly:
hlt
jb 0x1404ebee4
mov edi, 0xd9dd4921
fdiv qword [0x10cc2ff76]
movabs al, byte [0x714053db1b40425c]
push rcx
xor ebp, dword [rdx]
mov ebp, 0x6c7bc2bf
invalid
ja 0x14064bbb0
sub word [rsp + rcx*2 - 0x601b6], 0x40b4
not rcx
call fcn.140444567
mov bh, 0x57
sub ch, byte [rax]
fcom dword [rbx + 0x190d4b46]
xor al, 0xaa
add al, 0xaf
xor eax, 0x7e2ca30
in al, 9
jne 0x1404ebfd2
lahf
lahf
jp 0x1404ebf24
iretd
test byte [rsi], ch
nop
add dword [rsi - 0x4e], esi
xchg ecx, eax
movabs byte [0xed8683e27dceadf7], al
sub ah, ah
cld
stosd dword [rdi], eax
invalid
push r9
movabs r9, 0x3694e69b681bdb05
pushfq
or r9, 0xffffffffb02cb131
jne 0x14066c767
cmp r9, 0x171ca327
add qword [rsp + 0x10], 0x268444
neg r9w
movabs rbp, 0xfa827d9e942e53aa
jae 0x1406af2b7
setg bpl
movzx ebp, bpl
push r15
mov rbp, qword [rsp + r9 + 0x7c0fb4d]
mov rbp, qword [rbp + r9*8 + 0x3e07d9a8]
movabs r15, 0xd686f6badba8a094
not r9
call fcn.1405d96c4
xchg qword [rsp + r11*2 + 0x1e], rax
mov r11, qword [rsp + r11*2 + 6]
xor byte [rsp + 0x18], 4
cmp dword [rsp + 0x18], 0x68193cbd
jo 0x1404ebf54
jb 0x1404a12b8
out dx, eax
and al, 0xb0
push rdi
sbb al, 0x53
push 0xffffffffec17b393
or eax, 0xfa684e4b
mov edi, 0x23284b54
lea ebx, [rsi + 0x4a]
sub byte [rax - 0x66], cl
call 0xfffa6399
invalid

Function at 0x140622aaa
Capabilities:
Encode data using xor

Disassembly:
movzx cx, cl
sete byte [rsp + 0x48]
xchg qword [rsp + rcx - 0x3606ff90], rdx
mov r9, qword [rsp + r9 - 0x7ab4b88b]
sets byte [rsp + 0x38]
jle 0x14041e945
seto byte [rsp + 0x50]
add qword [rsp + 0x20], 0xffffffffbf9d2e73
call fcn.1406092d4

Function at 0x140626dd6
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
test qword [rsp + 0x18], 0xffffffffb110c00a
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.140771367

Function at 0x140626dee
Capabilities:
Encode data using base64

Disassembly:
add r9w, 0x271f
cmp rcx, 0xffffffffcb30aeb7
jl 0x14064c9ed

Function at 0x14063577e
Capabilities:
Authenticate hmac
Encode data using base64
Get system information on windows

Disassembly:
setae r8b
je fcn.1406bd6e3
add byte [rsp + 0x28], 0x12
test qword [rsp + 0x30], 0x24a8aba7
call fcn.140361559
xor qword [rsp + 0x40], r10
mov r10, qword [rsp + 0x38]
jb 0x1406aa0b1
shl qword [rsp + 0x40], 0xe4
setae byte [rsp + 0x30]
mov r8, r9
movabs r8, 0x291bce302793aa1f
jne 0x140668200
mov r9, qword [rsp + 0x20]
jae 0x1404a89e5

Function at 0x14063a3b8
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + r10 - 0x73094232], rdx
mov r14, qword [rsp + r10 - 0x73094242]
add qword [rsp + r10 - 0x7309423a], 0xffffffffbf956ac2
shl dword [rsp + r10 - 0x73094262], 0xf8
shl r10w, 0x44

Function at 0x140642ad4
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
test r15, r15
bswap r15d
jb 0x1404d7198
lea rsi, [rsi + 1]
shr r15w, 0xf0
sub r15b, 0x23
test r15d, 0x1e9a072a
Function at 0x14065bc26
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
lea r12, [r12 + r12*8 + 0x7ead6fb8]
add qword [rsp + 0x10], 0x1bc160
call fcn.14043ac18
push r12
pushfq
movabs r12, 0xb1349f041c872d07
movabs r12, 0xb23f4f2914b0378e
xor r12, r12
jbe 0x140642abe

Function at 0x14065bc46
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
pushfq
movabs rsi, 0x1dbedcba5b02619b
push rdi
add qword [rsp + 0x20], 0xffffffffbf77744e
neg esi
movabs rdi, 0xbb06603967ae19b1
mov qword [rsp + 0x20], 0xffffffffadd701fb
mov rdi, qword [rsp]
jno 0x14047d969

Function at 0x14065bc7b
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
je fcn.1405ff4c1
mov r15, qword [rsp + 0x28]
and r14w, word [rsp + 0x29]
and qword [rsp + 0x28], r15
lea rsi, [rsi + 0x480253ad]
push r9

Function at 0x14065e277
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp], 0xffffffffbfb47b06
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffcb270dbc
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407769e0

Function at 0x140667dfb
Capabilities:
Encode data using xor

Disassembly:
test r12b, 0x96
not ebx
mov r11, rbx
add qword [rsp], 0x1bdd38
and al, 0
cmp ch, bl
sbb eax, dword [rax]
and r9w, 0x1d1d
call fcn.1406c9401
pop rbp
add dword [rdi], 0x49
and dword [rcx + 0x491e7dff], ecx
fldenv [rbx + 0x7a]
loope 0x140667e70
jp 0x140667e07
cli
cli
mov ah, 0xc9
mov dh, 0x6a
xor dl, byte [rdi]
jl 0x140667e24
mov dh, 0xcf
pop rbx
add byte [rcx + 0x2d], cl
adc eax, 0x49112054
adc rcx, qword gs:[rcx - 0x4f]
ret 0xf451
cld
leave
pop rdx
sal dword [rsi - 0x7c76eba1], 1
jae 0x140667e07
int 0x11
rol byte [rcx], cl
add byte [rax], al
add byte [rbx - 0x10], al
pop rsp
adc al, 6
adc eax, 0x9a3da69
invalid

Function at 0x14066c3e0
Capabilities:
Set socket configuration

Disassembly:
mov r11, rdx
jae 0x1405339d5

Function at 0x140671e31
Capabilities:
Packed with generic packer

Disassembly:
or r12w, word [rsp + r12 - 0x77fef6f8]
setb r12b
je 0x1404192cc

Function at 0x140679a9c
Capabilities:
Encode data using base64

Disassembly:
call fcn.140556d66
mov r10, qword [rsp + 0x50]
or r10b, byte [rsp + 0x54]
mov rsi, qword [rsp + 0x50]
mov r15, rsi
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
jg fcn.1406671e9
test r10w, 0x96b7
mov qword [rsp + 0x28], rbx
movsx ebx, r10b
call fcn.14051261c
fistp qword [rax + 0x4c]
or al, 0xf3
jg 0x140679b3e
movsx r13, r11w
push rdx
sub r10b, r12b
invalid
add dword [rdx + 0x7d065bef], 0xfffffffa
test byte [rsi + 0x3bf83221], dl
adc edx, dword [rcx - 0x154ffd]
invalid
Function at 0x140679aa1
Capabilities:
Encode data using base64

Disassembly:
call fcn.140556d66
mov r10, qword [rsp + 0x50]
or r10b, byte [rsp + 0x54]
mov rsi, qword [rsp + 0x50]
mov r15, rsi
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
jg fcn.1406671e9
test r10w, 0x96b7
mov qword [rsp + 0x28], rbx
movsx ebx, r10b
call fcn.14051261c
fistp qword [rax + 0x4c]
or al, 0xf3
jg 0x140679b3e
movsx r13, r11w
push rdx
sub r10b, r12b
invalid
add dword [rdx + 0x7d065bef], 0xfffffffa
test byte [rsi + 0x3bf83221], dl
adc edx, dword [rcx - 0x154ffd]
invalid

Function at 0x14067b248
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
not cx
add qword [rsp + 0x20], 0x948cd
test ecx, ecx
not rcx
call fcn.1406c531a
push r13
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov r13, rsi
shr si, 0xe3
lea rax, [rax + 0x2b67421]
movsx si, sil
call fcn.1403ee645
mov rbx, qword [rsp + rbx*2 - 0xd98]
mov rbx, qword [rbx]
lea rbx, [rbx + 0x4c370599]
mov qword [rsp], 0x2da5e204
push r10
pushfq
mov r10, qword [rsp + 0x10]

Function at 0x14067b33b
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
not r8d
mov r8, qword [rsp + rdi + 0x50]
call fcn.1406f55c7
shr dword [rsp + 0x40], 0x47
je 0x1404cd6b8
call fcn.1405bbbbd
js 0x14065bc9a
xor r9d, 0x541841bc
neg r9b
movsx rbx, word [rsp + 0x28]
lea rax, [rax - 0x65461a64]
mov bx, 0xf63b
test r11, 0x4e39aa39
movzx bx, r11b
jle 0x14048771a
js 0x140588703
xchg qword [rsp + rbx + 0x38], rax
mov r9, qword [rsp + 0x10]
not bx
sub dword [rsp + rbx - 0xffd7], r11d
or ebx, 0xbd01bd1e
cmp bx, word [rsp + 0x2a]
call fcn.140510d33
push rdx
sal edi, 1
xor al, 0xb8
cli
mov edx, 0xf44f6fbf
out 0x45, eax
out 0x98, al
mov ebx, 0xcb46d9bf
mov dil, 0xc8
invalid
jne 0x14055977f
or r11d, 0x7ba7df80
add qword [rsp + 0x20], 0xffffffffffe0a5dc
add rcx, 0xffffffff8917e221
shl r11d, 0xe1
and r11, 0x37974627
jo fcn.1403b2578
call fcn.1403bfd2f
shl r14, 0x38
mov r9, r14
seta r9b
mov dword [rsp + r9*2 + 0x2e], r9d
je 0x140352ea2
not r9w
push rbx
add r9d, 0xbe969696
xchg qword [rsp + r14*2 + 0x40], rsi
mov r9, qword [rsp + r14*4 + 8]
shl r15, 0xcd
movsxd r15, r14d
call fcn.1405ce919
sub qword [rsp + 0x50], r10
mov r10, qword [rsp + 0x40]
or dword [rsp + 0x50], 0xe005749e
or byte [rsp + 0x50], 0x9d
shr qword [rsp + 0x50], 0x25
js 0x14040378f
je 0x1404d8e94
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x14067c3a5
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs r9, 0x29a7e8a310a971a
add qword [rsp + 0x10], 0x5b656
call fcn.1404c2599

Function at 0x14067c3d3
Capabilities:
Packed with generic packer

Disassembly:
ja 0x14063fc61
shl dword [rsp + 8], 0x70
lea rax, [rax - 0x4bd331d5]
jne 0x1406eecc2
js 0x1406db5c9
sub word [rsp + 8], r12w
sete r12b
push r15
movabs r15, 0xe09e180a9c090a0f
lea r15, [r15*8 - 0x77fbdc7d]
xchg qword [rsp + 0x28], rax
mov r12, qword [rsp + 0x20]
xor r15, 0x6bbdc189
setge r15b
jbe fcn.14046a408
mov r15, qword [rsp]
jl 0x1403f399f
setae byte [rsp + 0x10]
add qword [rsp + 0x10], 0xfffffffff1a9460b
jle 0x140452ca5
ja 0x1406d5c71
jge 0x140710172
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret
Function at 0x14068b77d
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
sub bpl, bpl
jb 0x14064e069
cmp bl, bpl
not rbx
bswap r12
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
not r12b
mov qword [rsp + 0x10], rbp
bswap r12d
lea rbx, [rbx - 0x677635ca]
jl 0x1406cf35d
push rdx
add qword [rsp + 0x10], 0x13169a
movzx bp, byte [rsp + 0x1c]
lea rsp, [rsp + 0x10]
ret 8
add qword [rsp], 0x309f17
shr rsi, 0x6c
mov rcx, rsi
push r9
movabs r9, 0xc803f719ffb15613
movzx cx, cl
cmp rcx, rsi
lea r9, [rsi + r9*2 + 0x5585300d]
call fcn.14054ad38

Function at 0x1406946a8
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
js fcn.140665d02
mov rsi, qword [rsp + 0x60]
jo 0x140409d32
jo 0x140697058
movabs r15, 0x8e8186914d39122e
not cl

Function at 0x1406aa962
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.1407f2cfd

Function at 0x1406bcce0
Capabilities:
Encode data using base64

Disassembly:
movabs r15, 0x2db21c0c5919901b
not dword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
jo 0x14064fded
jno 0x14040379f

Function at 0x1406c1516
Capabilities:
Set socket configuration

Disassembly:
mov r14w, 0x7f10
mov rcx, qword [rsp + r14 - 0x5fa47ee8]
test r14d, 0xc11d113c
setne r14b
jne 0x1403af3fd

Function at 0x1406c1539
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], 0x413bb5bc
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407200cc
pop rcx
push 0xffffffff9080c59f
push rdi
pushfq
mov rdi, qword [rsp + 0x10]
test word [rsp + rdi + 0x6f7f3a71], 0x3627
call fcn.140654c39

Function at 0x1406c2417
Capabilities:
Packed with generic packer

Disassembly:
lea rcx, [rcx + rdx - 0xb67fec4]
mov word [rsp + rdx - 0x4723afd0], 0xef1e
add qword [rsp + r11 - 0x4723b09c], 0xffffffffffe2178d
push r11
mov rbx, qword [rsp + r11 - 0x4723b0ac]
mov rsi, r11
call fcn.140023925
js 0x14057a3a8

Function at 0x1406c7701
Capabilities:
Encode data using xor

Disassembly:
or r13, r13
not r13
setae byte [rsp + r13*4 - 0x2f73cab8]
jns 0x1406975f6
mov r13, qword [rsp + r13 - 0xbdcf27c]
jne 0x1406b5163
retf

Function at 0x1406cdfd3
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov qword [rsp + 8], 0xfffffffff9cacd58
lea rsp, [rsp + 8]
call fcn.1408697db

Function at 0x1406cdfe6
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
lea rsi, [rsi + 0x73ae0725]
movzx r8w, byte [rsp + 0x2a]
jl 0x1406091b6
call fcn.14063651a

Function at 0x1406cf3a1
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp], 0x1712f7
push r8
and r13, r13
lea rcx, [rcx + 1]
movabs r8, 0xc33266adc73f8db2
test r13w, 0x761f
call fcn.14036231d

Function at 0x1406d4e01
Capabilities:
Encode data using xor

Disassembly:
jo 0x1407075e1
lea rdi, [rdi + 1]
call fcn.14035b190

Function at 0x1406d8b92
Capabilities:
Encode data using base64

Disassembly:
push rdi
push r12
pushfq
movabs r12, 0xd581dd94c6bd7f84
Function at 0x1406de0ac
Capabilities:
Packed with generic packer

Disassembly:
shl rsi, 0x9b
test dword [rsp + 0x18], 0xe400871d
call fcn.14002ee62
cmp al, r13b
jo 0x14041497b
add r14b, byte [r11 + r11 - 0x31]
sub byte [rdx], al
sahf
add dh, bl
sahf
out 0xb2, eax
invalid
jae 0x14041495f
not byte [rsp + 0x78]
sub dword [rsp + 0x78], 0x7d2fcf31
jge 0x1405494a5
not qword [rsp + 0x78]
and word [rsp + 0x78], 0x7d27
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret

Function at 0x1406e569c
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
push rax
push 0xffffffff8923f814
pushfq
sub byte [rsp + 8], 0x30
jns fcn.14054ad38
cmp qword [rsp + 8], 0xffffffffcb991780
mov rax, qword [rsp + 0x18]
je 0x140352ea4
shl byte [rsp + 8], 0xe7
or word [rsp + 8], 0x82d
cmp byte [rsp + 8], 0xa0
push rbx
lea rax, [rax + 1]
push r11
call fcn.1404b918f
push rsi
mov dl, ch
xor al, 0x4c
adc ebx, esi
outsb dx, byte [rsi]
insd dword [rdi], dx
jo 0x1406e5750
invalid
in eax, 0xda
xchg edx, eax
xchg esi, eax
mov edi, 0x92fabf0e
mov edi, 0x6a6ea24a
jo 0x1406e56e1
cmp ebp, dword [rax + 0x40]
rcl dword [rax - 8], cl
insb byte [rdi], dx
invalid
mov edi, 0x40689050
iretd
xor ebx, dword [rdi + 0x6a]
cmc
adc ebp, dword [rcx + 0x7e]
sub rax, 0xffffffffccf3ce7f
js 0x1406e5714
sub dh, bh
adc dword [rbx + 0x3c], esp
fmul qword [rsi + 0x41962ec3]
adc esp, esi
cmc
out dx, eax
rol byte [rdx - 0x2c704d10], cl
adc ah, byte [rax + 0x7d]
xor bl, byte [rcx]
pop rdx
xor dword [rdi], eax
invalid

Function at 0x1406e60ac
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shl r13d, 0x89
ja 0x140352ec5
call fcn.140531aa4

Function at 0x1406e60cb
Capabilities:
Packed with generic packer

Disassembly:
call fcn.140431118
push 0xffffffffffffffe8
mov dl, 0xbf
test dword [rdx - 0x24], ecx
stosb byte [rdi], al
sbb eax, 0x3e28205c
push rbp
ror dword [rsi + 0x4e], cl
adc al, 0x55
movabs dword [0x5517200055088c7f], eax
fld st(0)
mov ah, 0x45
stosb byte [rdi], al
sbb eax, 0xaae767f1
jge 0x1404c3ec8
call 0xfe975d52
cmp eax, 0x494c0555
push 0xffffffffb389556c
stosb byte [rdi], al
adc ch, cl
jp 0x1404c3ee5
stosb byte [rdi], al
invalid
cmp byte [rsp + 0x28], dil
movsx edx, dl
movabs r15, 0x5820c789268e2f82
xchg qword [rsp + rdx + 0x58], rsi
mov r15, qword [rsp + 0x50]
lea rdi, [rdx + rdi*8 - 0x484107c4]
jge 0x1404c3e75
bswap r9d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + r9 - 0x80]
mov r14, r15
mov qword [rsp + 0x30], r14
xor r15, 0x73bc1620
setae byte [rsp + 0x30]
push r9
lea rax, [rax + 0x3d10feb7]
ja 0x1406d99e5
popfq
lea rsp, [rsp + 0x98]
ret
push r15
sete r15b
sub r15d, dword [rsp + 0xc]
neg dword [rsp + r15 - 0x73bc1600]
cmovno r15w, word [rsp + r15 - 0x73bc15f4]
xchg qword [rsp + r9*8 - 0x3b0], rax
mov r15, qword [rsp + 0x38]
lea r9, [r14*2 + 0x63abb80f]
jo 0x1405cbd33
shr byte [rsp + 8], 0x41
jo 0x1405f399b
shr r13, 0xb7
ja 0x1405693cb
mov r13, qword [rsp + r13 + 0x70]
cmp r9d, 0x3891dba7
mov r13, qword [rsp + r9 - 0x1a55]
movzx r9w, r9b
mov r9, qword [rsp + r9 - 0x75]
jge 0x140665d19
mov dword [rsp + 0x70], 0x152940a0
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret