joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002acf0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg r10, rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg rcx, r15
mov rsi, r15
xchg rcx, r15
mov rax, qword gs:[0x30]
xchg rdi, rbp
mov rbp, qword [rax + 0x60]
xchg rbp, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0x3174de43
add rcx, 0x3174df0b
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002a080
test eax, eax
js 0x14002ad86
cmp qword [rsp + 0x40], rbx
je 0x14002ad86
lea eax, [rbx + 1]
jmp 0x14002ae13
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002ada7
mov eax, 2
jmp 0x14002ae13
cmp dword [rcx + 0x74], ebx
jbe 0x14002adba
mov eax, 3
jmp 0x14002ae13
cmp byte [rdi + 2], bl
je 0x14002adcd
mov eax, 4
jmp 0x14002ae13
cmp r14d, 0xa
jb 0x14002adf6
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002adf6
mov eax, 8
jmp 0x14002ae13
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a650
jmp 0x14002ae11
mov eax, ebx
xchg r10, rbx
mov r10, qword [rsp + 0x48]
xchg rbx, r10
xchg r12, rsi
mov r12, qword [rsp + 0x50]
xchg rsi, r12
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
ret
Function at 0x14005d290
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r11
mov r9, r11
xchg rcx, r11
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005d343
cmp byte [rcx], 0
je 0x14005d343
test rdx, rdx
jne 0x14005d2d8
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005d2c2
test rdx, rdx
je 0x14005d340
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 7
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005d2ea
not r8d
mov eax, r8d
ret

Function at 0x140060a50
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x140060a69
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x140060a96
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060a93
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060a77
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret

Function at 0x140060aa0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x140060abd
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x140060af1
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060aee
xchg rcx, rsi
mov rsi, qword [rdx + 0x10]
xchg rcx, rsi
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060acb
xchg r13, rax
mov r13, qword [rdx + 0x10]
xchg r13, rax
mov byte [rdx], 1
ret

Function at 0x140060b90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rax
mov rbx, qword [rcx + 0x10]
xchg rbx, rax
mov rdx, rcx
test rax, rax
jne 0x140060ba1
ret
cmp byte [rcx], 0
jne 0x140060bd7
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060bd4
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060bb4
xchg r9, rax
mov r9, qword [rdx + 0x10]
xchg r9, rax
mov byte [rdx], 1
ret
Function at 0x1400d66c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
push r14
push r15
sub rsp, 0x30
xchg rbx, r8
mov r14, rbx
xchg rbx, r8
mov r12, rdx
test rdx, rdx
je 0x1400d68cc
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d68cc
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d68cc
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d68cc
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d68c1
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 2
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d68b3
mov ecx, 0x60
call fcn.140154090
xchg r8, rsi
mov r8, rax
xchg rsi, r8
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d67d6
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
mov qword [rsp + 0x88], rax
mov edx, dword [rax]
add rdx, r12
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.1400dd530
lea rax, [0x140003e48]
mov qword [rsi], rax
jmp 0x1400d67f8
xchg r15, rsi
mov r15, rsi
xchg rsi, r15
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
xchg rdx, rax
mov qword [rsp + 0x88], rdx
xchg rdx, rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.1401540d4
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
test rax, rax
je 0x1400d6829
mov r8d, r12d
xor edx, edx
xchg rbp, rax
mov rcx, rbp
xchg rbp, rax
call fcn.140155126
jmp 0x1400d682b
xor ebx, ebx
mov r8d, dword [r15]
mov rax, qword [rsp + 0x88]
mov edx, dword [rax]
xchg rcx, r12
mov rcx, qword [rsp + 0x78]
xchg rcx, r12
add rdx, r12
xchg rcx, rsi
mov rsi, rbx
xchg rcx, rsi
call fcn.140155150
mov rax, qword [rsi]
xchg rdx, r8
mov r8, rbx
xchg rdx, r8
xchg rcx, rbp
mov rbp, rsi
xchg rcx, rbp
call qword [rax + 0x10]
mov qword [rsp + 0x88], rsi
xchg rdx, rbx
mov rbx, qword [r14 + 8]
xchg rdx, rbx
cmp rdx, qword [r14 + 0x10]
je 0x1400d689d
mov qword [rdx], rsi
neg qword [r14 + 8]
add qword [r14 + 8], 0xfffffffffffffff8
neg qword [r14 + 8]
jmp 0x1400d68ad
lea r8, [rsp + 0x88]
mov rcx, r14
call fcn.1400d58a0
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d674c
test r13d, r13d
setne al
jmp 0x1400d68ce
xor al, al
xchg r9, rbx
mov r9, qword [rsp + 0x70]
xchg r9, rbx
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
push rbx
push rcx
push rax
push rbx
push rax
push rbx
push rdx
push rax
xchg qword [rsp + 0x40], r14
pop rax
pop rdx
pop rbx
pop rax
pop rbx
pop rax
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
push rbx
push rdx
xchg qword [rsp + 0x10], rsi
add rsp, 0x18
push rbx
push rcx
push rbx
push rax
push rbx
push rbx
push rbx
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
ret
Function at 0x1400d7f50
Capabilities:
Parse pe header

Disassembly:
mov byte [rsp + 0x20], r9b
push rbp
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rsi
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x6c73dae5
mov qword [rsp], r15
lea rbp, [rsp - 0x17]
sub rsp, 0xb0
movzx r12d, r9b
mov rbx, r8
xchg rcx, rdx
mov rsi, rcx
xchg rdx, rcx
xchg rcx, r13
mov rcx, r13
xchg r13, rcx
test rdx, rdx
je 0x1400d8d3b
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d8d3b
movsxd r15, dword [rdx + 0x3c]
add r15, rdx
mov qword [rbp - 0x41], r15
cmp dword [r15], 0x4550
jne 0x1400d8d3b
xchg r15, rcx
mov r15, qword [rbp + 0x7f]
xchg r15, rcx
xor r14d, r14d
mov qword [rbp - 0x59], r14
mov eax, dword [r15 + 0x50]
mov qword [rbp + 7], rax
test rcx, rcx
je 0x1400d7ffe
xchg rbx, rax
mov qword [rcx], rbx
xchg rbx, rax
xor r9d, r9d
mov dword [rsp + 0x30], 0x40
lea rax, [rbp + 7]
mov dword [rsp + 0x28], 0x3000
lea rcx, [r13 + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x59]
lea rdx, [r9 - 1]
call fcn.1400d5ea0
test eax, eax
js 0x1400d8d3b
mov r8d, dword [r15 + 0x54]
xchg r11, rdx
mov r11, rsi
xchg r11, rdx
xchg r10, rcx
mov r10, qword [rbp - 0x59]
xchg r10, rcx
mov qword [rsp + 0xf0], rdi
call fcn.140155150
mov edi, r14d
cmp r14w, word [r15 + 6]
jae 0x1400d80a4
nop word [rax + rax]
mov eax, edi
lea rcx, [rax + rax*4]
mov edx, dword [r15 + rcx*8 + 0x11c]
mov r8d, dword [r15 + rcx*8 + 0x118]
add rdx, rsi
mov ecx, dword [r15 + rcx*8 + 0x114]
add rcx, qword [rbp - 0x59]
call fcn.140155150
movzx eax, word [r15 + 6]
inc edi
cmp edi, eax
jb 0x1400d806b
mov rdi, qword [rbp - 0x59]
test rbx, rbx
mov eax, dword [r15 + 0xb0]
cmove rbx, rdi
xor esi, esi
mov edx, esi
test eax, eax
je 0x1400d80c6
lea rdx, [rdi + rax]
mov eax, dword [r15 + 0x90]
xchg r9, rsi
mov rsi, r9
xchg rsi, r9
test eax, eax
je 0x1400d80e2
lea r9, [rdi + rax]
sub rbx, qword [r15 + 0x30]
xchg r15, r9
mov qword [rbp - 0x49], r15
xchg r9, r15
test rdx, rdx
je 0x1400d8163
cmp dword [rdx], r14d
je 0x1400d8163
mov eax, dword [rdx + 4]
cmp eax, 8
jb 0x1400d8157
lea r8, [rax - 8]
mov ecx, esi
shr r8, 1
je 0x1400d8157
xchg r11, rax
mov r11, rsi
xchg r11, rax
nop dword [rax]
movzx eax, word [rdx + rax*2 + 8]
test ax, ax
je 0x1400d814a
and eax, 0xfff
add eax, dword [rdx]
add qword [rax + rdi], rbx
xchg rdi, rcx
mov rcx, qword [rbp - 0x59]
xchg rcx, rdi
inc ecx
mov eax, ecx
cmp rax, r8
jb 0x1400d8127
mov eax, dword [rdx + 4]
add rdx, rax
jne 0x1400d80f9
movabs rdx, 0x852396afe3269
movabs rbx, 0xc562983199256
test r9, r9
je 0x1400d8997
xor eax, eax
Function at 0x1400dd620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rbx
mov rbx, rdx
xchg r11, rbx
xchg r14, rcx
mov r10, r14
xchg rcx, r14
test rdx, rdx

Function at 0x1400dfc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rsi
mov qword [rsp + 0x10], r10
xchg r10, rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rdi, r8
xchg rdx, rcx
mov rbx, rcx
xchg rcx, rdx
xchg rcx, r9
mov rsi, r9
xchg r9, rcx
test r8, r8
je 0x1400dfdfd
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfd8a
mov edx, 0x3e
xor ecx, ecx
call fcn.1400e04b0
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dfdce
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400dfc9a
xchg r8, rbx
mov qword [rsi], r8
xchg rbx, r8
jmp 0x1400dfe00
mov qword [rcx], rdx
xchg r13, rax
mov r13, rsi
xchg r13, rax
lea r11, [rsp + 0xa0]
xchg rbx, rsi
mov rsi, qword [r11 + 0x10]
xchg rsi, rbx
mov rsi, qword [r11 + 0x18]
xchg r10, rdi
mov r10, qword [r11 + 0x20]
xchg r10, rdi
mov rsp, r11
push rbx
push rcx
push rbx
xchg qword [rsp + 0x18], rbp
add rsp, 0x20
ret
Function at 0x1400e0750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400e07b9
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400e0774
mov ecx, dword [r9]
jmp 0x1400e08ae
cmp ecx, 0x4e0
jb 0x1400e08ae
lea r10, [r9 + 0x9c4]
xchg r8, rbx
mov qword [rsp], r8
xchg rbx, r8
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e07de
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e0832
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 3
shr ecx, 5
shr ecx, 1
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 1
shl eax, 2
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 2
shl eax, 0xc
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x11
shr eax, 1
xor eax, edx
add rsp, 8
ret
Function at 0x1400ee65d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r10 + 0x4320]
xor al, 0xec
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400ee5ff
inc r8
sub r9, 1
jne 0x1400ee5e9
movzx eax, byte [rsi + 5]
lea rdx, [rbp - 1]
movzx ecx, byte [rsi + 1]
lea r8d, [r9 + 4]
mov byte [rsi + 1], al
sub rdx, rsi
movzx eax, byte [rsi + 9]
mov byte [rsi + 5], al
movzx eax, byte [rsi + 0xd]
mov byte [rsi + 9], al
movzx eax, byte [rsi + 0xa]
mov byte [rsi + 0xd], cl
movzx ecx, byte [rsi + 2]
mov byte [rsi + 2], al
movzx eax, byte [rsi + 0xe]
mov byte [rsi + 0xa], cl
movzx ecx, byte [rsi + 6]
mov byte [rsi + 6], al
movzx eax, byte [rsi + 0xf]
mov byte [rsi + 0xe], cl
movzx ecx, byte [rsi + 3]
mov byte [rsi + 3], al
movzx eax, byte [rsi + 0xb]
mov byte [rsi + 0xf], al
movzx eax, byte [rsi + 7]
mov byte [rsi + 0xb], al
mov byte [rsi + 7], cl
nop dword [rax]
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rdx]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x1400ee6a7
sub r8, 1
jne 0x1400ee697
add rsp, 0xf8
nop
mov r15, qword [rsp]
add rsp, 8
push rdx
xchg qword [rsp + 8], r14
pop rdx
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rdx
push rcx
xchg qword [rsp + 0x18], rsi
pop rcx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
push rbx
push rcx
push rax
push rbx
push rbx
push rbx
push rbx
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
ret
Function at 0x14014a691
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [rdi + rdx*4], ah
mov dl, 0
add byte [rbp - 0x67db7b3a], dl
mov dl, 0
add byte [rsi + rax*8], bl
test byte [rcx + rbx*4], ah
mov dl, 0
add byte [rsi + rax*8 - 0x7c], dl
and al, 0x9a
mov dl, 0
add ch, bl
mov byte [rsp + 0xb29b], 0xe8
mov byte [rsp + 0xb29c], 0xab
mov byte [rsp + 0xb29d], 0x86
mov byte [rsp + 0xb29e], 0xe3
mov byte [rsp + 0xb29f], 0xa2
mov byte [rsp + 0xb2a0], 0x1e
mov byte [rsp + 0xb2a1], 0x8b
mov byte [rsp + 0xb2a2], 0x61
mov byte [rsp + 0xb2a3], 0x7c
mov byte [rsp + 0xb2a4], 0x6e
mov byte [rsp + 0xb2a5], 0xdc
mov byte [rsp + 0xb2a6], 0xd4
mov byte [rsp + 0xb2a7], 0x6c
mov byte [rsp + 0xb2a8], 0x53
mov byte [rsp + 0xb2a9], 0x67
mov byte [rsp + 0xb2aa], 0xc8
mov byte [rsp + 0xb2ab], 0x2a
mov byte [rsp + 0xb2ac], 0xf5
mov byte [rsp + 0xb2ad], 0x17
mov byte [rsp + 0xb2ae], 6
mov byte [rsp + 0xb2af], 0x18
mov byte [rsp + 0xb2b0], 0xbe
mov byte [rsp + 0xb2b1], 0xb9
mov byte [rsp + 0xb2b2], 0xa5
mov byte [rsp + 0xb2b3], 0xbe
mov byte [rsp + 0xb2b4], 0x49
mov byte [rsp + 0xb2b5], 0x83
mov byte [rsp + 0xb2b6], 0xdf
mov byte [rsp + 0xb2b7], 0xa1
mov byte [rsp + 0xb2b8], 0x8b
mov byte [rsp + 0xb2b9], 0x7f
mov byte [rsp + 0xb2ba], 0xf5
mov byte [rsp + 0xb2bb], 0xb9
mov byte [rsp + 0xb2bc], 0x98
mov byte [rsp + 0xb2bd], 0xb0
mov byte [rsp + 0xb2be], 0x31
mov byte [rsp + 0xb2bf], 0x9b
mov byte [rsp + 0xb2c0], 0x16
mov byte [rsp + 0xb2c1], 0x52
mov byte [rsp + 0xb2c2], 0x30
mov byte [rsp + 0xb2c3], 0xbc
mov byte [rsp + 0xb2c4], 0xd5
mov byte [rsp + 0xb2c5], 0xf4
mov byte [rsp + 0xb2c6], 0xde
mov byte [rsp + 0xb2c7], 0x35
mov byte [rsp + 0xb2c8], 0x54
mov byte [rsp + 0xb2c9], 0x76
mov byte [rsp + 0xb2ca], 0xeb
mov byte [rsp + 0xb2cb], 7
mov byte [rsp + 0xb2cc], 0x7e
mov byte [rsp + 0xb2cd], 0
mov byte [rsp + 0xb2ce], 0
mov byte [rsp + 0xb2cf], 0
mov dword [rsp + 0xb2f0], 0xb280
mov eax, 1
imul rax, rax, 0
movsx eax, byte [rsp + rax + 0x50]
xor eax, 0xe0
mov ecx, 1
imul rcx, rcx, 0
mov byte [rsp + rcx + 0x50], al
mov qword [rsp + 0xb2d0], 1
jmp 0x14014a8a7
mov rax, qword [rsp + 0xb2d0]
inc rax
mov qword [rsp + 0xb2d0], rax
cmp qword [rsp + 0xb2d0], 0xb280
jae 0x14014a8e8
mov rax, qword [rsp + 0xb2d0]
movsx eax, byte [rsp + rax + 0x4f]
mov rcx, qword [rsp + 0xb2d0]
movsx ecx, byte [rsp + rcx + 0x50]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xb2d0]
mov byte [rsp + rcx + 0x50], al
jmp 0x14014a894
mov dword [rsp + 0xb2d8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb2d8]
mov r8d, 0xb280
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xb2e0]
push rax
call 0x1409c5c19
mov rcx, qword [rsp + 0xb2e0]
call 0x140c40f6f
int3

Function at 0x140154ab0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rax
call 0x14086359d
test rax, rax
je 0x140154afa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140154afa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140154afa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140154afa
cmp dword [rcx + 0x84], 0xe
jbe 0x140154afa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140154afc
xor al, al
add rsp, 0x28
ret
Function at 0x140182570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14018259d
xor al, al
jmp 0x1401826ff
mov rax, qword [0x1401a16c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401a16c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401a16d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401a16d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401a16e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401a16e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401a16f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401a16f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401a1700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401826f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140182649
mov r11d, 2
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140182663
mov r11d, 1
jmp 0x14018266d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140182715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401826b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401826ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401826da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401826e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140182630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401826fa
Function at 0x140a10583
Capabilities:
Encode data using xor

Disassembly:
jge 0x140a10593
leave
jmp 0x14055a32e
push 0xffffffffd40c2218
call fcn.140d061e4
movabs rax, qword [0xa54e0f147e067971]
xchg esi, eax
pop rsi
cli
or ebx, dword [rdi - 0x59]
jle 0x140a105a9
cmovle esp, dword [rbp + 0xbfa5e96]
pop rdi
cmpsd dword [rsi], dword [rdi]
cmpsb byte [rsi], byte [rdi]
jae 0x140a10620
push 0xffffffffffffffc3
movabs eax, dword [0x6e338cf0a7831728]
test eax, 0xbdd8e4f5
xlatb
cdq
fdivp st(3)
xlatb
loop 0x140a10575
invalid
pop rsi
xlatb
mov edi, 0xc4988e3
std
imul esi, dword [rbp + 0x25], 0xba857492
xchg ebp, eax
outsb dx, byte [rsi]
invalid
lodsb al, byte [rsi]
mov byte [rcx + 0x2941f35d], dl
jns 0x140a10670
sal byte [rax + 0x48], cl
or bl, byte [rcx + 0x55]
mov ah, 0xd3
std
rcr byte [rbp + 0x71], 0x83
invalid
outsb dx, byte [rsi]
and esp, esp
ficom word [r9 - 0x6023c448]
fld dword [rax - 0xa]
invalid

Function at 0x140ab09d8
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x1401c5d89
cmp ebx, 3
jne 0x140933d2b
mov r8, rax
jmp 0x1401c5d89
jne 0x1401c5d85
mov r9, rax
jmp 0x1402f8d3b
push qword [rbp + rbx*8 + 0x20]
sub ebx, 1
jne 0x14085f27e
mov rax, qword [rbp + riz]
sub rsp, 0x20
jmp 0x1406a507f
jmp 0x1401c5d89
call rax
mov rsp, qword [rbp + riz - 0x10]
shl bl, cl
mov rbp, qword [rbp + riz - 8]
sub bx, bx
bt ebx, 0x65
cmovge ebx, r12d
mov qword [rbp + riz], rax
pop rbx
sub rsi, 4
add al, dh
mov eax, dword [rsi]
cmp spl, r14b
xor eax, ebx
cmp r10b, dl
clc
add eax, 0x7fb25a9e
xor eax, 0xc752d5a
clc
cmc
bswap eax
cmc
ror eax, 3
cmp r15w, 0x29a4
test r8w, r12w
push rbx
movzx ebx, r13w
or bh, 0x80
xor dword [rsp], eax
shrd ebx, r15d, 4
sal bh, 0xe3
pop rbx
cmp r14w, 0x32db
movsxd rax, eax
clc
add rdi, rax
jmp 0x1407adc92
jne 0x140cc85cf
mov rcx, rax
jmp 0x1401c5d5e
jmp rdi
je 0x1401c5d95
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x1406e6bfe
cmp ebx, 4
jmp 0x1401c5d77
jne 0x1401c5d63
mov rdx, rax
jmp 0x140aa89c6
jmp 0x1401c5d89
push 0xffffffffde2fc3a8
call fcn.140ba3e9e
cmp r8d, esi
mov qword [rbp + riz - 0x10], rsp
cmp al, 0x1a
sub rsp, rcx
test cl, 0x6c
cmc
cmp ax, r11w
and rsp, 0xfffffffffffffff0
lea rsp, [rsp + rcx]
cmp ax, 0x48e6
test ebx, ebx
jmp 0x14085f278
cmp ebx, 2
jmp 0x1409d04cd

Function at 0x140c6db57
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140cdf3f0
syscall
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004bd9a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004bd9b0]
mov dword [rax], 1
mov rax, qword [0x004bd9c0]
mov dword [rax], 1
mov rax, qword [0x004bd990]
mov dword [rax], 1
mov rax, qword [0x004bd860]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004bd980]
mov dword [0x004e400c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004bd940]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004bccb0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067