joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140575fff
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi
shl bx, 0x5c
cmp r14b, bl
not r14d
lea rbx, [rbx*8 - 0x5f7e7d66]
jle 0x140638387
add qword [rsp], 0xfffffffffffc1b10
push rbx
add qword [rsp + 0x10], 0x129dd6
bswap rbx
push 0x14a5b622
call fcn.1405c94cb
popfq
mov qword [rsp + 0x10], rbx
pushfq
add qword [rsp + 0x10], 0xfffffffffff2bbf2
movabs rbx, 0x2a8d3bba4f8aad0b
lea rbx, [rbx + rbx*4 + 0x46167482]
lea rbx, [rbx*4 - 0x375a947b]
call fcn.1405ebb77

Function at 0x14057b9c4
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs r10, 0x8c8df7b3023940a7
xor r10b, r10b
mov r10b, 0x33
add qword [rsp + 0x28], 0xfffffffffff1bcea
push rsi
push rdx
mov rdx, r10
movzx dx, dl
movabs rax, 0x16bd3fa1a7a5eeaa
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rdx
add r10b, byte [rsp + 0x3e]
movabs rsi, 0x993e4b0c5f8d6a14
sets r10b
not edx
or r10w, dx
jne 0x140352d52

Function at 0x14057ba39
Capabilities:
Packed with generic packer

Disassembly:
movabs rbx, 0x2f0a68a376a0869f
setge bl
lea rdx, [rdx + 1]
movabs r13, 0xe498c9355308481c
cmp rbx, r12

Function at 0x140588783
Capabilities:
Set socket configuration

Disassembly:
jg fcn.1405c434d
jg 0x14001c09a
mov qword [rsp + 0x20], 0x1916a735
shl dword [rsp + 0x20], 0xf
lea rdi, [rdi - 0x8de0e43]
call fcn.140415e1f
adc eax, 0xe1c7ab09
movsd dword [rdi], dword [rsi]
invalid

Function at 0x140592c30
Capabilities:
Terminate process

Disassembly:
call 0x140604efa
push rsi
call fcn.140416004

Function at 0x140592c3b
Capabilities:
Terminate process

Disassembly:
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140633146
jl 0x14035b321
lea rdi, [rdi + 1]
sub rdx, rdx
movabs rdx, 0xa627d6b503031c9b
jo 0x1406fe82d
or dl, 0x3e
add dx, 0x52bd
setns dl
jl 0x140475d4b
jb fcn.1403f420c
jg 0x14070c280
pushfq
cmp r9b, 0x3c
jae 0x14004a964
push rbx
mov rax, qword [rsp + 0x30]
call fcn.14063508f
jg 0x1405102a9

Function at 0x140592c57
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffac29d615
call fcn.14068fb42

Function at 0x140592c61
Capabilities:
Packed with generic packer

Disassembly:
xor word [rsp + 0x50], r15w
mov qword [rsp + 0x40], r10
push rsi
xchg qword [rsp + 0x88], rcx
mov r15, qword [rsp + 0x50]
shl r12b, 0x86
mov rsi, qword [rsp + 0x48]
movzx rsi, word [rsp + 0x48]
neg word [rsp + rsi - 0x1f4c]
movabs r9, 0x4bbfd5ad4a34ef94
movabs rbx, 0xb3b7609c6780d90d

Function at 0x140599530
Capabilities:
Packed with generic packer

Disassembly:
ja fcn.14047300b
mov r10, r12
not r12
Function at 0x14059bffe
Capabilities:
Packed with generic packer

Disassembly:
test r15d, r15d
lea rax, [rax + r15*8 + 0x44243d0a]
not r15
jne 0x1406f4435
mov qword [rsp + r15 + 9], r15
jg 0x14040a902
sub r15w, 0x5f00
xchg qword [rsp + r15 + 0x5f21], rax
mov r15, qword [rsp + r15*8 + 0x2f820]
sub dword [rsp + 8], 0xdf9b908e
add qword [rsp], 0xffffffffbfca0c4e
xor dword [rsp + 8], 0xaba44a2a
call fcn.1403f60fa
mov rax, qword [rsp + 8]
mov rax, qword [rax]
movzx r15d, r15b
setle r15b
jbe 0x14040be81
jb 0x1404e93c4
ja 0x14052ec85
xchg edx, eax
repne stosd dword [rdi], eax
enter 0xffffffffffff86c6, 0x20
out 0xfb, al
out 0x1e, eax
jmp 0x170cb08dd

Function at 0x1405a8a10
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1404bb2c1
call fcn.1403c738f
add eax, 0xdbcc7067
xchg dword [rax], ebx
xchg esp, eax
cmpsb byte [rsi], byte [rdi]
loopne 0x14057bad1
or dl, bh
sub esp, dword [rdx + 0x66]
jle 0x14057ba79
invalid
movabs dword [0x51cff5712b379383], eax
ror dword [rbp + 0x4d0d01ed], 0x56
imul rbx, qword [r8 - 0x72], 0xffffffffbf0ee20c
invalid
jno 0x14057ba70
iretd
cld
wait
ret 0x4b61
jb 0x14057ba57
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1405c451b
Capabilities:
Encode data using base64

Disassembly:
call fcn.1404bb05d
and al, 0x10
cmovge r8w, bx
jg 0x140720736
xchg byte [rdi + 0xa], dl
test eax, 0x130fd618
jbe 0x1405c44e6
invalid
jno 0x1404270c4
call 0x140560cce
jne 0x1403e256a
invalid

Function at 0x1405c710e
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x20]
call 0x14069bcda

Function at 0x1405c711e
Capabilities:
Packed with generic packer

Disassembly:
js 0x1406a1480
setae r11b
jbe 0x1403f6cc3
movabs byte [0x6d80fd1cf47df322], al
movabs byte [0x7a76fcfe3e925a68], al
xchg edx, eax
jrcxz 0x1405c71b8
xchg edx, eax
xchg ecx, eax
xchg esi, eax
mov eax, 0x7344bb6d
movabs al, byte [0xd67e92481f6de86d]
mov byte [rdi + 0x1b869279], ah
pop rbp
xchg edx, eax
and eax, 0x6d8fdb5b
invalid
mul dword [rsi]
invalid

Function at 0x1405c9fef
Capabilities:
Packed with generic packer

Disassembly:
call fcn.14068e890
jle 0x1408994fa
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140848552
mov al, 0x60
mov word [rbx], cs
pop qword [rbx]
scasd eax, dword [rdi]
pop rax
push rbp
pushfq
movabs rbp, 0x648d0e28f98803a7
cmp bp, 0x398
push r13
call fcn.1404f0d61
fild dword [rcx - 0x66]
invalid

Function at 0x1405df0cb
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffbfac10ec
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]

Function at 0x1405df120
Capabilities:
Packed with generic packer

Disassembly:
push rsi
movzx di, dil
call fcn.1405b1ce2
mov ch, 0x51
sub ch, byte [rsi]
invalid
sub qword [rsp + 0x30], rbp
movabs r10, 0xff981f2e5bb6110c
xchg qword [rsp + 0x38], rsi
mov rbp, qword [rsp + 0x20]
ja 0x14069d7fe
and ebp, dword [rsp + 0x11]
jb 0x14047178d
test byte [rsp + rbp*2 - 0x202007f0], 0x9c
lea rbp, [rbp + rbp*8 - 0x5cb45c2]
lea rsi, [rsi - 0x59dbb051]
mov qword [rsp + 0x10], 0xffffffffb38c0a2f
mov word [rsp + 0x10], 0x889
push r10
jne 0x1405a89f1
xor r10d, r10d
bswap r10d
pop r10
jno 0x1405c0715
seta dil
Function at 0x1405e9ab6
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
or word [rsp + r13 - 0x5db0c208], 0x3c1c
lea rax, [rax - 0x3ce3dbda]
js 0x14062374f
jge 0x1403fc6e6

Function at 0x1405eec3e
Capabilities:
Packed with generic packer

Disassembly:
lea rdx, [rdx + 1]
not r11d
push rdi
movabs rdi, 0x4b1e51a82291d6a0
test edi, edi
push rdx
push rsi
movzx r11, r8b

Function at 0x1405ff2d7
Capabilities:
Write file on windows

Disassembly:
and r14b, 0x8d
or bpl, r14b
mov qword [rsp + rbp - 0xcd], rdi
not dil
lea rdx, [rdx + rdi*2 + 0x759485a2]
bswap rdi
jbe 0x14040dc02
shr qword [rsp + r14 - 0x1800c27d], 0x28
seta byte [rsp + rbp*4 - 0x3e4]
jbe 0x1405659e3
call fcn.1403e67b6
cdq
xchg esp, eax
invalid
jbe 0x14041aa45

Function at 0x140603d26
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov r15w, di
jl 0x14065f427
neg r15
jb 0x1403e258c

Function at 0x140610c8b
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x10]
call fcn.140560e0d
je 0x140351cea
movabs r15, 0xf01f2f9e22036a07
call fcn.14059348a
lahf
jle 0x140610cba
and eax, 0xa5676c4f
invalid
popfq
cmp dword [rdx], ecx
out 0x9d, al
add eax, 0x69ffc468
std
lahf
stc
invalid

Function at 0x1406145fb
Capabilities:
Read file on windows

Disassembly:
lea rcx, [rcx + 1]
push 0xffffffff840b8b86

Function at 0x140616108
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffffe36fed
mov r15d, 0x8b10e99e
mov rbx, r15
cmp r15d, 0x7fa86833
mov r12, r15
mov rbx, qword [rsp]
mov rbx, qword [rbx]
mov qword [rsp], r9
jno 0x1403be686
test word [rsp + r9 - 0x5ad50069], r12w
push r11
lea rbx, [rbx - 0x74f7c074]
jg 0x14064b021
int3
add r12w, word [rsp + 0xa]
mov r11, r9
xchg qword [rsp + 0x30], rbx
mov r15, qword [rsp + r9 - 0x5ad50054]
call fcn.1406286f1

Function at 0x14061a803
Capabilities:
Packed with generic packer

Disassembly:
movabs rax, 0xde83ba265301a3a6
mov esi, 0x3a931fbc
add ax, 0x51ab
setl al
movzx ax, sil
jge 0x140516f31
mov rax, qword [rsp + rsi*2 - 0x75263f60]
mov rax, qword [rax + rsi*2 - 0x75263f78]
je 0x1404fb7ee
sets sil
jge 0x140031d93
mov qword [rsp + rsi*2 - 0x75263dea], rsi
test word [rsp + rsi*2 - 0x75263de7], si
movzx si, sil
lea rax, [rax + rsi - 0x73def272]
ja 0x14067512f
and dword [rdi + rcx + 0x5a8c887], ecx
add al, ch
invalid
call fcn.1404cd047
mov r12, qword gs:[rdi + r11]
mov ebx, 0xd9a99716
jrcxz 0x14061a8bb
push rsp
pop rax
and ch, ch
cdq
mul dword [rax]
sal dword [0xe7488b71], cl
adc dword [rbx], 0x4b08b13c
invalid
out 0x80, al
push rsp
sbb dword [rbx + 0x57401cab], esi
scasb al, byte [rdi]
jp 0x14061a85f
xor eax, 0x675a0a6d
invalid
Function at 0x1406269cd
Capabilities:
Write file on windows

Disassembly:
or eax, 0xffffffff
jmp 0x14006e0ef
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14006dfda
test sil, sil
je 0x14006dfbc
dec sil
cmp sil, 1
ja 0x14006e076
lea r12, [rdi + r14]
mov qword [rbp - 0x30], rbx
mov r14, rdi
cmp rdi, r12
jae 0x14006e06c
mov esi, dword [rbp - 0x2c]
movzx eax, word [r14]
movzx ecx, ax
mov word [rbp - 0x10], ax
call fcn.14007ab04
movzx ecx, word [rbp - 0x10]
cmp ax, cx
jne 0x14006dfae
add esi, 2
mov dword [rbp - 0x2c], esi
cmp cx, 0xa
jne 0x14006df9f
mov ecx, recv
call fcn.14007ab04
mov ecx, recv
cmp ax, cx
jne 0x14006dfae
inc esi
mov dword [rbp - 0x2c], esi
inc ebx
add r14, 2
cmp r14, r12
jae 0x14006e06c
jmp 0x14006df5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
jmp 0x14006e06c
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006d4bc
movsd xmm0, qword [rax]
mov ebx, dword [rax + 8]
jmp 0x14006e071
lea rax, [0x1403473e0]
mov rcx, qword [rax + r13*8]
cmp byte [rcx + r15*8 + 0x38], bl
jge 0x14006e039
mov ecx, esi
test sil, sil
je 0x14006e025
sub ecx, 1
je 0x14006e011
cmp ecx, 1
jne 0x14006e076
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006daac
jmp 0x14006dfce
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006dbc8
jmp 0x14006dfce
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006d9a8
jmp 0x14006dfce
mov rcx, qword [rcx + r15*8 + 0x28]
lea r9, [rbp - 0x2c]
xor eax, eax
mov r8d, r14d
and qword [rsp + 0x20], rax
mov rdx, rdi
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006e069
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
mov ebx, dword [rbp - 0x28]
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbp - 0x20], xmm0
mov rax, qword [rbp - 0x20]
shr rax, 0x20
test eax, eax
jne 0x14006e0e6
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x14006e0b6
cmp eax, 5
jne 0x14006e0a9
call fcn.140060edc
mov dword [rax], 9
call fcn.140060ebc
mov dword [rax], 5
jmp 0x14006de6b
mov ecx, dword [rbp - 0x20]
call fcn.140060e6c
jmp 0x14006de6b
lea rax, [0x1403473e0]
mov rax, qword [rax + r13*8]
test byte [rax + r15*8 + 0x38], 0x40
je 0x14006e0ce
cmp byte [rdi], 0x1a
je 0x14006e0ed
call fcn.140060edc
mov dword [rax], 0x1c
call fcn.140060ebc
and dword [rax], 0
jmp 0x14006de6b
mov eax, dword [rbp - 0x1c]
sub eax, ebx
jmp 0x14006e0ef
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
and r10d, 0x7b838e32
shr rbp, 0xec
xchg qword [rsp + r10 - 0x7b838598], rax
mov r12, qword [rsp + 0x58]
jne 0x1407180de
shl r10d, 0x74
shl r10, 0x10
mov rbp, qword [rsp + 0x30]
lea r10, [r10*8 + 0x4532ef13]
jb fcn.14049e204
js 0x14006df24

Function at 0x14063835b
Capabilities:
Packed with generic packer

Disassembly:
add r14w, 0x3f0e
lea r14, [r14*8 - 0x37f02e42]
sub r14w, r14w
shl qword [rsp + 0x28], 0xae
setns r14b
mov r14, qword [rsp + 0x70]
mov dword [rsp + 0x28], 0x1e373a0a
add qword [rsp + 0x40], 0xffffffffbf90035a
call fcn.140369663
jae 0x1405f6d58
Function at 0x1406383b6
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs r13, 0xdd813b85c12f6b08
push r8
movabs r8, 0x161bce278f2e8182
not r8w
movsx r8d, r8b
shr r13b, 0xb1
or r8, 0xffffffff808a218c
mov qword [rsp + 0x28], rax
jbe 0x1405d67ef
test r8b, r13b
not r13d
add qword [rsp + 0x20], 0xffffffffffc27317
shr r8w, 0x7c
mov rax, r8
not r13d
or r13d, 0xa7a21039
add r13b, r8b
movzx eax, r13b
mov rax, qword [rsp + rax - 0x19]
mov rax, qword [rax + r8 + 0x7f760000]
shl r8d, 0xfd
call fcn.14000acdf
invalid

Function at 0x140646e58
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
setle bl
lea rbx, [rbx + rbx*2 + 0x770dccae]
bswap rbx
mov rbx, qword [rsp + 0x50]
jae fcn.1405c6c04
jne 0x1406fe61a
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x5748517f
mov r15, qword [rsp + 8]
jns 0x140684f3f
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
ret

Function at 0x140651fa8
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], rbp
pushfq
add qword [rsp + 0x10], 0xffffffffbfa2c1b5
add qword [rsp + 8], 0xcd7fa
movabs rbp, 0x711c2592d302d40f
neg rbp
movsx rbp, bpl
not bpl
add ebp, 0xd6969f87
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
call fcn.140422f17

Function at 0x14065403f
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push r12
lea rcx, [rcx + r8 - 0x8140437]
not r8
bswap r8
movabs r12, 0xdf0f5db0dbb16f2f
shr r8b, 0xa7
jb 0x1406d35fe

Function at 0x140655978
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
je 0x140567872
test dword [rsp + 8], ebx
push rbx
xchg qword [rsp + 0x40], rdi
mov r12, qword [rsp + 0x38]
jbe 0x1405d626a
je 0x1406e43fc
jns 0x1405c432e

Function at 0x1406569a4
Capabilities:
Packed with generic packer

Disassembly:
cmp dl, bpl
push r8
movabs r9, 0xd3a46fa89b2a29b1

Function at 0x14065ef02
Capabilities:
Encode data using xor

Disassembly:
add word [rsp + 0x58], 0xf581
jge 0x14054f61b

Function at 0x14065fd63
Capabilities:
Encode data using xor

Disassembly:
popfq
lea rsp, [rsp + 0x68]
ret
shr qword [rsp + 0x10], 0x29
call fcn.140421d6c
or al, 0x1c
invalid
add qword [rsp], 0x33586f
mov qword [rsp + 0x40], rdi
push rdi
cmp r8w, 0x7e3b
movabs rsi, 0x43a6230482926db4
js 0x1405ca6dd
nop
shl esi, 0x93
movabs rdi, 0x8081ec3ade14fb36
cmp rdi, 0x2fb25f34
jno 0x14045ac32
mov rax, qword [0x1403877c8]
add r10b, 0x8c
btc r10, 0xc
mov r10, rcx
inc cx
sar ch, 0x30
mov rcx, qword [rax + 0x58]
test rcx, rcx
jmp 0x1403c07ef
sub r12d, dword [rsp + 0x34]
mov r12, qword [rsp + 0x38]
call fcn.140439f1f
or dword [rsp + 0x18], ebp
setle r13b
add word [rsp + rbx - 0x75a57d3b], 0x6537
xor r13d, ebx
lea rbx, [r13 + r13*8 + 0x582cf212]
jb 0x140578b9c
mov r13, qword [rsp + 0x38]
ja 0x1405ad328
or dword [rbp + 0x7d], eax
cwde
add byte [rbx], dh
pushfq
jo 0x14060e9d1
push rdx
adc dl, byte [rdx]
mov bh, 0x77
invalid
jle 0x14060e9e3
movabs r8, 0x37b111b09dad8a16
jle 0x1406f239b
jne 0x1405af3b0
Function at 0x14066b155
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header
Set socket configuration

Disassembly:
mov byte [rsp + 0x28], 0x32
jns 0x1406d6501
shl word [rsp + 0x28], 0x6d
xor dword [rsp + 0x28], 0xab3a1c12
add word [rsp + 0x28], 0x8716
push qword [rsp + 0x40]

Function at 0x14067bb5e
Capabilities:
Encode data using base64

Disassembly:
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407c955e
pushfq
add qword [rsp + 8], 0xffffffffbf75f5bf
push 0x2c330e09
push rbx
mov qword [rsp + 0x18], 0xffffffffa3c30578
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14084c046
movabs r13, 0xa811f6b71829d097
not r13w
pushfq
add r13, 0x692ddc0b
neg r13
jne 0x140709d57
test r13b, r13b
mov r13, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x60c62b35
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407d1649
jl 0x1403fc67b

Function at 0x14067c5a9
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x28]
call fcn.1407cde16

Function at 0x14067efa7
Capabilities:
Packed with generic packer

Disassembly:
and rax, 0x7eb3f409
shl r8b, 0xa3
add al, 0x39
add bp, 0xbf04
push rdi
mov rax, qword [rsp + rbp - 0x7d49d670]
mov rax, qword [rax + rbp - 0x7d49d680]
or bpl, 0x82
ja 0x1403ecb0d

Function at 0x14067f3ae
Capabilities:
Encode data using xor

Disassembly:
push r8
call fcn.1405e6df4
movabs eax, dword [0x808b353383f0933b]
invalid

Function at 0x14068c87a
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + rbp - 0x76b3daf1], 0xffffffffbfb82e31
neg dword [rsp + rbp - 0x76b3dac9]
not qword [rsp + rbp - 0x76b3dac9]
and bp, 0x682d
jo 0x140351198
cmovns ebp, dword [rsp + rbp - 0x76b347b0]
mov rbp, qword [rsp + rbp*8 + 0x88]
neg word [rsp + 0x40]
call fcn.14056001c

Function at 0x14069e730
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [rcx - 0x57557b74]
bswap r10d
and qword [rsp + r10 - 0x7348073d], r12
cmovl r11w, word [rsp + 0xb]
lea r12, [r11*2 - 0x1c518e52]
test dword [rsp + 0x48], 0x6d13c83d
bswap r10
xchg qword [rsp + 0x60], rcx
mov r13, qword [rsp + 0x18]
jno 0x1405a58b6
nop
invalid

Function at 0x1406a13dc
Capabilities:
Packed with generic packer

Disassembly:
xor r14d, 0xf833f580
neg r14w
setle r10b
mov r14, qword [rsp + 0x38]
cmp word [rsp + r10*2 + 0x2f834c20], r10w
push qword [rsp + r10*2 + 0x2f834c10]
popfq
mov r10, qword [rsp + r10*2 + 0x2f834c08]
lea rsp, [rsp + 0x18]
ret 0x10
jne 0x14040a870
add qword [rsp], 0xffffffffbfca39db
lea rsi, [rsi + rdx*2 - 0x7215b4f8]
and edx, 0xf0a5d3ac
shr bpl, 0x10
or r11b, 0x94
neg di
add rdx, r11
mov dx, 0xeb38
sets dil
lea rbp, [rbp*4 + 0x1a924e9f]
xchg qword [rsp + 0x58], rsi
mov rdi, qword [rsp + 0x28]
xor ebp, 0x600245b9
shr bp, 0xc7
not ebp
add qword [rsp + 8], 0xffffffffbfa3c3fb
mov r11b, dl
sub ebp, ebp
mov r11b, bpl
mov r11, qword [rsp + 0x48]
bswap rbp
lea rdx, [rdx + rbp*2 - 0x2bff9cca]
test edx, ebp
movabs rbp, 0x64106ea52f1ef9af
lea rdx, [rdx + rbp + 0x2ba2e719]
mov rbp, qword [rsp + 0x38]
jb 0x14058f86c
not rdx
shl dx, 0xef
Function at 0x1406b670a
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.140848552

Function at 0x1406d5e77
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
not r11
call 0x140707ae6
mov rdx, r10
jb 0x1406fd31b

Function at 0x1406d64e2
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rcx
push r12
movabs r12, 0x7190930bb20b38b9
neg r9
xor r9d, r12d
lea r9, [r12 - 0x53599cec]
add qword [rsp + 8], 0xffffffffffcf0d51
or r12w, 0x1a2b
js 0x1403e24f1

Function at 0x1406e1e5c
Capabilities:
Authenticate hmac

Disassembly:
xor byte [rsp + r14*4 - 0x63d8], r14b
bswap r14d
xchg qword [rsp + r14 - 0x18ffb0], rbx
mov r14, qword [rsp + r14*8 - 0xc7ffd0]
sub rbp, 0x58190aa1
call fcn.14066d618
js 0x14065363f

Function at 0x1406e1e62
Capabilities:
Authenticate hmac

Disassembly:
push r11
movsx r10w, r10b
mov rdi, r10
not r10b
movabs r11, 0xa0b9a50f59109c03
mov r10, qword [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov rcx, r11
or cx, 0x1d13
push rdi
push r8
mov r8, rcx
add qword [rsp + 0x18], 0xffffffffffa91806
movabs rsi, 0xdbb5c43b0f172507
shl rcx, 0xb0
jns 0x1406cf9f3
not r8
jns 0x140350aff
push rcx
mov rsi, qword [rsp + 0x20]
mov rsi, qword [rsi]
mov qword [rsp + 0x20], rcx
test r8w, r11w
jb 0x14040517a
or r8, 0xfffffffffb80a88b
setle byte [rsp + r8 + 0x101531]
lea rsi, [rsi - 0x3ce3dbda]
jg 0x14065937c
push r14

Function at 0x1406e6b01
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rax + 0x12], ah
invalid
xchg esi, eax
movabs eax, dword [0x4786f16f045c2759]
int1
xchg byte [rdi + 0x44], al
or r10b, byte [rsp + 0xa]
or r10b, byte [rsp + 0xa]
add qword [rsp], 0xffffffffbf9aa8e3
and si, si
xor word [rsp + rsi - 0x76b022ae], r10w
mov r10, qword [rsp + rsi - 0x76b02286]
mov qword [rsp + 0x30], rax
call fcn.1405a6af8
mov esi, dword [rcx]
sar dword [rbp + 0x19], 0xf2
xchg edi, eax
insd dword [rdi], dx
cmc
in al, dx
mov bh, 0x6d
cmc
jns 0x1406e6af7
insd dword [rdi], dx
sti
jne 0x1406e6b4e
jne 0x1406e6ad6
pop rax
invalid
and eax, 0xb43dbbdd
insd dword [rdi], dx
mov ch, 0x81
nop
insd dword [rdi], dx
jo 0x1406e6b9c
xchg edx, eax
jne 0x1406e6b23
mov edx, 0x2b924299
fist dword [rdi + 0x2656da0]
jp 0x1406e6afe
mov dword [rax - 0x6da5e325], edx
imul ecx, dword [rcx + 0x29e69254], 0xf56d98fc
stosd dword [rdi], eax
sbb dword [rax + 0x75c2876d], eax
push 0xffffffffbfa0a192
int 0x59
xchg edx, eax
invalid
retf

Function at 0x1406f9102
Capabilities:
Encode data using xor

Disassembly:
push r12
push r12
call fcn.140495571
fdivr st(4), st(0)
push rcx
js 0x1405efe8c
invalid
movabs al, byte [0xfb3fd07facce26e5]
in eax, dx
movd dword [rdi + riz*4 + 0x59], mm1
xchg edx, eax
rcl ecx, cl
xor al, 0x42
fiadd word [rsi + 0x433f47f4]
cmp byte [rbp + 0xc3e0b78], dil
mov al, 0xf1
in al, dx
and ch, byte [rdx]
sub byte [rbx + 0x5cfe0d33], dh
nop
mov eax, 0x1924d456
sbb al, 0x67
add dword [rbx + 0x1a], edx
rcl al, 0xe2
push rdi
and eax, eax
mov ch, 0x6d
invalid
or r8d, 0x5f2c900e
mov rbx, qword [rsp + 0x38]
shr r8w, 0x49
mov r14, r8
push r12
movabs r12, 0xad2ae423afb55aa9
push r8
lea rbx, [rbx + 1]
test r8w, 0x388e
jne 0x1405efe73
xchg esp, eax
invalid
Function at 0x1406fb53b
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs r13, 0xfd260e14cc80b092
movabs r8, 0x179c9aa051bf9030
call fcn.14054e244
xor r14, r10
js fcn.140577d84
mov rdi, qword [rsp + rdi*2 - 0xfa4]
shl dword [rsp], 0x29
xor r10, r10
jb 0x1403d69f2
neg word [rsp + 0x50]
sub r10w, r10w
call fcn.1407106a9
push rdx
xchg qword [rsp + rsi*2 - 0x440fff70], rbp
mov rsi, qword [rsp + rsi - 0x2207ffc8]
jo 0x1404abff2
jns 0x1406b09fc
clc
mov ecx, 0x82c3cea0
push 0x1a
test ah, ah
xchg esi, eax
invalid

Function at 0x1406fdedc
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], 0xffffffff9ed5e932
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.14073ff2a

Function at 0x1406fdef4
Capabilities:
Enumerate processes

Disassembly:
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x14000139a
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x4c]
mov rax, rdi
sub r8, rdi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001383
inc rax
test ecx, ecx
jne 0x140001370
mov rcx, rbx
test edx, edx
je 0x1400013c6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140001360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140052a40
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400013a5
mov qword [rsp + 0x20], 0x2024f035
xor dword [rsp + 0x40], 0x46bb7b88
lea rbx, [rbx - 0x63cdd8dd]
and word [rsp + 0x40], 0xe41c
jo 0x140001348
jle 0x14049d2b2
push rdi
xchg qword [rsp + 0x50], rbx
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
jg 0x1407074d3
sub byte [rsp + 0x40], 0x2c
sub word [rsp + 0x18], 0x6e14
mov byte [rsp + 0x40], 0xa
jne 0x1406116f2

Function at 0x140702c26
Capabilities:
Packed with generic packer

Disassembly:
mov r9, qword [rsp + 0x18]
cmp dword [rsp + 0x28], ebx
call fcn.14058be7b

Function at 0x140702c88
Capabilities:
Packed with generic packer

Disassembly:
and r12b, r14b
neg r8
xchg qword [rsp + r12*2 - 0x19e], rbx
mov r12, qword [rsp + 0x18]
call fcn.1403ec079

Function at 0x140707ae6
Capabilities:
Packed with generic packer

Disassembly:
add cx, bx
mov rbx, qword [rsp + 0x60]
jge 0x14064384e
sub eax, 0x80a47da5
cmp cl, byte [rdx - 0x3d0372f1]
loop 0x140707ae5
dec dword [rdi]
xchg dword [0x1297067da], edx
and dword [rdi + rcx*8 + 0x7c8b4cff], ebx
and al, 0x10

Function at 0x140707b35
Capabilities:
Set socket configuration

Disassembly:
lea r12, [r12 + r13 - 0x1fea721]
setno byte [rsp + 0x28]
xchg qword [rsp + 0x38], rcx
mov r13, qword [rsp + 0x18]
lea r12, [r12 + r12 + 0x5fa59491]
or qword [rsp + 0x28], 0x7721ec04
call fcn.1405ceaf2