joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801fc697
Capabilities:
Encode data using base64

Disassembly:
jbe 0x1802bd73e
xor r9w, r15w
or r9, r9
add r9, 0xffffffff9288778d
or sil, r15b
mov rbp, qword [rsp + 0x40]
not word [rsp + r15*2 - 0x21f4]
xor esi, 0x4d0a1c28
and si, word [rsp + 0x33]
jle 0x180127670
mov r9, qword [rsp + r15*2 - 0x21fc]
jbe 0x1801eda73
add qword [rsp + r15 - 0x10f2], 0x7fce18ee
call fcn.1802e508c

Function at 0x1801ffa13
Capabilities:
Encode data using xor

Disassembly:
jle 0x1801c7fd9
seta r8b
push rdx
mov rcx, qword [rsp + 0x40]
push 0x41f9f82
jns 0x1801a18ad
je 0x1801a18b4
adc al, ch
mov dword [rcx + rcx], 0x489c5700
push rdi
pushfq
movabs rdi, 0x1399edb74c3015b7
cmp di, 0x1b87
jl 0x1802955ca
or r8b, 0x8d
mov rcx, qword [rsp + 0x30]
or r8b, 0x8d
mov rcx, qword [rsp + 0x30]
and al, 0x30
mov rcx, qword [rcx]
movabs rdi, 0x159b5f99ad912130
call fcn.18012fcd9
adc eax, 0x52e70579
push rsi
jo 0x1801a193c
jle 0x1801a1901
jno 0x1801a188e
xchg ebx, eax
sbb byte [rdi], ah
fcomp qword [rdi + 0x2f]
in eax, 0x48
sbb byte [rcx], dh
movsd dword [rdi], dword [rsi]
cmp esi, edi
vpor ymm2, ymm4, ymmword [rdx]
stosb byte [rdi], al
fist dword [rdi - 0x6463a8c8]
xchg edi, eax
cmp eax, 0x70f8d29e
mov ch, 0xee
out dx, eax
push rbx
fnsave dword [rcx + 0x47]
cmpsb byte [rsi], byte [rdi]
in eax, 0x9d
fldcw word cs:[rbp - 0x23]
invalid
frstor dword [rdx - 0xa]
invalid
invalid
shl byte [rsp + 8], 0x85
jb 0x1801c3135
ja 0x18013c300
mov qword [rsp + 8], 0x61811d9f
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
ret
mov r13, qword [rsp + r9 - 0x46e497ed]
xchg qword [rsp + r9 - 0x46e497dd], rcx
mov r13, qword [rsp + 8]
test byte [rsp + r9 - 0x46e497e7], r9b
js 0x180127334
not edi
shr dil, 0x10
call fcn.18028ba03
rcl dword [rcx - 0x3c], 0x68
adc eax, 0x2aa10edd
sub ecx, 0x1f0a1efb
sbb ecx, dword [rbx + rdx - 0x32bcd078]
pop rsp
xor byte [0x1db0d013b], cl
mov ecx, ecx
ja 0x1801ffa58
outsd dx, dword ss:[rsi]
invalid

Function at 0x180200f2d
Capabilities:
Packed with generic packer

Disassembly:
add rbx, r15
mov rsi, qword [rsp + r8 - 0x177420a0]
mov rsi, qword [rsi + r8 - 0x177420d8]
or ebx, r8d
or ebx, 0xa28e43a
or qword [rsp + 8], r15
sub bx, bx
je 0x18028e5f6
and r8w, word [rsp + 0x1a]
je fcn.1802d0509
lea rsi, [rsi + r8 - 0x2de45857]
call fcn.18024ca89

Function at 0x180200f66
Capabilities:
Packed with generic packer

Disassembly:
mov r9, qword [rsp + r9 - 0x70]
neg word [rsp + 0x48]
jb 0x1801b3663
jae 0x180200ff4
sub dword [rbx], eax
xchg ebx, eax
adc dword [rcx - 0x55], eax
mov ebx, 0x2b7be9b9
mov cl, 0xe1
rol dword [rbx - 0xf], cl
invalid
and eax, 0x2537cf66
retf

Function at 0x180203155
Capabilities:
Encode data using base64

Disassembly:
xor cx, 0x6e29
lea rbx, [rbx + 1]
lea rcx, [rcx*4 + 0x53a6f48c]
and cx, cx
shl cl, cl
jne 0x180235ba0
call fcn.18026c208
Function at 0x180206286
Capabilities:
Packed with generic packer

Disassembly:
mov rcx, rsi
sub r10w, r12w
shr byte [rsp + rcx - 0xc5e5], cl
movabs r15, 0x2923fe22c335950a
jns 0x18029c697
popfq
invalid
movabs rdx, 0x87ab3c9c2909d1a9
push rdx
neg r10w
push r9
shr rdx, 0xec
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], r10
push rcx
movabs r9, 0xc11bf6374bb1d71e
shl r14d, 0x93
sete byte [rsp + 0x10]
mov esi, dword [rsp + 0x3a]
lea rdx, [rdx - 0x8d72d50]
push r8
test r10d, 0xb69b2026
jno 0x180239815
setns r14b
push r15
cmp r10b, byte [rsp + 0x23]
xchg qword [rsp + 0x70], rdx
mov r9, qword [rsp + 0x18]
setge r14b
jno 0x1801cbdb2
jne 0x1802499c0
lea r12, [r10*4 + 0x6517bd15]
mov rsi, qword [rsp + 0x68]
shr cl, cl
test qword [rsp + 0x30], 0x34a1603c
cmovno r14d, r10d
mov r8, r14
lea r8, [r12 + r12*4 + 0x30ba8b0e]
mov rcx, qword [rsp + rcx - 0xc5f0]

Function at 0x18020a748
Capabilities:
Encode data using base64

Disassembly:
push r10
push rdx
pushfq
movabs rdx, 0xb38f322ea8869790
and dl, 0x80
mov rax, qword [rsp + 0x30]
xor dl, dh
call fcn.18029e737

Function at 0x18020a765
Capabilities:
Encode data using base64

Disassembly:
pushfq
movabs rdx, 0x6a862481b8b37b97
xor dx, 0xc895
shl edx, 0xd
push r10
mov qword [rsp + 0x20], 0xffffffff857087d8
mov rdx, qword [rsp + rdx - 0x76603fe8]
call fcn.180249972

Function at 0x18020a790
Capabilities:
Encode data using base64

Disassembly:
js 0x180239ea3
call fcn.18030d4f6
or word [rsp + 0x18], 0x8e31
test byte [rsp + 0x20], 0
call fcn.180127825

Function at 0x18020e2e0
Capabilities:
Encode data using base64

Disassembly:
movabs r14, 0x8d23eb0f4e9d943b
call fcn.180227c1d
shr byte [rsp + r12*4 - 0x7e0], 9
mov r8d, 0xdda82604
js 0x1802adc15
setns byte [rsp + r12*4 - 0x7e0]
mov r15, qword [rsp + 8]
test qword [rsp + 0x20], r8
jae 0x1801e77f0
adc dword [rax + 0x16234603], ebp
invalid
shr byte [rsp + 0x60], 0x7b
or r12b, r8b
neg word [rsp + 0x60]
jno 0x1802c86ba
Function at 0x180210d20
Capabilities:
Packed with generic packer

Disassembly:
cmp word [rsp + rcx - 0x1e], 0xf693
not word [rsp + rcx*2 - 0x64]
push rbp
mov rbp, r11
xchg qword [rsp + 0x48], rdx
mov rbp, qword [rsp]
movsx ecx, word [rsp + 0x23]
movsx r11, byte [rsp + 0x28]
jl 0x1802efeaa
mov rcx, qword [rsp + 0x38]
sub r8w, 0x511
shl r8b, 0x7b
sub r8b, 0xaa
jb 0x1802dc0cc
push r14
movabs r14, 0x3b23680236aff88b
pushfq
and r14b, 0x29
push r8
push r9
mov qword [rsp + 0x20], 0x6fd9cc39
mov r14, qword [rsp + 0x18]
movabs r8, 0xa713a0a8798eafb3
jae 0x1802cdcb1
or rsi, 0xffffffffeb936288
setno r10b
call fcn.1802e9d7b
add qword [rsp + r12 - 0x31ffffd0], 0x7fd32250
movabs r12, 0xc4ad6f8f0085bd8b
or r11w, 0x851d
lea rsi, [rsi + 0x3d05269e]
mov qword [rsp + 0x20], rbx
push r11
movsx r12w, byte [rsp + 2]
push r14
lea r12, [r12*2 + 0x7f8f5826]
jle 0x1801b6fff
shr word [rsp + 8], 0xe1
setle byte [rsp + 0x30]
xchg qword [rsp + 0x50], rsi
mov r11, qword [rsp + 0x20]
shr byte [rsp + 8], 0xce
mov r14, r12
and qword [rsp + 8], 0xffffffffb9bc2f21
not dword [rsp + 8]
and ebx, ebx
mov rbx, qword [rsp + 0x48]
add r12b, r12b
neg r14d
neg word [rsp + 8]
cmp r14, qword [rsp + 8]
call fcn.1802edbbd
push r13
js fcn.180313d7f
xchg qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0x58]
mov r14d, 0x1a9212b5
add qword [rsp + 0x28], 0xfffffffffff3942f
test word [rsp + r14*2 - 0x3524251a], r14w
js 0x18031c104
cmp r14d, 0xa12b1a0f
mov r13, r10
mov r13, qword [rsp]
lea r14, [r10 + r10*8 - 0x4ecba775]
je 0x18026bca8
cmp r10d, r14d
cmove r10w, word [rsp + 0x53]
neg r14w
call fcn.180248f44
mov rdi, qword [rsp + rdi + 0x72f1f8a2]
ja 0x18031ba2d
push rsi
mov qword [rsp], 0x2fdbbb2e
call fcn.180324dee
jle 0x1801e4ef7
mov qword [rsp + 0x10], r8
test byte [rsp + 0x19], r8b
setle byte [rsp + 0x18]
push r11
mov r11, r8
mov r11d, r8d
lea rdx, [rdx + rcx + 0x62a3614f]
not r8
jne 0x180134bcd
jno 0x180004631
mov rdx, qword [rsp + rdx + 0x10]
mov rdx, qword [rdx]
jae 0x18030f1c9
add qword [rsp + 0x18], 0xffffffffde197e25
test byte [rsp + 0x40], 0x17
jo 0x180315f33
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x60]
ret
mov rdx, qword [rsp + 0x18]
shr dword [rsp + 0x28], 0x6b
add qword [rsp + 0x10], 0x7fd72859
mov word [rsp + 0x28], 0x53b9
sub word [rsp + 0x28], 0x9b22
and dword [rsp + 0x28], 0x6ab37fb0
cmp word [rsp + 0x28], 0xa914
call fcn.18013b3a1
movabs eax, dword [0xc72f12810188b18f]
mov dword [rsp + 0x40], 0xe5bfce1a
call 0x1802a9473
push r9
call fcn.18029e77c

Function at 0x1802186fe
Capabilities:
Encode data using base64

Disassembly:
jo fcn.1802d19c3
jle 0x18021e796
mov r14, qword [rsp + 0x20]
jae 0x180224e16
lea rsp, [rsp + 0x68]
ret 8
Function at 0x18021870a
Capabilities:
Encode data using base64

Disassembly:
movabs rcx, 0x6882c52fa0b8a2aa
call fcn.18029c73a
or eax, 0x15863ca2
mov byte es:[rax + 0x7d978e8], ah
call fcn.1801a7c46
invalid
jbe 0x18012a33e
adc al, byte [rax]
push 0xffffffffffffffee
int3
mov dl, byte [rcx - 0x53]
xor edx, esi
add byte [rdx + rcx*4 + 0x14], al
xor ah, byte [rsp + rbx*4 + 0x47]
enter 0x2ecf, 0xffffffffffffffee
push rsp
xchg edi, eax
jg 0x18012a35c
sub eax, 0xaf037b54
sub bh, byte [rdx]
invalid
cmp al, 0xa
in eax, dx
retf
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], rsi
push rbx
movabs rbx, 0x6695380508bf7d89
call fcn.1802983e7
lea rcx, [rbp + rbp*4 - 0x5def8e1]
mov rdi, r14
test cl, cl
mov r15, qword [rsp + 0x38]
jle 0x1802080b4
mov r10, qword [rsp + rbp*2 - 0x2270000]
or cl, 0xe
call fcn.1802d4096
lea rbx, [rbx + r9 - 0x254cf97a]
or r9d, r12d
jle 0x1802a567c
shr r13b, 0xed
lea r13, [r13*2 - 0x4964424f]
mov rbp, qword [rsp + 0x18]
or r13d, r13d
lea r13, [r13 + r13*8 + 0x3b282906]
shl r13b, 0x85
shl r13d, 0xb6
not r13d
lea rbp, [rbp + 1]
and r13b, 0xaf
movsx r13d, r13b
push r14
ja 0x1802e1b57
shr di, cl
sub cx, di
setb cl
xchg qword [rsp + 0x28], rsi
mov rcx, qword [rsp + 0x10]
add di, 0xf0a8
call fcn.1801f7f56
push rbx
pushfq
movabs rbx, 0x5b5aa395528cfb7
neg bl
mov rbp, qword [rsp + 0x20]
jl 0x18013c3bc
push r15
sub ebx, 0xb89a599d
push 0xffffffff9d3898a8
lea rbx, [rbx*2 + 0x75854b8a]
cmovb bx, word [rsp + 3]
lea rbp, [rbp + 1]
push rbx
mov r15, rbx
and r15, 0xffffffffd003482f
shl r15, 0x21
test byte [rsp + 8], 0x9c
mov qword [rsp + 0x38], rbp
call fcn.18021dd30
jo 0x180130cdb
add qword [rsp + 8], 0x73bf5
shr dword [rsp + r15*8 - 0x71978], 0x5e
movzx r15d, word [rsp + 0x22]
sub r15, 0xffffffff9837cda5
and edx, edx
push r14
mov rcx, qword [rsp + r15 - 0x67c8324b]
mov rcx, qword [rcx + rdx - 0x6b1de333]
shl r15d, 0xeb
mov qword [rsp + r15 - 0x4192d7f0], r15
add qword [rsp + rdx - 0x6b1de30b], r15
mov r14, qword [rsp + r15 - 0x4192d7d8]
shl dl, 9
sub word [rsp + rdx - 0x6b1de2d8], 0x7a3e
push r8
movabs rbp, 0x99815cbbfa98230b
lea rcx, [rcx + 0x1b94b399]
mov r8, rbp
push 0xfffffffff208ab9d
push r10
push rsi
mov rsi, qword [rsp + 0x30]
call fcn.18031e712
setno r9b
jb 0x18023a562
or r9, r9
xchg qword [rsp + 0x40], rbx
mov r9, qword [rsp + 0x38]
not r12
xor r12, qword [rsp + 0x20]
not r12b
test r12d, r12d
mov byte [rsp + 0x20], 8
lea r12, [r12 + r12*4 + 0x42b119b0]
jns fcn.18014f229
shl byte [rsp + 0x20], 0x7e
mov r12, qword [rsp + 0x30]
shr word [rsp + 0x20], 0xd9
not word [rsp + 0x20]
js 0x1802b608b
and byte [rsp + 0x20], 0x20
xor dword [rsp + 0x20], 0x5d0b168f
sub word [rsp + 0x20], 0x4b3a
jge fcn.1802c9188
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
ret
sbb al, 0xb8
scasb al, byte [rdi]
invalid
push r11
mov r11, r13
call fcn.1801e0c1d
jb 0x18012a2b2
call fcn.1802a9abe

Function at 0x180223d50
Capabilities:
Encode data using base64

Disassembly:
push rcx
movabs rcx, 0x6217b299530da10b
movsx rcx, cx
mov rsi, qword [rsi + rcx + 0x5ef5]
movabs rcx, 0x56913fae8b81c1ae
pushfq
or cx, cx
not ecx
lea rcx, [rcx*4 - 0x495e624f]
push rdi
lea rsi, [rsi - 0x655d3343]
mov rdi, rcx
xor cl, 0xa4
jno 0x1802080ef
Function at 0x180230319
Capabilities:
Encode data using base64

Disassembly:
push r12
mov rdx, qword [rsp + 0x28]
shr rsi, 0xe8
movsx esi, sil
mov r12, rsi
movsx r12d, r12w
lea rdx, [rdx + 1]
shl r12b, 0xe5
call fcn.1802dc71c
mov dl, 0x3f
or bh, byte [rax + 0x48f20d1b]
stosb byte [rdi], al
mov edx, 0x82123060
sub byte [rax + 0x68387222], bh
jp 0x18022b966
xor byte [rax + 0x4a], ah
fisub dword [rax + 0x70]
xor ah, byte [rdx + 0x58]
invalid
or al, 0x17
iretd
jno 0x18022b902

Function at 0x18023031f
Capabilities:
Encode data using base64

Disassembly:
cmp dword [rsp + 0x40], 0xd0a55ead
not word [rsp + 0x40]
mov dword [rsp + 0x40], 0xc71abc1a
jo 0x1801c634f

Function at 0x18025162c
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sete byte [rsp + r8*2 - 0x4d9a49d0]
shl dword [rsp + 0x30], 0x2e
mov rcx, qword [rsp + r8 - 0x26cd24e8]

Function at 0x18025164e
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push rbx
test dword [rsp + r15 - 0xdf43], 0x949c25ab
xchg qword [rsp + r15 - 0xdf2b], rax
mov r15, qword [rsp + r15 - 0xdf33]
js 0x18027fbac
jns 0x1802d5297
fadd dword [rbp - 0x4b]
cld
fcom qword [rdi + 0x1c]
retf
movabs rbx, 0x7222a10cbe2b7cb4
jl fcn.1802983d8

Function at 0x180255dba
Capabilities:
Encode data using base64

Disassembly:
jns 0x1802bfc31
shl r14d, 0x5a
or r13w, 0x27af
and rsi, 0xffffffffdd1affa6
or r14w, 0x6238
push r15
xor sil, 0x17
lea rcx, [rcx + 1]
movzx r14w, r14b
push r11
shl r13, 0xb1
movabs r15, 0x22a0d73b38082e96
mov r11, r15
xor r14b, r13b
movzx r14, sil
mov qword [rsp + 0x40], rcx
shl esi, 0xc1
call fcn.180202b33
sub r11b, 0x14
push r10
call fcn.1802165d0

Function at 0x18025ea24
Capabilities:
Encode data using base64

Disassembly:
add dx, word [rsp + 0x32]
add r12, 0x4903728d
neg edx
neg dl
mov rdx, qword [rsp + 0x20]
or r12b, byte [rsp + 0x37]
test dword [rsp + 0x30], 0x6faffd8a
mov word [rsp + 0x30], r12w
ja 0x18028f685
sub r12, r12
mov r12, qword [rsp + r12 + 0x28]
jge 0x1802f0842
setns byte [rsp + 0x30]
call fcn.1802dc0de

Function at 0x180261166
Capabilities:
Packed with generic packer

Disassembly:
test cl, cl
setbe byte [rsp + rcx*2 - 0x1ff26]
add rbx, rbx
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x50], ebx
sub qword [rsp + 0x50], rbx
xor dword [rsp + 0x50], 0x1d2c7c07
js fcn.1802b8157
shr bx, 0x1b
movzx rbx, bx
test word [rsp + rbx*8 + 0x50], 0x6702
je fcn.180200f66
jns 0x18028ee08

Function at 0x18026a201
Capabilities:
Encode data using base64

Disassembly:
test word [rsp + r14 - 0x7fdfd3cb], r14w
setl byte [rsp + r14 - 0x7fdfd3d0]
shr word [rsp + rbp - 0x47da4f6], 0xb2

Function at 0x180278647
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea rsi, [rsi - 0x7dca841]
call fcn.180135599
xchg qword [rsp + 0x18], rax
or r12d, ecx
call fcn.18021edf7
or dword [rcx - 0x55a813d3], esp
pop rdx
adc esi, dword [rbx]
mov eax, 0xf7f3ec5f
jmp 0x179a0a3b1
neg r9b
jns 0x1802c5698
and r8, 0xffffffffbe084a9c
shr r9b, 0x41
mov r9, qword [rsp + 0x28]
jg 0x180274f89
test word [rsp + 0x58], r8w
jne 0x180251642
call fcn.1801321e7
Function at 0x18028b97a
Capabilities:
Encode data using base64

Disassembly:
not eax
sub al, 0xb4
mov rax, qword [rsp + rax*4 - 0x4402e064]
mov rax, qword [rax + r12*2 + 0x220171b0]
call fcn.1802b64dc

Function at 0x18029b0c6
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x40], rcx
mov r10, qword [rsp + 0x10]
neg edi
je 0x180276dc7
shr r13w, 0x14
or bx, bx
jbe 0x1801cb467
sub rbx, rbx
test r13d, edi
mov rbx, qword [rsp + 0x28]
call fcn.180257b31

Function at 0x18029b0f6
Capabilities:
Encode data using base64

Disassembly:
jbe 0x1801273f0
push r10
sub rdx, rdi
jns 0x180315dd0
xchg qword [rsp + 0x68], rbx
mov rdx, qword [rsp + rdx + 0x7b803578]
movabs r10, 0x519b61a79bbfbdac
not rcx
call fcn.1802cdda2

Function at 0x18029e79d
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x7fce1273
cmp word [rsp + 0x50], 0xf486
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret
jo 0x18027cc81
cmp dword [rsp + rdx*8 + 0x50], 0x1e251222
mov rdx, qword [rsp + 0x28]
jo 0x1802c5694
lea rax, [rax + rsi*8 - 0x47]
add qword [rsp + rsi*8 - 0x38], 0xffffffffffedd7fe
neg si
push rsi
shr rsi, 0xc2
mov qword [rsp + rsi*8 - 0x1ffc0], rax
neg rsi
call fcn.18031ceb6
xchg esi, eax
fdivr qword [rcx + 0x16f70536]
or ecx, dword [rax - 0x77]
invalid
invalid
jl 0x18027ccb1
sub al, ch
bnd ret 3
xchg dword [rbx + 0x46], edx
idiv edi
lea r12, [r12*2 - 0x2a5f456e]
bswap r12
mov qword [rsp + 0x10], r12
lea rcx, [rcx + 0x21cd485]
sets r11b
call fcn.1803104b8
mov rax, qword [rsp + 0x10]
push rsi
pushfq
movabs rsi, 0xcfa6cbb49e923da5
shr esi, 0xbc
jns 0x1802282aa
and edx, dword [rsp + 0x1c]
jge 0x18013b4da
shl r11b, 0x1f
js 0x18029b0a6
shr qword [rsp + 0x20], 0x74
cmp byte [rsp + 0x50], r11b
not r11w
mov r11, qword [rsp + 8]
jno 0x180002f15

Function at 0x1802a9701
Capabilities:
Encode data using base64

Disassembly:
push rbp
shl bp, 0x7a
cmp bp, word [rsp + 3]
mov qword [rsp + 0x48], rsi
call fcn.180220f67

Function at 0x1802a9731
Capabilities:
Encode data using base64

Disassembly:
push r11
jae 0x1802cc88a
movabs rdx, 0x883c112ce6a49101
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
movabs r15, 0xf4816f275334d03a
or cl, 0xa8
lea rcx, [r14*2 - 0x1d58b4ee]
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
call fcn.18013678f
push r9
push rbx
jg 0x1801fa1ad
lea rsi, [rsi + rsi - 0x6756b3c7]
call fcn.1802a5605
add qword [rsp + 0x10], 0xfffffffffff3cadc
push r14
shl r12, 0x90
push r15
mov r14, r12
jb 0x1801c7c1b

Function at 0x1802a9761
Capabilities:
Encode data using base64

Disassembly:
not r10d
seto r10b
movabs r12, 0xfc302f8e85888f3c
add qword [rsp + 8], 0x3a33
push rdx
mov rdx, r12
call fcn.1802a0b06
push r12
ja 0x1802835a2
cmp r11d, 0xf196a813
push rbp
push rbx
je fcn.1802b5fc2
add qword [rsp + 0x28], 0x123b07
lea rdx, [rdx + 1]
push r9
mov r9, r11
mov r11, qword [rsp + 0x28]
push qword [rsp + 0x18]
popfq
mov r9, qword [rsp]
lea rsp, [rsp + 0x30]
ret

Function at 0x1802b5fb3
Capabilities:
Encode data using base64

Disassembly:
and di, 0x2a2c
ja 0x1802e56d4
lea rbx, [rbx + 1]
xor di, 0x1e94
jne 0x18023cc9f
push r9
mov qword [rsp + 0x38], rbx
mov r9, rdi
add di, 0x5907
jne 0x1801bbc5a
Function at 0x1802b5fc2
Capabilities:
Encode data using base64

Disassembly:
shr dword [rsp + 8], 0x9e
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp]
lea rsp, [rsp + 0x20]
ret
cmovne r8d, dword [rsp + r8*2 - 0x2d]
jns 0x1801e77ea
invalid
add qword [rsp], 0xfffffffffffc9b43
push r8
movabs rdx, 0xcf974ebe81859b8b
movabs r8, 0x1cb78036cf215097
and r9b, 0x22
shr dl, 5
js 0x180127bc0
movzx r8w, r9b
mov rdx, qword [rsp + r9 + 8]
mov rdx, qword [rdx]
shr r8, 0xcb
mov qword [rsp + 8], r9
push r11
mov dword [rsp + 0x10], 0xc03da29d
mov r11, qword [rsp + r9*4 + 0x10]
ja 0x1802b645e
pushfq
add qword [rsp + 8], 0x7fcd1bb7
mov qword [rsp + 8], 0xffffffffcfdb2946
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.180324dee
mov r9b, byte [rsp + 0x16]
lea rdx, [rdx + r11 - 0x70139071]
movsx r8d, r8b
jbe fcn.1802b5b52
jne 0x18026a22f

Function at 0x1802b7bbd
Capabilities:
Encode data using xor

Disassembly:
movzx r15w, byte [rsp + 0x4d]
jae 0x18012c765
pop rsi
xchg bh, ah
invalid

Function at 0x1802c5657
Capabilities:
Packed with generic packer

Disassembly:
jb 0x1802df2bc
setne byte [rsp + 0x70]
call fcn.1801b2ed5
lea rcx, [rcx + rcx*8 - 0x54d5c9ea]
mov byte [rsp + 0x70], 0xac
mov cl, 0x2e
mov rcx, qword [rsp + 0x38]
jge 0x18026ae26

Function at 0x1802c5676
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x20], 0x5209ce80
sub word [rsp + 0x20], 0xafbb
test dword [rsp + 0x20], 0x99a27618
push rsi
call fcn.180286fae

Function at 0x1802d8434
Capabilities:
Encode data using base64

Disassembly:
jbe 0x180319c49
jbe 0x18024c44e
jbe 0x1801f12b8
mov rax, qword [rsp + 0x20]
add qword [rsp], 0xfffffffffffe5896
test r15d, 0x5c3678b5
push r15
push 0x582eef20
lea rax, [rax + 1]
jbe fcn.18013d979
jno 0x1803046b9
mov rsi, r13
lea rcx, [rcx + r13*2 - 0x7a9781fd]
call fcn.1802f084c
cmp r15, 0x1d81d5a4
jno 0x1801405e0
sub qword [rsp + 0x18], r14
and byte [rsp + r14 - 0x7a89a9fb], 0x19
push rsi
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + r14 - 0x7a89aa13]
lea r14, [rdi + rdi*4 - 0x77bd1f7]
mov qword [rsp + 0x18], r14
call fcn.1801a1ffd

Function at 0x1802db754
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffbd384f0d
call fcn.1802671ab

Function at 0x1802ebfed
Capabilities:
Encode data using xor

Disassembly:
movabs r10, 0xc10a442f9c3dff86
lea r10, [r10 + riz - 0x12518efa]
lea r10, [r10 + r10*8 + 0x4b9ea60a]
xchg qword [rsp + 0x10], rbx
call fcn.180220fe7
js 0x180258bd1
add qword [rsp + 8], 0xfffffffffff27360
or r9b, 0x11
push r12
shl word [rsp + rbp - 0x7dd4b211], 0xb0
call fcn.18026c276
mov qword [rsp + 0x50], rbx
mov r12, qword [rsp + r9*4 - 0x28]
bswap ebp
shl r9w, 0x65
push 0xffffffff9e257cae
shr byte [rsp + r9 - 0x280], 0x58
jns 0x1802c9e65
invalid

Function at 0x1802f9a2a
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x10], 0xffffffffffe25d75
mov rsi, r15
movsx r15, r15b
bswap ebx
or rsi, 0xffffffffd5087710
jo 0x18013158e

Function at 0x18030d09f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg word [rsp + 0x60]
mov r10, qword [rsp + 0x28]
test dword [rsp + r13*2 + 0x28], 0xc0b4d3a0
call fcn.180252aed
pop rax
jae 0x180132845
pushfq
call fcn.18021741f
jae 0x18023533d
Function at 0x18030d567
Capabilities:
Packed with generic packer

Disassembly:
and byte [rsp + 0x40], 0x37
jg 0x180283555
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret
jae 0x18027ccd9
jae 0x180210d15

Function at 0x1803195b9
Capabilities:
Encode data using base64

Disassembly:
xor r13w, 0xd230
neg r13w
mov r13, qword [rsp + 0x18]
call fcn.180224546
jb 0x180227c33
lea r12, [r13*8 + 0x2a01b9]
sub r12, 0xffffffffeba08003
xchg qword [rsp + 0x38], rsi
mov r12, qword [rsp + 0x20]
test r13, 0xffffffffe52f2ab4
jne 0x180226e4f
ja 0x18021a0e6
xor r13b, 0x94
xor r12b, 0xb3
lea rsi, [rsi + 0x5a851b3c]
mov bl, 0x48
lea esi, [rsi + 0x5a851b3c]
and r12d, 0x8924a227
ja 0x180278f69
xchg dword [rsi - 0x2e000a07], ecx
sub edi, dword [rbx]
adc dword [rcx - 0x204bdcf5], eax
sbb ebx, 0x7bd9898b
jmp 0x18031961d
shr dword [rbx], 1
cmp edx, dword [rcx]
or dword [rbx], 0x81dfb423
fisttp dword [rbx - 0x14842677]
xor dword [rcx + 0xb], esp
sbb edx, ecx
add ebx, 0xe3d98993
xor dword [rcx + 0x43], esp
rcr ecx, cl
mov ebx, eax
add al, 0xea
jo 0x1803195d6
shl esi, 1
movabs al, byte [0xa2398669d1f74d0a]
test al, 0xab
mov edi, 0xec7a977c
invalid
jle 0x1803195c6
mov ecx, 0x3016db5b
mov al, byte [r15 - 0x35]
invalid

Function at 0x18031c536
Capabilities:
Packed with generic packer

Disassembly:
and rbx, 0x4b0f0f13
add qword [rsp + 8], 0xe1c53
movabs r13, 0x781e599b8e0a0e3f
movabs rbx, 0xe9ae863ca01e168f
lea rbx, [rbx + rbx*2 + 0x33a0d7b1]
test bl, 0x84
seto bl
push r10
ja 0x1801bc655
xchg qword [rsp + rbp + 0x50], rsi
mov r11, qword [rsp + rbp + 0x48]
test dword [rsp + rbp*4 + 0x20], 0x5c92da3e
call fcn.1802ad326
mov qword [rsp + 0x28], rcx
lea rbx, [rbx + rbx - 0x766ad350]
push r13
jge 0x18013b480
Function at 0x140002a50
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.14001e460
sub rsp, rax
mov rax, qword [0x14004ce78]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1400198a0
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140002acd
lea rcx, [rsp + 0x70]
call fcn.140026af4
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14001e4c0
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14001e4c0
add rsp, 0x10088
ret

Function at 0x140002bb0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004ce78]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x140034010]
call fcn.140002a50
xor edi, edi
mov qword [0x14004e588], rax
lea rdx, [0x140034010]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.1400198a0
lea rdx, [0x140034018]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.140002a50
mov cl, 1
mov qword [0x14004e590], rax
call fcn.14001ab00
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1400198a0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.14001ab00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [sym.imp.python310.dll__Py_path_config]
mov dword [rax + 0x30], 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret