joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405b6f88
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs rdx, 0x209b0d87ad16670e
cmp dl, 4
push r12
push r10
mov r10, rdx
bswap rdx
xchg qword [rsp + 0x20], rbp
movzx edx, dx
push r8
jge 0x14061bbf5
sub r14d, r14d
mov r14d, 0xbb136e99
xor r14w, 0xee0a
movsx r14w, r14b
movzx r14d, r14b
and r14b, r14b
mov r14, qword [rsp + r14*8 - 0x490]
jbe 0x14070a265
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
call fcn.140768a4f
and al, 0x60
cmp dword [rax], eax
xor eax, 0x8e62112b
jns 0x1403d2a27
lodsb al, byte [rsi]
add dword [rax], 0xffffff9b
movabs dword [0xd2fc5f084d4e2603], eax
add eax, 0xa4f4fc5f
add al, 0x95
pop rcx
jl 0x1403d2a4b
invalid
add esp, dword [rbp + rsi*4 + 0xd03af41]
stosd dword [rdi], eax
invalid
mov qword [rsp + 0x10], rdi
or qword [rsp + 0x10], rdi
lea rcx, [rcx + 0x37b3afa5]
seta byte [rsp + 0x10]
neg word [rsp + 0x10]
not qword [rsp + 0x10]
shl di, 0x4b
jae 0x1403d29cb
cmp dil, byte [rsp + 0x14]
xchg qword [rsp + 0x50], rcx
mov rdi, qword [rsp + 0x38]
setbe byte [rsp + 0x10]
or qword [rsp + 0x10], 0x15079a8d
not dword [rsp + 0x10]
call fcn.1405d624b
ja 0x1404661c3
movabs rsi, 0xe21a4fb4943b7b01
push r14
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0x7872cb01
mov rdx, qword [rsp + 0x18]
movabs r14, 0xd0a54eb652999e15
call 0x1403d29f3

Function at 0x1405c06ea
Capabilities:
Encode data using base64
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push rbp
call fcn.1406a9d73
mov rcx, rbx
call fcn.14036df0c
add rsp, 0x20
pop rbx
ret
xchg qword [rsp + 0x50], rcx
mov r15, qword [rsp + 0x18]
mov dword [rsp + r14 - 0x70bfffc8], r14d
mov rsi, qword [rsp + r14 - 0x70bfffc8]
call fcn.140421cd1
pop rdi
enter 0xffffffffffff9bae, 0xffffffffffffff92
invalid
shl r14d, 0xd5
push r10
and r14b, r14b
jle 0x14051f0fe
lea rcx, [rcx - 0x7d48d953]
jge 0x14054b2f3
jl 0x14036e06e
lea rdx, [rdi + riz - 0x50ffc061]
cmova rdi, qword [rsp + 8]

Function at 0x1405c1d6d
Capabilities:
Packed with generic packer

Disassembly:
push r13
push 0xffffffff82138bb0
lea rdx, [rdx + 1]
sub r8d, dword [rsp + 4]
jae 0x1406681cc
mov r13, r8
shr r13w, 0xfd
shr r13w, 0x29
add r13w, 0x3387
mov qword [rsp + 0x40], rdx
and cl, 0x37
add qword [rsp + 0x10], 0xfffffffffff09949
call fcn.140544476

Function at 0x1405c5c94
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
shr r14b, 0x50
jne fcn.1406ea1fd
xchg qword [rsp + 0x40], rax
mov r14, qword [rsp + 0x20]
neg byte [rsp + 0x18]
not qword [rsp + 0x18]
shr edi, 0x3e
sub dil, r12b
call fcn.14062625b
adc dword [rcx - 0x4644b0cb], ebx
xchg esp, eax
invalid
jo 0x140411823
shl dword [rsp + 0x50], 0xc1
add r14b, byte [rsp + 0x54]
xor r14w, r14w
jno 0x14057fb21

Function at 0x1405cc09f
Capabilities:
Get geographical location

Disassembly:
xchg qword [rsp + r15 - 0x50907fb8], rcx
mov r15, qword [rsp + r10 - 0x509080ae]
jae 0x1405dc1fb

Function at 0x1405d95d2
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0xffffffffffe791f1
xor r9d, 0x29b20990
Function at 0x1405da84a
Capabilities:
Encode data using base64
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x20], 0xffffffffbfafb28d
sub dword [rsp + 0x48], ecx
xchg qword [rsp + 0x60], rdx
mov rcx, qword [rsp + 0x18]
call fcn.1404ab7f3
shl r11b, 0x22
je 0x1404b7e06
Function at 0x1405e7f1b
Capabilities:
Terminate process

Disassembly:
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14005369a
mov ecx, ebx
int 0x29
mov ecx, 3
call fcn.140053668
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x4d0
call fcn.140057410
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0xe8]
lea rdx, [rbp + 0x4d8]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14005371a
and qword [rsp + 0x38], 0
lea rcx, [rbp + 0x4e0]
mov rdx, qword [rbp + 0x4d8]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rbp + 0x4e8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4c8]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0xe8], rax
xor edx, edx
lea rax, [rbp + 0x4c8]
mov r8d, 0x98
add rax, 8
mov qword [rbp + 0x88], rax
call fcn.140057410
mov rax, qword [rbp + 0x4c8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x40000015
mov dword [rsp + 0x54], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x10]
sete bl
mov qword [rsp + 0x48], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400537aa
test bl, bl
jne 0x1400537aa
lea ecx, [rax + 3]
call fcn.140053668
mov rbx, qword [rsp + 0x5d0]
add rsp, 0x5c0
pop rbp
ret
call fcn.1404de7d4
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
ret 8
mov esp, dword [rsp + 0x40]
or qword [rsp + r10*2 - 0x3b66ccb8], 0x2513890c
call fcn.140489254
or qword [r12*4 + 0x1ca2b8ff], 0x4f5e0059
popfq
push rax
xlatb
movabs al, byte [0xbfa687a44880bfa4]
in eax, dx
xchg ecx, eax
test al, 0xbf
pop rsi
mov bl, 0x5c
add byte [rdi + 0x30805bb6], dh
mov bh, 0x2f
pop rbp
xor byte [rsi*4 - 0x40572e27], 0xde
leave
stosb byte [rdi], al
jg 0x1404038cc
invalid
pop rsi
sub byte [rsi], 0xa9
cdq
pop rax
xor byte [0xe873e1cc], 0xff
jo 0x14040385b
invalid
movabs rbx, 0xbd2d05b6a297561b
mov rbx, qword [rsp + rbp - 0x43f2d590]
test cx, dx
seto cl
jne 0x14045f074
add qword [rsp + 0x10], 0xffffffffffe43e4c
mov rsi, rdi
sub edi, 0xa53b741f
xor sil, 0xa3
sets dil
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi + rdi - 0x7c4b1401]
lea rdi, [rdi + rdi*8 + 0x6ab50c0b]
or di, di
mov qword [rsp + 0x10], rdi
je 0x1403651cf
jge 0x140447a65
add qword [rsp + 0x20], 0xffffffffbfb54825
lea rsi, [rsi + 0x3494e58f]
add qword [rsp + 0x10], 0xffffffffbf9d5fa1
setb dil
push r13
call fcn.1406bcd4e
test di, r11w
call fcn.1404f0e57
js 0x14005368c
push rbp
lea rbx, [rbx - 0x7cf0ee68]
setne r8b
mov r11, r14
je 0x1405859e7
xor r15w, 0x1433
mov rbp, r8
xchg qword [rsp + r11 - 0x6fc7ffb0], rbx
mov r8, qword [rsp + r15*8 - 0x4148a058]
movzx r15, word [rsp + r11 - 0x6fc7ffd8]
test r11b, r14b
jb 0x14040386b
not r11b
cmp r14b, 0xa7
bswap r15
call fcn.1403bf115
Function at 0x1405e7f93
Capabilities:
Terminate process

Disassembly:
mov r14d, dword [rsp + 0x40]
lea rsi, [rsp + 0x720]
xor ecx, ecx
mov eax, ebp
sub eax, r12d
cmp eax, r13d
jae 0x14037359d
movzx eax, word [rbp]
add rbp, 2
cmp ax, 0xa
jne 0x140373589
mov word [rsi], dx
add r14d, 2
add rsi, 2
add rcx, 2
add rcx, 2
mov word [rsi], ax
add rsi, 2
cmp rcx, 0x13fe
jb 0x140373562
and qword [rsp + 0x20], rbx
lea rax, [rsp + 0x720]
mov r8d, esi
sub r8d, eax
lea rax, [0x140388800]
mov dword [rsp + 0x40], r14d
mov r14, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x720]
mov rcx, qword [rax + r14*8]
mov rcx, qword [r15 + rcx]
push rsi
call fcn.140588a45
test eax, eax
je 0x14037352e
add edi, dword [rsp + 0x48]
lea rax, [rsp + 0x720]
sub rsi, rax
movsxd rax, dword [rsp + 0x48]
cmp rax, rsi
jl 0x1403733db
mov eax, ebp
mov edx, recv
sub eax, r12d
cmp eax, r13d
jb 0x140373553
jmp 0x1403733db
test r14w, 0x4a06
js 0x1403735d7
test r10b, 0x26
lea rsi, [rsi - 0x7de5c25d]
not r10w
not r14d
mov qword [rsp + r14 - 0x6ee97faa], r10
xchg qword [rsp + r10*4 - 0x163b4], rsi
mov r10, qword [rsp + r10 - 0x58c7]
setno byte [rsp + r14 - 0x6ee97faa]
mov qword [rsp + r14 - 0x6ee97faa], 0x15980836
jg 0x1406ea208
add qword [rsp + r14 - 0x6ee97fc2], 0xffffffffbfba7c77
mov r14, qword [rsp + r14 - 0x6ee97faa]
add qword [rsp + r14*2 - 0x2b30104c], 0xe8bc7
mov r14, qword [rsp + r14 - 0x15980826]
call fcn.1405fc1b6
cmp byte [rsi], bl
sbb byte [rsi], 0xbc
sbb byte [rsi], 0xd0
sbb byte [rsi], 0x3a
or dh, byte [rax + 0x210001bd]
add bh, byte [rdx]
rcr byte [0x1435f802e], 0x3e
xor al, 0x70
add eax, 0xc06a6000
sbb eax, 0x4410000
xor al, 0x70
add eax, 0xc06a6000
sbb eax, 0x5810000
xor al, 0x70
add eax, 0xc06a6000
sbb eax, 0x5010000
xor al, 0x70
add eax, 0xc06a6000
sbb eax, 0x3a10000
adc eax, 0x1dc002
add byte [rcx - 0x3ffc9afd], ah
sbb eax, 0x3a10000
mov ch, 4
rcr byte [0x143ff807a], 0xa5
add eax, 0x1dc0
movabs eax, dword [0x6a000570344603]
invalid

Function at 0x1405ebbd0
Capabilities:
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
seta r12b
add r12, 0xffffffffdaaf519e
xor r12b, r12b
not r12w
add qword [rsp], 0x284abb
movabs rdi, 0x143736af83378795
neg dil
shr rdi, 0x65
not r12w
cmp edi, 0xf8084d0a
setno dil
sete dil
shr edi, 0xcf
or r12w, 0xaa9b
mov rdi, qword [rsp]
mov rdi, qword [rdi]
xor r12w, r12w
jno 0x14052144b
out dx, eax
iretd
push 0xffffffffc24f2a3d
sbb eax, 0x928ad48b
je 0x1405ebc84
ja 0x1405ebc62
jbe 0x1405ebc3d
test edx, esp
mov ss, word [rdx - 0x2b539ff0]
cld
xchg ebx, eax
ja 0x1405ebc62
adc byte [rax - 0x54], ah
invalid
loop 0x1405ebbd4
cmp byte [rbx - 0x55], dh
push rbp
mov r14b, 0x4a
and byte [rdx - 0xa], 0xc9
je 0x1405ebc0f
invalid
loop 0x1405ebc70
movsb byte [rdi], byte [rsi]
add al, 0x88
invalid
xchg dl, ah
mov ah, 0xe4
invalid
push rbx
and dword [rdx + 0x58], 0x42
mov dh, 0xbd
push rsp
pushfq
cmp byte [rax], 0x99
xor byte [rax + rbp*4 - 0x744fd57], ch
push rbp
mov es, word [rcx]
jbe 0x1405ebc8b
popfq
invalid

Function at 0x1405fb55e
Capabilities:
Terminate process

Disassembly:
ja 0x1406ea1ae
add word [rsp + 0x30], 0xfb0f
bswap r10d
mov r10, qword [rsp + 0x48]
call fcn.1406d3829
Function at 0x1405fc05a
Capabilities:
Packed with generic packer

Disassembly:
movabs r15, 0xbb25ae09e595cc8e
bswap r15
jb 0x140507abc
je 0x1406faa51
je 0x1404e23a1
movsx r15d, word [rsp + 0x3a]
sub r15, 0xffffffffa19d3a10
mov r15, qword [rsp + r15 - 0x5e6341e1]
je fcn.140351f42
call fcn.1407295f7
pop rbp
leave
call 0x11058852b
ret
Function at 0x1406028f4
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0x1519b
test bx, 0xd00c
mov rsi, qword [rsp + 0x20]
jg 0x1403f3bb4
sub bl, dh
xor dl, bl
sub ebx, ebx
mov ebx, edx
or ebx, 0xd181128f
mov rdx, qword [rsp + 8]
add ebx, ebx
jns 0x1405f6580
je fcn.140403606
jge 0x1406d7036
call fcn.1405e4523
not byte [rsp + 0x40]
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x70]
ret

Function at 0x140616a10
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x28], rcx
push rbp
movabs rbp, 0x929d361a9d0def13
push rcx
jae 0x140554d19
sub eax, 0xf1f1012f
jae 0x140616a3c
jmp loc.1408f7ab5
fimul dword [rdx - 0x134e6cf]
invalid

Function at 0x140622aa8
Capabilities:
Encode data using base64

Disassembly:
cmp r14w, 0xd49e
mov r14, qword [rsp + r14 + 8]
jns 0x14072b359
call fcn.140649bf2
push rsp
xchg esi, eax
invalid
movabs r14, 0xcd9547170432e2a8
shl r14d, 0x5b
xor r14, r14
jle 0x14047efe0

Function at 0x14062d382
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
setl byte [rsp + 0x38]
xor word [rsp + 0x38], 0x9f16
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret
js 0x1403ef5fc

Function at 0x140635f45
Capabilities:
Get geographical location

Disassembly:
pushfq
add qword [rsp + 0x10], 0xffffffffbf7699b2
mov qword [rsp + 0x10], 0x2ecec702
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.140768a4f

Function at 0x140635f67
Capabilities:
Get geographical location

Disassembly:
movzx r15w, byte [rsp + r11 + 0x6e7cb0b3]
or r15d, 0x200186b1
jne 0x1405fed05

Function at 0x140635f7e
Capabilities:
Get geographical location

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x20], r12d
je 0x1400784b9
lea rax, [r14 + 0x100]
neg r14
lea rdx, [rbp - 0x20]
sbb rcx, rcx
and rcx, rax
call fcn.14007807c
mov ebx, eax
test eax, eax
je 0x1400784b9
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
call fcn.1406da416
and word [rsp + rdi - 0x7bffffbd], 0xcc10
mov rdi, qword [rsp + rdi - 0x7bffff95]
je 0x1400783c8
jl 0x1403f3dae

Function at 0x140651063
Capabilities:
Query environment variable

Disassembly:
xchg qword [rsp + rbx - 0x36174e10], rdi
mov rbx, qword [rsp + rbx - 0x36174e50]
add qword [rsp + 0x18], 0xffffffffbffb67ef
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
ret
lea rdi, [rdi + rbx + 0x1e7fa438]
js 0x140074c25
jne 0x1403f20a6
Function at 0x140654ab6
Capabilities:
Packed with generic packer

Disassembly:
jge 0x140473a5f
not si
xchg qword [rsp + 0x48], rbx
mov r14, qword [rsp + 0x18]
test si, 0x7081
jl 0x1405d5618
shr esi, 0x99
and dx, 0x5c3b
mov rdx, qword [rsp + 0x28]
or esi, 0x37b56593
or esi, 0x4305c03c
test si, si
push qword [rsp + rsi - 0x77b5e58f]
popfq
mov rsi, qword [rsp + rsi - 0x77b5e5af]
lea rsp, [rsp + 0x38]
ret 8
sub r13d, 0xf602033a
mov bl, r13b
and ebx, dword [rsp + 0x33]
or rdi, r13
push r9
lea rdi, [rbx*4 + 0x7a26b68b]
add qword [rsp + 0x20], 0xfffffffffff08a2b
add qword [rsp + 8], 0xfffffffffffe8349
call fcn.1407122b1
shr r11b, 0x44
test r11, 0xffffffffa638953e
jl 0x1404ae848
xchg qword [rsp + 0x10], rbp
mov r11w, 0xd711
neg r11d
call fcn.14045be74
call fcn.1405da491
push 0xffffffffc9a915e8
cld
invalid
test word [rsp + 0x28], 0x24a5
js 0x1405aa04e
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret
not r15
pushfq
add r15, r15
mov rax, qword [rsp + 0x20]
call fcn.1404490fe
push rbx
xor r15b, r15b
call fcn.1406bd23d
pop rbp
push r11
pushfq
movabs r11, 0x23855504e23c4834
sub r11, 0xffffffffa9a8b706
jge 0x140579b30
pop rax
push rcx
movabs rcx, 0x28276b17229fb99c
push rsi
call fcn.140562e53
js fcn.14047aa23
lea rbx, [rbx - 0x336a405a]
and esi, 0xbc02ea9e
shl r14b, 0xe4
not rsi
jne 0x140623b51
test r14d, r14d
je 0x1403e2e4a
movsx r8w, dil
movabs rdx, 0xdcae08a3d835cb2b
jle 0x1405ac907

Function at 0x140654adf
Capabilities:
Packed with generic packer

Disassembly:
jge 0x140473a5f
not si
xchg qword [rsp + 0x48], rbx
mov r14, qword [rsp + 0x18]
test si, 0x7081
jl 0x1405d5618
shr esi, 0x99
and dx, 0x5c3b
mov rdx, qword [rsp + 0x28]
or esi, 0x37b56593
or esi, 0x4305c03c
test si, si
push qword [rsp + rsi - 0x77b5e58f]
popfq
mov rsi, qword [rsp + rsi - 0x77b5e5af]
lea rsp, [rsp + 0x38]
ret 8
sub r13d, 0xf602033a
mov bl, r13b
and ebx, dword [rsp + 0x33]
or rdi, r13
push r9
lea rdi, [rbx*4 + 0x7a26b68b]
add qword [rsp + 0x20], 0xfffffffffff08a2b
add qword [rsp + 8], 0xfffffffffffe8349
call fcn.1407122b1
shr r11b, 0x44
test r11, 0xffffffffa638953e
jl 0x1404ae848
xchg qword [rsp + 0x10], rbp
mov r11w, 0xd711
neg r11d
call fcn.14045be74
call fcn.1405da491
push 0xffffffffc9a915e8
cld
invalid
test word [rsp + 0x28], 0x24a5
js 0x1405aa04e
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret
not r15
pushfq
add r15, r15
mov rax, qword [rsp + 0x20]
call fcn.1404490fe
push rbx
xor r15b, r15b
call fcn.1406bd23d
pop rbp
push r11
pushfq
movabs r11, 0x23855504e23c4834
sub r11, 0xffffffffa9a8b706
jge 0x140579b30
pop rax
push rcx
movabs rcx, 0x28276b17229fb99c
push rsi
call fcn.140562e53
js fcn.14047aa23
lea rbx, [rbx - 0x336a405a]
and esi, 0xbc02ea9e
shl r14b, 0xe4
not rsi
jne 0x140623b51
test r14d, r14d
je 0x1403e2e4a
movsx r8w, dil
movabs rdx, 0xdcae08a3d835cb2b
jle 0x1405ac907

Function at 0x140665dea
Capabilities:
Encode data using xor

Disassembly:
jne 0x14059d7c5
push rbp
call fcn.14063e6e0
invalid
Function at 0x14066ec46
Capabilities:
Authenticate hmac

Disassembly:
mov r13, qword [rsp + r13*2 + 0x68]
shr r9w, 0xca
mov r12, qword [rsp + r9 - 0x3003ffa0]
jbe 0x1407203e0
invalid
out dx, eax
out dx, eax
test dl, bl
loopne 0x14066ecaf
add dh, 0x28
invalid
js 0x14066ec57
sar byte [rsp + rdx*8], 1
pop rsp
and al, 0x11
invalid

Function at 0x140670ca9
Capabilities:
Packed with generic packer

Disassembly:
jl 0x140627701
add bpl, byte [rsp + 0x30]
sub bp, bp
jl 0x1404d7f44
xchg qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x18]
add dword [rsp + 0x30], 0x4db30e0d
test qword [rsp + 0x30], 0x2b8fc8af
jl 0x1406db022
or qword [rsp + 0x30], 0x64946014
jb 0x140724738
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
ret
lea rax, [rax - 0x18dac1e1]
xor bpl, bpl
xor qword [rsp + 0x30], rbp
jns 0x1405c426d

Function at 0x140677562
Capabilities:
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
sub ecx, ecx
mov rbx, rcx
movabs r15, 0x863440916eb132bc
add qword [rsp + 0x10], 0x122bb6
add qword [rsp + rbx*2], 0xffffffffbfa2fc70
call fcn.1405751a3
mov sil, byte [rdx + 0xce046e9]
sub dword [rax], ecx
fild dword [rdx - 0x7b24c42a]
enter 0x3028, 0x4e
invalid
jns 0x14060d89b
pop rbx
push r14
push rsi

Function at 0x1406790b0
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0x2880d7
shl qword [rsp + 0x18], 0x69
and qword [rsp + 0x18], 0x59426be
call fcn.140526bf2
push rdi
jbe 0x14048a46c
xor eax, 0xce3d1aff
rcl byte [rdx + rsi], 0xa4
enter 0x56c0, 0x2e
sub al, 0x5a
cmp eax, 0x3f422bff
invalid
adc cl, ch
shr bh, 0xc8
or ch, ah
cmp bh, bh
or eax, 0xe3f3af4
invalid
add r9w, word [rsp + 0x14]
add r9b, r9b
test word [rsp + 0x10], 0x953d
bswap r9
mov r9, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdx
jns 0x1404e23b4
mov dword [rsp + 0x10], 0x5d8c7b1f
push r15
mov r15, qword [rsp + 0x18]
add r15d, r15d
jne 0x14048a40d

Function at 0x140681e05
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + r10 - 0x6b11d9c9], 0xe839a9a3
mov r10, qword [rsp + 0x30]
call fcn.1406911f4

Function at 0x140681e1b
Capabilities:
Terminate process

Disassembly:
push rsi
movabs rsi, 0xd723a909c632dfbc
pushfq
xor sil, 0x8e
sub si, 0x240c
sub esi, esi
mov rsi, qword [rsp + rsi*4 + 0x20]
js 0x1406ea1f1
add qword [rsp + 0x10], 0xfffffffffffe0399
call fcn.1406d52f7

Function at 0x14068c846
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rsp + 0x20]
push r8
movabs r8, 0x9a91f38f0ebce805
call fcn.140433bc0

Function at 0x140690a5d
Capabilities:
Packed with generic packer

Disassembly:
call fcn.140481380
add qword [rsp], 0xffffffffbfc39eb4
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1407ad61e
or r9, r14
popfq
adc edx, dword es:[rsi]
jmp loc.1408f7b85

Function at 0x1406975a7
Capabilities:
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + rdi - 8]
mov rbp, qword [rbp + riz]
jne 0x14069e323
call fcn.140609f09
Function at 0x14069ad69
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add r8b, byte [rsp + r8 + 4]
shr bpl, 0x18
mov r8, qword [rsp + 0x10]
shl rbp, 0xdc
sets byte [rsp + 0x38]
or bl, bpl
and dword [rsp + 0x38], 0x23808197
shl dword [rsp + 0x38], 0x33
or dword [rsp + 0x38], 0xf68c63b8
bswap rbx
mov rbp, qword [rsp + 0x48]
neg dword [rsp + 0x38]
or bl, 0x21
movsx ebx, bl
mov byte [rsp + rbx*8 - 0x180], bh
add byte [rsp + rbx*2 - 0x36], bl
add ebx, ebx
mov rbx, qword [rsp + rbx - 0xe]
neg dword [rsp + 0x38]
shr byte [rsp + 0x38], 0x11
sub qword [rsp + 0x38], 0xffffffffe5995aa8
jns 0x1405846fe
test qword [rsp + 0x38], 0x32c4013
jge 0x14055f864
cmp r8b, 0x8e
mov rcx, qword [rsp + 0x18]
jae 0x14071b50a
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x68]
ret
neg r11d
movabs r8, 0xd4a0e537a7b55397
add qword [rsp + 0x18], 0xffffffffffd43bbf
movzx r8, r11w
lea r8, [r11 + r11*4 + 0x315233b]
call fcn.1406e0724
mov rdx, qword [rsp + 0x50]
not r8
mov rcx, rbx
jns 0x1405e6846
not rbx
cmp rcx, 0x37ab24b1
mov r15, qword [rsp + 0x20]
jbe fcn.14066a00b
js 0x140550c05
je 0x14071b500
invalid
mov rdx, qword [rsp + 0x10]
call fcn.1405c3f98
movabs rbp, 0xbd1e670a478d1e86
and r8d, 0xf895c73a
ja 0x1404dbc47
jb 0x14071b58c
adc dword [rcx], esp
add byte [rax], al
add byte [rax - 0x32ffc9a1], dh
pop rdi
add al, bh
adc eax, 0x30280069
push rdi
test eax, 0x1c02a5e9
adc ch, byte fs:[0x15c50e5bb]
adc ch, byte [0x15c50e5bb]
movabs dword [0xba640f050618d7b3], eax
out 0xfe, al
jno 0x14071b5a8
adc ah, byte [rbx + 0x6886d737]
sbb cl, byte [rsi - 0x5d]
xchg ebx, eax
scasd eax, dword [rdi]
loope 0x14071b5b7
outsd dx, dword [rsi]
jne 0x14071b5ac
and byte [rbx], al
xchg ebx, eax
mov ah, 0xc0
imul edx, dword [rbp + 0x66], 0x333b2dbf
fistp dword [rsi + 0x32b729b3]
out dx, eax
wait
jl 0x14071b4fd
ret
or esp, dword [rbx - 0x12]
rcl byte [rdx], cl
xchg ecx, eax
popfq
invalid
ret 0x7861
mov dl, 0xde
std
movabs al, byte [0x602bcf93a37d3e25]
jne 0x14071b53d
sub esp, dword [rax + 0x75]
invalid
movabs al, byte [0x366837ba90086245]
invalid
Function at 0x1406a659d
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or dword [rsp + 0x18], 0x63116c9d
mov word [rsp + 0x18], 0xda1
mov dword [rsp + 0x18], 0x69904fb1
mov qword [rsp + 0x20], rdi
neg dword [rsp + 0x18]
or word [rsp + 0x18], 0xedbc
or qword [rsp + 0x18], 0x299b8ae
add dword [rsp + 0x18], 0xfd9eec95
shl qword [rsp + 0x18], 0x6b
add qword [rsp + 8], 0x7645
push rcx
mov rdi, qword [rsp + 0x20]
and di, word [rsp + 0x23]
ja fcn.140445608
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
not dword [rsp + 0x20]
movabs rcx, 0xc004360e1587e80c
jno 0x1404f3e4f
shl ecx, 0xe3
not cl
setae cl
cmove ecx, dword [rsp + 0x23]
lea rdi, [rdi + 0x16148410]
mov cl, byte [rsp + 0x27]
mov qword [rsp + 0x10], rcx
lea rcx, [rcx + rcx*2 - 0x4fcfa4d4]
not ecx
neg ecx
xchg qword [rsp + 0x28], rdi
mov rcx, qword [rsp]
call fcn.1404f7967
push rdx
push r8
pushfq
movabs r8, 0x5a93ac8b28829616
and r8, 0xffffffffe3a4e809
jle 0x140728bbc
lea r8, [r8 + r8*2 - 0x324ad3d6]
not r8b
mov rdx, qword [rsp + 0x18]
shl r8, 0x9d
js 0x1405d95e2
or r8b, r8b
sub r8, r8
lea rdx, [rdx + r8*8 + 1]
neg r8b
push rdi
jg fcn.1405552a2
mov rdi, r8
call fcn.1404d3cbb
movabs rsi, 0x92204521232242ad
cmp rsi, 0x1436b62e
call fcn.140523133
shl r13b, 0x78
pop r13
sub dword [rsp + 0x48], 0xd4902406
or rdx, qword [rsp + 0x48]
xor rcx, 0x51935e9e
mov rdx, qword [rsp + 0x20]
or byte [rsp + rcx - 0x4ca9c309], cl
jl 0x14067756c
pushfq
movabs r14, 0x6b3e758f460eb138
movabs rsi, 0x69a3aa1229246fb7
test si, 0x233c
xchg qword [rsp + 0x18], rbx
movabs r14, 0xce001d217fa48a16
push r15
jne 0x1406e4a69
pushfq
or dword [rsp + 0x18], 0x8a859cbd
jle 0x1404a7a38
test rdx, rdx
call fcn.14001fdee
push rsi
push r9
mov r15, r14
mov r14, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
push 0x75a7ad0e
jne 0x1403fa154
bswap ecx
cmp r11b, 0x2f
xchg qword [rsp + 0x58], rbp
mov r11, qword [rsp + rcx - 0x1d3a9d8f]
not rdx
jg 0x1406ca2fd
movabs r13, 0x2d9f59173b8a3197
jle 0x1406689fc
mov bh, 0xc4
hlt

Function at 0x1406ad282
Capabilities:
Packed with generic packer

Disassembly:
sete r8b
js 0x1407026c8
call fcn.1405b0a0c
neg byte [rsi + 0x4b]
imul esp, dword [rdi + rbx + 0x54d15214], 0xedbb23ef
push rdi
in al, dx
sbb bh, byte [rbx + 0x443a8160]
or al, 0xd9
xchg edx, eax
sub ecx, dword [rax - 0x5de6ce27]
ret 0x129

Function at 0x1406ad28c
Capabilities:
Packed with generic packer

Disassembly:
jns 0x14067a919
call fcn.1403e0eac

Function at 0x1406c9eae
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push 0xffffffffe6a97d8b
pushfq
xor word [rsp + 8], 0xabe
js fcn.1406c9eae
mov qword [rsp + 0x18], 0x1783daf7
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.14072efb7