joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14034f0e0
Capabilities:
Encode data using base64

Disassembly:
movabs r13, 0xfbabf5a004a21403
mov rcx, qword [rsp + 0x20]
pushfq
xor r13w, 0xc690
jns 0x1403e17ba
add qword [rsp + 8], 0xfffffffffffac6f7
not r13w
push r9
lea rcx, [rcx + 1]
shl r13, 0x7c
jbe fcn.1406aa09c
push qword [rsp + r13*4 + 8]
popfq
lea rsp, [rsp + r13*8 + 0x10]
ret
and r13d, 0xef322197
bswap r14d

Function at 0x140352e4d
Capabilities:
Encode data using base64

Disassembly:
push rcx
call fcn.14070e063
push rcx
pushfq
movabs rcx, 0xad94609ed616a624
sub ecx, 0x42960b0c
jb 0x140352e6b
add ecx, 0x25bb0325
call fcn.1405cba17

Function at 0x140357500
Capabilities:
Packed with generic packer

Disassembly:
push rcx
pushfq
neg r13d
mov qword [rsp + 0x28], 0x6a12e033
mov r13, qword [rsp + r13*4 - 0x5f17e70c]
movabs rcx, 0x6338fd86ba3f402a
jae 0x1403e01c2
add qword [rsp + 0x20], 0xffffffffbf775bc5
add cx, 0x2b10
or rcx, rcx
neg ecx
mov rcx, qword [rsp + rcx - 0x45c094be]
call 0x1403e01c2
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x30]
call fcn.140771367

Function at 0x1403abaa1
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], 0x12bf0513

Function at 0x1403ba9c6
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbfbca52b
add qword [rsp + 0x10], 0x38ca1e
movabs rdi, 0xe3084fb9cab51d39
neg di
bswap rdi
cmp rdi, 0xffffffffd58f0486
setne dil
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
mov qword [rsp + 0x10], 0xffffffff8f8af622
test byte [rsp + 0x10], 0x12
jbe fcn.140663f0b
cmp byte [rsp + 0x10], 0x8b
jle 0x140584fa6
jae 0x140524f0a
push 0x1a273b87
neg byte [rsp + 0x18]
lea rdi, [rdi - 0xf74b2d8]
je 0x1406a4408
shr byte [rsp + 0x18], 0xf1
test word [rsp + 0x18], 0xfba0
ja 0x14066e5f7
call fcn.1405f5105
xchg qword [rsp + 0x40], rcx
mov r9, qword [rsp + 0x10]
lea rdi, [rdi*4 - 0x6579f77f]
jg 0x14065f890
jae 0x140714fb3
call fcn.140577cb3
call fcn.140496770

Function at 0x1403bf2ba
Capabilities:
Encode data using base64
Get system information on windows
Packed with generic packer

Disassembly:
test r8d, r8d
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
mov qword [rsp + 0x18], rbx
lea r8, [r8 + r8*4 + 0x13af213d]
jle 0x1406fe85e
not r8w
cmp r8b, 0x8d
js 0x1404cd194

Function at 0x1403ca195
Capabilities:
Authenticate hmac

Disassembly:
jo 0x140426f45
xchg qword [rsp + 0x58], rbp
mov r14, qword [rsp + 0x30]
movsx rcx, cx
mov word [rsp + rcx - 0x271f], 0xe4ab
jge 0x1404a1956
jge 0x14043c400
jns fcn.14068143b
neg ecx
mov r9, qword [rsp + 0x18]
or word [rsp + 0x50], 0xa0b5
shl r15w, 0x88
sub byte [rsp + 0x18], r15b
add qword [rsp + 0x38], 0x7272e
test qword [rsp + 0x28], r15
call fcn.140363245
call fcn.140611db9
bswap ecx
mov rcx, qword [rsp + 0x10]
setae byte [rsp + 0x18]
jg 0x1406a6ebe
jns 0x1406b2ae6
insd dword [rdi], dx
mov esp, dword [rdi - 0x45]
invalid

Function at 0x1403cc1af
Capabilities:
Get system information on windows

Disassembly:
jg 0x1405b5376
mov qword [rsp + 0x38], rdi
and r13b, 0
shr r13b, 0xc2
or word [rsp + 0x10], 0xa685
jae 0x1403b01f1
Function at 0x1403cc828
Capabilities:
Packed with generic packer

Disassembly:
cmp r12, 0x678744b5
call fcn.1404f3980

Function at 0x1403cc834
Capabilities:
Packed with generic packer

Disassembly:
jne 0x140538878
shl r15w, 0x4a
movabs rbx, 0x9eaa9da6c4aa00a7
and ebx, 0x849e442a
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
add qword [rsp], 0x215b9e
shl ebp, 0x69
ret 8

Function at 0x1403cc83a
Capabilities:
Packed with generic packer

Disassembly:
push r15
mov rdx, qword [rsp + rcx - 0x484ffd0]
mov rdx, qword [rdx]
call fcn.140678ee1

Function at 0x1403cc84c
Capabilities:
Packed with generic packer

Disassembly:
not cx
add qword [rsp], 0xfffffffffffde64a
push rdi
mov rbp, qword [rsp + 0x38]
mov r9, rsi
neg r9
or cx, word [rsp + 0x38]
cmp byte [rsp + 0x38], 0x1c
lea rbx, [r9 + riz - 0x397a426f]
lea r9, [rbx + r15*4 - 0x22d534de]
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
jo 0x1406cf754
test byte [rsp + 0x38], 0x3f
jle 0x1404799cb
setg r15b
shr qword [rsp + 0x38], 0x4c
call fcn.14067784e
call fcn.140426ee1
movzx r15d, r15b
or dword [rsp + r15*8 + 0x18], 0xcfbf899f
lea rcx, [rcx + r15*2 - 0xfdf33d1]
xor byte [rsp + r15 + 0x18], 0x94
jbe 0x14054dfd2
call fcn.1405b7908
push r8
mov qword [rsp], 0xffffffffbb80cb5c
call fcn.14071c090
sub dword [rsp + 8], 0x19199296
xor byte [rsp + 8], 0xa4
shr qword [rsp + 8], 0xb8
sub byte [rsp + 8], 0x15
add word [rsp + 0x18], 0xf8a
add qword [rsp], 0xaf0de
mov rcx, r15
or r15w, r15w
or ecx, dword [rsp + 0x19]
shl r15d, cl
mov rcx, qword [rsp + r15]
mov rcx, qword [rcx + r15*2]
or dword [rsp + r15*2 + 0x18], 0xf1b09a11
neg r15w
jge 0x1403f6753
jns 0x1405e58b9
setae r14b
lea r14, [rsi + rsi*8 - 0x23657cd1]
xor esi, 0xb72c6721
not word [rsp + 0x28]
lea rdi, [rdi - 0xfdf33d1]
jg 0x1405e6662
shr esi, 0xde
je 0x1404e1bd9
push r11
mov rbp, qword [rsp + rsi*2 + 0x2c]
je 0x140713b6c
xchg qword [rsp + rbp + 0xcd865f5], rdi
mov rsi, qword [rsp + rbp + 0xcd865b5]
not qword [rsp + rbp*2 + 0x19b0cb5a]
xor dword [rsp + rbp + 0xcd865cd], 0x53908bbe
call fcn.14040fbca

Function at 0x1403cd02f
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
invalid
mov rdi, qword [rsp + 0x50]
js 0x14043a120
mov cl, 0xb1
xor dword [0xea1afca8], esi
movabs dword [0x7a4d378050e63243], eax
in eax, 0x1b
sbb eax, 0x60acedd0
cmpsd dword [rsi], dword [rdi]
add al, 0x2d
and eax, 0x933f0593
in eax, dx
jle 0x1403cd015
pop rsi
scasb al, byte [rdi]
iretd

Function at 0x1403e01c2
Capabilities:
Packed with generic packer

Disassembly:
push rcx
pushfq
neg r13d
mov qword [rsp + 0x28], 0x6a12e033
mov r13, qword [rsp + r13*4 - 0x5f17e70c]
movabs rcx, 0x6338fd86ba3f402a
jae 0x1403e01c2
add qword [rsp + 0x20], 0xffffffffbf775bc5
add cx, 0x2b10
or rcx, rcx
neg ecx
mov rcx, qword [rsp + rcx - 0x45c094be]
call 0x1403e01c2
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x30]
call fcn.140771367

Function at 0x1403e01d1
Capabilities:
Packed with generic packer

Disassembly:
lea rsi, [rsi + riz - 0x67e16ffb]
xor rdi, rdx
mov rsi, qword [rsp + 0x18]
Function at 0x1403e75d2
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
xor r11, 0x4d923831
push rbp
sub r11, r11
mov qword [rsp + r11*2 + 0x50], rsi
movabs rbp, 0x45b04282c6b8e4be
push rbp
push r14
shl r11d, 0xdd
mov r14, qword [rsp + 8]
add qword [rsp + 0x48], 0xffffffffffd6220b
sub bp, r14w
push r9
xor r11w, 0xadbf
push r10
or rbp, r11
mov rsi, qword [rsp + 0x58]
mov rsi, qword [rsi]
movabs r10, 0x7f114b809f9a93a3

Function at 0x1403ea6cd
Capabilities:
Encode data using base64

Disassembly:
shr word [rsp + rbp*2 + 0x5418], 0xf
mov qword [rsp + 0x48], rbp
shl edi, 0x87
neg bp
jb 0x1405231a1
xchg qword [rsp + 0x68], rdx
mov rbp, qword [rsp + rdi + 0x60]
jns 0x14059e770
shr byte [rsp + 0x18], 0x3f
jne 0x1405f169d
call fcn.14034d319

Function at 0x1403ee5e5
Capabilities:
Packed with generic packer

Disassembly:
movsx r10w, byte [rsp + 0x2b]
xchg qword [rsp + 0x60], rcx
mov r14, qword [rsp + r14 - 0x41610b9]
jb 0x14054c4da
jle 0x14070ae57
shr si, 0x4c
and r10, 0xffffffffcfb48a1b
mov rbp, qword [rsp + r10 + 0x3f5f7658]
xor byte [rsp + rsi*2 + 0x1e400028], 0x24
sub dword [rsp + rsi + 0xf200028], 0xc98dfe20
add qword [rsp + rsi + 0xf200040], 0xfbf2a
cmp word [rsp + r10*2 + 0x7ebeec28], si
call fcn.1405043ec
add qword [rsp], 0x1bfc31
push rbx
movabs rbx, 0x5ea3ec8d3bbc1da3
nop
push r14
movabs rax, 0xaba53806068e21b3
not al
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
sub bl, bl
call fcn.14070774c
cmp ebp, 0x9f05de3a
push r12
movabs r12, 0xef0bec3752121408
push r12
call fcn.1406d8bb5
movabs rax, 0x62827a0cd1173b10
shl eax, 0x9e
ja 0x14055ece8
cmp ax, 0xac22
call fcn.1405b5055
jae 0x14070ae16
movabs dword [0x3614c03f2b0b2428], eax
xor al, 0x3b
invalid

Function at 0x140408680
Capabilities:
Packed with generic packer

Disassembly:
lea rbx, [rbx + r12*4 + 0x52ae6c1b]
xor r12w, 0xad15
lea r12, [r12*8 + 0x2b934fa9]
mov rbx, qword [rsp + 0x38]
neg byte [rsp + 0x30]
add qword [rsp + 0x10], 0xffffffffbf9b0cc5
test word [rsp + 0x30], 0x2027
jg 0x140408671
mov r12, qword [rsp + 0x58]
setno byte [rsp + 0x30]
call fcn.1405e5927
sub edx, edx
jno 0x140607cfe
and word [rsp + 0x60], 0xc932
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x78]
ret
xor dl, byte [rsp + rdx*2 + 0x62]
test dword [rsp + rdx*4 - 0x314], edx
jl 0x140607f99
mov rdx, qword [rsp + rdx*2 - 0x17a]
test byte [rsp + 0x60], 0xa0
jle 0x140503119
Function at 0x14040fc58
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x28]
and dl, dl
sub dx, dx
push rdi
movabs rdi, 0x4e2eed20e230aca1
jl 0x1404a2379
movzx edx, dl
push r10
lea rax, [rax + 1]
setne dl
add qword [rsp + 0x10], 0xfffffffffffb30c9
and rdx, rdi
movabs r10, 0x6b882907ed026518
shr r10d, 0x6b
mov qword [rsp + r10*2 - 0x3b4060], rax
and dx, di
or r10d, edx
shl dl, 0x69
mov r10b, dil
neg r10b
push r10
neg di
add qword [rsp + 0x20], 0xffffffffffd9edd9
call fcn.14041edfb
sbb eax, 0x80bfa081
and eax, 0x5daa45cd
mov bh, ch
loop 0x14040fc7b
add dword [rdi], ecx
xchg ebp, eax
ret 0x8148
add al, 0xad
in eax, dx
stosb byte [rdi], al
push rdi
sub dh, byte [rsi]
cmp byte [rbp + 0x45], dl
in al, dx
adc al, ah
imul edx, dword [rbp - 0x30], 0x99aa413b
cld
sub byte [rbp + 0x25], dl
in al, 0x49
nop
retf 0x8aaa
not r13d
add qword [rsp + rdi + 0x40410020], 0xffffffffbfa7e670
shr dil, 0x6b
bswap r13
mov rdi, qword [rsp + rdi + 0x40410030]
je 0x14058ff94
call fcn.14066b9ed
add qword [rsp + 0x10], 0xffffffffbfcad256
add qword [rsp + 0x40], 0xffffffffbfba3360
test word [rsp + 0x50], 0x4cb1
not r13d
call fcn.140626aa2
neg qword [rsp + 0x28]
jl 0x14062f985
sbb edx, esp
mov ecx, 0xaf55a1c7
iretd
call fcn.1405c8057
iretd

Function at 0x14041709c
Capabilities:
Set registry value

Disassembly:
jns 0x1405a7a4c
add bx, bx
shr qword [rsp + 0x70], 0x1e
shr qword [rsp + 0x70], 0x69
mov rbx, qword [rsp + 0x30]
setbe byte [rsp + 0x70]
test word [rsp + 0x70], 0xe500
setae byte [rsp + 0x70]
setb byte [rsp + 0x70]
call fcn.1405aa20f
neg byte [rsp + rbx*8 - 0xf0]
mov rdx, qword [rsp + rdx*2 - 0x70]
mov rbx, qword [rsp + rbx + 0x44]
xor byte [rsp + 0x70], 0x95
shl bl, 0xb4
sub word [rsp + 0x70], bx
jae 0x1405847fc

Function at 0x14041cdde
Capabilities:
Set socket configuration

Disassembly:
mov r10, qword [rsp + r10 + 0x484a851a]
call fcn.1404ca360
push r11
push rdx
mov qword [rsp + 8], 0xffffffffe98d32ea
lea rsp, [rsp + 8]
call fcn.1407f2cfd

Function at 0x140431216
Capabilities:
Encode data using base64

Disassembly:
push r10
jg 0x1404720c0
ja 0x140431273
push rbp
mov ch, 0xf6
mov dh, 0x97
xchg byte [r14 + 0x18], bpl
nop
invalid
out dx, al
mov ebx, 0xd7b497b4
cmovo eax, dword [rbx]
push rbx
jle 0x140431279
ret
mov r12, qword [rsp + r9 - 0x1db9c6e1]
push r8
xchg qword [rsp + 0x60], rbp
mov r9, qword [rsp + r9 - 0x1db9c701]
jo 0x14062ead4
Function at 0x140439ed6
Capabilities:
Packed with generic packer

Disassembly:
and eax, 0xaaedcd
int3
xor qword [rsp + 0x20], 0xffffffffda11b1b6
shl word [rsp + 0x20], 0x28
cmp dword [rsp + 0x20], 0xf719308c
jo 0x140701767
je 0x140058052
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
ret
add qword [rsp + 8], 0xffffffffbf9af123
neg r15d
sub r14b, dl
mov rdx, qword [rsp + 0x30]
jb 0x140536659
add qword [rsp + 0x40], 0xffffffffffe49b4a
bswap r8
mov r8w, r15w
cmp r15, 0xffffffff953951ab
lea r13, [r14*2 + 0x4a3f3d17]
mov r8, qword [rsp + 0x58]
mov qword [rsp], 0xffffffffe03db73b
jno 0x14047e1db
int1
hlt
jne 0x1403726b5
mov r10, qword [rsp + r10*2 + 0x28]
jae 0x1404ed9fc
js 0x1404b1efa
test dword [rdi - 0x42], ecx
sub esi, 0x25
invalid
not dil
movabs rbp, 0xff3c5b9d952f39a2
or r15b, 0x21
push rdi
mov rdi, qword [rsp + 0x60]
mov rdi, qword [rdi]
jo 0x1405ea60a
jo 0x1403e0167
mov r8d, dword [rsp + 2]
je 0x1404192f1
lea rdi, [rdi - 0x25c163e0]
shl r14b, 7
lea rdx, [r14 + r15*8 + 0x660139bc]
setne dl
sub r15, qword [rsp]
mov r13, rdx
xchg qword [rsp + 0x68], rdi
mov rbp, qword [rsp + 0x18]
jg 0x1404b7cb6
add qword [rsp + 8], 0x27228
call fcn.1406d506e

Function at 0x140447ce9
Capabilities:
Set registry value

Disassembly:
push rcx
pushfq
add qword [rsp + 0x10], 0xfffffffffffc2ac0
movabs rbx, 0x789587b5ed04cd9e

Function at 0x140449759
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.14071c090
test dword [rsi], esi
cdq
in al, 0x25
invalid

Function at 0x14044b34c
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov r15, rsi
mov rsi, qword [rsp + r9 - 0x17881cf0]
mov rsi, qword [rsi + r9 - 0x17881d30]
test word [rsp + 0x18], 0xe03a
ja 0x140686016
and al, 0xfa
stosb byte [rdi], al
mov edi, 0x5517186e
ja 0x14044b344
mov edx, 0x73aa407d
iretd

Function at 0x14044b8f9
Capabilities:
Packed with generic packer

Disassembly:
lea rsp, [rsp + 0x18]
call fcn.1408697db

Function at 0x1404515b4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], 0x2a9f1b63
lea rsp, [rsp + 0x18]
call fcn.140837e71
Function at 0x140452c8d
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1406c05b5
mov esp, 0x579c90f2
cdq
sal byte [rsi + 0x3815791], cl
invalid
push rcx
and word [rsp + 0x20], cx
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
js 0x1406447a6
add qword [rsp + 0x10], 0x1130b9
neg byte [rsp]
je 0x1404d831b
cmp word [rsp + 0x20], r11w
mov rbp, qword [rsp + 8]
lea rsp, [rsp + 0x10]
ret 0x10
sub dword [rsp + 0x18], 0xbfab689d
xor byte [rsp + 0x18], 5
jl 0x1404a0bd9
call fcn.1405b4d1a
je 0x140429467
mov rbx, qword [rsp + 0x18]
js 0x1404a45a6
sub qword [rsp + 8], 0xffffffffac834c8d
call fcn.140374a80
neg bpl
push r14
neg byte [rsp + r14]
add qword [rsp + 0x18], 0x1eb31b
mov rdx, rbp
neg r12w
call fcn.140496a77
sbb edi, edi
mov dword [rdi], edi
push 0xffffffffbf5464ee
adc bh, dl
or al, 0xcb
add byte [rax + rcx*4 - 0x24], dl
jmp 0x1327bf06f
mov rdx, qword [rsp + r15 + 0x61950698]
mov rcx, qword [rsp + rdx - 0x11421d3]
mov rcx, qword [rcx + r15 + 0x61950670]
mov r12, qword [rsp + r15 + 0x61950698]
js 0x14049db80
mov ebp, 0x20b7b189
out dx, eax
jae 0x140452cc0
int 0xd3
mov ch, 0x62
invalid
cmp word [rsp + r12*4 - 0x45087e4], 0x4a86
mov qword [rsp + rdx*2 - 0x22843d6], rdx
ja 0x1405d38b8
test dword [rsp + r15 + 0x6195069c], edx
movzx r15w, byte [rsp + r15 + 0x619506a2]
lea rcx, [rcx + r15*2 + 0x64e775e7]
call fcn.1405b637f
cmp rbp, 0xf868382
nop
movabs rcx, 0xa834f73e972d6b88
jg 0x14041316b
setno cl
sub dword [rsp + rcx*2 - 0x6c0dff9a], 0x3939d28f
xor byte [rsp + rcx*2 - 0x6c0dff9a], 7
jbe 0x140525f14
neg word [rsp + rcx*2 - 0x6c0dff8a]
call fcn.140487af4
not r15d
neg byte [rsp + r15 - 0xdffff9d]
cmp qword [rsp + r15*2 - 0x1bffffb2], 0xffffffffff399eb7
call fcn.1404e25cf
neg byte [rsp + 0x10]
jb 0x1405e1bb1
and byte [rbx], bh
sbb al, byte [0xf7fac2b7]
invalid
add qword [rsp + 0x38], r15
mov r14, r12
je fcn.140420f6f
lea rdi, [rdi - 0x5e4489f1]
jne 0x140409f6c
movabs rbx, 0xd23b7a2166abc112
neg bl
mov rbx, qword [rsp]
mov qword [rsp + 0x28], rbx
jg 0x14063a3e2
mov qword [rsp], 0x213f0db9
or qword [rsp], 0x2bbc2035
cmp byte [rsp], 0x24
jns 0x14066cd29
call fcn.140704a78
mov qword [rsp], 0x4923e491
cmp dword [rsp], 0xb3a97635
not dword [rsp]
sete byte [rsp]
push rcx
test qword [rsp + 8], 0xffffffffb6af3da7
lea rbx, [rbx - 0x5e4489f1]
add qword [rsp + r10 - 0x73092988], 0x730
or dword [rsp + r10 - 0x73092968], 0xdf07a124
add qword [rsp + rbp - 0x208e000], 0xffffffffbfff9f00
add r10d, 0x9c992bab
mov rbp, qword [rsp + rbp*8 - 0x10470058]
setl byte [rsp + r10 - 0xfa25513]
jno 0x140447053
call fcn.1406e690b
neg qword [rsp + 0x18]
xchg qword [rsp + 0x20], rcx
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
ret
Function at 0x140464be6
Capabilities:
Packed with generic packer

Disassembly:
je 0x1404c340d
lea rdx, [rdx + r13*8 + 0x303b6822]
movsxd r15, dword [rsp + 0x30]
mov r15, qword [rsp + r15 - 0x1336111d]
and byte [rsp + 0x30], 0xaa
jg 0x1406685c7
pop rbx
pushfq
xchg qword [rsp + 8], rbx
call fcn.1404a1821
push rax
push r13
pushfq
movabs r13, 0xfe0f04b49726962b
neg r13
and r13, 0x26205791
js fcn.14065bcf3
call fcn.140552150
push r13
push r14
add qword [rsp + 0x28], 0x17ae9b
movabs r13, 0x17981296621bd11a
movabs rdx, 0x6c0080b5420237af
call fcn.14055491d
xchg esp, eax
invalid
mov r11, qword [rsp + r11 - 0x520beb78]
mov rdx, r13
and dl, r15b
xor byte [rsp + 0x30], 0xaa
jns 0x14041e8b6
jbe 0x140464b98
std
xor al, 0xcc
sbb esi, ebp
insd dword [rdi], dx
or cl, byte [rdx + 0x58bfbe8f]
outsd dx, dword [rsi]
out 0xba, eax
mov edi, 0x4273521a
out 0xac, al
wait
sbb ch, ah
iretd
neg r15d
neg r15d
mov rsi, qword [rsp + r15 + 0x28]
movabs r9, 0x4106663008018082
xor r15d, r15d
shr r9w, 0xd7
movabs r11, 0x38099da64425d133
or r15d, 0x4485a39d
lea rsi, [rsi + 1]
call fcn.140586145
sub dword [rsp + 0x30], edx
and r13w, dx

Function at 0x14047047d
Capabilities:
Get system information on windows
Packed with generic packer

Disassembly:
test word [rsp + 0x80], 0x20b8
je 0x140556a6d
push qword [rsp + 0xa0]
popfq
lea rsp, [rsp + 0xc8]
ret
je 0x1403ababa
seto sil
jl 0x1405a63d7
call fcn.1403ac7cb
lea rsp, [rsp + 0x48]
ret

Function at 0x140481806
Capabilities:
Get system information on windows

Disassembly:
mov rbp, qword [rsp + 8]
jle fcn.14047047d
jg 0x140663701
push rcx
pushfq
movabs rcx, 0x1f05f030380a09a5
mov rcx, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffbc3a40fe
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14071c090
add dword [rax + rcx], edx
add byte [rsp + riz*2], dl
or byte [rax], al
adc al, 0x54
invalid
test al, 0xa2
invalid
xor rdx, 0x75a25318
cmp dword [rsp + 0x28], esi
jle 0x1405c65b4
je 0x14066372f
sub byte [rdi], cl
mov fs, word [rdx - 0x80009d2]
fimul dword [rdi]
adc dword [rdx], 0x74000a97
fst dword [rax + 0x72]
invalid
neg edx
jno 0x14070ce2c
je 0x1406636f5
push rax
jb 0x140663709
jg 0x140663754
insb byte [rdi], dx
add bl, byte [rsi - 0x71]
stosd dword [rdi], eax
or byte [rcx + rbp], ah
mov ah, 0x2c
in al, 0xe3
invalid
push rbx
xor byte [r14 + 0x7aef1cae], r11b
invalid
and esp, edx
movabs al, byte [0xd6d09b8fa815fd98]
rcl dh, 1
nop
mov edi, 0x5d981c10
shl dword [rdi + 0x3dc2afb2], 1
call 0x14519c481
jne 0x14066375e
pop rbx
add dword [rcx], 0xffffffe2
movabs byte [0x668c65230bdc3820], al
and al, 0x47
sub al, 0xac
movsd dword [rdi], dword [rsi]
invalid
invalid
neg si
mov rdx, qword [rsp + 0x30]
call fcn.1403f56a8
jl 0x14070cdd6
retf 0xc5dc

Function at 0x140481a14
Capabilities:
Packed with generic packer

Disassembly:
or r14w, si
cmp word [rsp + rdx*4 - 0x27fffb0], 0x8913
js 0x140415fb3

Function at 0x140487758
Capabilities:
Encode data using base64

Disassembly:
jle 0x1405b42c6
jle 0x1406d8b87
test r9d, 0x5f3fe618
not r9b
lea rdi, [rdi + 0x3bbbb13c]
mov qword [rsp + r9*2 - 0x3d1380ac], r12
jl 0x14047e5f3
neg word [rsp + 0x20]
and dword [rsp + r13*8 - 0x50440], 0xa39d860f
call fcn.14060f2ca
pop rcx
invalid
jae 0x1406c923a
Function at 0x140489650
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffae386720
pushfq
shr qword [rsp + 8], 0x9f
mov dword [rsp + 8], 0xde00c389

Function at 0x1404907e4
Capabilities:
Encode data using xor

Disassembly:
movzx r13, r13w
movzx ebp, bp
mov qword [rsp + r13*4 - 0xd634], r13
jle fcn.1406ee543
call fcn.140667253
sar rdi, cl
cmp eax, 0x53ecde4d
test eax, 0xa7ebc04c
call 0x14a622c59
jnp 0x140490849
push 0xffffffffe4f97207
mov bl, 6
je 0x1404907e5
iretd
stc
pop rsi
sub dword [rbx + 0x7a], eax
int 0x35
mov ch, 0xfb
push rdx
invalid

Function at 0x140498748
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 0x20], 0x860e
shr si, 0xec
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + rsi - 0x61e3fff6]
push qword [rsp + rsi - 0x61e3fffe]
popfq
shr dx, 0x89
jns 0x140361c00
or bpl, 0x8c
add r8d, 0x17859fab
add rbp, 0xffffffff959093b7
shr r8b, 0x36
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + r8 - 0x23e5fa00]
shl r8w, 0xf
mov qword [rsp + r8*2 - 0x47c9fff8], r8
js 0x1404f01e8
push r15
jne 0x14058fe94
add word [rsp + r8*2 - 0x47c9fff0], 0x5f29
lea rbp, [rbp + r8*2 - 0x223c81c9]
mov r15, qword [rsp + r8*2 - 0x47c9fff0]
jl 0x14045f736
neg r8d
or qword [rsp + r15*2 - 0x47cabe42], r15
or r15, qword [rsp + r15*2 - 0x47cabe42]
shr r15w, 0xf0
xchg qword [rsp + r15 - 0x23e4ffd8], rbp
mov r15, qword [rsp + r15*2 - 0x47ca0000]
shr r8b, 0xff
lea r8, [r8 + r8 + 0x31d23a2]
call fcn.14056878b

Function at 0x140499780
Capabilities:
Encode data using xor

Disassembly:
xor rdx, qword [rsp + 0x10]
xchg qword [rsp + rdx - 0x29e8], rax
mov r12, qword [rsp + 0x28]
call fcn.1404731a7
sete r12b
lea r12, [rax + rdx*8 - 0x49652e4b]
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
test r12d, 0xf3844729
not rdx
mov qword [rsp + 0x10], rdx
mov dx, r12w
lea rax, [rax + 0x52bb90b4]
seta r12b
neg r12w
sets r12b
or r12w, dx
shl r12d, 0x54
jne 0x1403c05e5

Function at 0x14049d694
Capabilities:
Packed with generic packer

Disassembly:
or r14d, r14d
push 0x2838ce86
mov r14, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffe9a78f82
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407f2cfd

Function at 0x14049d6b9
Capabilities:
Packed with generic packer

Disassembly:
movabs r8, 0x6a87bb1c38b13708
push r10
jbe 0x1405074a7
or r10w, r10w
call fcn.1406a73ef

Function at 0x1404a4591
Capabilities:
Packed with generic packer

Disassembly:
jo 0x1406aa27a
mov word [rsp + rcx - 0x3606ffe0], 0xd504
mov rdi, qword [rsp + 0x30]

Function at 0x1404b39f3
Capabilities:
Set registry value

Disassembly:
xor dword [rsp + 0x40], 0x4b08e114
cmp esi, dword [rsp + 0x43]
jbe 0x140594bc0
mov rsi, qword [rsp + 0x48]
jne 0x1406b3e85
pushfq
shl r13b, 0x73
test r13w, r13w
mov qword [rsp + r13*8 + 0x20], rcx
movabs r13, 0x59344f36cf092e00
push rbp
mov rbp, r13
push r13
call fcn.1406f4bfd