joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14047a618
Capabilities:
Encode data using base64

Disassembly:
shl rdx, 0xb7
lea rdx, [rsi + riz - 0x1ef5c95b]
jbe 0x1405739aa
sub esi, 0xf3bd2823
push 0xffffffff942d8d2a
push r12
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbp
or qword [rsp + 8], 0xffffffff92aa0a02
call fcn.140265518

Function at 0x14047d017
Capabilities:
Authenticate hmac

Disassembly:
test r11d, r11d
jl 0x140500aa1
mov qword [rsp + 0x20], r11

Function at 0x14049983d
Capabilities:
Set thread local storage value

Disassembly:
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
not rdi
bswap edi
mov rdi, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x72da089d
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1406fa391
setns byte [rsp + 0x18]
and word [rsp + 0x18], 0xbf0c
cmp dword [rsp + 0x18], 0xbba2ae1e
js 0x140565791
neg dword [rsp + 0x18]
or word [rsp + 0x18], 0x6e36
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret
call fcn.14050c634
movabs rbx, 0xc1bedcb29f90c400
xor bl, bh
je 0x140068f48
jg 0x1404c328c
test bh, bl
push rdi
push rbp
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
call int.14047d484

Function at 0x1404a067d
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1404139b8
call 0x14028b4d1
setl byte [rsp + rdi - 0xffdf]
jge 0x14030723c
sub qword [rsp + rdi*8 - 0x7ffd8], rdi
mov rdi, qword [rsp + rdi - 0xffaf]
or qword [rsp + 0x20], 0xffffffffcf2731aa
test qword [rsp + 8], 0x20080c27
not word [rsp + 8]
call fcn.14003f44f

Function at 0x1404a65c9
Capabilities:
Packed with generic packer

Disassembly:
add r15w, 0xcda6
xor r15w, r15w
sub r15w, 0xa797
lea r15, [r15 + r15*2 - 0x405fbece]
or r15b, 0xba
call fcn.1405c02e7
pushfq
add qword [rsp + 0x28], 0x276d60
movabs rax, 0xc0271ae29871536
and al, al
jb 0x1404693aa
or rax, rax
shl rax, 0xff
shl rax, 0xd9
mov eax, 0xfb9a5905
neg rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], 0x59d913e
cmp qword [rsp + 0x28], 0xffffffffae0cbd3e
push r15
jo 0x14044d88f
lea rax, [rax + 0x2b824233]
mov r15, qword [rsp + 0x30]
push r11
add r15w, word [rsp + r15*2 - 0xb3b2240]
shr dword [rsp + r15 - 0x59d9106], 0xcd
shl dword [rsp + r15*2 - 0xb3b2244], 0x89
xchg qword [rsp + r15 - 0x59d90fe], rax
mov r15, qword [rsp + r15 - 0x59d9136]
setb byte [rsp + 0x38]

Function at 0x1404b11bf
Capabilities:
Authenticate hmac

Disassembly:
test sil, 0xe
add qword [rsp + 0x18], 0xfffffffffff00431
cmp rsi, 0x7a4273b
movabs rbx, 0x7fb434a2bd12b705
je 0x1404e827f
neg rbx
cmp bx, 0xa336
movabs r8, 0xae918c361494a7bb
call fcn.14048674c
push rbx
pushfq
movabs rbx, 0x87b8c40a31abaa31
add bl, 0x23
mov rbx, qword [rsp + 8]
mov qword [rsp + 8], 0xfffffffffcc8c1c0
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14065ba29
push rdx
seto byte [rsp + r11*2 - 0x4708ee04]
cmp byte [rsp + r11*2 - 0x4708ee0c], 0x8d
xchg qword [rsp + r11 - 0x238476d2], rbp
mov r11, qword [rsp + r11*2 - 0x4708ee24]
call fcn.14044b761

Function at 0x1404b62b2
Capabilities:
Terminate process

Disassembly:
jae 0x1400512d2
call 0x14055cd56
Function at 0x1404bf2ad
Capabilities:
Authenticate hmac

Disassembly:
sub bx, bx
neg bx
lea rbx, [rbx*8 - 0x6ebf4c2]
add qword [rsp], 0xfffffffffff00ffa
movabs rbp, 0xe48e9798e28892bb
call fcn.1403a1d82

Function at 0x1404c29e6
Capabilities:
Encode data using base64

Disassembly:
and bl, 0x27
bswap r14
jb 0x1404eff45
lea rax, [rax + 0x11abc5ab]
or rbx, rdi
jne 0x1404c2c76
shl rbx, 0x64
nop
movabs rax, 0xfaa6f82fc83ea4b3
push rdi
shr bl, 0x26
movabs rdi, 0xdd27f7be77a83fb0
add eax, eax
xor bx, 0xa387
push r14
sub eax, 0xd4a24283
movabs r14, 0x9ac39b25538dc22
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
not r14b
shr r14, 0x50
add qword [rsp + 0x10], 0xffffffffbfbeb045
cmp r14d, edi
jne 0x1403c2f1e

Function at 0x1404c2c37
Capabilities:
Encode data using base64

Disassembly:
call 0x14045ea40
movzx r14, word [rsp + r14 + 0x40]
setne r14b
add bp, 0x5a9b
or word [rsp + r14*8 + 0x68], bp
add cx, word [rsp + r14 + 0x6c]

Function at 0x1404ce3ef
Capabilities:
Encode data using base64

Disassembly:
setbe byte [rsp + 0x38]
neg word [rsp + 0x38]
jg 0x1405838a1

Function at 0x1404d34b7
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [rax + rsi*2]
adc al, 0xc0
lahf
pop rbx
cdq
add eax, dword [rcx]
retf
jne 0x14048a12c
jb 0x14002b186
add dword [rax - 0x75], ecx
lea esp, [rax]
invalid
and r8, r8
xchg qword [rsp + 0x88], rax
mov r9, qword [rsp + 0x40]
call fcn.1405129c6
push r8
lea rax, [rax - 0x45d0ce6f]
jne 0x140599243
sub bh, cl
xor al, 0x4d
add bl, ah
xor al, 0x4d
add byte [rdx], cl
or ah, byte [rax + 0x1a]
add byte [rax], al
xor byte [rsi], 0xc4
push rsp
add eax, 0x6a605800
invalid
ja 0x14002b1ce
invalid

Function at 0x1404d7b34
Capabilities:
Authenticate hmac

Disassembly:
not sil
lea r10, [r8 + rsi*4 + 0x4682cb25]
lea r10, [r10 + rsi*2 - 0xc6da900]
jne 0x1403d363e
setns byte [rsp + rsi - 0x1100ffb7]
call fcn.1403ce606

Function at 0x1404e012a
Capabilities:
Authenticate hmac

Disassembly:
mov r13, qword [rsp + 0x28]
add qword [rsp + 0x18], 0xffffffffffef9b2e
movabs rdx, 0xdb85971009a98f1f
call fcn.140569c96
jl 0x14033cc2f
and sil, cl
mov rdi, qword [rsp + 0x48]
add word [rsp + rcx*2 - 0x7a6725f6], 0x589e
call fcn.1403fbfe7

Function at 0x1404eeafa
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x30]
pushfq
add sil, 0x81
call fcn.1403ce6db
xor ebp, dword [r8 + rax*2 + 0x57adfeea]
invalid

Function at 0x14050391c
Capabilities:
Encode data using base64

Disassembly:
jbe 0x14050972e
call fcn.1403424d8
movabs r15, 0x10fd334d530e213
not r15w
shl r15d, 0x46
movabs r15, 0xe7a3739a811f5685
xor r15b, 0x10
mov r15, qword [rsp]
call fcn.1405bb384

Function at 0x140505345
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
jle 0x140370ca4
jbe 0x140360ecb
mov r13, qword [rsp + 0x40]
or qword [rsp + 0x30], 0xffffffffb58ecb0e
jns 0x1403f2822
call fcn.140341492
Function at 0x1405096d8
Capabilities:
Encode data using base64

Disassembly:
call fcn.14048b9c7
setle r12b
mov r12d, dword [rsp + r12 - 0x752cffc0]
mov r12, qword [rsp + r10 - 0xff3a]
lea r10, [r10 + r10 + 0x4300421a]
mov r10, qword [rsp + r10 - 0x430240ee]
sub r10w, word [rsp + 0x43]
shr word [rsp + 0x40], 0x4d
shl r10d, 0xad
call fcn.14054f3cc

Function at 0x14050973d
Capabilities:
Encode data using base64

Disassembly:
mov r10, r11
movabs rcx, 0xf528a62aeea1a712
push rcx
shl r10b, cl
lea rdx, [rdx + 1]
cmp r11d, 0xc9941b9c
movsx rcx, r10b
push r11
jb 0x140361cda
je 0x14057ee38
lea r10, [rcx + r9 - 0x33f64afb]
mov qword [rsp + rcx + 0x48], rdx
sub r11b, r10b
setno r9b
ja 0x1405209ce
add qword [rsp + 0x28], 0xcbad3
mov qword [rsp], rcx
nop
movzx r11w, r10b
movzx r11, word [rsp + rcx*4 + 8]
test qword [rsp + rcx*4], rcx
push rcx
not cx
call fcn.1402f4627
invalid
push rcx
neg r9b
mov rdx, qword [rsp + 0x30]
push r10
jbe 0x14002bcb7
cmp dword [rsi - 0x13dcd607], ecx
jg 0x1402a71f0
test ebx, esp
sbb ebx, edi
or ebp, ecx
pop rbp
jb 0x1402a7299
retf 0x9e4a
push rcx
sti
and eax, 0xda414866
iretd
movabs r11, 0x6392d107f88c833e
pushfq
mov r9, r11
cmp r9d, 0xb6b48c25
jns 0x1402a7227
pushfq
shl bx, 0xea
js 0x140382a18
neg ebx
add bl, 0x3d
mov rbx, qword [rsp + rbx - 0x4a32b025]
mov qword [rsp + 0x18], 0xfffffffff7f2e3c4
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1405f37aa

Function at 0x14050a068
Capabilities:
Authenticate hmac

Disassembly:
sub dword [rsp + rcx + 0x40], 0x69904894
shl r14w, 0x5b
call fcn.14000ac53
call fcn.1403d7589
pushfq
movabs rbx, 0x8c195d3c209cb7a1
push rsi
push r14
push r12
call fcn.1405096d8
jne 0x140426a2b
shr dword [rsp + rbx + 0xb69], 0xae
shl r14d, 0x85
lea rbp, [rbp + rbx - 0x42c04876]
push 0x262aa0ae
jns 0x1402dde06
test dword [rcx + 0x7eb69ed5], esi
retf

Function at 0x14050a3fa
Capabilities:
Enumerate processes

Disassembly:
lea r10, [r10*8 + 0x6289e8aa]
cmp r10w, 0x6829
bswap r10d
Function at 0x14051207c
Capabilities:
Get geographical location

Disassembly:
adc eax, 0x93d4f7
test byte [rbp - 0x20], 4
jne 0x140076864
mov dword [rbp - 0x20], r12d
jmp 0x140076864
cmp dword [rbp - 0x20], r12d
je 0x140076949
lea rax, [r14 + 0x100]
neg r14
lea rdx, [rbp - 0x20]
sbb rcx, rcx
and rcx, rax
call fcn.14007650c
mov ebx, eax
test eax, eax
je 0x140076949
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x140076949
mov ecx, dword [rbp - 0x1c]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x140076949
test r15, r15
je 0x1400768c0
mov dword [r15], ebx
mov ecx, dword [rbp - 0x1c]
lea rdx, [rsi + 0x2f0]
xor r9d, r9d
lea esi, [r9 + 0x55]
mov r8d, esi
call fcn.140069100
test rdi, rdi
je 0x140076942
mov ecx, dword [rbp - 0x1c]
lea rdx, [rdi + 0x120]
xor r9d, r9d
mov r8d, esi
call fcn.140069100
mov ecx, dword [rbp - 0x1c]
mov esi, 0x40
mov r9d, esi
mov r8, rdi
mov edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140076949
mov ecx, dword [rbp - 0x18]
lea r8, [rdi + 0x80]
mov r9d, esi
mov edx, 0x1002
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140076949
lea rdx, [rdi + 0x100]
mov ecx, ebx
lea r9d, [rsi - 0x36]
lea r8d, [rsi - 0x30]
call fcn.14007a254
mov eax, 1
jmp 0x14007694b
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140050ed0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
add ebp, 0xa3163914
jns 0x140076840
xchg qword [rsp + 0x38], rdi
mov rbp, qword [rsp + 0x18]
or byte [rsp + 0x28], 0x91
cmp dword [rsp + 0x28], 0x1ca7b12b
mov qword [rsp + 0x10], 0x38054992
jo 0x14038f78e
call fcn.1405bf4be
jge 0x1403bb5e2

Function at 0x140514b3c
Capabilities:
Read file on windows

Disassembly:
add qword [rsp], 0xffffffffffca2dbe

Function at 0x14051c15d
Capabilities:
Encode data using xor

Disassembly:
xor word [rsp + 0x40], 0x2295
mov rbx, qword [rsp + 0x30]
jne 0x1405af976
pop rbp
and dword [rax], ecx
add al, byte [rax]
or byte [rcx + rbp], dl
xor byte [rdx], al
and byte [rax], al
invalid
add byte [rsp + 0x40], 0x39
shl word [rsp + 0x40], 0x6d
not dword [rsp + 0x40]
call fcn.1404923c7
mov bp, 0x81b8
call fcn.14045892a

Function at 0x140528bd7
Capabilities:
Authenticate hmac

Disassembly:
leave
scasd eax, dword [rdi]
scasd eax, dword [rdi]
xchg ebp, eax
invalid
add dword [rsi - 0x55b3aa56], edx
lodsb al, byte [rsi]
adc eax, 0xc565e99e
push rsp
stosb byte [rdi], al
or esp, dword [rdx + 0x11]
movabs al, byte [0xf796a93fc7814115]
add r15d, 0xf796a93f
call fcn.1403d8ac8
jle 0x14059f1e5
setne sil
mov qword [rsp + 0x10], 0xffffffff99072ffb
mov rsi, qword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1405eef85
xor ebx, ebp
jge 0x140528ba8
and dword [rcx], ebp
xchg ecx, eax
clc
movsd dword [rdi], dword [rsi]
jle 0x140528bb8
mov fs, word [rbp - 0x1c733ebf]
jne 0x140528c6b
scasd eax, dword [rdi]
cmpsb byte [rsi], byte [rdi]
invalid
xor esi, edi
invalid

Function at 0x14052a805
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + r13 + 0x50], rbx
or word [rsp + 0x60], 0x8327
jb 0x14056ebad
call fcn.14051aad3
outsb dx, byte [rsi]
ret
Function at 0x14052f92e
Capabilities:
Encode data using xor

Disassembly:
push r15
pushfq
mov qword [rsp + 0x30], 0xffffffff96998305
jne 0x1405974bd
seta byte [rsp + 0x30]
lea rax, [rax + 0x63144d04]
push r11
jo 0x14048ba86
mov r11, qword [rsp + 0x38]
add byte [rsp + r11 + 0x69667d38], r11b
sub word [rsp + r11 + 0x69667d38], r11w
xchg qword [rsp + r11 + 0x69667d40], rax
mov r11, qword [rsp + r11 + 0x69667d00]
test dword [rsp + 0x38], 0xf2056a85
call fcn.14058b507
add dword [rax], 2
int3
in al, 0xff
lea rax, [rax + rdi*4 - 0xcf52515]
bswap edi
call fcn.1402848c5
and dword [rax], eax
add byte [rax], al
jo 0x140597523
and byte [rax], al
mov ss, word [rcx + 0x20]
add byte [rax - 5], al
cmp eax, dword [rax]
fcom dword [rdx + riz*8 - 0x7a]
loop 0x1405974ad
add ebx, esp
jae 0x140597576
pop rax
xor ah, al
imul r13d
insb byte [rdi], dx
adc eax, 0x77a0388e
xor rdx, qword [r14]
loope 0x140597537
invalid
jbe 0x140597525
invalid

Function at 0x140547375
Capabilities:
Packed with generic packer

Disassembly:
and qword [rsp + 0x28], r14
xor r10, r14
jno 0x1404eaab0

Function at 0x14055cd4c
Capabilities:
Packed with generic packer

Disassembly:
mov bx, 0x96b3
setge bl
mov bl, 0xa
mov rdx, qword [rsp + 0x18]
neg ebx
jae 0x14059980c
not bx
call fcn.14051ed51
lodsd eax, dword [rsi]
xchg r13, rax
xlatb
iretd
movsx dx, dl
ja 0x14058aa5c
lea rsi, [rsi + rdi - 0x5aaa665d]
or dil, dil
not qword [rsp + 0x18]
jo 0x140328cfa
jbe 0x1402cf455
mov qword [rsp + 0x30], rbx
xchg qword [rsp + 0x40], rsi
mov rdi, qword [rsp + 0x38]
call fcn.1402e7d1d
shr rdx, 0x81
setle dl
jl 0x140557799

Function at 0x140565787
Capabilities:
Set thread local storage value

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffffffd7ca

Function at 0x140569ec8
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
pushfq
add qword [rsp + 8], 0x2bf154
push rbx

Function at 0x14056bdca
Capabilities:
Encode data using xor

Disassembly:
pop rdi
and eax, 0xadf0726b
mov ecx, 0x82474ff
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1405eef85
js 0x140327f3b
add ebx, ebx
not word [rsp + rbx - 0x5f43ffd0]
call fcn.140544348
call fcn.140385f8e
jg 0x14056bd9f
xchg r15d, eax
xchg ebp, eax
invalid
Function at 0x140576d0e
Capabilities:
Read file on windows

Disassembly:
mov rdi, qword [rsp + 0x20]
shl byte [rsp + r15 - 0x7fffd7], 0x70
and r15, 0xffffffff910919b1
mov r8b, byte [rsp + r15 - 0x91983]
jle 0x14045115d
mov r10, qword [rsp + 0x40]
add qword [rsp + r15 - 0x91969], 0xffffffffbfd655bc
mov r8, qword [rsp + r15*2 - 0x123362]
add qword [rsp + r15*2 - 0x12335a], 0xffffffffbfbaa9be
mov word [rsp + r15*4 - 0x246684], 0xb127
cmp word [rsp + 0x50], r10w
lea r15, [r15*4 - 0x73f3a678]
jae 0x1403961bf
and r10d, r15d
mov r10, qword [rsp + r15 + 0x73cf3fc4]
mov word [rsp + r15 + 0x73cf4004], 0xbc1e
add word [rsp + r15 + 0x73cf3fdc], 0xe239
sub r15d, 0x89154881
call fcn.1405055a9
mov rdx, qword [rsp + 0x10]
push r10
pushfq
movabs r10, 0xe61e1a0af0269384
cmp r10b, 0x8b
ja fcn.1405b2c17
lea rdx, [rdx + 1]
or r10d, r10d
call fcn.1403539f0
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], rdi
push r8
jns 0x140487d5f
push rdx
call fcn.1405c0de4
and qword [rsp + 0x28], 0xffffffffe0b0f13f
xor bp, bp
je 0x140499ffd
mov rbp, qword [rsp + 0x20]
and dword [rsp + 0x28], 0xe70e6d38
add qword [rsp + 8], 0xffffffffbfaf4d36
and byte [rsp + 0x28], 0xab
add qword [rsp + 0x18], 0xffffffffbfac32c6
not dword [rsp + 0x28]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
jo 0x1402b49fc
mov r12, qword [rsp + 0x28]
jns 0x1405402e4

Function at 0x14057b8e6
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x48], rsi
mov r12, qword [rsp + 0x40]
neg qword [rsp + 0x28]
shr byte [rsp + 0x28], 0x6c
xor rdi, qword [rsp + 0x28]
call fcn.1402eb026
push rbx
push r12
pushfq
movabs r12, 0x73188b257683a828
sub r12w, r12w
sete r12b
call fcn.140539a8b
add rdi, qword [rsp + rdi - 0x61296c83]
jns 0x14051f119
jg fcn.1404bf2d3
ja 0x1402a1029

Function at 0x14058a839
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push 0xffffffff8f99b28d
call fcn.14028a2e4

Function at 0x140590191
Capabilities:
Encode data using xor

Disassembly:
xor byte [rbp + 0x24648d48], bl
cmp bl, al
movabs rbx, 0x303e973e6006a48e
pushfq
sub ebx, ebx
add qword [rsp + rbx*4 + 0x30], 0xfffffffffffc72c0
push rcx
mov qword [rsp + rbx + 0x50], rcx
movabs r9, 0x9b8900930e0c4b80
neg bx
lea r9, [r9 + rbx*8 + 0x569a9798]
shr r9b, 6
add qword [rsp + 0x40], 0x9db28
and r9d, r9d
call fcn.140511c8e
xchg ebx, eax
jno 0x140590189
call 0xd375ba7b
fst qword [rbp + 0x3f]
sbb byte [rax + 0x6b99b32], dh
sub eax, 0x3da9c4df
leave
mov ah, 0x18
mov edi, 0x2d0a6b35
leave
ror dl, 1
stc
cmc
je 0x140590223
adc byte [rbx - 0x6e9b9688], ch
adc esi, dword [0x186279af9]
pop rbx
add dword [rax + 0xc], edi
fsubr qword [rbp + rdx*2 + 3]
add dword [rcx + rdi*4 - 0x466ce43c], ebp
invalid
xchg edi, eax
invalid
Function at 0x140595be7
Capabilities:
Enumerate processes

Disassembly:
and al, 0x20
adc al, 0x40
invalid
call fcn.140590827
int1
rol dword [rsi + 0x5a], cl
jo 0x140435644
js 0x1404356b7
cmp cl, byte [0x10627049c]
invalid
jrcxz 0x140435710
in al, dx
invalid
cli
add esp, dword [rcx + riz*2 - 0x1a]
test dword [rbx + 0x48809c5b], esp
xchg ebx, eax
ret 0xfa10
js 0x14043568f
je 0x140370cca
shr qword [rsp + 0x20], 0x9f
mov r14, qword [rsp + 0x10]
test r8d, r8d
lea r8, [r8 + riz - 0x41e7e77e]
cmova r8, qword [rsp + r8 - 0x59f26662]
call fcn.140533d47
push rbx
mov rbx, qword [rsp + 0x18]
sub bx, word [rsp + rbx - 0x53c2dd]
setbe bl
shl rbx, 0xf3
lea rbp, [rbp + 1]
call fcn.1403caeaa

Function at 0x140599828
Capabilities:
Check for software breakpoints

Disassembly:
test r12b, 0x30
mov r12, qword [rsp + 0x18]
call fcn.140322e26
setb byte [rsp + r12*2 + 0x66]
sub r12d, dword [rsp + r12 + 0x6a]
add qword [rsp + 0x68], 0xffffffffc51c809c
mov r12, qword [rsp + 0x78]
setl byte [rsp + 0x68]
neg qword [rsp + 0x68]
call fcn.1404253e4
mov r8, qword [rsp + 0x10]
movabs r12, 0x843006387d27e705
je fcn.14053156c
seta r12b
jg 0x1402675aa
push reloc.WS2_32.dll_WSAGetLastError
not qword [0xd0270f39]
push rdi
add eax, 0x8621f97
movabs al, byte [0x205edf5ffa20407d]
invalid

Function at 0x140599856
Capabilities:
Check for software breakpoints

Disassembly:
test r12b, 0x30
mov r12, qword [rsp + 0x18]
call fcn.140322e26
setb byte [rsp + r12*2 + 0x66]
sub r12d, dword [rsp + r12 + 0x6a]
add qword [rsp + 0x68], 0xffffffffc51c809c
mov r12, qword [rsp + 0x78]
setl byte [rsp + 0x68]
neg qword [rsp + 0x68]
call fcn.1404253e4
mov r8, qword [rsp + 0x10]
movabs r12, 0x843006387d27e705
je fcn.14053156c
seta r12b
jg 0x1402675aa
push reloc.WS2_32.dll_WSAGetLastError
not qword [0xd0270f39]
push rdi
add eax, 0x8621f97
movabs al, byte [0x205edf5ffa20407d]
invalid

Function at 0x14059dc12
Capabilities:
Encode data using xor

Disassembly:
push rcx
xchg edi, eax
invalid
fld st(6)
test eax, 0x22cf79e3
cmp eax, 0x7ab30c7b
pop qword [rdi + rax + 0x102474ff]
push qword [rsp + 0x10]
jp 0x14059db9f
test byte [rdi], al
seta byte [rsp + 0x28]
jne 0x1405947b3
fcomp qword ds:[rdx + rdi - 0x9c2ac6c]
push rbx
mov dh, 0x53
cmp ah, cl
pop rdi
push rbx
add al, 0x4d
rcl byte [rsi - 0x47], 0x66
scasd eax, dword [rdi]
scasw ax, word [rdi]
pop rax
xchg esp, eax
cld
xor ebx, dword [rax - 0x2d]
test dword [rsp + rdi], edi
mov esp, 0x6d1b0209
ja 0x14059dc0e
cmp qword [rdi + r8 + 0x435d01dd], 0xffffffff88a63c83
jl 0x14059dc03
test bl, 0x40
mov dh, 0xa1
jrcxz 0x14059dcc2
mov ecx, 0xac1fbe45
movabs al, byte [0x3fa487658a33d1d0]
movabs al, byte [0xdb9d7ac2a746e52f]
cmp bh, byte [rdx - 0x6e]
mov edi, 0x15adf655
push rbx
hlt
cmpsd dword [rsi], dword [rdi]
pop rbp
std
jns 0x14059dc53
invalid
Function at 0x14059dc34
Capabilities:
Encode data using xor

Disassembly:
push rcx
xchg edi, eax
invalid
fld st(6)
test eax, 0x22cf79e3
cmp eax, 0x7ab30c7b
pop qword [rdi + rax + 0x102474ff]
push qword [rsp + 0x10]
jp 0x14059db9f
test byte [rdi], al
seta byte [rsp + 0x28]
jne 0x1405947b3
fcomp qword ds:[rdx + rdi - 0x9c2ac6c]
push rbx
mov dh, 0x53
cmp ah, cl
pop rdi
push rbx
add al, 0x4d
rcl byte [rsi - 0x47], 0x66
scasd eax, dword [rdi]
scasw ax, word [rdi]
pop rax
xchg esp, eax
cld
xor ebx, dword [rax - 0x2d]
test dword [rsp + rdi], edi
mov esp, 0x6d1b0209
ja 0x14059dc0e
cmp qword [rdi + r8 + 0x435d01dd], 0xffffffff88a63c83
jl 0x14059dc03
test bl, 0x40
mov dh, 0xa1
jrcxz 0x14059dcc2
mov ecx, 0xac1fbe45
movabs al, byte [0x3fa487658a33d1d0]
movabs al, byte [0xdb9d7ac2a746e52f]
cmp bh, byte [rdx - 0x6e]
mov edi, 0x15adf655
push rbx
hlt
cmpsd dword [rsi], dword [rdi]
pop rbp
std
jns 0x14059dc53
invalid

Function at 0x14059f186
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [rdx + rdx*2 - 0x755c9650]
mov cx, dx
bswap rdx
mov qword [rsp + 0x30], rsi
movabs r10, 0x342f6217e43b292c
movabs r15, 0x30990f0fbdb4699c
push rdx
and qword [rsp], 0x521b84af
sub r10d, 0x270f682f
call fcn.1403af94c
neg word [rsp + rdi + 0x58daf380]
neg bpl
call fcn.14053eac8
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406fa391
push rdi
call fcn.140559b49
push r15
push 0xffffffffc3bcbd29
mov r15, qword [rsp]
pushfq
sub word [rsp + r15 + 0x3c4342df], 0xf633
test dword [rsp + r15 + 0x3c4342df], 0xb90acf22
jg 0x14059f1a8
xor r15w, word [rsp + r15*2 + 0x788685b6]
mov qword [rsp + 0x18], 0x399152a
mov r15, qword [rsp + r15 + 0x3c438431]
popfq
call fcn.1403bafd3
shr word [rsp + rbp*2 + 0x53e5f818], 7
mov qword [rsp + rdi + 0x58daf378], rbp
lea rax, [rax + rbp*2 - 0x2b195e4c]
push rdi
je 0x1402697ae
and ebp, edi
jae 0x1403f09f4
cld
loopne 0x14059f25c
xchg edi, eax
add bh, byte [rax - 0x5447a126]
neg byte [rbp - 0x40]
invalid
invalid
Function at 0x1405a604f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
add qword [rsp + rdi - 0xfff7], 0xfffffffffff3c3b7
xor ebp, ebp
xchg qword [rsp + rbp*8 + 0x70], rdx
mov r14, qword [rsp + 0x58]
jb fcn.1404c3297
js 0x140338277
lea rbp, [rbp*8 - 0x105945e9]
jno 0x140321900
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
test bl, 0xb7
not rsi
jg 0x14037db1e
cmp ebx, 0xbd8b6d9b
setne bl
lea rdx, [rdx + 0x1614a30e]
add ebx, 0x523ce798
shl rsi, 0x63
or bl, 0x24
mov qword [rsp + 8], rbx
push rbx
test qword [rsp + 0x10], 0x63a1ddbb
xchg qword [rsp + rbx - 0x5f6398d], rdx
mov rbx, qword [rsp + rbx*2 - 0xbec7352]
mov sil, byte [rsp + 5]
call fcn.14049a20e
cmp rbp, 0xfffffffffebff709
call fcn.140286345
shr dword [rsp + rdx - 0xf1c3b98], 0xfc
add dword [rsp + rbx - 0xf1c2924], 0x1f04892b
je 0x140543055
shl bx, 0x6f
shr rdx, 0x85
mov rdx, qword [rsp + rbx*4 - 0x3c6fffa0]
add qword [rsp + rbx - 0xf1bffc8], rbx
xor byte [rsp + rbx*2 - 0x1e37ffc8], 7
sub dword [rsp + rbx - 0xf1bffc8], 0xce9748a5
call fcn.14055cd96
and r12w, 0x9f00
mov r12w, 0xf3a1
lea rax, [rax + 1]
and r12d, r12d
neg r12
add qword [rsp + r12 + 0x1b3af3b1], 0x13fa05
call fcn.1405855f2
invalid
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
add qword [rsp + 8], 0xfffffffffff9ac32
or r13d, 0x4c2e28bb
lea rsp, [rsp + 8]
ret
lea rsp, [rsp + 0x18]
ret
mov qword [rsp + rdi - 0xffb7], r14
jge 0x1402c771d

Function at 0x1405b46e5
Capabilities:
Read file on windows

Disassembly:
jo 0x14006ce4d
mov rdi, qword [rsp + 0x30]
cmp r12, 0x19a73786
call fcn.14029ce14

Function at 0x1405bec4e
Capabilities:
Encode data using xor

Disassembly:
movabs rdx, 0xbba2623163b8bd95
add rdx, rdx
jne 0x1404e7cb6
cmp dword [rax + rsi*8 + 0x526c9ad7], esi
cli
invalid

Function at 0x1405c4b35
Capabilities:
Encode data using xor

Disassembly:
not r9
mov r9, qword [rsp + 0x20]
shl byte [rsp + 0x40], 0x68
shr qword [rsp + 0x18], 0x81
neg dword [rsp + 0x48]
xor word [rsp + 0x48], 0x933b
jo 0x1403f13c0
mov r12, qword [rsp + 0x38]
call fcn.140574836
mov bl, 0x3f
rcr al, cl
xor dword [0x1af12d87c], 0xffffffeb
add r8, r15
push rdi
loopne 0x1405c4bc7
pop rcx
mov ch, 0x60
or al, 0x59
or edi, edi
iretd
jae 0x1405c4c41
stosb byte [rdi], al
add byte [rax], al
add byte [rax], al
and bl, al
test eax, 0x7ae280ff
scasb al, byte [rdi]
add byte [rbp + 0x7d], dl
cmp al, 0x83
xor dl, byte [rax + rax*2 - 0x13aa307]
invalid
add dl, byte [rax]
rol ecx, 1
div dword [rbx - 0x6496effb]
add dl, byte [rax]
pop rcx
lodsd eax, dword [rsi]
xor dword [rax], 0xaa4111ff
and ecx, dword [rdi]
out dx, al
sahf
je 0x1405c4cd7
sbb al, 0x10
movsb byte [rdi], byte [rsi]
or byte [rbx], 0xf6
adc dword [rcx], ebp
adc al, 0xff
out dx, eax
in eax, dx
sub dword [rax + 0xb], esi
out dx, al
invalid
pop rsi
retf 0xdb39

Function at 0x1405c56ac
Capabilities:
Packed with generic packer

Disassembly:
jb 0x1402661fc
mov rbp, qword [rsp + 0x38]
js 0x140322584
push rdx
call fcn.140299d15