joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
push r15
mov r14d, ecx
nop dword [rax]
mov rax, qword gs:[0x30]
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
mov r15, qword [rax + 0x10]
nop word [rax + rax]
cmp edx, 0x811c9dc5
jne 0x1400023ae
mov rdi, qword [r15 + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov rcx, qword [rax + rdi + 0x88]
mov r12, rcx
mov ebp, ecx
shr r12, 0x20
add rbp, rdi
cmp rbp, rdi
je 0x1400023ae
mov esi, dword [rbp + 0x18]
xor ebx, ebx
test esi, esi
je 0x1400023ae
mov r11d, dword [rbp + 0x20]
add r11, rdi
nop dword [rax]
mov eax, dword [r11]
mov r10d, 0x811c9dc5
add rax, rdi
movzx r9d, byte [rax]
inc rax
test r9b, r9b
je 0x14000239f
nop dword [rax + rax]
movsx ecx, r9b
lea rax, [rax + 1]
sub r9b, 0x41
mov r8d, ecx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rax - 1]
cmova r8d, ecx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140002370
cmp r10d, r14d
je 0x1400023b6
inc ebx
add r11, 4
cmp ebx, esi
jb 0x140002350
mov r15, qword [r15]
jmp 0x140002310
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x1c]
add rax, rdi
add rcx, rdi
movzx edx, word [rax + rbx*2]
mov r8d, dword [rcx + rdx*4]
add r8, rdi
cmp r8, rbp
jbe 0x1400023e8
lea rax, [r12 + rbp]
cmp r8, rax
jae 0x1400023e8
mov edx, 0x811c9dc5
mov r14d, edx
jmp 0x1400022f0
mov rbx, qword [rsp + 0x28]
mov rax, r8
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r12
pop rdi
ret
Function at 0x140006300
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rbp + 0x250], rax
cmp dword [0x1401f4574], 0
lea rax, [rbp + 0x138]
mov rcx, qword [rcx]
mov r9d, 0x18
mov qword [rsp + 0x38], 0
mov rdi, rdx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x120], r8
lea r8, [rbp + 0x120]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
je 0x14000688b
mov edx, 0x222404
mov edx, 0x222004
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400069c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rdx, 0x6d0a2baea6947676
lea r8, [rsp + 0x50]
mov qword [rbp + 0x158], rdx
movabs rcx, 0x2ee23b47cfefafad
mov qword [rbp + 0x150], rcx
movabs rdx, 0x5a81542eefb28ef6
mov qword [rsp + 0x50], rdx
movabs rcx, 0xdb3b2f2d041af7ef
mov qword [rbp + 0x160], rcx
movabs rdx, 0x1f7f47c7c7f2561a
mov qword [rsp + 0x58], rdx
movabs rcx, 0x60aee9d47dd48af8
movdqa xmm0, xmmword [rsp + 0x50]
movabs rdx, 0x844f5c4c683adb8a
pxor xmm0, xmmword [rbp + 0x150]
mov r9d, eax
mov qword [rsp + 0x60], rdx
movabs rdx, 0x498ec1a612a6f89d
mov qword [rbp + 0x168], rcx
movabs rcx, 0x8d8c1d13ad0ad6e1
mov qword [rsp + 0x68], rdx
movabs rdx, 0x8d8c1d13a772f3dc
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp + 0x160]
mov qword [rbp + 0x170], rcx
movabs rcx, 0x98df57aa64cea0a
mov qword [rsp + 0x70], rdx
mov edx, 1
mov qword [rsp + 0x78], rcx
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x178], rcx
pxor xmm0, xmmword [rbp + 0x170]
mov rcx, qword [0x1401f45f0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm1
call fcn.140004c10
mov qword [rdi], 0
mov qword [rdi + 8], 0
jmp 0x1400069e6
Function at 0x14000ae50
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rdx
mov qword [rsp + 0x20], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [0x140090958]
jmp 0x140729d22
Function at 0x140014990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400149c4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400149b0
ret
Function at 0x14001bef0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x79], rdx
mov rsi, qword [rbp + 0x7f]
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rdx, qword [rcx]
mov rcx, qword [rdx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x14001bf4e
mov edx, 0x2749
mov rcx, rbx
call fcn.14001b930
jmp 0x14001c080
xor r9d, r9d
mov r8d, 0x4000
mov rdx, rax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jle 0x14001bf72
mov qword [rsi], rdi
mov byte [rbx], r15b
jmp 0x14001c080
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rbp - 0x39], r15
movdqa xmm0, xmmword [0x1400917a0]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov dword [rbp - 0x41], eax
xor r8d, r8d
lea rdx, [0x14008f908]
lea rcx, [rbp - 0x39]
call fcn.140001bf0
nop
mov dl, 1
mov byte [rbp - 0x11], dl
mov r8d, dword [rbp - 0x41]
mov dword [rbp - 9], r8d
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp + 0xf], xmm1
mov dword [rsp + 0x20], 0x18
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14001bfef
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [r14]
mov qword [rax + 0x28], 0xffffffffffffffff
mov r8d, dword [rbp - 9]
movzx edx, byte [rbp - 0x11]
mov qword [rsi], r15
test edi, edi
jne 0x14001c004
mov byte [rbp - 0x41], dil
mov edi, 0x1a
mov byte [rbx], 0
jmp 0x14001c051
mov byte [rbp - 0x71], dl
test dl, dl
je 0x14001c020
mov dword [rbp - 0x69], r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x61]
call fcn.140002f30
movzx edx, byte [rbp - 0x71]
mov edi, 0x1c
mov byte [rbx], dl
test dl, dl
je 0x14001c051
mov eax, dword [rbp - 0x69]
mov dword [rbx + 8], eax
movups xmm0, xmmword [rbp - 0x61]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x51]
movups xmmword [rbx + 0x20], xmm1
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], setsockopt
mov byte [rbp - 0x61], 0
or edi, 1
test dil, 4
je 0x14001c067
and edi, 0xfffffffb
lea rcx, [rbp - 0x71]
call fcn.140013b40
nop
test dil, 2
je 0x14001c077
lea rcx, [rbp - 0x41]
call fcn.140013b40
nop
lea rcx, [rbp - 0x11]
call fcn.140013b40
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140050ed0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.1400558a0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400225c1
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022638
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14002260e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022638
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x30]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140004710
mov rax, rdi
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140050ed0
mov rbx, qword [rsp + 0x888]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov ecx, 0xf75db66e
call fcn.140002180
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140022ed6
mov qword [rsp + 0x50], rsi
mov ecx, 0xc309a0d
call fcn.140002180
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x140022ec7
mov ecx, 0x700da41
call fcn.140002180
lea r9d, [rsi + 4]
mov r8d, 0x3000
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x140022ed6
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140022e09
mov ecx, 0x6bcbc4b2
call fcn.140002180
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
jmp 0x140022ec7
mov ecx, 0x8285aca5
call fcn.140002180
mov rcx, rdi
call rax
mov dword [rsp + 0x4c], esi
mov ecx, 0xd30e846a
call fcn.140002180
mov r8d, 6
lea r9, [rsp + 0x4c]
xor edx, edx
mov rcx, rbx
call rax
test rax, rax
jne 0x140022e5b
mov ecx, 0x6bcbc4b2
call fcn.140002180
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x140022edc
mov ecx, dword [rax + 0x18]
add rcx, rbx
mov rdx, rcx
mov qword [rsp + 0x40], rcx
movabs r8, 0x6c616e416f747541
lea rax, [rcx + 0xa0]
cmp rdx, rax
jae 0x140022eac
cmp qword [rdx], r8
jne 0x140022ea2
mov ecx, 0x6bcbc4b2
call fcn.140002180
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
mov eax, 1
jmp 0x140022edc
inc rdx
mov qword [rsp + 0x40], rdx
jmp 0x140022e73
mov ecx, 0x6bcbc4b2
call fcn.140002180
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x140022edc
mov ecx, 0x8285aca5
call fcn.140002180
mov rcx, rdi
call rax
xor eax, eax
jmp 0x140022edc
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140050ed0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140025240
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x1400901c0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1400252b9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140025260
test r8, r8
je 0x1400252dd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400252c0
not ecx
mov eax, ecx
ret
Function at 0x14002b220
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x1400912e0]
jmp 0x14072e1d2
Function at 0x14004702b
Capabilities:
Read file on windows

Disassembly:
movabs r8, 0x96affca9e4ac1693

Function at 0x1400512b8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14006215c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140061f88
Function at 0x1402031f5
Capabilities:
Authenticate hmac
Enumerate processes
Packed with generic packer

Disassembly:
xor r10, 0x7b06cb0d
mov qword [rsp + 0x30], rsi
movabs rcx, 0x8d30af94a419919f
ja 0x14001f2bd
int3

Function at 0x140203205
Capabilities:
Packed with generic packer

Disassembly:
movabs r9, 0x4bae5caf5faf1e2a
mov rbx, qword [rsp + rbx - 0x5f928103]
mov qword [rsp + 0x20], rdi
cmp r9, 0xffffffff96184b33
je 0x1404c256d
add qword [rsp + 0x18], 0xee8c8
push rdx
bswap r9d
nop
push r12
mov r12, r9
add r12w, r12w
xor r12w, 0x86a4
movabs rdx, 0x75287932edbd7632
add r12, 0xffffffff8c86f507
mov rdi, qword [rsp + r9*2 - 0x543d5e96]
mov rdi, qword [rdi + r9 - 0x2a1eaf5f]
not r9
add qword [rsp + r12 + 0x495a32ef], 0xffffffffbfb7b45d
cmp r12, 0xa21e08e
jno 0x14046aa0f
shr si, 0x13
or sil, sil
shl esi, 0xa3
xchg qword [rsp + 0x10], rdx
call fcn.140356046

Function at 0x14020bdd1
Capabilities:
Read file on windows

Disassembly:
pushfq
movabs r12, 0x74ad3bbff8bc121f
xor r12, r12
je 0x140584e45
mov qword [rsp + 0x18], 0x72c437d5
mov r12, qword [rsp + r12*2 + 0x10]
jl 0x14072b892
call fcn.14020b337
call fcn.140263606
movdqa xmmword [rsp + 0x40], xmm0
push r15
call fcn.14037aaba
rol byte [rcx + 0x57], 0x9c
movabs r15, 0x9f009e887f983cbf
lea r15, [r15*2 - 0x6cd77944]
lea r15, [r15 + riz + 0x1b38bf91]
not r15b
mov r15, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffa90ac8c0
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14065ba29
sub eax, ebp
cmp dh, al
enter 0xfff, 0x57
rcl byte [rbp + 0x48], 0xbd
xchg ebp, eax
outsd dx, dword [rsi]
lodsd eax, dword [rsi]
mov bh, 0x8e
retf 0x9032
Function at 0x140218586
Capabilities:
Write file on windows

Disassembly:
or eax, 0xffffffff
jmp 0x14006c57f
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14006c46a
test sil, sil
je 0x14006c44c
dec sil
cmp sil, 1
ja 0x14006c506
lea r12, [rdi + r14]
mov qword [rbp - 0x30], rbx
mov r14, rdi
cmp rdi, r12
jae 0x14006c4fc
mov esi, dword [rbp - 0x2c]
movzx eax, word [r14]
movzx ecx, ax
mov word [rbp - 0x10], ax
call fcn.140078f94
movzx ecx, word [rbp - 0x10]
cmp ax, cx
jne 0x14006c43e
add esi, 2
mov dword [rbp - 0x2c], esi
cmp cx, 0xa
jne 0x14006c42f
mov ecx, recv
call fcn.140078f94
mov ecx, recv
cmp ax, cx
jne 0x14006c43e
inc esi
mov dword [rbp - 0x2c], esi
inc ebx
add r14, 2
cmp r14, r12
jae 0x14006c4fc
jmp 0x14006c3ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
jmp 0x14006c4fc
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006b94c
movsd xmm0, qword [rax]
mov ebx, dword [rax + 8]
jmp 0x14006c501
lea rax, [0x1401f3fe0]
mov rcx, qword [rax + r13*8]
cmp byte [rcx + r15*8 + 0x38], bl
jge 0x14006c4c9
mov ecx, esi
test sil, sil
je 0x14006c4b5
sub ecx, 1
je 0x14006c4a1
cmp ecx, 1
jne 0x14006c506
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006bf3c
jmp 0x14006c45e
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006c058
jmp 0x14006c45e
mov r9d, r14d
lea rcx, [rbp - 0x30]
mov r8, rdi
mov edx, r12d
call fcn.14006be38
jmp 0x14006c45e
mov rcx, qword [rcx + r15*8 + 0x28]
lea r9, [rbp - 0x2c]
xor eax, eax
mov r8d, r14d
and qword [rsp + 0x20], rax
mov rdx, rdi
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006c4f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
mov ebx, dword [rbp - 0x28]
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbp - 0x20], xmm0
mov rax, qword [rbp - 0x20]
shr rax, 0x20
test eax, eax
jne 0x14006c576
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x14006c546
cmp eax, 5
jne 0x14006c539
call fcn.14005f36c
mov dword [rax], 9
call fcn.14005f34c
mov dword [rax], 5
jmp 0x14006c2fb
mov ecx, dword [rbp - 0x20]
call fcn.14005f2fc
jmp 0x14006c2fb
lea rax, [0x1401f3fe0]
mov rax, qword [rax + r13*8]
test byte [rax + r15*8 + 0x38], 0x40
je 0x14006c55e
cmp byte [rdi], 0x1a
je 0x14006c57d
call fcn.14005f36c
mov dword [rax], 0x1c
call fcn.14005f34c
and dword [rax], 0
jmp 0x14006c2fb
mov eax, dword [rbp - 0x1c]
sub eax, ebx
jmp 0x14006c57f
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
add word [rsp + 8], 0x52ba
not bp
add rbp, rbp
js 0x14044befd
jno 0x14006c3b4
call fcn.1404b4564
Function at 0x140266218
Capabilities:
Packed with generic packer

Disassembly:
movabs r11, 0x458b2403b9015d21
sub r11b, 6
neg r11
cmp r11, 0xffffffffa9baa480
neg bx
push r14
movabs rdx, 0x632c3f273819fc37
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
jl 0x1402ea663
movabs r14, 0x17161f1c7c2e5586
lea r14, [r14 + riz - 0x56a9174]
jae 0x140537531
add qword [rsp + 0x10], 0xffffffffbf8d3adf
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
call fcn.1405d1f37
not r14
shr edx, 0xeb
lea rcx, [rcx + rdx*8 - 0x798ed4e6]
sub rdx, 0xffffffffe502bd21
cmp dl, 0x9d
jno 0x14042eec1
test bl, 0x97
not rbx
setae dl
test dx, 0x7432
jo 0x140210d44
xchg qword [rsp + rdx - 0x1b0445d1], rcx
mov rdx, qword [rsp + 0x20]
setb r14b
sub ebx, 0x48a57285
call fcn.1404ab2da

Function at 0x140267713
Capabilities:
Read file on windows

Disassembly:
jb 0x140371c4a
cmp r14b, bpl
bswap r14d
xchg qword [rsp + 0x58], rbx
mov r14, qword [rsp + 0x20]
jg 0x14050cb67
sub bp, bp
sub bp, bp
sub bp, 0x2af
test bpl, bpl
call fcn.1402b6f3e
shl r13b, 0x70
lea r13, [r13 + r13 - 0x237744d9]
mov rdi, r13
test rdi, r13
mov rdi, qword [rsp + 0x20]
call fcn.1403d8dc2
test dx, dx
bswap edx
seta cl
lea rcx, [rdx + rdx*2 + 0x3f044386]
push r14
call fcn.14042195d

Function at 0x1402779be
Capabilities:
Enumerate processes

Disassembly:
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
movabs rcx, 0xdf292d9ec60b5693
mov qword [rsp + 0x28], rcx
call fcn.1403f6950

Function at 0x1402779dc
Capabilities:
Enumerate processes

Disassembly:
jle 0x140370c79
neg word [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rbp, 0xffffffffd089703f
shl dword [rsp + 0x38], 0x29
neg qword [rsp + 0x38]
shl bpl, 3
shl qword [rsp + 0x38], 0xfd
mov r11, qword [rsp + 0x60]
shl dword [rsp + 0x30], 2
not byte [rsp + 0x38]
jae 0x140211be7
sbb cl, byte [rdi - 0x5d59e6df]
clc
test byte [0xcba6b327], 0x48
xlatb
sti
invalid
mov word [rsp + rcx - 0x189bffc0], 0xd03
lea rbp, [rbp - 0xb44fecd]
shr dil, 0x1b
shl dword [rsp + rcx*2 - 0x3137ffe0], 0xab
sub dil, byte [rsp + rcx*2 - 0x3137ffc0]
sub byte [rsp + rcx*2 - 0x3137ffc0], dil
test dword [rsp + 0x40], 0x73016bb3
not rcx
call fcn.1402ac1a4
and eax, 0x1b5aa87c
outsd dx, dword [rsi]
xor eax, 0x3b8186e
mov ebp, 0xb5e42e06
scasb al, byte [rdi]
in eax, 0x72
cli
xchg edi, eax
pop rax
jno 0x140328537
pop rbx
and bl, byte [rdx - 0x787addb1]
push r14
out dx, al
invalid
shl edi, 0x5d
mov rbp, qword [rsp + rcx - 0x189bffe0]
mov rbp, qword [rbp + rcx*2 - 0x31380000]
test word [rsp + rdi + 0x42], cx
mov qword [rsp + rdi*8 + 0x20], rcx
lea rdi, [rcx + rcx*8 + 0x7126cf97]
jge 0x1403284e5
Function at 0x140294dae
Capabilities:
Authenticate hmac

Disassembly:
je 0x14054910b
pushfq
mov al, 1
mov rbp, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
test ecx, 0x91b0da8a
setb cl
nop
push rdx
push r11
jle 0x140216be6
shr cl, 0xfd
movabs r11, 0x9e81e239783c91ab
add qword [rsp + 0x38], 0xffffffffbfdf79ed
neg r11
movabs rdx, 0xe1af7da2c5850b35
mov rbx, qword [rsp + 0x40]
mov rbx, qword [rbx]
jae 0x1405baa2a
not cl
sub dx, cx
setno r11b
lea rbx, [rbx + 0x3e066a30]
jo 0x1402a49de
mov qword [rsp + 0x40], rcx
or rcx, 0x66b186b6
jns 0x1404bf2da
neg word [rsp + 0x40]
movzx rdx, cl
push r14
xchg qword [rsp + 0x60], rbx
mov rcx, qword [rsp + rdx - 0xd7]
cmp edx, r11d
lea rdx, [rdx + r11*2 + 0x3d19f92c]
not dx
jge 0x140332281
call fcn.140522ed4
movabs r14, 0x519c9cb0e6801fb4
jbe 0x1403e7e9e
jns 0x14000ace9
add qword [rsp + 0x10], 0xf981c
movabs rdx, 0xa72dc00c5594a990
and edi, 0xcaecd1b
add qword [rsp + rdi*8 + 8], 0xffffffffbfc5e4da
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + rdi]
not dil
mov dil, 0x9b
lea rdi, [rdi*4 - 0x65d3386d]
not rdi
bswap rdi
sub rdi, 0xfffffffff5228125
not rdi
lea rdx, [rdx - 0x35537a49]
not di

Function at 0x140295bb9
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 0x10]
pushfq
add qword [rsp + 8], 0xffffffffbfcbd0dd
call 0x140328775

Function at 0x140295bcd
Capabilities:
Packed with generic packer

Disassembly:
call 0x140030dfe
adc bl, byte [rdx - 0x49f556e4]
invalid

Function at 0x1402caf56
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x48], r14
test r14w, r14w

Function at 0x1402caf65
Capabilities:
Encode data using base64

Disassembly:
setb bpl
jno 0x140536541
or bpl, 0x2e
lea rbp, [rbp + riz - 0x295e50ca]
mov rbp, qword [rsp + 0x30]
jno 0x1405777ab
pop rcx
xchg esi, eax
wait
invalid

Function at 0x1402caf7e
Capabilities:
Encode data using base64

Disassembly:
jge 0x140343d77
add bh, ch
out dx, al
and eax, dword [rdx]
cwde
adc byte [rbx + 0x10671aba], ah
jle 0x1402ead9e
in al, dx
pop rax
invalid
mov r15d, dword [rsp + 0x3c]
push 0x1a7380f
mov r14, qword [rsp + rcx - 0xb]
jne 0x140209807
js 0x1402ead21
invalid
xor byte [rsi + 0x6e], ch
invalid
add qword [rsp + 0x10], 0xffffffffbfd79a07
add dword [rsp + 0x40], r8d
mov r11, qword [rsp + 0x28]
mov word [rsp + r8 - 0x80], 0xe0aa
jl 0x140479a31
lea r15, [r8 + r15*4 + 0x24b39082]
not r8d
js 0x1402ead58
mov r15, qword [rsp + 0x20]
lea r8, [r8 + riz - 0x22439cdb]
neg r8
shl r8w, 0x74
shr qword [rsp + 0x60], 0x41
ja 0x140584061
mov eax, 0xd46d2dfa
push 0xffffffffe0caa7c1
test al, 0x79
sub byte [rdi - 0x55], ah
invalid
movzx r8w, r8b
mov r8, qword [rsp + 0x38]
or byte [rsp + 0x40], 0xe
xor dword [rsp + 0x60], 0xc527238d
cmp byte [rsp + 0x60], 0x3f
mov qword [rsp + 0x40], 0xffffffffd8328f07
setae byte [rsp + 0x60]
call fcn.1403224a4
mov qword [rsp], rbp
push rsi
movabs rsi, 0x343ffb100fbe598d
not esi
not si
call fcn.14050bd8f
Function at 0x1402d47de
Capabilities:
Encode data using xor

Disassembly:
jge 0x140301232
lea rdx, [rdx + 0x6c80f8a9]
mov qword [rsp + 0x10], 0xffffffff928396a6
xor qword [rsp + 0x10], 0xffffffffb287519b
test qword [rsp + 0x10], 0x5d36ed02
not byte [rsp + 0x10]
call fcn.14038bd2f
js 0x14072a86f
sub edi, 0xee2d631c
call fcn.1403ea71a
push rdi
pushfq
movabs rdi, 0xa2a0ca372d02f325
and dil, dil
call 0x1402d47de
pxor xmm0, xmmword [rbp + 0x8e0]
push 0xffffffffa9921403
push r10
pushfq
mov r10, qword [rsp + 0x10]
xor dword [rsp + r10 + 0x566dec0d], r10d
sub r10, 0xcbf41b5
mov dword [rsp + r10 + 0x632d2dc2], 0x5f82b71c
mov qword [rsp + 0x10], 0xffffffff9ccf8180
mov r10, qword [rsp + r10 + 0x632d2dba]
jb 0x14072a892
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1405d1f37
movdqa xmmword [rbp + 0x40], xmm0
push rdx
movabs rdx, 0xe707a503bc144a84
push rdi
pushfq
xor dl, 0x2d
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x72a6ab77
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1406fa391
movdqa xmm1, xmmword [rbp + 0x50]
push rdi
pushfq
movabs rdi, 0x7504061e119c1f93
test dil, 0xad
lea rdi, [rdi + rdi + 0x269f0987]
call fcn.14048c4cf
pxor xmm1, xmmword [rbp + 0x8f0]
push rsi
movabs rsi, 0xe9b1a7022ebedc32
pushfq
shr si, 0x5d
call fcn.14051fc52
movdqa xmmword [rbp + 0x50], xmm1
call fcn.14036c6c9
invalid