joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020066e
Capabilities:
Packed with generic packer

Disassembly:
bswap rbp
movabs rbx, 0xf93d0030378bbdb0
js 0x140380d98
sub bl, bl
jno 0x1402f3936
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rbx, [rbx + rbx*2 + 0x403334b2]
lea rbx, [rbx*4 - 0x3f51f2c6]
xor ebx, ebx
push qword [rsp + rbx*4 + 0x10]
popfq
mov rbx, qword [rsp + rbx + 8]
lea rsp, [rsp + 0x18]
ret

Function at 0x140200689
Capabilities:
Packed with generic packer

Disassembly:
mov r13, qword [rsp + 0x48]
shr word [rsp + 0x58], 4
neg qword [rsp + 0x58]
call fcn.140420481

Function at 0x1402120b7
Capabilities:
Packed with generic packer

Disassembly:
add byte [rcx - 0x3f], cl
in eax, 0xbf
shl r13, 0xbf
jne 0x1402fec02
mov rbp, qword [rsp + r13 + 0x38]
setbe r12b
lea r12, [r13 + r13*2 + 0x71a23184]
shl r13, 0xe6
mov qword [rsp + r13 + 0x60], 0xffffffffbe3a3a8a
neg r13d
mov qword [rsp + r12 - 0x71a23124], r12
call fcn.14047d455
loop 0x1402120b6
js 0x140212107
int3
insb byte [rdi], dx
and al, 0x18
shl rdx, 0xb0
sub rdx, 0xffffffffd9a4c392
push r13
push rbp
movabs rbp, 0x242f7f1aca16cb81
mov rbp, qword [rsp]
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbp
movabs r13, 0x5eb40e389919ad9c
or r13, r13
and r13w, 0xfb26
or r13w, 0xab09
and r13, 0x251f44a7
shr r13, 0xb0
movabs r13, 0x6e3cfa168ebc6807
add qword [rsp + 0x10], 0xfffffffffffa1e60
mov r13b, 0
movabs rbp, 0xdba84b85e38e7512
add r13b, 0xad
not r13
test r13w, 0x261a
jns 0x1402e0ee6

Function at 0x14026421b
Capabilities:
Encode data using base64

Disassembly:
bswap ebx
push 0x71382399
lea rdx, [rdx + rbx*4 - 0x2146d9f3]
call fcn.140525e98

Function at 0x14026e867
Capabilities:
Packed with generic packer

Disassembly:
neg qword [rsp + 0x18]
sub ebp, 0x298ee304
je fcn.1404bf583
ja 0x1405732b1
pushfq
movabs rbx, 0x3521de118c06d812
mov rcx, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xfffffffffffca23a
xor bl, bl
sub bl, 0x28
xor ebx, ebx
add bx, bx
sub byte [rsp + r8 - 0x7c034052], r8b
sub r8d, r8d
xchg qword [rsp + 0x40], rsi
mov r8, qword [rsp + 0x38]
jo 0x14034930d
shr bpl, 0xf6
call fcn.14040ec4f
int 0x70
xchg ebp, eax
sbb eax, 0x57aa15ea
mov ss, word [rdi + 0x410cc4fd]
sal dword [rdi], 1
or eax, edx
xor esp, dword [rbx + 0x1d]
sbb ch, byte [rcx + 0x50de759b]
cmp dword [rax + 0x39], ebp
mov r13b, 0xa1
jg 0x140573336
invalid
push rax
retf

Function at 0x140273396
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + r8*4 - 0xb0], rcx
mov r8, qword [rsp + r8*2 - 0x44]
call fcn.14054e725
mov word [rsp + rsi - 0x25cbac61], 0xa41b
jge 0x14042899a
neg rsi
mov sil, byte [rsp + rsi + 0x25cbaca8]
add qword [rsp + rsi + 0x25cbac75], 0xffffffffbfaee9c1
mov rsi, qword [rsp + rsi*2 + 0x4b9758ca]
shl qword [rsp + 0x20], 0xa3
not word [rsp + 0x20]
and dword [rsp + 0x20], 0x720972a1
call fcn.1403ac1e4
Function at 0x1402750d8
Capabilities:
Delete registry key

Disassembly:
jbe 0x14054ec31
sub r15, qword [rsp + r15*2 - 0x669e41c0]
mov r14, qword [rsp + 0x40]
jae 0x1403ed8a0
and r14d, dword [rsp + r15 - 0x434f20c0]
movzx r8, r15b
mov rcx, qword [rsp + r8*2 + 0x38]
mov r8d, r15d
ja 0x14042443b
and r14w, 0xa6ae
js 0x140505660
movzx r14w, byte [rsp + r15 - 0x434f20bb]
add r15b, 0x38
test byte [rsp + r15 - 0x434f20f8], r14b
call fcn.14020d3a2
and al, dl
cmp eax, 0xf663842c
test eax, 0x9b3f4a5a
lahf
test dword [0x1986f684a], edx
mov esp, 0xa0892f1f
out dx, eax
cmp dword [rcx + 0x5e], eax
or al, 0x7f
out dx, al
test dword [rdi + 0x76085e55], ebp
popfq
push rdx
sub al, 0xab
or al, 0x78
xchg esi, eax
mov ah, 0x65
mov fs, eax
sbb esi, ecx
invalid
mov r14, qword [rsp + 0x40]
shl byte [rsp + 0x58], 0x1d
shr word [rsp + 0x58], 0xd8
call fcn.1404e497a
int 0xa7
cmp al, 0x7e
and al, 0xa7
sub al, 0x41
mov esi, 0x7d03ac4a
scasb al, byte [rdi]
xor ch, dl
add al, 0x8f
not dword [rdx + rbp*2 + 0x2cb4c475]
push rsi
cmpsb byte [rsi], byte [rdi]
mov esp, 0x2670aa50
pop rax
invalid
jge 0x14053a5b7
invalid

Function at 0x14027512c
Capabilities:
Delete registry key

Disassembly:
not r14w
jns 0x140045629

Function at 0x140275136
Capabilities:
Delete registry key

Disassembly:
movabs r13, 0xea2e423a6eb3730c
pushfq
add qword [rsp + 8], 0xffffffffbfcdad2f
mov qword [rsp + 0x18], 0xffffffff9383eca8
mov r13, qword [rsp + 0x10]
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.140679246

Function at 0x14027cb1c
Capabilities:
Packed with generic packer

Disassembly:
push r8
movabs r8, 0xdc888f8349ad472c
mov qword [rsp + 0x10], 0xffffffff8c9025b5
mov r8, qword [rsp]
lea rsp, [rsp + 0x10]
call fcn.1406af0c2

Function at 0x14027cb40
Capabilities:
Packed with generic packer

Disassembly:
not sil
add qword [rsp], 0xfffffffffff7089d
sub si, 0x889a
mov rax, rsi
test esi, 0x919d5dbd
je 0x1402c5518
shl si, 0x53
push r10
mov rax, qword [rsp + 8]
mov rax, qword [rax]
movabs r10, 0x36169d87a39b059a
sub r10, 0x1c3a522a
and rsi, 0xfffffffffe2109be
lea rax, [rax - 0x3ed46377]
shl si, 0x3f
or esi, 0x2786bdb1
shl r10w, 0x89
jae 0x1404fd45a
mov ch, 0x69
push rdx
cmc
add al, 0x23
sub dword [rcx + 0xb], eax
mov al, 0xd7
xchg edi, eax
invalid
call fcn.140508690
call fcn.14033855e
Function at 0x14028ebd1
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x58], rcx
mov r10, qword [rsp + r10*4 + 8]
jb 0x14053e78e
xor di, r11w
or r12b, byte [rsp + 0x4e]
movabs r13, 0xc836fa7179fc7ba
shl r12b, 0x5c
mov dil, 0xa5
or di, 0x1419
mov r8, qword [rsp + 0x30]
cmp r12, qword [rsp + 0x48]
js 0x14051adbc
mov cs, word [rdx - 0x4d]
add dword [rax - 0x75], ecx
clc
test rax, rax
je 0x14002e2a3
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14002e2a3
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x28], 0xffffffffffffffff
lea rcx, [rbp - 8]
call fcn.14001c2d0
nop
lea rcx, [rbp]
call fcn.140012f00
nop
lea rcx, [rbp + 0x30]
call fcn.140001dc0
movzx eax, bl
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140052a40
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rsp + rdi - 0x1bbbedd2]
mov rcx, qword [rcx + rdi - 0x1bbbee02]
mov qword [rsp + 0x30], rdi
test r11d, 0xe80c0506
push r10
movabs r10, 0xba88e80703b0561f
jb 0x1403503df
or dil, dil
cmovge r10, r11
lea rcx, [rcx - 0x2cdaa67e]
push r12
mov r12, qword [rsp + rdi*4 - 0x6eefb7c8]
shr r12, 0x43
push r13
movzx r10d, dil
jbe 0x140526c7f
ja 0x14002e238
cmp cl, byte [rsi + 0x5d]
jle 0x14028ebb6
add al, 0x26
mov word [r15 + 0x46040d8], ss
invalid
call fcn.14041cf75
fisubr dword [rcx + 0x6d4d7406]
loop 0x140350427
sal byte [rdi - 0x3bc4153e], 1
fcom qword [rax]
xor ch, cl
mov ebx, 0x34187235
invalid
cmp ecx, edx
mov dl, 0x7e
in al, dx
sar dword [rbx + 0x38c484c3], 0x44
and ebp, dword [rax - 4]
mov ebx, 0x5e9a19b
jle 0x1403504ba
sbb dword [rbx], eax
invalid
out 0xfb, al
push qword [rcx - 0x5c576a1a]
xor ch, byte [rcx]
test byte [rsi - 0x355b69], bh
xchg esp, eax
sbb byte [rsi + r8*4], r8b
popfq
invalid
jg 0x140350464
push rbx
cmpsd dword [rsi], dword [rdi]
nop
invalid
pop r13
mov r11, qword [rsp + 0x38]
setns r12b
bswap edi
cmp di, r12w
mov rdi, qword [rsp + 0x48]
jae 0x1405c8eb8
invalid
setl bpl
and rbp, qword [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov r10, rbp
neg byte [rsp + 0x30]
jae 0x140374040
add r10b, 0xb4
shl ebp, 0x37
je 0x14047bc42
or r15w, r14w
shl r13w, 0x37
shr r9w, 0xaa
call fcn.140213e03

Function at 0x14029b07b
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rsp + 0x38]
xor dword [rsp + r10*8 - 0x2107ffc8], 0xb404e423
cmp r10, qword [rsp + r10*4 - 0x1083ffc8]
cmp byte [rdx - 0x7f], al
mov ah, 0xd4
cmp byte [rax], al
clc
fisub word [rbx]
in al, 4
mov ah, 0x4e
cmp edx, dword [rsp + rdx*4 - 0x1083ffc8]
js 0x140551760
je 0x14029b0f2
and eax, 0x5c0d2ea0
mov bl, 0x47
pop rdx
xchg ebp, eax
xchg edx, eax
xor dword [rdi], ebp
mov r13b, 0x36
jl 0x14029b07f
lahf
call 0x19ba13303
invalid
invalid
Function at 0x1402a3c22
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406763f0
call fcn.1402da76e
push rbp
movabs rbp, 0x9a365110b332f68d
pushfq
cmp bp, 0x8ab3
not ebp
mov qword [rsp + 0x18], 0x71ea4de8
mov rbp, qword [rsp + rbp - 0x4ccd096a]
js 0x1402a3c2d
jne 0x1402821b4

Function at 0x1402a6be2
Capabilities:
Packed with generic packer

Disassembly:
js 0x1405854db
jne 0x14047bcd7
call fcn.140548566
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.14072b378

Function at 0x1402afcc0
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
call fcn.14054a5bb
mov ebp, 0x21
shr byte [rax], 1
and dword [rax], eax
adc ebp, dword [rcx]
and dword [rax], eax
sub byte [rsi + 0x40], bl
add byte [rcx + 0xf], al
seta r8b
add qword [rsp + r8 + 0x18], 0xffffffffbfd885f6
xor r8w, 0x6980
invalid
invalid
test byte [rax + rax*2 + 0x2d], al
invalid

Function at 0x1402b3db7
Capabilities:
Packed with generic packer

Disassembly:
cmovs r12d, dword [rsp + 0x31]
jg fcn.1405429cd
mov rbp, qword [rsp + rbp*8 - 0x4ddb0]
and r12w, 0x4982
setge byte [rsp + r12*2 - 0x1ffd0]
call fcn.14003f408

Function at 0x1402ca2d7
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [rsp + 0x58], r11d
je 0x1403751a6
mov r11, qword [rsp + 0x50]
not word [rsp + 0x30]
call fcn.1405712fa

Function at 0x1402cde71
Capabilities:
Encode data using xor

Disassembly:
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x451e2f2b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14072b378
jne 0x1402cdec0
lodsd eax, dword [rsi]
pop rsi
mov cl, 0x62
cmp sil, byte [rsi - 0x74]
std
out dx, al
invalid
sar bl, 7
add al, byte [rax + 0x46]
int 0
push rsi
fstp xword [rsi]
stosd dword [rdi], eax
mov edi, 0xa10efcaa
movabs byte [0xa304405ec26066bf], al
push rsp
xor eax, ebx
jnp 0x1402cded2
mov ah, 0x8c
sbb al, byte [rbx + 0x1ec846db]
sbb esp, edi
mov edi, 0x4c96a6d9
pop rax
jmp 0x183750729

Function at 0x1402db5a4
Capabilities:
Terminate process

Disassembly:
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jbe 0x140063bf7
mov rdi, qword [rsp + rdi - 0x2607ffcf]
jg 0x1404f5535
push rax
invalid

Function at 0x1402ea6a0
Capabilities:
Packed with generic packer

Disassembly:
jle 0x1403d21fb
xor dword [rsp + rdi - 0x47c264be], 0x1d118622
setle byte [rsp + rdi - 0x47c264be]
call 0x1404abb8b
push rcx
push r15
movabs r15, 0x411491bb02142bb
pushfq
sub r15d, r15d
sete r15b
push r12
lea r15, [r15*4 - 0xac90256]
lea r15, [r15*2 + 0x313c400f]
ja 0x140349350
mov rcx, qword [rsp + r15*2 - 0x375476b6]
call fcn.1400310be

Function at 0x1402f271c
Capabilities:
Encode data using base64

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14064e2cf

Function at 0x140322f37
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
sub dword [rsp + r8*4 - 0x560f9e6c], 0x9fb1150e
mov r11, qword [rsp + r11*4 - 0x34d3a188]
call fcn.14045e87c
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + rcx*2 - 0x374cd496]
mov qword [rsp + rcx*4 - 0x6e99a91c], r8
jae 0x140409e18
Function at 0x140323c27
Capabilities:
Packed with generic packer

Disassembly:
lea rsi, [rsi + 1]
jg 0x1404c2122
push r11
call fcn.14041bd9f
sub dword [rsp + 8], 0xac1d9229
and qword [rsp + 8], 0x561d6680
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x140323c63
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, ebp
invalid
shr rbx, cl
js 0x1405429db
cmp r15, qword [rsp + rbx*2 - 0x1b2647fc]
call fcn.14053de42
jrcxz 0x140323c1f
mov bl, 0xe2
jl 0x140323ce0
cmpsd dword [rsi], dword [rdi]
fistp qword [rcx + rax + 0x32]
out dx, eax
loope 0x140323d03
xchg ebx, eax
loop 0x140323c9b
adc dword [rax - 0x65], 0xffffffff
sti
jl 0x140323d0a
adc byte [rbx], bh
xchg esi, eax
fistp qword [rbp + rcx*4 - 0x35]
sbb eax, 0x4df68311
xor esi, 0x4d
sbb byte [rbx - 0x38daabe], al
jl 0x140323d11
invalid
invalid
ret
stosd dword [rdi], eax
jl 0x140323cf5
invalid
cmp al, 0x4c
invalid
xor eax, dword [rdx]
or byte [rcx], bl
sar dword [rax + 0x49daabe3], 0xa6
pushfq
invalid

Function at 0x140335393
Capabilities:
Terminate process

Disassembly:
cmp dword [rsp + 0x30], 0x3d948e80
jge 0x140376db8
je 0x140063bdd
jns fcn.1405d1095
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x140336c0b
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
je 0x140478b30
xor al, 0x24
cld
cmp edx, eax
ffree st(5)
stosb byte [rdi], al
sbb bh, byte [rdi + 0x13a3875a]
xor dword [0x1806c163e], esp
invalid
xor word [rsp + 0x30], 0xb127
or r13d, dword [rsp + 0x21]
mov r13, qword [rsp + 0x28]
or word [rsp + 0x30], 0x34bb
jns 0x1400224cc
setns byte [rsp + 0x30]
jno 0x1403bde63
adc dl, byte [rdi + 0x73]
add byte [rdi + 0x6fa8df13], cl
add byte [rbx], al
and ebx, ecx
xchg ebx, eax
inc dword [rbp - 0x56]
cdq
invalid

Function at 0x140349376
Capabilities:
Packed with generic packer

Disassembly:
neg byte [rsp + 0x60]
mov r13, qword [rsp + 0x18]
test word [rsp + 0x60], 0x10
not dword [rsp + 0x60]
not word [rsp + 0x60]
not word [rsp + 0x60]
jae 0x14049ff4d
push rsi
pushfq
movabs rsi, 0x381097aafe9e7a0c
push r15
add esi, 0x423f8887
mov rsi, qword [rsp + rsi - 0x40de0283]
xchg qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], 0xfffffffff4a3f497
movabs r15, 0x42a36608bba8a22a
call fcn.1404f27fa

Function at 0x1403565a6
Capabilities:
Packed with generic packer

Disassembly:
call fcn.14054554d
sar edi, cl
invalid
lea rax, [rax + r8*2 + 0x2a10f52a]
push rcx
push rbp
push r12
jg fcn.140523dd1
mov r12, r8
push r15
mov rcx, r12
xchg qword [rsp + rcx - 0x283b6ed9], rax
mov r8, qword [rsp + rbx - 0xb700]
sub byte [rsp + 0x50], ch
not bx
mov rbp, qword [rsp + rcx - 0x283b6ee9]
sub rbx, qword [rsp + rcx - 0x283b6ee9]
mov qword [rsp + rcx*2 - 0x5076de22], 0x4b268d12
mov rbp, qword [rsp + rcx - 0x283b6f29]
jl 0x14046de78
shl byte [rsp + rbx + 0x283b271a], cl
je 0x14033d2e5
push r13
pushfq
movabs r13, 0xd4a8759b89b61698
not r13d
mov qword [rsp + 0x10], 0x6e353535
mov r13, qword [rsp + r13 - 0x7649e95f]
call fcn.1402e1e2a
Function at 0x14035f974
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xd805d
mov rcx, qword [rsp + 8]
push rdx
mov rbp, qword [rsp + 0x10]
push rcx
push 0xffffffffa697b0b4
xor byte [rsp + 0x20], ch
mov rdx, rbp
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
not dword [rsp]
setno dl
jge 0x14043e068
cmp byte [rsp + 8], cl
movsx edx, dx
not dword [rsp + 8]
jns 0x140555af4
ja 0x1404c77a9
shr cl, 0x21
add word [rsp], 0x5a1
call fcn.140555814
jge 0x1403b578c
call fcn.140044c6a
or al, 0x1d
scasb al, byte [rdi]
popfq
mov r12b, byte [rax - 0x5d633e8e]
stosd dword [rdi], eax
or ebp, dword [rcx - 0x76]
in eax, dx
or dword [rbx + 0x1712c69a], ebx
push rbx
or byte [rcx - 0x4c], 0x92
xchg ebp, eax
js 0x14043e104
nop
outsd dx, dword [rsi]
adc esi, esp
push rsp
retf 0x12a1
pop rdx
invalid
movabs rdx, 0xa788d60d26aac093
shl dx, 0xea
and r15w, 0xf711
call fcn.1404989db
js 0x1404d7026
mov r12, qword [rsp + 0x58]
jne 0x14056973d
jns 0x1402b6b31
cmp r9d, 0xf2af5416
lea r9, [r9*8 - 0x56d2dd7e]
xchg qword [rsp + 0x10], rdi
seta r9b
call fcn.1405168d2
xor edx, dword [rdi - 0x18e5f862]
out dx, eax
and esi, dword [rcx + rdx + 0x1992067b]
mov bh, 0x64
cmp al, 0x8e
mov esp, 0x73e385f1
invalid
lea rbp, [rbp + 0x401e00a8]
not dword [rsp + 0x20]
je 0x1403c2a66
sub qword [rsp + 0x20], rdx
mov byte [rsp + 0x20], 0x2f
and byte [rdi], ch
lea rdx, [r11 + riz - 0x7e5dcec7]
xchg qword [rsp + 0x50], rax
mov rdx, qword [rsp + rdx - 0x74722ee9]
add r9b, byte [rsp + 0x24]
bswap r11
shr byte [rsp + 0x28], 0xac
and r9w, 0x2202
call fcn.140209380
call fcn.14046b665
push rdi
call fcn.14054e1bb
add ebx, ecx
jl 0x140569745
jbe 0x1405697c2
jl 0x14056975c
out dx, eax
push rdi
sub al, 0xa
in al, 0xcd
jle 0x1405697df
mov esi, 0x1c794cfb
xor eax, 0x33816ace
test ebx, ebx
sbb dword cs:[rsi], ebp
cld
and eax, 0x8319d88
in eax, 0x74
and dword [rsi + rdi + 0x3a], ebx
enter 0xffffffffffffe4eb, 0xffffffffffffff8c
out 0x82, eax
xor al, byte [rcx - 0x68affeb2]
xchg bh, bh
mul dword [rdx + 0x10242989]
jrcxz 0x140569754
mov cl, 0x3c
mov cl, 0x3c
cmp dword [rbx + rbp*8 + 0xa], 0x73c895b3
invalid
invalid

Function at 0x140369f00
Capabilities:
Encode data using xor

Disassembly:
cmp rbp, 0x4c87e018
mov rbp, qword [rsp + r9 + 0x5cd078c4]
call fcn.14046c2df
out 0x7c, al
add rax, 0x60d184ce
shr ah, 0xf4
not ecx
pop rcx
xor al, 0x3c
add bpl, dl
cmpsb byte [rsi], byte [rdi]
add ch, byte [rsi]
add al, 0x67
pop rcx
mov dl, 0xff
xchg ecx, eax
stosb byte [rdi], al
leave
push rdx
add byte [rax - 0x80], bl
sub al, byte [rsi + 0x19]
jb 0x140369f17
add al, 0xa
sub dword cs:[rdx], esi
invalid
Function at 0x1403791c1
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1404b7f61
jno 0x14041c897
movsx bp, bpl
shl rbp, 0xed
lea rcx, [rcx + 0x54b66618]
xor bp, dx
shr edx, 0x92
shr dx, 0x89
call fcn.14045b826
pop rdi
invalid
and byte [rdx + 0x1a9c44bf], bh
out 0x90, eax
invalid
nop
mov esp, 0x9baa4cb4
stosb byte [rdi], al
wait
adc dword [rbx], esp
mov cl, 0x7b
movabs eax, dword [0x91a55d4145bf22ce]
mov al, 0xc5
pop rbx
jle 0x1404b7eee
add al, 0x66
add r8d, r9d
movabs eax, dword [0x33ee21ec17ead1b2]
jnp 0x1404b7ed8
xor al, 0x51
or eax, 0x8dcc483e
and dword [rbx], edx
test byte [rdi + riz*4], ah
js 0x1404b7f59
mov word [rdi + 0x1a6cacbc], es
mov dh, 6
and esp, dword [rcx - 0x25]
mov ecx, ds
and bh, byte [rdi]
jne 0x1404b7f9e
movsq qword [rdi], qword [rsi]
loope 0x1404b7f96
call 0x1a526fd87
push r10
add ebx, ebx
xchg ebx, eax
mov ch, 0xaf
xchg qword [rsp + rdx - 0xcd49c23], rsi
mov r8, qword [rsp + rdx - 0xcd49c3b]
cmp r13, 0xffffffffa5b97034
cmp r13, 0xffffffffa5b97034
mov r13b, byte [rsp + rdx*4 - 0x33527199]
call fcn.14049be47
xchg dl, bl
pushfq
jl 0x1404b7eeb
and byte [rbx + 0x147ca05b], 0xc3
shr byte [rsi - 0x7d], 1
inc byte [rax + 0x455a8367]
mov edi, 0xfb8b7c83
movabs al, byte [0x5d836c46237ca0f1]
jge 0x1404b7f51
cmp al, 0x81
jl 0x1404b7f8c
cmp dword [rbp + rdi*8 - 0xc], 0xde7d7ca4
mov esp, 0x915f7c9a
hlt
jl 0x1404b7ff7
xchg ecx, eax
mov cl, 0x6b
sbb dword [rdi + rcx - 0x12837f54], 0x65
pop rbp
movsb byte [rdi], byte [rsi]
jl 0x1404b7fb0
lodsb al, byte [rsi]
cmp byte [rbp + rbp*8 + 0x65], 0x8f
invalid
xchg dword [rsi + 0x6a], ecx
cmp dword [rdx + 0xf83631e], 0xfffffff9
and dword [rdi - 0x418a4884], eax
mov esi, 0xd8bb1b5c
invalid
psubw mm4, qword [rcx]
xchg dword [rdi + rsi*4 + 0x75], edi
mov esi, 0xbb1b5cbe
fcom st(4)
or dword cs:[0x184f20333], ebx
invalid
mov al, 0xf4
stc
sar dword [rdi + rdi*8], cl
invalid

Function at 0x14038d3ae
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffc7633140
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14064e2cf

Function at 0x14038d70e
Capabilities:
Encode data using base64

Disassembly:
ja 0x14052eedf
neg qword [rsp + 0x20]
lea rax, [rax - 0x426ebf51]
jle 0x1402b31b4

Function at 0x14038d726
Capabilities:
Encode data using base64

Disassembly:
push r11
mov qword [rsp + 0x40], rax
pushfq
movabs r11, 0x6b0ba712df2ed1a1
shr r11d, 0xc
call fcn.1403287c9
Function at 0x14038d741
Capabilities:
Encode data using base64

Disassembly:
shl cl, 0x83
or r14, qword [rsp]
sub qword [rsp], 0x55113fb2
xchg qword [rsp + 0x30], rbx
mov r13, qword [rsp + 0x10]
xor dword [rsp], 0xf206217
xor cl, 0xa
jae 0x1403662a0
add eax, 0x44d6cda
pop rdi
mov dl, 0xff
fcom dword [0x115756f6a]
invalid
mov rbx, qword [rsp + rbx*2 + 0x4934400]
mov rbx, qword [rbx]
jo 0x1403293a8
movabs rcx, 0x23b2fd1c7b21b20b
mov qword [rsp], r14
ja 0x1405bc77f
shl dword [rsp], cl
cmp r14b, 6
not cx
lea rbx, [rbx - 0x5ad2b3c1]
not r13w
mov r14b, byte [rsp + 4]
jbe 0x1402c6eea
and dword [rsp + 8], 0xd63b7298
call fcn.14059c2a6
add qword [rsp], 0x72f51
movabs r13, 0x38337590998ab22f
add qword [rsp + r14*2 + 0x49343b8], 0xffffffffbfde85a6
shl r14b, 0x71
mov rbx, r14
add r13w, r13w
add r14d, ebx
lea r13, [r13 + r13*8 - 0x14667767]
jl 0x1402ece89
add r13b, 0xb8
not r13b
call fcn.1403e592d
pushfq
movabs r9, 0xc9923804af13edb2
add qword [rsp + 0x18], 0xffffffffbf8c6db2
mov qword [rsp + 0x18], 0x32cc7fe8
mov r9, qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x10]
call fcn.1406763f0

Function at 0x14038e0be
Capabilities:
Set registry value

Disassembly:
adc eax, 0x99d586
test eax, eax
jne 0x140022b11
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 8
mov r9d, recv
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x140022b09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140052a40
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140052a40
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rsp + r12 - 0xf35c077]
mov rdx, qword [rdx + rsi - 0x24414000]
mov r12b, 0x98
movabs r10, 0x5989d23643aa4212
setb r12b
je 0x1403825e5
lea rdx, [rdx + 0x69bf7e24]
add qword [rsp + r12 - 0xf35bfb9], 0x68444
or sil, sil
jg 0x140022ab1

Function at 0x14039604b
Capabilities:
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
lea rbp, [rbp - 0x452597e]
mov qword [rsp + 8], 0x41abb906
setg byte [rsp + 8]
call fcn.1402ea0fd

Function at 0x14039606f
Capabilities:
Packed with generic packer

Disassembly:
lea r13, [rbp*8 - 0x29e65a6e]
xchg qword [rsp + rbp*2 - 0x40], rdx
mov r14, qword [rsp + rbp - 0x48]
xor byte [rsp + rbp - 0x30], 0x86
not byte [rsp + r13*2 + 0x53ccb074]
setg byte [rsp + rbp*8 - 0x220]
setno byte [rsp + rbp*8 - 0x218]
or dword [rsp + rbp - 0x20], 0x9c87041b
mov r13, qword [rsp + r13 + 0x29e65866]
neg byte [rsp + rbp - 0x28]
neg ebp
test word [rsp + 0x28], 0x2989
call fcn.1404d6e2f
mov rdx, qword [rsp + rdx*2 + 0x30]
mov rdx, qword [rdx]
jge 0x1402c5510
call fcn.1404ae430
mov qword [rsp + 0x20], 0xffffffff9914758a
mov rbx, qword [rsp + 0x18]
movabs r11, 0xfb86971af5b9f9be
xor r11, r11
jl 0x1404aea02
and r11d, 0x42a114ae
mov r11, qword [rsp + r11 + 0x10]
jge 0x14051409c
cmp esi, 0xcc842d00
call fcn.1404d32d6
invalid
add qword [rsp], 0xffffffffbfb515ef
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.140697f63