joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bd80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x79], rdx
mov rsi, qword [rbp + 0x7f]
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rdx, qword [rcx]
mov rcx, qword [rdx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x14001bdde
mov edx, 0x2749
mov rcx, rbx
call fcn.14001b7e0
jmp 0x14001bf10
xor r9d, r9d
mov r8d, 0x4000
mov rdx, rax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jle 0x14001be02
mov qword [rsi], rdi
mov byte [rbx], r15b
jmp 0x14001bf10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rbp - 0x39], r15
movdqa xmm0, xmmword [0x1400907d0]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov dword [rbp - 0x41], eax
xor r8d, r8d
lea rdx, [0x14008e9a8]
lea rcx, [rbp - 0x39]
call fcn.140001be0
nop
mov dl, 1
mov byte [rbp - 0x11], dl
mov r8d, dword [rbp - 0x41]
mov dword [rbp - 9], r8d
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp + 0xf], xmm1
mov dword [rsp + 0x20], 0x18
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14001be7f
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [r14]
mov qword [rax + 0x28], 0xffffffffffffffff
mov r8d, dword [rbp - 9]
movzx edx, byte [rbp - 0x11]
mov qword [rsi], r15
test edi, edi
jne 0x14001be94
mov byte [rbp - 0x41], dil
mov edi, 0x1a
mov byte [rbx], 0
jmp 0x14001bee1
mov byte [rbp - 0x71], dl
test dl, dl
je 0x14001beb0
mov dword [rbp - 0x69], r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x61]
call fcn.140002f20
movzx edx, byte [rbp - 0x71]
mov edi, 0x1c
mov byte [rbx], dl
test dl, dl
je 0x14001bee1
mov eax, dword [rbp - 0x69]
mov dword [rbx + 8], eax
movups xmm0, xmmword [rbp - 0x61]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x51]
movups xmmword [rbx + 0x20], xmm1
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], recv
mov byte [rbp - 0x61], 0
or edi, 1
test dil, 4
je 0x14001bef7
and edi, 0xfffffffb
lea rcx, [rbp - 0x71]
call fcn.1400139f0
nop
test dil, 2
je 0x14001bf07
lea rcx, [rbp - 0x41]
call fcn.1400139f0
nop
lea rcx, [rbp - 0x11]
call fcn.1400139f0
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400503d0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022130
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, rcx
xor esi, esi
mov dword [rbp - 0x18], esi
lea r9, [rbp - 0x18]
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, dword [rbp - 0x18]
lea edx, [rax + rax]
xor ecx, ecx
lea r9d, [rsi + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]

Function at 0x140022410
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140054da0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
Function at 0x140022c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14009c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov ecx, 0xf75db66e
call fcn.140002170
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140022db6
mov qword [rsp + 0x50], rsi
mov ecx, 0xc309a0d
call fcn.140002170
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x140022da7
mov ecx, 0x700da41
call fcn.140002170
lea r9d, [rsi + 4]
mov r8d, 0x3000
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x140022db6
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140022ce9
mov ecx, 0x6bcbc4b2
call fcn.140002170
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
jmp 0x140022da7
mov ecx, 0x8285aca5
call fcn.140002170
mov rcx, rdi
call rax
mov dword [rsp + 0x4c], esi
mov ecx, 0xd30e846a
call fcn.140002170
mov r8d, 6
lea r9, [rsp + 0x4c]
xor edx, edx
mov rcx, rbx
call rax
test rax, rax
jne 0x140022d3b
mov ecx, 0x6bcbc4b2
call fcn.140002170
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x140022dbc
mov ecx, dword [rax + 0x18]
add rcx, rbx
mov rdx, rcx
mov qword [rsp + 0x40], rcx
movabs r8, 0x6c616e416f747541
lea rax, [rcx + 0xa0]
cmp rdx, rax
jae 0x140022d8c
cmp qword [rdx], r8
jne 0x140022d82
mov ecx, 0x6bcbc4b2
call fcn.140002170
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
mov eax, 1
jmp 0x140022dbc
inc rdx
mov qword [rsp + 0x40], rdx
jmp 0x140022d53
mov ecx, 0x6bcbc4b2
call fcn.140002170
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x140022dbc
mov ecx, 0x8285aca5
call fcn.140002170
mov rcx, rdi
call rax
xor eax, eax
jmp 0x140022dbc
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400503d0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140025120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x14008f260]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140025199
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140025140
test r8, r8
je 0x1400251bd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400251a0
not ecx
mov eax, ecx
ret
Function at 0x14002b100
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x140090308]
jmp 0x140723ea1
Function at 0x1400497ed
Capabilities:
Authenticate hmac

Disassembly:
and r14b, r14b
and r14d, r15d
mov word [rsp + 0x30], 0x23a2
js 0x14048f3cf

Function at 0x14006165c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140061488
Function at 0x1401fe6df
Capabilities:
Packed with generic packer

Disassembly:
add word [rsp + 0x50], 0x2884
add dword [rsp + 0x50], 0x74a8a307
jle 0x140343d4e
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
ret

Function at 0x140211c0f
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0x5ac6e14b
lea rsp, [rsp + 8]
call fcn.1406d8037
Function at 0x140267012
Capabilities:
Encode data using xor

Disassembly:
sub r13, 0x6d843da0
call fcn.140491ab6
cmp eax, 0x4d6730da
xchg edi, eax
ficom word [rdi + 0x60]
jge 0x140267054
invalid
push 0x4d
std
pop rbp
xor bp, word [rcx + 0x4d]
jno 0x140267026
xor eax, 0x52a14d6e
and dword [rdi + 0x4d], ebp
jb 0x140267071
lodsb al, byte [rsi]
mov dl, 0x7b
invalid
mov dl, 0x21
mov edx, 0x414d5051
and byte [rsi + rbp*2 + 0x64c1834d], bh
add r8, qword [r11 + 0x4d67d858]
mov edi, 0x4d60dec4
adc dword [rbp + 0x5f], edx
or ebx, dword [r14]
mov dl, 0xda
and esi, dword cs:[rbx + 0x38]
stosd dword [rdi], eax
jne 0x14026709e
invalid
mov edx, dword [rdx + 0xe169]
add byte [rax], al
add al, 0x93
jb 0x140267034
mov cl, byte [0xcd35b929]
or eax, 0x8d0f487a
xchg edi, eax
cmp esp, 0x3f
or eax, 0x38541a0f
add byte [rsi], dh
sbb esp, eax
cmp qword [rsi], r9
jl 0x1402670a9
add dword [rdx + 0x4ff82fcf], ecx
hlt

Function at 0x140267c98
Capabilities:
Encode data using base64

Disassembly:
jae 0x14042d9be
shl r9, 0xac
ja 0x14048a200
shr word [rsp + 0x78], 0xaf
mov r10, qword [rsp + 0x80]
movabs rbx, 0x831a951f09866699
not r9d
add word [rsp + 0x78], 0xceaf
mov rdi, r15
neg dword [rsp + 0x10]
jg 0x1405391f3
call fcn.1403ffb8d

Function at 0x14026a934
Capabilities:
Packed with generic packer

Disassembly:
pushfq
sub bl, 0x14
add qword [rsp + 0x18], 0xffffffffffda58d3
shr rbx, 0x13
movabs rax, 0xa63ff62db99b1d2f
xor bl, bl
and bx, 0x5b19
sets bl
push rbx
setle al
push 0xffffffff9a081117
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
xor word [rsp + 8], 0x521e
not ebx
shl ebx, 0x30
and ebx, dword [rsp + 1]
add word [rsp], 0xeda0
xor qword [rsp + 8], 0x72a31a91
shr bl, 0xa1
jno 0x14059b909

Function at 0x140277b35
Capabilities:
Encode data using base64

Disassembly:
je 0x1403b8c5d
neg r14d
mov r14, qword [rsp + r14 - 0xa690974]
mov qword [rsp + 8], 0xffffffffac14ecf0
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1406f518b
jge 0x1404bcedb
invalid
ja 0x14046124c
mov r12, qword [rsp + rcx - 0xa3]
and rcx, qword [rsp + 0x48]
not cx
lea r14, [r14 + rcx + 0xd19ad85]
call fcn.14057b829
mov rdx, qword [rsp + rdx*2 - 0x35bc52ea]
jge 0x14054ab58
int3
xchg qword [rsp + rbx - 0x4d12], rbp
mov r11, qword [rsp + rbx - 0x4d6a]
or dword [rsp + rbx - 0x4d2a], 0x282c379b
add qword [rsp + rbx - 0x4d1a], 0xffffffffbfd57b98
cmp qword [rsp + rbx - 0x4d2a], rbx
ja 0x14049031a
not r11b
jle 0x140495554
sub qword [rsp + rbx*8 - 0x26b78], rbx
shr qword [rsp + r11 - 0x6d0c13fc], 0xa7
jb 0x14040a496
pand mm4, mm6
sha256rnds2 xmm6, xmm4, xmm0
mov ch, 0x60
ret 0x5253
not byte [rsp + rbx*4 - 0x13590]
not rbx
mov rbx, qword [rsp + rbx + 0x4d93]
mov byte [rsp + 0x20], 0x8e
js 0x140564ec3
add word [rsp + 0x50], 0xef34
or byte [rsp + 0x50], 0x3d
jb 0x1402c53a5
mov rdi, qword [rdi]
add r11, 0x48be03bf
or byte [rsp + 0x20], 0xab
cmp word [rsp + 0x20], 0x5237
call fcn.14050ed5a
add r15d, r15d
shr r15w, 0x97
sub r15d, 0x1f27ba99
mov r15, qword [rsp + r15*2 - 0x48ac6]
mov qword [rsp + 8], 0x5afcc0ba
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1405cf5f2
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
ret
call fcn.14047b84e
xor r12b, r12b
shr r12b, 0xf
call fcn.140343ce7
Function at 0x14027f5fd
Capabilities:
Packed with generic packer

Disassembly:
not r8w
cmp cl, r9b
xchg qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x10]
cmovae cx, r12w
setae r13b
sub r13, r12
cmp r13, 0x3e96d622
jno 0x14041bde4
mov r13, qword [rsp + 0x28]
mov r12w, 0xce34
jne 0x1403f33d9

Function at 0x1402848a5
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x96
sbb byte [rsi + 0x48], 0xc7
and al, 0x10
xor cl, ch
imul ecx, dword [rax - 0x75]
insb byte [rdi], dx
and al, 8
mov qword [rsp + 8], 0xffffffffb0bbf49d
lea rsp, [rsp + 8]
call fcn.14069fd06
or dword [0x1694bb13f], edi
cdq
cmp edx, dword [rcx]
and dword [rbx + riz*8 + 0x324cd957], ebp
sti
call 0xfc3c890c
cli
add dword [rcx], esi
pop rbp
movabs dword [0xae4009e3d4bfc6fe], eax
mov esi, 0x4016f888
stosd dword [rdi], eax
jp 0x140284884
invalid
mov edi, 0x2b27d4e3
adc dil, byte [rbx + 0x40347175]
add eax, 0x40064a8a
jno 0x14028493d
call 0x12009e2bc
jnp 0x1402848c5
mov edi, 0xbfc9dffd
and dh, byte [rdx - 0x403ac95c]
and cl, byte [rbp - 0x37]
xor al, byte [rax + 0x3a]
invalid
add bh, cl
wait
iretd
Function at 0x14028ec7f
Capabilities:
Packed with generic packer

Disassembly:
jne 0x14050640a
lea r15, [r15 + r14*8 + 0x2e820ca4]
or qword [rsp + 0x50], 0x1189d205
shr word [rsp + 0x50], 0x51
shl qword [rsp + 0x50], 0x20
not r13d
add qword [rsp + r14 - 0x4e234883], 0xffffffffbfa754a2
mov r15, qword [rsp + 0x28]
call fcn.1403a6a6e
and r14b, byte [rsp + r14 - 0x4e2348ce]
sub byte [rsp + 0x50], 0x3b
xchg qword [rsp + rsi*2 - 0xe19bc4], rdi
mov rsi, qword [rsp + 0x60]
jne 0x140329b0f

Function at 0x1402a5631
Capabilities:
Encode data using base64

Disassembly:
jb 0x14046123e
lea rbp, [rbp - 0x456e5cd3]
add ebx, dword [rsp + rbx*2 - 0x5838]

Function at 0x1402ab997
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push r11
push r9
movabs r9, 0xf11e563967b14088
pushfq
sub r9w, 0xb4af
js 0x1403c23d9
invalid

Function at 0x1402b25dc
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x30384d26
and qword [rax - 0x4a], rsi
invalid
mov qword [rsp + 0x18], 0x7ac87358
mov rdx, qword [rsp + 0x10]
call fcn.1404b7f79
pushfq
stosd dword [rdi], eax
stosb byte [rdi], al
loopne 0x1402b25a6
invalid

Function at 0x1402b5bac
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x50], r11
jl 0x1404ab74f
cmp r10b, 0x80
push r12
movabs r12, 0x54146000bca20d11
push r15
movabs r13, 0x80791206e0d490e
xchg qword [rsp + 0x88], rax
mov r13, qword [rsp + 0x18]
not r11d
lea rax, [rax + 0x769f92b8]
js 0x140467c5e
jp 0x1404ab79b
invalid
fadd qword [rbx]
invalid

Function at 0x1402c3b36
Capabilities:
Packed with generic packer

Disassembly:
mov r10, qword [rsp + rsi - 0x23226d9]
lea rax, [rax + r10 - 0x4d7b0657]
push r9
setne r13b
or r10w, word [rsp + rsi*4 - 0x8c89bce]
shr r10, 2

Function at 0x1402c4a39
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1404b44b0
shr rdx, 0x59
not rdx
lea rdx, [rdx*2 - 0x12e74ff5]
mov rdx, qword [rsp + rdx*2 + 0x25cea03e]
add qword [rsp + 0x10], 0xffffffffbfcc4155
call fcn.1402128cb
mov rax, qword [0x1402347c8]
mov rdx, rcx
neg ch
cmc
mov rcx, qword [rax]
jmp fcn.1403a4b30
setno bl
mov r12, qword [rsp + r12*8 - 0x56b58]
add bl, bh
neg ebx
add bl, byte [rsp + 0x6e]
neg qword [rsp + 0x68]
mov rbx, qword [rsp + 0x30]
and dword [rsp + 0x68], 0x4b8f4d33
add word [rsp + 0x68], 0xfa2b
jg 0x140419666
call fcn.140515250
jbe 0x1404c5ea8
test bl, 0x25
movsx r9w, r12b
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
lea r12, [r12 + 0x39901899]
call fcn.14050cfe8
jmp 0x14042499b
mov r13, qword [rsp + r13*2 + 0x870]
movzx rbx, word [rsp + r12*2 - 0x15a8e]
jg 0x14048cd82
insb byte [rdi], dx
and dword [rsi + 0x7f9c6065], edi
clc
cmp dh, al
movabs byte [0x22eb405e06e44051], al
or eax, 0xab4052ef
invalid

Function at 0x1402d1396
Capabilities:
Authenticate hmac

Disassembly:
lea rsi, [rsi - 0x7fe7a34c]
je 0x14027cd52
mov rbp, qword [rsp + 0x58]
Function at 0x1402d5d7c
Capabilities:
Packed with generic packer

Disassembly:
bswap r10
shl dword [rsp + 0x70], 0x97
movabs rdi, 0x680181bd6dbc2013
shl byte [rsp + 0x70], 0xe6
mov rdi, qword [rsp + 0x40]
jbe 0x1404d1821
sub dword [rcx + 1], ecx
sbb ecx, dword [rcx]
add byte [rbx], bl
xor al, 0x5b
add byte [rbx], bl
add dword [rdx], edx
or al, 0xf0
or ah, al
or byte [rax + 7], dh
invalid
cmp byte [rsp + 0x70], 0x8c
call fcn.1400208a6
jae 0x1404165fa
jne 0x140471071

Function at 0x1402ddbad
Capabilities:
Get geographical location

Disassembly:
mov r14, qword [rsp + 0x10]
jno 0x140460d66

Function at 0x1402f1424
Capabilities:
Encode data using xor

Disassembly:
and byte [rsp + 8], 0xa3
shr word [rsp + 8], 0x24
xchg qword [rsp + 0x10], rax
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
ret
setno r13b
mov qword [rsp + 0x18], rsi
jne 0x14052704f
mov qword [rsp + 8], 0xffffffffd1998628
jns 0x1402c9147
nop
jge 0x1402f1458
sub cl, byte fs:[rcx + rbx*8]
mov edi, 0x5ad3ddbc
invalid
outsb dx, byte [rsi]
sbb al, byte [rax - 0x19]
pop rsi
out 0x5e, eax
push rcx
push rax
xor al, 0x40
jae 0x1402f1455
cmp eax, dword [rax + 0x2c]
lodsd eax, dword [rsi]
xchg edx, eax
sbb eax, 0x43044037
loop 0x1402f142d
mov edi, 0x400fff34
faddp st(7)
shl ah, 1
adc byte [rax - 0xd], al
cwd
mov edi, 0x2d3bd42b
shr byte [rbx + 0x5d], cl
insd dword [rdi], dx
xor al, byte [rax - 0x54]
invalid
add esi, 0xe802baa9
lea rbp, [rbp - 0x796eb66b]
or r13, qword [rsp + 0x18]
xor esi, 0xec821091
call fcn.1402aa894

Function at 0x140313616
Capabilities:
Packed with generic packer

Disassembly:
mov r11, qword [rsp + 0x48]
mov r8w, word [rsp + 0x46]
jno 0x1405aa18d

Function at 0x140315a4d
Capabilities:
Encode data using base64

Disassembly:
call fcn.14020810f
invalid
pushfq
add qword [rsp + 8], 0xfffffffffffb5dc3
movabs rax, 0xd906ff295f280084
push rcx
call fcn.14025f6c5
jge 0x1400444a6
jbe 0x140570785
call fcn.1404cb2f3

Function at 0x140326981
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], 0xffffffffe4208a3b
mov rdx, qword [rsp + 0x18]
add qword [rsp + 0x10], 0x1028c5
cmp word [rsp + 0x20], 0x660e
movsx r12, word [rsp + 0x20]
call fcn.1403a219f
movabs rsi, 0xe53ec713c33b4105
jno 0x140289ec8
mov esp, 0xb886ebf
adc al, 0x36
invalid

Function at 0x14033ad8e
Capabilities:
Encode data using base64
Get system information on windows

Disassembly:
lea rsp, [rsp + 0x10]
call fcn.1406f518b
Function at 0x14033c5be
Capabilities:
Authenticate hmac

Disassembly:
sub al, 0x99
sub r9b, bl
not dword [rsp + 0x28]
add dword [rsp + 0x28], 0x37851bb7
and word [rsp + r9 - 0x1627fff1], 0xd89d
lea rcx, [rcx + 0x12ce938]
cmp ebx, dword [rsp + r9*2 - 0x2c4ffffe]
je fcn.1405a6981
and rbx, qword [rsp + 0x28]
or byte [rsp + r9*2 - 0x2c4ffffa], 0xbd
call fcn.1402976f1
cmp al, 0x33
cmp eax, 0x4d9eb2f1
pop rbx
loope 0x1402fac1a
insd dword [rdi], dx
and cl, byte [r13 - 0x2c]
jmp 0x1402facb6
fdiv dword [r10 + 0x694d96d6]
out dx, al
mov dl, 0x9d
in eax, dx
mov dl, 0x44
pop rbx
adc dword [rcx*2 - 0x21d4b21a], esp
mov dl, 0xb6
invalid
xor dh, cl
out dx, eax
out dx, eax
loopne 0x1402fac6e
mov esp, 0x9329fec5
setge byte [rdi + 0x14]
int3
shr r9w, cl
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + r9*2 - 0x2c500000]
add byte [rsp + 0x28], 0x8e
cmp bx, r9w
jns 0x1402fac1c

Function at 0x140343d30
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400224a1
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022518
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400224ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022518
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x30]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400045a0
mov rax, rdi
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400503d0
mov rbx, qword [rsp + 0x888]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
push r13
and qword [rsp + 0x38], r15
jb 0x1404b8650
xchg qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x10]
add qword [rsp + 0x18], 0xffffffffbfca2554
neg byte [rsp + 0x38]
xor qword [rsp], 0xffffffffeebbc781
shr r13d, 0x18
jb 0x14057a2df
jbe 0x140022483
cmp dword [rsp + r13 - 0x5d], r13d
jno 0x1403c4cbc
in al, 0xc3
in eax, dx
invalid
or word [rsp + 0x48], 0xf1a
movabs r12, 0x959335267f3c9739
lea r15, [r12 + r13*4 + 0x67be0536]
setb byte [rsp + 0x48]
or word [rsp + 0x48], 0x8116
lea rax, [rax + r13 - 0x26f8ab9f]
jno 0x1402e65fa
test byte [rsp + 0x10], 0x22
lea rsp, [rsp + 0x20]
ret 8
mov r13, qword [rsp + 0x48]
je 0x1402d3eda
jge 0x14054fc6d
popfq
lea rsp, [rsp + 8]
ret

Function at 0x14035ba0f
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1402df5bf
xchg dword cs:[rbx - 0x1b9ef3e4], esp
movsb byte [rdi], byte [rsi]
xor eax, 0xc2b080e4
hlt

Function at 0x140364066
Capabilities:
Authenticate hmac

Disassembly:
mov r13, qword [rsp + 0x48]
mov r11, qword [rsp + 0x40]
ja 0x1405130dd
call fcn.14057b982
Function at 0x140366596
Capabilities:
Allocate thread local storage

Disassembly:
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
neg si
mov esi, 0x4391af80
or bl, 0xe
shl r15b, 0xc6
jb 0x140068372
jbe 0x140533ce6
pushfq
add qword [rsp + 8], 0xffffffffbf8cfcfd
mov qword [rsp + 8], 0x33369bfd
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14066973d
call 0x1403f6c1a
add qword [rsp + 0x20], 0x34caa3
push 0x6a0df601
sub rsi, 0xffffffff8523abae
add esi, dword [rsp + 2]
movabs rdx, 0x49806a9d72a84e26
push r12
add qword [rsp + 0x10], 0x25a45
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
xor word [rsp + 8], 0xc02f
add qword [rsp + 0x38], 0xffffffffbfa8a10d
cmp bx, word [rsp + 0xb]
mov r12, qword [rsp + 8]
mov qword [rsp + 0x30], rbx
setg r12b
setae bl
lea rdx, [rdx - 0x262a6f8]
push 0x649f34b6
mov qword [rsp + 0x10], rbx
push r8
and dword [rsp + r12 - 0x6a0d35c0], 0x263f383b
jge 0x140526e4c

Function at 0x14038508d
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], 0x575b5b6e
lea rsp, [rsp + 0x18]
call fcn.1406cc902
and r12d, 0x3e2dc583
jno 0x14027720b
jl 0x1403850e8
mov esp, 0x542c2be3
and al, byte [rax + 0xe]
invalid
jl 0x1403850b4
invalid

Function at 0x14039a1fb
Capabilities:
Encode data using base64

Disassembly:
not word [rsp + 0x60]
call fcn.1404cc1fc

Function at 0x1403a219f
Capabilities:
Terminate process

Disassembly:
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
jb 0x1400507cc
test qword [rsp + 0x28], r12
lea rsp, [rsp + r12 + 0x75dd]
ret 8

Function at 0x1403a689d
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsp + 0x48]
cmp ebx, 0x793e710f
bswap ebx
je 0x140277224
test bx, 0x710c
mov r10, qword [rsp + 0x68]
lea rsp, [rsp + rbx*4 - 0x3bfef39c]
ret 0x20

Function at 0x1403a6cec
Capabilities:
Check for software breakpoints

Disassembly:
jge 0x1403afc3e
test word [rsp + r15*2 + 0x10], bx
mov rbx, qword [rsp + 0x40]

Function at 0x1403a9622
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x68
hlt
shl qword [rsp + 0x50], 0xb
setns byte [rsp + 0x50]
test qword [rsp + 0x50], 0xfffffffff031228e
jae 0x140506971
xor eax, 0x430015d3
sbb al, 0x95
sbb al, 0x95
movsd dword [rdi], dword [rsi]
mov ecx, dword [rcx - 0x42]
sahf
loop 0x1403a9638
and al, 0x37
xchg edi, eax
jno 0x1403a961e
add dword [rdx], ebp
invalid
add word [rsp + 0x50], 0xda9