joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009fb72
Capabilities:
Encode data using base64

Disassembly:
cmp byte [rsp + 0x48], 0x15
push rbp
ja 0x14008faad
mov rbp, qword [rsp + 0x50]
xor word [rsp + 0x50], 0x7888
xchg qword [rsp + 0x60], rax
mov r9, qword [rsp + 0x38]
movabs rdi, 0x218b7807e6bb7425
add byte [rsp + 0x50], dil
not rdi
add qword [rsp + 0x20], 0xffffffffbff6f5e7
add word [rsp + 0x50], 0x1a3d
call fcn.1400d0f46
adc al, 0xe5
add dword [rdx], ecx
add al, 0
or dh, byte [rdi + rax]
add byte [rdx], cl
xor al, byte [rsi]
invalid
jbe 0x1400ddcc2
test rdx, 0xffffffffe72511bf
mov qword [rsp + 0x18], rdx
lea rsi, [rsi - 0x257003e5]
call fcn.1400c5d03
lea rsi, [rsi*4 - 0x4bd5acd6]
call fcn.1400917a9
movabs rdx, 0x8e0c681749a66fae
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
mov r8d, 0xd9aac29c
setg dl
jge 0x1400dc54e
add qword [rsp + 0x40], 0x5c17a
shr r14d, 0x8b
jb 0x14006e385
call fcn.14008e10b

Function at 0x1400a3415
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
setl byte [rsp + 0x38]
cmp rsi, qword [rsp + 0x38]
jg 0x14001b440
mov r8, qword [rsp + 8]
je fcn.1400dd886
jle 0x140075b26

Function at 0x1400a62df
Capabilities:
Set registry value

Disassembly:
add byte [rsp + r12 + 0x211e3ba], 0x16
call fcn.140064326
popfq
lea rsp, [rsp + 0x50]
ret
mov r13d, 0xb5a3d6aa
neg r13d
push rcx
movabs rcx, 0x300226033b3de0b6
add r13b, 0x8c
test rcx, r13
mov r13, qword [rsp + r13 - 0x4a5c29ca]
mov qword [rsp + 0x18], rax
jl 0x140008142
jle 0x1400912ab
mov ecx, 0x598342b2
push r14
shl ecx, 0xa6
movabs r14, 0x8c81a5b7392c689b
add qword [rsp + 0x10], 0xfffffffffff94cd6
movabs rax, 0x701755a2d495f115
test ecx, 0xd9089d34
jb 0x140058005
mov rax, qword [rsp + rcx - 0x60d0ac70]
mov rax, qword [rax]
neg r14d
or cl, 0
bswap ecx
or r14w, cx
call fcn.1400d7f93
call fcn.14007b892
jbe 0x14006a5b2
add qword [rsp + r9*2 + 0x7bfc018e], 0xffffffffbff37677
call fcn.140009828

Function at 0x1400a647a
Capabilities:
Delete registry key
Encode data using base64
Packed with generic packer
Query or enumerate registry key
Set registry value

Disassembly:
and dil, 0x22
jb fcn.140086758
sub di, di
xor di, 0xa297
mov rdi, qword [rsp + rdi - 0xa267]
add qword [rsp], 0xffffffffbffb6982
call fcn.140008faa
Function at 0x1400a8416
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
lea rcx, str..pipedialerchildproc64
call fcn.140001c64
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002db1
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002d91
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140002e0f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e1a
mov ecx, dword [rsp + 0x60]
call rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 1
mov byte [rsp + 0x58], 0x4d
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002e1a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140002db1
lea rcx, [rdx + riz - 0x687cf64e]
push r9
sete dl
xor ecx, 0xad04e89e
add qword [rsp + 0x30], 0xfffffffffffe5fbe
mov rsi, rcx
lea rcx, [rsi*2 - 0x33495c6d]
call fcn.14001ce9e
push r15
shr byte [rsp + 0x18], cl
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
sub qword [rsp + 0x18], 0x26862908
jb 0x140002da9
test dword [rsp + 0x18], 0x52a1990
call fcn.14005d51a
pushfq
movabs rbp, 0x13342297b3f829c
push r12
add qword [rsp + 0x10], 0xfffffffffff6b5ac
mov r12, rbp
movabs r10, 0x1702e7b783ae5014
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xffffffffc94f4bfe
mov r12, qword [rsp]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
ret
Function at 0x1400a8981
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
ret
jne 0x140092e77
jo 0x14000c6f2
int3
mov rax, qword [rax]
or r11w, 0x16bc
or r11, r11
and r11b, 0
mov r11w, 0x5b98
cmp r11d, 0x572496b2
call fcn.14004f64c
jne 0x1400a0ffe
or r12d, 0x112ee9b6
add qword [rsp], 0xfffffffffff95cb5
add qword [rsp + 0x10], 0xfffffffffffd3a4a
shr r14b, 0x41
jbe 0x1400ab77c
mov qword [rsp + 0x30], rbp
call fcn.1400650f2
call fcn.1400d7889
popfq
int3
and dword [rsp + 0x68], 0x109b11ae
shl dword [rsp + 0x50], 0x95
add r10d, r14d
mov r14, qword [rsp + 0x30]
lea r10, [r10*2 + 0x391ef415]
neg qword [rsp + 0x68]
mov r10, qword [rsp + 0x60]
js 0x14000c71e
cmp qword [rsp + 0x50], 0xffffffffb3862036
call fcn.140071489
mov bh, 0x24
ficom word [rbx + 0x3a]
stc
stosb byte [rdi], al
sbb dword [rbx], edx
jle 0x1400a10ab
xlatb
xchg esp, eax
mov dh, 0xbb
xchg edx, eax
movabs eax, dword [0x3e8f54878ec3d96a]
add dword [rbx + 0x6f], edx
pop rbp
invalid
sub eax, 0x4df7cd47
sub esp, dword [rbp + 0x5e73587]
movabs dword [0xeff51fd5736d976d], eax
mov cl, 0x7e
loopne 0x1400a113d
invalid
invalid
push r13
jb fcn.14004d42d
movabs r13, 0x208fda3a0297f88e
mov rcx, qword [rsp + 0x18]
xchg qword [rsp + 0x20], rcx
movabs r13, 0xca01e4967b9c07bc
neg r13
neg r13w
or r13b, 0xa8
jl 0x1400c426b
not r14b
add r12d, 0x99a43839
movabs rbx, 0xebf3a186b250231
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
cmp r12d, 0xdfbdf620
lea r12, [r12 + r12 - 0x56486dc6]
call fcn.1400b0693
mov qword [rsp + 0x18], rcx
jo 0x14001b89e
test r13w, 0xf59b
wait
cmc
push rsi
add qword [rsp + 0x10], 0xfffffffffffa9192
call fcn.1400917d8
enter 0xffffffffffffa0e3, 0xffffffffffffffe2
scasd eax, dword [rdi]
div word gs:[rcx]
jae 0x1400c427a
js 0x1400c42bf
invalid
add ah, dl
invalid

Function at 0x1400a974e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rcx
push r9
pushfq
movabs rcx, 0xec87f49de820ba2d
and cl, 0xac
mov qword [rsp + 0x28], 0xffffffff992783fa
mov rcx, qword [rsp + 0x10]
je 0x1400a975c
movabs r9, 0xd01b569276151237
jns 0x1400dc8cd
mov rax, rcx
jmp fcn.14000104a
mov word [rsi], ss
sub al, 0x96
call 0x1709bcd2e
mul byte [rax - 0x73a16bc2]
outsb dx, byte [rsi]
sub al, 0xbe
sbb dh, dl
sub al, 0xd6
call fcn.14001acc4
jo 0x1400dc8b7
adc byte [rbx + 0x36f5f4a9], ah
invalid

Function at 0x1400a9c77
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r13
pushfq
movabs r13, 0x14a5661a77836b02
mov r13b, 0x84
shl r13b, 0x69
lea r13, [r13 + r13 + 0xd2a6e95]
jne 0x1400cccb1
xchg qword [rsp + 0x10], rax
xor r13w, r13w
call fcn.1400a62df
movabs rbx, 0xc92184186012a005
xor bx, 0xf992
jle 0x14009a4cc
call fcn.1400bc777
nop
push r11
mov rbx, qword [rsp + r14 - 0x5c41d08c]
jne 0x14005f908

Function at 0x1400a9f45
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
add qword [rsp + 0x28], 0xffffffffbffa0760
call fcn.140077712
invalid
bswap rbp
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
jg 0x140087634
Function at 0x1400c201b
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
pop rax
push r15
push r14
push rbx
pushfq
movabs rbx, 0xfaecd2477a5d4a1
movabs r15, 0xe9f4484539be6be
movsx r15d, r15b
push r10
test bx, r15w
lea rbx, [rbx*2 + 0x16b8600d]
xchg qword [rsp + 0x28], rax
js 0x140093a74

Function at 0x1400c2d22
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jg 0x1400714c1
add cx, 0x7414
add cx, cx
xchg qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 8]
jae fcn.14001b770
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret
jne 0x14006b173
or r13w, word [rsp + 0xa]
shl r8d, 0x16
neg r13d
lea rax, [rax - 0x77d602c1]
lea rdx, [rdx + rdx*2 - 0x277e5c41]
mov rdi, r13
mov qword [rsp + 0x18], rdi
xor qword [rsp + 8], 0x630d710d
xor byte [rsp + r8 + 8], r13b
cmp edx, dword [rsp + r8 + 8]
xchg qword [rsp + r8*4 + 0x50], rax
mov rdx, qword [rsp]
movzx rdi, byte [rsp + r8*2 + 8]
seta dil
add qword [rsp + r8*8 + 0x30], 0xffffffffbff2b7b0
add qword [rsp + r8 + 0x38], 0xfffffffffffede6e
call fcn.14009ce30
mov al, 0x13
adc dword [rbp + rbx*4 - 0x62], ecx
insd dword [rdi], dx
invalid
mov r13, r8
push rdi
cmp r8w, 0x2234
mov qword [rsp + 0x40], rax
push r8
jge 0x140052b68
or r13w, 0xd132
movsx r13d, r13w
push rdx
jb 0x1400aaa9c
sub r13, r8
add qword [rsp + 0x18], 0xfffffffffffbf10a
not word [rsp + 8]
mov rax, r8
and r8, qword [rsp + 8]
not rax
movabs rdx, 0x1819c6a8d1ba5193
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
shl r8b, 0x59
je 0x1400bc9bd
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x1400c358f
Capabilities:
Set registry value

Disassembly:
js 0x1400025f1
call fcn.1400c6a70
jl 0x1400cd4c8
shl word [rsp], 0xcb
call fcn.14006807a

Function at 0x1400c71e7
Capabilities:
Encode data using base64

Disassembly:
mov r13, rdx
shr rdx, 0x3d
mov rbx, qword [rsp + 0x38]
mov rbx, qword [rbx + rdx - 6]
jb 0x1400cfd63
not r14w
call fcn.1400c809e

Function at 0x1400c9f7c
Capabilities:
Get token privileges

Disassembly:
add byte [rsp + 0x30], dl
and r8w, r8w
shl dword [rsp + 0x30], 0xd4
setns byte [rsp + 0x30]
lea rax, [rax + 0x4bbbf325]
jae 0x14008fa2c
mov byte [rsp + 0x30], dl
bswap rdx
call fcn.14009d721
Function at 0x1400cbc03
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
call fcn.1400c71e7
pop rsi
cmp cl, al
and al, 0xe2
pop rbp
invalid
js 0x14000cf10
mov rcx, qword [rsp + rsi - 0x3a40fd]
not si
or r10, r10
sub r10d, esi
jo 0x14000700d
lea rcx, [rcx + 1]
mov qword [rsp + 0x18], r10
call fcn.140022b89
setae r10b
add qword [rsp + 0x28], 0xffffffffbff400c3
lea r10, [r10*8 - 0x31c59e44]
lea rax, [rax - 0x4e57d1f3]
test r8b, r9b
movzx r8, r9b
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + r8*2 - 0x86]
mov r10, qword [rsp + 8]
lea rsp, [rsp + 0x38]
ret
not rdi
je 0x1400d7a7e
push rdi
movzx edi, di
add qword [rsp + 0x10], 0x91011
add qword [rsp + rdi - 0xe7b9], 0xffffffffbff524b8
call fcn.14000f7d7
jge 0x14005ac1c
test r9b, 0x3a
movabs r8, 0xf2379e0be2b6028c
lea r9, [r10*2 - 0x31460df3]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
jno 0x140084cf2

Function at 0x1400cbd53
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
not r12
neg r12w
sub cx, r13w
lea r12, [r13 + r14*2 + 0x3c8146b7]
test cx, 0x5513
seta r13b
or r12w, r12w
lea rsi, [rsi - 0x31e01677]
je 0x1400a89ae
call fcn.14004f07d

Function at 0x1400cc9f1
Capabilities:
Set registry value

Disassembly:
test byte [rsp + 0x10], 1
jl 0x14007ec71
neg r14b
mov r14, qword [rsp + 0x38]
test dword [rsp + 0x10], 0xf936ad11
jbe 0x1400daa8e
setns byte [rsp + 0x30]
jo 0x140052458
call fcn.14001e052
neg byte [rsp + 0x10]
and rbx, qword [rsp + 0x30]
add qword [rsp + 0x28], 0xffffffffbff89e03
mov rbx, qword [rsp + 0x40]
neg r14b
ja 0x1400c6aac
shr dword [rsp + 0x10], 0x25
jns 0x14007ec21
add qword [rsp + 0x18], 0xfffffffffffbd160
mov rdx, rsi
and bp, 0x951f
add si, 0x6d24
mov r10, rsi
jne 0x1400bebac

Function at 0x1400cda93
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
push rdi
mov r14, qword [rsp + r14*4 + 0x24eba948]
mov qword [rsp + 0x20], rax

Function at 0x1400d8345
Capabilities:
Delete registry key
Get token privileges
Packed with generic packer
Query or enumerate registry key

Disassembly:
mov r10, qword [rsp + r10*2 + 0x40]
call fcn.14009451d
Function at 0x1400d8360
Capabilities:
Delete registry key
Encode data using xor
Get token privileges
Packed with generic packer
Query or enumerate registry key

Disassembly:
movsx ebp, bpl
and dword [rsp + rbp*8 + 0x38], ebp
jle 0x14008bc24
mov rbp, qword [rsp + rbp + 0xb]
xor qword [rsp + 0x60], 0xfffffffff23735a4
shr qword [rsp + 0x60], 0x33
ja 0x140012957
not dword [rsp + 0x60]
call fcn.1400b5c8d
jns 0x1400cbd16
xor al, 0x67
mov ah, 0xc7
cmp eax, 0xe1622160
ror byte [rax - 0x3487b2b], cl
fisttp word [0xf91fa48b]
fisubr dword [rax + 0x75]
push rsp
push rdi
je 0x1400d83b9
jne 0x1400d83fc
rcl edx, 1
jno 0x1400d835a
sbb eax, 0x6724efdc
and eax, 0x6f6a63d9
invalid
or cl, byte [rax - 0x67b537ee]
bnd js 0x1400d8434
fadd st(6)
xchg ebp, eax
push rsi
and eax, 0x9093c29f
invalid
idiv byte [rax - 0x3f69cfd2]
pop rsi
enter 0xc16, 0x25
popfq
jmp 0x1400d8433
adc al, 0x59
push rax
add ebx, dword [rax]
mov ebx, 0x1625f4a9
mov ebp, 0xa041dcfe
xchg ebx, eax
sbb byte [rbx], ch
jno 0x1400d842e
test eax, 0xbd1625f4
invalid
sbb eax, 0x4cce8dde
in al, dx
invalid

Function at 0x1400d9495
Capabilities:
Terminate process

Disassembly:
call fcn.1400aba1b
push rbp
add qword [rsp + 8], 0x5fd9c
or r13b, 0xa3
mov qword [rsp], r9
shl cx, cl
sub rcx, rcx
mov rbp, qword [rsp + rcx*4 + 8]
mov rbp, qword [rbp + riz]
jae 0x14008730d
jge 0x14008c864
Function at 0x1400d94a1
Capabilities:
Terminate process

Disassembly:
adc eax, 0x24c4f2
call fcn.14006099d
not r15b
add qword [rsp + 0x38], 0xffffffffbffe4978
mov r15, qword [rsp]
call fcn.140097c70
invalid
add r8b, 0x26
mov r8, qword [rsp + r8 - 0x16]
mov qword [rsp + 0x10], rcx
add qword [rsp], 0xfffffffffffab6bc
push rcx
movabs rcx, 0xbda74ba678a5dca3
nop
movabs rcx, 0x748410ab50b63308
bswap ecx
not cx
sub cl, 0x8f
sub cl, cl
bswap rcx
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov qword [rsp + 8], 0x66a0480b
not word [rsp + 8]
lea rcx, [rcx + 0x65ae021b]
jbe 0x1400d9bcd
mov dword [rdx], ebx
test eax, 0xc4f5e8ea
invalid
and r8b, 0x13
cmp r8d, 0x1d383da0
js 0x140055903
sub al, 0xaf
cmpsb byte [rsi], byte [rdi]
test dword ss:[rdi - 0x7c6f2c3e], ebx
rol dl, 0x9f
jge 0x14008b8ce
push rbp
invalid
sbb dword [rcx], eax
xchg dword [0xc53bd6b9], edx
cmp edi, ebp
wait
adc eax, 0xdc365a7
push rdi
int 0xdf
jge 0x14008b92a
std
invalid
imul eax, dword [rcx + 0x11db71f3], 0x1b
mov cl, 0x77
cdq
outsd dx, dword [rsi]
xchg ecx, eax
mov bl, 1
push rdi
leave
push rbx
mov dword [rbx], edi
stc
ja 0x14008b8e1
mov ebx, 0x5efc2a18
sbb eax, 0x845675be
invalid
test r15, 0xffffffff9fa4bf24
jg 0x140001295
lea r15, [r15*2 - 0x7ccd444e]
mov r15d, dword [rsp + 0x34]
mov qword [rsp + 0x18], r15
shl word [rsp + 0x20], 0xe1
xchg qword [rsp + 0x40], rcx
mov r15, qword [rsp + 8]
test qword [rsp + 0x18], 0x299cb099
jae 0x14009b2a6
sbb al, 0x6b
wait
push rsi
test eax, 0x48de9293
xor ecx, 0x5825ba9e
test ecx, 0x31ad8933
mov rcx, qword [rsp + rcx - 0x5825ba56]
not dil
not dil
call fcn.140053a84
xchg qword [rsp + r8 + 0x18], rcx
setne r8b
jge 0x14008b876
push rcx
pushfq
movabs rcx, 0xe40598ba1308711a
push r14
shl rcx, 0x7d
jns 0x140054510
fnstsw word [rsi - 0x6b]
test byte [rcx + rcx], 0x20
xor ecx, eax
mov ecx, dword [rcx - 0x2c1021c]
invalid
and word [rsp + 8], 0x8892
call fcn.1400983fc
jne 0x1400a96e8
and dword [rdx - 0x27945795], esp
push rdx
int 0x10
movabs al, byte [0x70f1ac86f5c6c5bc]
jae 0x1400d9bf3
invalid

Function at 0x1400daa56
Capabilities:
Create thread
Set registry value

Disassembly:
lea rsi, [rsi - 0x42f90c4f]
neg word [rsp + 0x28]
setns r12b
add r10b, 0xb3
mov r9, r12
not r12
xchg qword [rsp + 0x30], rsi
mov r9, qword [rsp]
neg r12d
call fcn.1400dd7bc
lea rbp, [rbp + rbp*4 + 0x753f38b6]
xchg qword [rsp + 0x20], rdi
push rsi
add bpl, 0x13
add ebp, 0xb99263bd
mov rsi, rbp
neg bpl
mov qword [rsp + 0x20], rdi
sub bp, 0x3ea2
seto bpl
not sil
push r10
jge 0x14006a689
push rdx
Function at 0x1400dd886
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
call fcn.1400d79c0
push rcx
push r8
push r15
movabs r15, 0x621af91a3e22979b
push 0xfffffffff7a74eba
movzx r15d, word [rsp + 3]
mov rcx, qword [rsp + r15*2 - 0x1ffce]
mov r8, qword [rsp + r15 - 0xfff7]
pushfq
test qword [rsp + r15 - 0xffef], r15
setne r8b
jne 0x14005ac47
xor qword [rsp + r9*2 - 0x5bc7e], 0x2d9da4b6
add byte [rsp + r9*2 - 0x5bc7e], 0xb1
movabs rdi, 0xdd86af8861bba836
shl byte [rsp + r9*4 - 0xb791c], 0x31
sub qword [rsp + r9 - 0x2de2f], 0xffffffffab39b5a7
xor r9b, 0xb9
mov r9w, word [rsp + 0x22]
mov rdi, qword [rsp + r9 - 0x21f42]
not byte [rsp + r9*2 - 0x43e74]
neg dword [rsp + r9 - 0x21f2a]
sub r9, 0x1a9c4828
not qword [rsp + r9*2 + 0x353451dc]
and dword [rsp + r9*4 + 0x6a68a398], 0xcb91d633
je fcn.14005fbaa
neg r15b
mov r15, qword [rsp + r15 + 0xd628]
call fcn.1400973fe
jo 0x14001df90
mov rdi, qword [rsp + 0x30]
jl 0x1400c066a
call fcn.1400ac303
call fcn.140008722
pushfq
call fcn.140094c3b
jl 0x14001d302
shl dword [rsp + r12 - 0x7fbfbed1], 0xc6
mov r12, qword [rsp + r12 - 0x7fbfbef1]
ja 0x1400b27ae
sub byte [rsp + 0x30], 0xc
cmp dword [rsp + 0x30], 0xc18d1226
ja 0x140073f3e
call fcn.14006ab89
add qword [rsp + 8], 0xb4590
movabs rdi, 0xa131d61a64b9b13b
or dil, 0x84
jns 0x14001cadf
shl r13b, 0xac
call fcn.1400c24cc
jne 0x14000c686
jae 0x14006dc9d
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + rdi + 0x4e03b92e]
setle byte [rsp + rdi + 0x4e03b936]
shr dword [rsp + rdi + 0x4e03b936], 0x8f
mov r9, qword [rsp + rdi + 0x4e03b936]
setns r9b
lea rdx, [rdx + rdi + 0x362261af]
call fcn.1400648cf
lea r8, [r8 + r8*2 - 0x4dd82eef]
mov r8, qword [rsp + r8 + 0x4dd82eb1]
jbe 0x14005edeb
and r15w, 0x9830
not r15b
neg r15
mov r15w, 0x1500
add r15w, r15w
jge 0x14004cb29
mov rdi, qword [rsp + 0x20]
neg r12
jae 0x14004f659
jae 0x140064f78
mov r12, qword [rsp + 0x48]
or bpl, bpl
cmp word [rsp + 0x58], bp
call fcn.1400d8360
mov qword [rsp + 0x18], 0x41d173a
lea rbp, [rbp + 0x2f03a23d]
mov word [rsp + 0x18], 0xf888
cmp byte [rsp + 0x18], 0xbe
push rdx
xchg qword [rsp + 0x28], rbp
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret
shr qword [rsp + rdi + 0x4e03b92e], 0x85
push r9
movabs rdx, 0xcea42cb6d5baa7aa
cmp edi, 0x9be282f
jle 0x14009793f
in eax, 0x8b
clc
invalid
call fcn.14004f703
jne 0x14005fb50
cmp byte [rsp + r8 + 0x3e], 1
mov r8, qword [rsp + r8 + 0x56]
jo 0x14000d01e
add word [rsp + 0x40], 0x7393
xor byte [rsp + 0x40], 0x1e
shr byte [rsp + 0x20], 0x4b
add qword [rsp + 0x18], 0xffffffffbff6da97
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret
Function at 0x140007a90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, word [0x140015918]
mov rbx, rcx
movsd xmm0, qword [str.qwertyuiop]
mov word [rsp + 0x28], ax
movzx eax, byte [0x14001591a]
mov byte [rsp + 0x2a], al
movsd qword [rsp + 0x20], xmm0
test rcx, rcx
je 0x140007ca0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov edi, 0xbfd5
mov ecx, edi
mov qword [rsp + 0x68], r14
call fcn.140007eb4
mov ecx, edi
mov rsi, rax
call fcn.140007eb4
mov ecx, 0x17fab
mov r14, rax
call fcn.140007eb4
mov rbp, rax
lea rdx, [rsi + 0xbfd4]
mov r8d, edi
nop word [rax + rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rdx], cl
lea rdx, [rdx - 1]
sub r8, 1
jne 0x140007b20
mov r9, rsi
nop word [rax + rax]
mov eax, 0x38e38e39
lea r9, [r9 + 1]
mul r8d
mov ecx, r8d
shr edx, 1
lea eax, [rdx + rdx*8]
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r9 - 1]
xor cl, r8b
inc r8d
mov byte [r9 - 1], cl
cmp r8d, edi
jl 0x140007b40
movdqa xmm2, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n]
lea rax, [rsi + 0x20]
mov ecx, 0x2ff
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
movdqa xmm1, xmm2
paddb xmm0, xmm2
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
paddb xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
paddb xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
paddb xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
sub rcx, 1
jne 0x140007b82
lea rax, [rsi + 0xbfc0]
mov ecx, 0x15
nop dword [rax + rax]
add byte [rax], 0xa
lea rax, [rax + 1]
sub rcx, 1
jne 0x140007be0
mov ecx, 0xbfd4
mov rdx, r14
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
sub rcx, 1
mov byte [rdx], al
lea rdx, [rdx + 1]
jns 0x140007c00
mov rcx, rsi
call fcn.140007eac
mov rsi, qword [rsp + 0x58]
mov r9, r14
mov r8, rbp
mov r10d, 0x37
nop dword [rax]
movzx eax, byte [r9]
mov ecx, 0x30
movzx edx, al
and al, 0xf
sar dl, 4
and dl, 0xf
cmp dl, 9
cmova ecx, r10d
add cl, dl
mov byte [r8], cl
cmp al, 9
ja 0x140007c58
add al, 0x30
jmp 0x140007c5b
add al, r10b
mov byte [r8 + 1], al
inc r9
add r8, 2
sub rdi, 1
jne 0x140007c30
mov rcx, r14
call fcn.140007eac
mov r14, qword [rsp + 0x68]
mov rax, rbp
mov byte [rbp + 0x17faa], dil
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140007d10
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140007d10
add rsp, 0x40
pop rbx
ret
Function at 0x140001530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140001644
mov rbx, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x140001644
cmp word [rax + rcx + 0x14], 0x78
jb 0x140001644
mov rsi, r8
mov rdi, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x14006a010]
test rax, rax
je 0x140001644
cmp rdi, 0xffff
mov qword [rsp + 0x20], rsi
jbe 0x14000166c
mov r14, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x14006a010]
mov r15, rax
mov eax, dword [r14 + 0x18]
test rax, rax
je 0x140001644
lea rsi, [r15 + rax*4]
lea r13, [rdi + 1]
mov rbp, r15
mov r12, rsi
sub r12, rbp
mov rax, r12
sar rax, 2
shr r12, 0x3f
add r12, rax
and r12, 0xfffffffffffffffe
mov edx, dword [rbp + r12*2]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x14006a010]
mov cl, byte [rdi]
test cl, cl
je 0x140001619
mov rdx, r13
cmp cl, byte [rax]
jne 0x14000161b
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140001609
xor ecx, ecx
lea r12, [r12*2]
add r12, rbp
movzx eax, byte [rax]
cmp cl, al
je 0x140001648
movzx ecx, cl
lea rdx, [r12 + 4]
cmp ecx, eax
cmovg rbp, rdx
cmovs rsi, r12
cmp rbp, rsi
jne 0x1400015d3
xor eax, eax
jmp 0x140001676
mov edx, dword [r14 + 0x24]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x14006a010]
sub r12, r15
sar r12, 1
movzx edi, word [rax + r12]
add di, word [r14 + 0x10]
mov rax, qword [rsp + 0x20]
mov word [rax], di
mov al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140006120
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140006173
mov rsi, rdx
mov rdi, rcx
mov r15d, 0xffffffff
cmp rsi, r15
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140006193
add rdi, rbx
sub rsi, rbx
jne 0x140006151
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140030100
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
lea r9, str.success
lea r14, [rsp + 0x20]
mov rcx, r14
mov r8d, 0x20
call fcn.14003af40
mov rcx, r14
call fcn.14003b030
jmp 0x14000616b