joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e64e
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x140017080], 0
je 0x14000e66d
mov edx, 1
jmp 0x14000e7ac
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
xor ebx, ebx
mov r8, qword [rax + 0x10]
xor eax, eax
mov rdx, qword [r8 + 0x30]
test rdx, rdx
je 0x14000e6d0
movsxd rcx, dword [rdx + 0x3c]
mov ecx, dword [rdx + rcx + 0x88]
test ecx, ecx
je 0x14000e6c8
lea rax, [rcx + rdx]
mov ecx, dword [rax + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x14000e6c8
mov ecx, dword [rcx + 4]
or ecx, 0x20202020
cmp ecx, 0x6c642e6c
je 0x14000e6da
mov r8, qword [r8]
mov rbx, rdx
jmp 0x14000e682
test rax, rax
jne 0x14000e6dd
jmp 0x14000e7ac
mov rbx, rdx
mov ebp, dword [rax + 0x1c]
mov esi, dword [rax + 0x24]
xor r10d, r10d
lea r13, [0x140017084]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x20]
add rsi, rbx
add rbp, rbx
lea r11d, [rdx - 1]
add rax, rbx
lea rdi, [rax + r11*4]
add r11, r11
add r11, rsi
mov ecx, dword [rdi]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x14000e740
mov eax, r10d
inc r10d
lea r12, [r13 + rax*8]
call fcn.14000e626
mov dword [r12], eax
movzx eax, word [r11]
mov eax, dword [rbp + rax*4]
mov dword [r12 + 4], eax
cmp r10d, 0x1f4
je 0x14000e752
sub rdi, 4
lea rax, [r11 - 2]
cmp rsi, r11
je 0x14000e752
mov r11, rax
jmp 0x14000e70a
mov dword [0x140017080], r10d
lea r11, [0x140017084]
dec r10d
test r10d, r10d
je 0x14000e663
lea rax, [0x140017080]
xor edx, edx
lea ecx, [rdx + 1]
mov r8d, dword [rax + 8]
mov rdx, rcx
lea rcx, [r11 + rcx*8]
mov r9d, dword [rcx + 4]
cmp r9d, r8d
jae 0x14000e79e
mov ebx, dword [rax + 4]
mov esi, dword [rcx]
mov dword [rax + 8], r9d
mov dword [rax + 4], esi
mov dword [rcx], ebx
mov dword [rcx + 4], r8d
add rax, 8
cmp edx, r10d
jb 0x14000e775
dec r10d
jmp 0x14000e763
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14000eb10
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xedafca3f
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000eb53
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x19991f17
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000eb96
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8b19978d
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret
Function at 0x14000ebd9
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3950907
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000ec1c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe24ceaef
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000ec5f
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x667614e0
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000eca2
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x88a6285
call fcn.14000e7bb
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000fc00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140015980
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140015980
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x14000fc70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400528b4]
mov rbx, rcx
test esi, esi
jle 0x14000fda0
mov rax, qword [0x1400528b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000fcbb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000fd45
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000fca0
mov rcx, rbx
call fcn.1400106c0
mov rdi, rax
test rax, rax
je 0x14000fdc2
mov rax, qword [0x1400528b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140010800
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400528b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000fda7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000fd3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000fd50
add dword [0x1400528b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400528b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000fd3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000fc00
nop dword [rax]
xor esi, esi
jmp 0x14000fcc8
mov rax, qword [0x1400528b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000fc00
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000fc00
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140010330
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140052920]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140052900]
test rbx, rbx
je 0x14001038c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140010383
test rsi, rsi
je 0x140010383
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140010368
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400106c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14003b170]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400106e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400106e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400106e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14001073d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140010734
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400106e0
add rax, 0x28
cmp rax, r9
jne 0x140010720
xor eax, eax
ret

Function at 0x140010740
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003b170]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14001075f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140010768
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14001075f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140010800
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003b170]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001081f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140010828
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140005b3d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x28], r15
jns 0x140369fd7
test r15w, 0xb536
lea rax, [rax + 0x498d81b8]
ja 0x1400a2281
Function at 0x14000ac83
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rdi, [rdi + rbx - 0x358c7b51]
bswap ebx
xor qword [rsp + rbx*2 - 0x3da25d0], 0xffffffff8e27ca08
jae 0x1400ece36

Function at 0x14000c258
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.14003b98b
jmp fcn.140666e4d
Function at 0x14000d474
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
movabs rax, 0x145017745
mov qword [rsp + 0x40], rax
movabs rax, 0x14976f5c5
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x34], 0xe9
mov byte [rsp + 0x35], 0x7b
mov byte [rsp + 0x36], 0x7e
mov byte [rsp + 0x37], 0x75
mov byte [rsp + 0x38], 4
mov byte [rsp + 0x39], 0x90
mov byte [rsp + 0x3a], 0x90
mov byte [rsp + 0x50], 0x4c
mov byte [rsp + 0x51], 0x8b
mov byte [rsp + 0x52], 0x91
mov byte [rsp + 0x53], 0x38
mov byte [rsp + 0x54], 2
mov byte [rsp + 0x55], 0
mov byte [rsp + 0x56], 0
mov byte [rsp + 0x57], 0x48
mov byte [rsp + 0x58], 0x8b
mov byte [rsp + 0x59], 0x81
mov byte [rsp + 0x5a], 0x18
mov byte [rsp + 0x5b], 1
mov byte [rsp + 0x5c], 0
mov byte [rsp + 0x5d], 0
mov byte [rsp + 0x5e], 0x48
mov byte [rsp + 0x5f], 0x8b
mov byte [rsp + 0x60], 0x91
mov byte [rsp + 0x61], 0xf8
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x63], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0x48
mov byte [rsp + 0x66], 0xa3
mov byte [rsp + 0x67], 0x13
mov byte [rsp + 0x68], 0xf6
mov byte [rsp + 0x69], 0x76
mov byte [rsp + 0x6a], 0x49
mov byte [rsp + 0x6b], 1
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x6d], 0
mov byte [rsp + 0x6e], 0
mov byte [rsp + 0x6f], 0x48
mov byte [rsp + 0x70], 0x89
mov byte [rsp + 0x71], 0x15
mov byte [rsp + 0x72], 0x47
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x75], 0
mov byte [rsp + 0x76], 0xe9
mov byte [rsp + 0x77], 0x5c
mov byte [rsp + 0x78], 0x81
mov byte [rsp + 0x79], 0x8a
mov byte [rsp + 0x7a], 0xfb
mov r9d, 0x20
mov r8, qword [rsp + 0x40]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008c684
mov r9d, 0x20
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008c684
mov qword [rsp + 0x20], 7
lea r9, [rsp + 0x34]
mov r8, qword [rsp + 0x40]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008c5ac
mov qword [rsp + 0x20], 0x2b
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.14008c5ac
mov eax, 1
add rsp, 0x88
ret
Function at 0x14000ed20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
movabs rax, 0x1427cb681
mov qword [rsp + 0x40], rax
movabs rax, 0x149b079f1
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x34], 0xe9
mov byte [rsp + 0x35], 0x6b
mov byte [rsp + 0x36], 0xc3
mov byte [rsp + 0x37], 0x33
mov byte [rsp + 0x38], 7
mov byte [rsp + 0x50], 0x41
mov byte [rsp + 0x51], 0xc7
mov byte [rsp + 0x52], 0x40
mov byte [rsp + 0x53], 0x38
mov byte [rsp + 0x54], 0x73
mov byte [rsp + 0x55], 0x65
mov byte [rsp + 0x56], 0x72
mov byte [rsp + 0x57], 0x4b
mov byte [rsp + 0x58], 0x41
mov byte [rsp + 0x59], 0xc7
mov byte [rsp + 0x5a], 0x40
mov byte [rsp + 0x5b], 0x42
mov byte [rsp + 0x5c], 0x4f
mov byte [rsp + 0x5d], 0x52
mov byte [rsp + 0x5e], 0x72
mov byte [rsp + 0x5f], 0x6f
mov byte [rsp + 0x60], 0x41
mov byte [rsp + 0x61], 0xf
mov byte [rsp + 0x62], 0xb6
mov byte [rsp + 0x63], 0x48
mov byte [rsp + 0x64], 1
mov byte [rsp + 0x65], 0xe9
mov byte [rsp + 0x66], 0x7b
mov byte [rsp + 0x67], 0x3c
mov byte [rsp + 0x68], 0xcc
mov byte [rsp + 0x69], 0xf8
mov r9d, 0x20
mov r8, qword [rsp + 0x40]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.14008c684
mov r9d, 0x20
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.14008c684
mov qword [rsp + 0x20], 5
lea r9, [rsp + 0x34]
mov r8, qword [rsp + 0x40]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.14008c5ac
mov qword [rsp + 0x20], 0x1a
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.14008c5ac
mov eax, 1
add rsp, 0x78
ret

Function at 0x140010850
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3a0
mov r8d, 0x100
lea rdx, [rsp + 0x2a0]
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x258]
call fcn.140021b30
nop
mov rax, qword [rsp + 0x3c0]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax

Function at 0x140024e4a
Capabilities:
Terminate process

Disassembly:
push r8
movabs r8, 0xc12d2b959d8a2ca8
movsxd r8, r8d
push 0xfffffffff73c14bc
pushfq
add r8w, 0x1505
seta r8b
mov qword [rsp + 0x18], 0x16e8c660
mov r8, qword [rsp + r8 + 0x6275bf0f]
ja 0x140052985
mov rbx, qword [rsp + r12 - 0x40000074]
jb 0x14034cbb5
test byte [rsp + 8], 0x3e
mov qword [rsp + 8], 0x1e1fd19f
shr dword [rsp + r12 - 0x40000084], 0x42
shl r12, 0xa3
shr byte [rsp + 0x38], 0xdb
sete byte [rsp + 0x38]
and r12, qword [rsp + 0x38]
mov r12, qword [rsp + 0x10]
test byte [rsp + 0x38], 0x1c
call fcn.1404a884a
push rbx
call fcn.1400d7aa5
Function at 0x14003227f
Capabilities:
Terminate process

Disassembly:
pushfq
add qword [rsp + 0x10], 0xffffffffbf9a148b
mov qword [rsp + 0x10], 0xffffffff8bb7a466
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1405e6916
mov rsi, qword [rsp + 0x40]
setle byte [rsp + 0x58]
movabs r13, 0x72a45c81142495ad
shr r13d, 0x85
bswap r13d
mov r13, qword [rsp + 0x18]
and qword [rsp + 0x58], 0x653d9a99
call fcn.14003b33d

Function at 0x14003a63c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jo 0x140399e45
xchg qword [rsp + 0x50], rax
mov rbp, qword [rsp + rbp - 0x7b78821c]
mov r15, qword [rsp + 0x28]
movsx r12w, byte [rsp + 0x28]
mov r12w, 0xd58d
cmp r12w, word [rsp + 0x2a]
seta r12b
jb 0x140437fbd
and r15b, byte [rsp + 0x2f]
neg r12w
mov r12, qword [rsp + 0x48]
or dword [rsp + 0x28], 0x6289202f
neg r15w
jg 0x140048213
sub r15, r15
mov r15, qword [rsp + r15 + 8]
call fcn.14037944c
and cl, ah
jmp fcn.14069cc68
mov qword [rsp + 0x58], rdx
and r13b, r13b
call fcn.14000c857
sub word [rsp + 0x30], 0x78aa
not word [rsp + 0x38]
shl dword [rsp + 0x40], 0xcd
call fcn.1404c38d0
int3
cmp r10w, bp
setge bpl
shr ebp, 0xe
neg r10b
call fcn.1400f9e1d
jne 0x1404bad85
mov eax, r8d
ror ch, cl
or cl, r10b
mov ecx, r9d
cmp r9b, 0x9e
shl rax, 0x20
or rax, rcx
jmp loc.14000c109
movsx r9d, r9b
mov dword [rsp + 0x28], 0xf077d33
not qword [rsp + 0x30]
mov r9, qword [rsp + 0x58]
ja 0x14008c21c
or al, 0xb5
adc dword [0x15370f86f], edx
mov esi, 0x66bdac10
outsb dx, byte [rsi]
ror byte [rsi], 0x15
adc bh, cl
invalid

Function at 0x140042547
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rax
call fcn.14003b3c9
mov bpl, 0xd4

Function at 0x14004fb75
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9, qword [rsp + 0x30]
call fcn.1400220f4
cwde
jmp fcn.1406bf002

Function at 0x14004fb80
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r9, qword [rsp + 0x30]
call fcn.1400220f4
cwde
jmp fcn.1406bf002

Function at 0x140054f69
Capabilities:
Check for software breakpoints

Disassembly:
jg 0x140366f36
js 0x140386acc
cmp al, 0xcc
int3

Function at 0x140055ffc
Capabilities:
Terminate process

Disassembly:
xor esi, esi
test qword [rsp + rsi*2 + 0x20], rsi
xchg qword [rsp + rsi + 0x38], rdx
mov rsi, qword [rsp + rsi*2 + 0x10]
je 0x140352758
lea r10, [r10 + riz + 0x3e00d635]
not r10w
or r10d, 0x85322a1f
and dword [rsp + 0x20], r10d
test r10d, 0x798fb81c

Function at 0x14005601c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], 0x4bbfe2d7
lea rsp, [rsp + 0x10]
call fcn.1405e6916
jmp 0x140338046
Function at 0x1400599d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1400295b6
stosd dword [rdi], eax
int3
stosb byte [rdi], al
cli
fistp word [rsi]
sbb dh, dl
invalid
jae 0x14036608a
jae 0x14005996e
dec ah
jmp fcn.1406d0532
mov qword [rsp + 0x18], r14
lea rax, [rax - 0x5cf8c0de]
push rdi
jge 0x14044bc2a
shr bp, 0x6d
js 0x14009ccc1
xchg qword [rsp + rbp - 0x63b6fff5], rcx
mov rbp, qword [rsp + rbp - 0x63b6fffd]
jne 0x14003323b
call fcn.140047f90
pushfq
xor rbp, 0x2c203a0a
lea rcx, [rcx - 0x75c42d00]
jns 0x1400599ce
movabs rdi, 0xc830688ca58b279a
shl edi, 0xce

Function at 0x14005c4b3
Capabilities:
Terminate process

Disassembly:
shr bpl, 6
lea rax, [rax - 0x7eee5c46]
je 0x140331662
seta bpl
bswap r13d
call fcn.1400a0e51

Function at 0x14005e75c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jge 0x1404ab787
jmp fcn.1406d88fb
js 0x14005e756
call fcn.14009d35d

Function at 0x14006384c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r10
pushfq
movabs r10, 0x612cd617d0930fb5
push rcx
sub r10d, 0xcb2f3816
movabs rcx, 0x71b27dab5d8a498e
call fcn.140402567
lea rax, [rax + 0x229391a4]
call fcn.1403f7bf9
jmp fcn.1406e1c45

Function at 0x14006579b
Capabilities:
Encode data using base64

Disassembly:
movabs r14, 0x3e17eb8d39a0bba1
and r14b, 1
jl 0x14009e82e
and r14w, 0x101e
sete r14b
mov r14, qword [rsp + 8]
jae 0x140038a2c
add dword [rax], eax
add byte [rax], al
jmp fcn.1406e53cd

Function at 0x140065880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or dx, word [rsp + 0x4c]
xchg qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x40]
jge fcn.140034f3e
shl word [rsp + 0x48], 0xe1
jno 0x14004cdfd
call fcn.140421cee
setge byte [rsp + 0x48]
movsx edx, byte [rsp + 0x49]
sete dl
mov rdx, qword [rsp + 0x38]
sub byte [rsp + 0x48], 0xb4
jge 0x1400523d5
jle 0x140065878
or dword [rsp + 0x48], 0x7c066086
mov byte [rsp + 0x48], 0x85
call fcn.1400e896f
call fcn.1400b07e1
pop rcx
mov bh, 0xcc
jmp fcn.1406e551a

Function at 0x140066144
Capabilities:
Parse pe header

Disassembly:
mov r9, r8
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
call fcn.140497112

Function at 0x1400692f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs rax, 0xbaa9c79bfb1d6315
test ax, 0x449b
push rsi
not cl
movabs rsi, 0x458fba176595c232
bswap rsi
Function at 0x140069350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sti
wait
invalid
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
setle sil
not si
add qword [rsp + 0x20], 0x458bbf
cmp sil, cl
mov esi, ecx
cmovb cx, si
lea rax, [rax - 0x20f3b1fc]
or rcx, 0x783c891a
jge 0x1404e6fb0
lodsd eax, dword [rsi]
or byte [rdi], ah
sub ecx, dword [rcx + 0x68a61ee5]
push 0xffffffffb60ae414
pushfq
xor word [rsp + 8], 0xbe39
jge 0x1404c3133
mov byte [rsp + 0x10], 0x8d
invalid
invalid
and al, 0
jnp 0x1400692fa
cmc
mov edi, 0x244c8166
adc byte [rbp + 0x798f0f68], dl
rol dword [rax], cl
cmp qword [rsp + 0x10], 0x79a55b16
call fcn.14005f85d
add dword [rax], eax
add byte [rax], al
jmp fcn.1406ebc41
xor r9, rdx
xchg qword [rsp + r9*2 - 0x7bb0], rcx
mov rdx, qword [rsp + r9*2 - 0x7bc0]
or qword [rsp + r9*2 - 0x7bc8], 0x7fa41f26
shl byte [rsp + r9 - 0x3dc8], 0x45
movsx r9d, word [rsp + r9 - 0x3dc6]
neg byte [rsp + r9*2 - 0xff10]
shl word [rsp + r9 - 0x7f6c], 0xe1
or word [rsp + r9 - 0x7f6c], 0x7623
mov r9, qword [rsp + r9*2 - 0xff00]
not qword [rsp + 0x38]
shl byte [rsp + 0x38], 0x36
and dword [rsp + 0x38], 0x6aacfa94
jl 0x140069313
xor byte [rsp + 0x38], 0xbb
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x140069390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sti
wait
invalid
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
setle sil
not si
add qword [rsp + 0x20], 0x458bbf
cmp sil, cl
mov esi, ecx
cmovb cx, si
lea rax, [rax - 0x20f3b1fc]
or rcx, 0x783c891a
jge 0x1404e6fb0
lodsd eax, dword [rsi]
or byte [rdi], ah
sub ecx, dword [rcx + 0x68a61ee5]
push 0xffffffffb60ae414
pushfq
xor word [rsp + 8], 0xbe39
jge 0x1404c3133
mov byte [rsp + 0x10], 0x8d
invalid
invalid
and al, 0
jnp 0x1400692fa
cmc
mov edi, 0x244c8166
adc byte [rbp + 0x798f0f68], dl
rol dword [rax], cl
cmp qword [rsp + 0x10], 0x79a55b16
call fcn.14005f85d
add dword [rax], eax
add byte [rax], al
jmp fcn.1406ebc41
xor r9, rdx
xchg qword [rsp + r9*2 - 0x7bb0], rcx
mov rdx, qword [rsp + r9*2 - 0x7bc0]
or qword [rsp + r9*2 - 0x7bc8], 0x7fa41f26
shl byte [rsp + r9 - 0x3dc8], 0x45
movsx r9d, word [rsp + r9 - 0x3dc6]
neg byte [rsp + r9*2 - 0xff10]
shl word [rsp + r9 - 0x7f6c], 0xe1
or word [rsp + r9 - 0x7f6c], 0x7623
mov r9, qword [rsp + r9*2 - 0xff00]
not qword [rsp + 0x38]
shl byte [rsp + 0x38], 0x36
and dword [rsp + 0x38], 0x6aacfa94
jl 0x140069313
xor byte [rsp + 0x38], 0xbb
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x14006b16a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub si, word [rsp + 0x4a]
jns 0x1400f9ad6
shr dword [rsp + 0x48], 0xe7
sub dword [rsp + 0x48], 0xfa8b7f83
cmp byte [rsp + 0x18], 0x9c
jae 0x140036181
add cl, dl
jmp fcn.1406ef164

Function at 0x14006fc03
Capabilities:
Parse pe header

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140628704

Function at 0x14006fc3d
Capabilities:
Parse pe header

Disassembly:
jne 0x1404a87f8
mov qword [rsp + 0x30], rbx
jne 0x140066156
shl bl, 0x5a
xchg qword [rsp + 0x38], rbp
mov rbx, qword [rsp + 0x10]
call fcn.140487fe4
Function at 0x140074128
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140037f52
adc eax, 0x7e9475b
cmpsd dword [rsi], dword [rdi]
push 0x9b4a800
mov cl, 0xb
mov ebx, 0x38f7376a
mov edi, 0xe2d4950f
invalid
cmp r9, qword [rsp + r9 + 0x30]
xchg qword [rsp + r15 - 0xef50], rax
mov r9, qword [rsp + r15*2 - 0x1dee8]
jl 0x140074120